We process information for the following purposes:

• Provide core functionality: to create, host, display and manage projects, BoQs and related content.
• Billing and payments: to issue invoices, reconcile payments, and detect fraudulent activity.
• Support and account management: to respond to inquiries, resolve incidents, and provide training or onboarding.
• Security and reliability: to detect abuse, secure the Service and perform forensic analysis after incidents.
• Product improvement: to analyze aggregated usage trends, prioritize features and test product changes.

Where required by law, we rely on lawful bases such as contract performance, legitimate interests (e.g., security, service operation), consent (for optional features like marketing), or legal obligations.

We only share personal information in limited circumstances:

• With your organization: administrators and users granted appropriate permissions can access data in accordance with your organization’s settings.
• Service providers and subprocessors: cloud hosts, analytics, email delivery, and payment processors who act on our instructions and are contractually required to protect your data.
• Legal disclosures: to comply with lawful requests, court orders, or to protect rights, safety, or property of CoPIMS, our users or the public.
• Business transfers: in the event of a merger, sale, reorganization, or acquisition we may transfer data as part of that transaction, subject to confidentiality obligations.

We maintain a list of subprocessors and data transfers in our documentation; contact support for the most recent list specific to your account or region.

Security is a priority. Our measures include:

• Encrypted transport (TLS) for data in transit and at-rest encryption for sensitive storage where applicable.
• Access controls and role-based permissions to limit who can access data.
• Periodic security reviews, vulnerability scanning and penetration testing by internal teams and third-party specialists.
• Logging, monitoring and alerting to detect anomalous behavior and incidents.
• Operational procedures for patching, incident response and disaster recovery.

If you suspect unauthorized access to your account or a data breach, notify us immediately at support@copims.com and provide relevant details (affected accounts, timestamps, screenshots).

Our retention principles:

• Active account data: retained for as long as the account is active.
• Deleted accounts: upon deletion we typically retain backups and limited metadata for up to 90 days for recovery and audit purposes, unless a longer retention is required by law.
• Transactional records: billing and tax records are retained for a longer legal period (commonly 6–7 years, depending on jurisdiction).

To request deletion of your personal data, contact support with proof of identity. We will evaluate requests and comply where required by law; note that deleting account data may remove access to your content and cannot be undone.

Data subject rights vary by jurisdiction. Common rights include:

• Access: request a copy of personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of personal data where lawful.
• Portability: request your data in a commonly used, machine-readable format.
• Objection & restriction: object to certain processing or request restriction of processing.

To exercise rights, use account settings where available or contact support@copims.com with a clear description of your request. We'll verify your identity and respond within applicable legal timeframes (e.g., 30 days under GDPR, subject to lawful extensions).

Third-party links and integrations:

• When you enable integrations (cloud storage, SSO, accounting connectors) we may exchange information with the third-party service. Those providers’ terms and policies apply to their processing.
• We recommend reviewing third-party privacy notices and configuring integration permissions carefully.

Questions or requests regarding this policy: support@copims.com.

Data Protection Officer / Privacy contact: privacy@copims.com (for legal & compliance requests).

We may update this policy periodically; we will post the updated effective date and, where required by law, provide additional notice of material changes.