DRAFT v1.0 — this notice must be validated by BuildUP Value's legal counsel before the first external client is invited (corporate norm §11/§12).
Privacy notice
BUV Flow is the project workspace of BuildUP Value (“BUV”, “we”), hello@buildupvalue.com. This notice explains what personal data the platform processes, why, for how long, and your rights. BUV is the controller for the data described here.
1. Who this applies to
People with a BUV Flow account: BUV staff (administrators and consultants) and client contacts invited to one or more boards. Accounts are created by invitation only; there is no public sign-up.
2. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, role, password (hashed), two-factor secret (encrypted), recovery codes (hashed) | Account, authentication, security | Contract / legitimate interest (art. 6(1)(b),(f) GDPR) |
| Board content: projects, items, owners, dates, status, comments, attachments | Managing BUV's engagements with its clients | Contract / legitimate interest |
| Sign-in events, invitations, role changes, exports (audit log) with a pseudonymised IP address (keyed hash) | Security, accountability | Legitimate interest |
| Notification emails (assignment, stuck item, daily digest) | Service communication | Contract |
| Interface preferences (filters, theme) | Usability | Legitimate interest |
We do not use cookies for tracking, analytics scripts, third-party fonts or advertising. The only cookies are the session, the two-factor step and the optional “trust this device” cookie, all strictly necessary.
3. Where the data lives and who can see it
Data is hosted on BUV's own server in the European Union (Hetzner Online GmbH, Germany), encrypted at rest, with daily encrypted backups kept 14 days on the server. Access is restricted on the server to the boards you are a member of.
Processors: Hetzner Online GmbH (hosting, Germany); Microsoft 365 / Microsoft Ireland Operations Ltd. (notification and invitation emails — Microsoft may transfer data to the United States under the EU-US Data Privacy Framework and the EU standard contractual clauses); Dropbox, Inc. (United States, certified under the EU-US Data Privacy Framework) holds an off-site copy of the backups, which is encrypted before it leaves BUV's equipment with a key Dropbox never receives. No other processors are used. Transfers outside the EU/EEA are limited to these two, with the safeguards stated.
4. Retention
- Account data: while the account exists. Accounts unused for 12 months are flagged for review and deleted by an administrator.
- Board content: for the life of the engagement and as long as BUV needs it for its records; deleted items are kept 30 days for undo, then purged.
- Audit log: 24 months; the pseudonymised IP is removed after 90 days.
- Notification records: 90 days. Sessions: 12 hours. Invitation links: 72 hours.
5. Your rights
You can access and download your data at any time from your Account page (“Download my data”), correct your name there, and request deletion (“Request deletion”); an administrator executes it within 30 days. Comments you wrote are anonymised rather than removed, so the work record of the board stays coherent. You may also contact hello@buildupvalue.com to exercise any right under the GDPR (access, rectification, erasure, restriction, portability, objection) and lodge a complaint with the Portuguese supervisory authority (CNPD).
6. Changes
We will update this notice before any change in processing (new purpose, new processor, new retention period) and tell account holders by email 30 days in advance when the change affects them.
Version 1.0 · DRAFT