Privacy Policy

Introduction

Protecting your personal data is a priority for SparkleIT Information Technologies, Lda. This Privacy Policy transparently describes how we collect, use, store and protect your personal data when you visit the AOM — Apontador de Obra website (apontadordeobra.pt) or use the AOM applications, in compliance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679).

Scope

This policy applies:

• To the apontadordeobra.pt website, covering visitors, leads and prospective customers;
• To the AOM applications (web and mobile), regarding the data needed to manage each customer's account and the connection of Google and Microsoft email accounts, described in a dedicated section of this policy.

The processing of personal data within the AOM platform (namely data about workers, construction sites, daily records, orders and other information that customers enter) is governed by the Data Processing Agreement (DPA) entered into with each customer, under which SparkleIT acts as a processor pursuant to Article 28 of the GDPR.

Data controller

Entity: SparkleIT Information Technologies, Lda
Company tax number (NIPC): 513192670
Registered office: Praça da Liberdade, Piso 1, Fração 2, 4900-040 Viana do Castelo, Portugal
Email for exercising your rights: info@sparkleit.pt
Website: www.sparkleit.pt

Personal data we collect

We only collect personal data when necessary to provide our services. Data may be collected in the following ways:

Data you provide directly

• Contact form and demo requests: name, company, email, phone number, subject and message.
• Construction management diagnostic: company tax number (NIF), business sector, questionnaire answers, name, email and company name.
• AOM account: identification and contact details of the customer company's representatives and billing details, needed to create and manage the account and the contractual relationship.

Data collected automatically

• Browsing data: IP address, browser type, operating system, pages visited, date and time of access and referring URL, logged by our servers for security and operational purposes.
• Cookies and similar technologies: as described in the "Cookies" section of this policy.

Legal bases and purposes of processing

Your personal data is processed on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR): use of analytics cookies (Google Analytics).
• Performance of a contract or pre-contractual steps (Art. 6(1)(b)): replying to contact, demo and diagnostic requests, providing the AOM services — including sending emails through the mailbox the user connects — and managing the contractual relationship.
• Legitimate interest (Art. 6(1)(f)): website security, protecting forms against spam and abuse, and improving the website and services.
• Compliance with a legal obligation (Art. 6(1)(c)): applicable tax, accounting and legal obligations.

Sharing data with third parties

We do not sell, rent or share your personal data with third parties for their own purposes. Your data may only be disclosed in the following situations:

• Service providers: entities acting on behalf of SparkleIT — hosting and infrastructure (including Microsoft Azure), email delivery (Microsoft 365), protecting forms against spam (Google reCAPTCHA) and statistical analysis (Google Analytics, only with your consent) —, contractually bound to process the data in accordance with this policy.
• Google and Microsoft, when you connect your email account: the emails you choose to send from AOM are delivered through your mailbox provider (see the section "Google and Microsoft accounts connected to AOM").
• Legal obligation: when legally required by the competent authorities.

International transfers

If your data is processed outside the European Economic Area — for example, by providers such as Google or Microsoft —, SparkleIT ensures that appropriate safeguards apply, such as standard contractual clauses approved by the European Commission or adequacy decisions.

Data retention

Personal data is only kept for as long as necessary for the purposes for which it was collected, or as required by applicable law. As a rule:

• Customer data: for the term of the contract and for the legally required period after it ends.
• Data entered by customers in the AOM platform (including the history of sent emails): for the term of the contract; when the contract ends, it is deleted or returned to the customer, under the DPA.
• Lead and contact data (contact form and diagnostic): up to 24 months after the last interaction, unless you consent to a longer period.
• Cookies: according to the periods listed in the "Cookies" section.

Once these periods end, the data is deleted or anonymised for statistical purposes.

Google and Microsoft accounts connected to AOM

In the AOM application, each user may choose to connect their Google account (Gmail or Google Workspace) or Microsoft account (Outlook, Hotmail or Microsoft 365), so that the emails they send from AOM — orders to suppliers and quote requests to subcontractors — are sent from their own mailbox. Connecting an account is optional: without it, emails are sent by AOM.

What data we access

With your permission, Google or Microsoft give us access to:

• the account's email address, name and identifier, to show in AOM which account is connected;
• permission to send emails on your behalf — on Google, the gmail.send permission; on Microsoft, the Mail.Send and User.Read permissions (the latter to find out the mailbox address);
• authorisation to keep the connection active, without asking you to sign in again for every email.

We do not request, and do not have, access to read, list, change or delete your email, your contacts or your calendar.

How we use this data

We use this data only to send, from your mailbox, the emails you choose to send in AOM, at the moment you click "Send", and to show you in AOM the connected account and the status of each email.

We do not use this data for advertising, we do not sell it, we do not build profiles and we do not use it to develop, improve or train artificial intelligence or machine learning models.

How we store and protect this data

• We store the provider (Google or Microsoft), the account's address, name and identifier, the permissions granted, the connection status and the date it was last used.
• The long-lived authorisation (refresh token) is stored encrypted (AES-256-GCM), with the encryption key kept in a key vault (Microsoft Azure Key Vault). The short-lived authorisation (access token) is only used in memory and is never stored.
• For sent emails, we keep the subject, body, recipients and attachments, so that the company has a history of its orders and quote requests.

Sharing

We do not share data obtained through the Google or Microsoft APIs with third parties. The only exceptions are the email itself, which is delivered to the recipients you choose through Google or Microsoft, and the hosting providers acting on behalf of SparkleIT.

Retention, deletion and how to revoke access

• You can disconnect the account at any time in AOM. When you disconnect it — or when your user or your company is removed from AOM —, the stored authorisation is deleted. For Google, we also ask Google to revoke access, unless the same account is connected by another AOM user.
• You can also revoke access directly in your account: Google at myaccount.google.com/permissions; Microsoft at myapps.microsoft.com (work or school accounts) or account.live.com/consent/Manage (personal accounts).
• The account's address and name remain linked to the history of emails already sent, which is part of the company's data and follows that data's retention period (see "Data retention").

Limited Use (Google): The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. Google Workspace APIs are not used to develop, improve, or train non-personalized AI and/or ML models.

Cookies

We use cookies to make the website work and, only with your consent, for statistical analysis. On your first visit, you can accept or reject non-essential cookies. You can change your choice at any time with the "Manage cookie preferences" button at the end of this page.

The contact form is protected by Google reCAPTCHA, to which Google's Privacy Policy and Terms of Service apply.

You can also control and delete cookies in your browser settings. Disabling cookies may affect how some parts of the website work.

Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: obtain confirmation that your data is being processed and access a copy of it.
• Right to rectification: request the correction of inaccurate or incomplete data.
• Right to erasure: request the deletion of your data, under the applicable law.
• Right to restriction of processing: request that processing be restricted in certain circumstances.
• Right to data portability: receive your data in a structured, commonly used format, or request its transfer to another entity.
• Right to object: object to the processing of your data, including for direct marketing purposes.
• Right to withdraw consent: withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

For data that your employer enters in AOM, requests should be addressed to your employer, which is the data controller; SparkleIT provides it with the necessary assistance.

To exercise any of these rights, contact us at info@sparkleit.pt. You also have the right to lodge a complaint with the Portuguese data protection authority, CNPD — Comissão Nacional de Proteção de Dados (www.cnpd.pt).

Security

SparkleIT implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration, including encrypted communications (HTTPS) and encrypted storage of mailbox access authorisations. All staff with access to personal data are bound by confidentiality obligations.

Despite our efforts, no data transmission or storage system is completely infallible. In the event of a data breach that may affect your rights, you will be notified without undue delay.

Minors

The website and the purchase of AOM services are intended for people aged 18 or over. We do not knowingly collect data from minors through the website. If we become aware that data from a minor has been collected, we will delete it immediately.

Changes to this policy

This Privacy Policy may be updated from time to time. Any significant changes will be published on this page, together with the date of the last update.