How we handle personal data.

In short

• We never sell your data. Not to advertisers, not to anyone.
• Your jobs, files and records are hosted in the EU.
• For the jobs and engineers you keep in Pendira, you are the controller and we are the processor.
• You can ask us to see, correct, export or delete personal data at any time.

Who we are

Pendira is made by AGByte Labs in the Netherlands. In this policy, "we" means AGByte Labs. For any question about privacy, or to use your rights, write to [email protected].

Who this policy is for

This policy explains how we handle personal data about:

• people who visit pendira.com
• people who write to us, for example to book a demo
• the people at our customers who use Pendira
• engineers, client contacts and other people whose details our customers keep in Pendira

Controller or processor

We are the controller for our website, for the messages you send us and for the accounts we run for our customers. That means we decide why and how that data is used.

For the data a customer keeps in Pendira, such as its jobs, engineers, clients and sites, the customer is the controller and we are the processor. We handle that data only on the customer's instructions, under a data processing agreement. This includes the text messages and links we send to engineers on a customer's behalf.

If you are an engineer or a client contact and want to know what is kept about you, ask the company you work with first. If you ask us, we pass your request on to that company and help it answer.

What we collect, why, and on what basis

What we never do

• We never sell, rent or share your data for advertising.
• We do not use the data in your company for our own purposes. It is used to run Pendira for you, nothing else.
• We do not use advertising cookies or follow you across other websites.

Who we share it with

We share personal data only with the sub-processors that help us run Pendira: hosting, the database, file storage and background tasks. Our sub-processors page names each one, what it does, where it processes data and how a transfer is protected. Every sub-processor is bound by a data processing agreement.

Emails and text messages travel through their delivery providers. We add each provider to the sub-processors page before it carries your messages.

A customer can share a job with its own client through a guest link. That is the customer's choice. The link shows status, schedule and proof, never prices.

We give personal data to authorities only when the law requires us to.

Our website

Our website, pendira.com, is hosted by Cloudflare, which also counts visits without cookies. If you accept analytics, Google Analytics measures how the website is used. Google may process that data outside the EU under the EU Standard Contractual Clauses. Our cookie policy lists every cookie.

The website has no forms that send data to us. When you book a demo or contact us, your own email app sends the message.

International transfers

Your jobs, files and records are hosted in the EU. Some of our providers are companies based outside the EU, such as in the United States. Where one of them could reach personal data from outside the EU, the transfer is protected by the EU Standard Contractual Clauses.

How long we keep it

• Your company's data in Pendira: as long as you use Pendira. When you leave, we return it on request and then delete it, as your data processing agreement sets out.
• Request logs, with IP address and browser: 90 days.
• Security events, such as sign-ins, failed attempts and lockouts: 400 days.
• Files that are uploaded but never completed: 24 hours.
• Engineer identity documents: only as long as needed, then deleted.
• Emails you send us: as long as we need them to answer you and keep a record of what we agreed.
• Cookies: as listed in our cookie policy.

Your rights

Under the GDPR you can ask us to:

• show you the personal data we hold about you
• correct it
• delete it
• limit how we use it
• give it to you, or to another company, in a common format
• stop using it where we rely on legitimate interest

Where we rely on your consent, you can withdraw it at any time. Write to [email protected]. We answer within one month, and we may first ask you to confirm who you are.

If you think we handle your data wrongly, please tell us first so we can put it right. You also have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in the EU country where you live or work.

Cookies

We use no advertising cookies. Analytics cookies are set only after you agree. Our cookie policy lists every cookie, and you can change your choice from Cookie settings in the footer.

Security

Two-factor sign-in, permissions checked on every request, private files with links that expire, encryption in transit and at rest, and a log of every change. Our security page describes each control.

Children

Pendira is a service for businesses. It is not meant for children, and we do not knowingly collect their data.

Changes to this policy

When this policy changes, we update this page and the date at the top. If a change matters for how we use your data, we tell our customers by email before it applies.

Contact

AGByte Labs, the Netherlands. Email [email protected].