Data controller

The controller for your account, for billing and for the public site is the legal entity identified below, which operates the BuildMetrica platform.

The contact details for any privacy matter are the ones listed in this block. If a field is not shown, it is not yet registered and we do not present it as if it were.

Address
Prishtinë, Kosovë

Two layers: when you are the controller and when we are

BuildMetrica is a multi-tenant platform: each company works inside its own space, on a database separated from every other. This creates two distinct legal roles, and conflating them is the most common mistake in SaaS privacy policies.

  • For your account data — company name, user names and emails, language, billing metadata — we are the controller. We decide why and how it is processed, and we answer to you for it.
  • For the personal data you enter inside your own space — buyers, their contact details, contracts, payments — YOU are the controller. We act solely as a processor on your behalf, on your instructions, and we do not use that data for any other purpose.
  • This means a buyer's request — access, rectification, erasure — is addressed to you as controller. If it reaches us directly, we forward it to you and do not decide in your place.
  • It also means you are responsible for the legal basis on which you collect that data and for informing the people it concerns.

What data we collect

We collect only what the service needs in order to work, to stay secure and to be billed. We do not buy data from third parties and we do not enrich your profiles from external sources.

  • Account data: company name, the name and email of the owner and of the users they create, preferred language, country, and the password stored ONLY as a one-way hash — never as readable text.
  • The business data you enter: complexes, buildings, units, clients, contracts, instalments, payments, invoices, materials, expenses and uploaded documents. These live in a separate database dedicated to your company alone.
  • Billing metadata: plan, subscription status, period dates, order and transaction identifiers at the payment processor, and the invoices issued. The full card number, expiry date and security code NEVER pass through our servers and are never stored by us.
  • Technical data: server logs, IP addresses in infrastructure logs, request timing, browser agent and errors — needed for security, for diagnostics and to evidence an incident if one occurs.
  • The in-account activity log: who performed an action, what changed, when, from which IP address and with which browser — for sign-ins, permission changes, status and price changes, and exports. Passwords, two-factor codes and card data are never written there.
  • Contact requests from the public site: name, company, email, optional phone, country, message, language, browser and an irreversible hash of the IP address. The raw IP address of the contact form is not stored.
  • Your cookie choice: stored in your browser only, in a first-party cookie, and never tied to any account identifier.

What we use it for and on what legal basis

Every processing operation has a defined purpose and a legal basis. We do not use any data for purposes incompatible with the one it was collected for.

  • To provide the service and keep your account working — performance of the contract between us (article 4(1.2) of Law 06/L-082).
  • To bill the subscription and issue VAT invoices — performance of the contract and a statutory tax obligation.
  • To send operational email: welcome, billing reminders, instalment and reservation notices, and replies to your requests — performance of the contract and our legitimate interest in communicating about the service.
  • To protect the platform from abuse, unauthorised access and automated submissions — our legitimate interest in the security of the system and its users.
  • To maintain an immutable activity log — our legitimate interest and yours in being able to evidence who changed what inside your account.
  • To respond to your contact or demo requests — steps taken at your request prior to entering a contract.
  • We run no advertising, we do no profiling, and we take no solely automated decisions producing legal effects concerning you.

Who we share it with (sub-processors)

We do not sell, rent or trade your data. We share it only with the providers we need in order to keep the service running, only to the extent necessary, and only under contracts binding them to the same standards.

Beyond the list below, data may be disclosed to authorities where the law requires it, and to our professional advisers bound by confidentiality.

Payment processing
Raiffeisen Bank Kosovo J.S.C. — RaiAccept
  • Infrastructure and database hosting — the servers where the platform, your company's dedicated space and the encrypted backups live.
  • The content delivery network and proxy in front of the platform — every request passes through it before reaching our servers, so it sees IP addresses, request headers and their timing. It exists for attack protection and speed.
  • Email delivery (SMTP) — the welcome message, billing reminders and operational notices we send.
  • Payment processing — RaiAccept by Raiffeisen Bank Kosovo, for the subscription. Full card details go directly to the bank; we receive only the outcome and the transaction identifiers.

How long we keep it

Some of the periods below are enforced automatically by the system itself, through scheduled jobs; the others are contractual commitments we carry out on your request or through our internal procedure. Each line says explicitly which kind it is — so you do not have to take it on trust, you can read it.

  • Account and business data are kept for as long as the account is active.
  • After the subscription ends, your company's space is kept for at least 30 days so the owner can start a full export. Deletion after that window is carried out on your request or through our internal procedure — not by a scheduled job.
  • Invoices and accounting records are kept for as long as the tax legislation of the Republic of Kosovo requires, even after the account is closed.
  • Technical infrastructure logs are kept for up to 12 months.
  • The in-account activity log is kept for up to 24 months, then deleted automatically by a scheduled job.
  • Backups are held on a rotation with a limited horizon; data deleted from the live system disappears from the backups as that rotation expires.
  • Contact requests are kept for up to 24 months from being archived, then deleted automatically by a scheduled job.
  • The cookie choice is kept for 12 months in your browser, or until you change it.

Your rights

Under Law no. 06/L-082 and GDPR-equivalent principles you have the rights below. You can exercise them by writing to the contact channel listed in the identity block above. We respond within 30 days and charge nothing for ordinary requests.

Where your request concerns data entered by a client company inside its own space, that company is the controller and the request goes to it; we forward it and assist, but we do not decide in its place.

  • Access: a copy of the data we hold about you and information about the processing.
  • Rectification: correction of inaccurate data — most of it you can correct yourself inside the application.
  • Erasure: removal of data, except what we are legally required to retain.
  • Restriction and objection: stopping or limiting processing in the cases the law provides, including objecting to processing based on legitimate interest.
  • Portability: receiving the data in a structured, machine-readable format — the account owner starts the full export themselves from the application, at any time.
  • Withdrawal of consent: where processing rests on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
  • Complaint: you may address the Information and Privacy Agency of the Republic of Kosovo, or the supervisory authority of your own jurisdiction.

International transfers

The payment processor is a bank licensed in Kosovo and payment data does not leave it. For hosting and email delivery we choose providers processing within the European Union or the European Economic Area.

If any sub-processor processes data outside that area, it is done only on a recognised legal basis — such as standard contractual clauses — and the sub-processor list above is updated BEFORE the change takes effect.

Security measures

Each company has its own separate database — one company's data is never mixed with another's. Access inside a company is controlled by fine-grained per-user permissions, with the option of restricting a user to specific buildings.

Traffic runs over HTTPS, passwords are stored only as one-way hashes, and two-factor authentication is available. Status and price changes on units and contracts are recorded with the user, time and reason; payments are kept as an append-only ledger. Backups are encrypted and also stored off-site.

These are technical and organisational measures to industry standards, but no system is impenetrable and we give no absolute guarantee against unauthorised access. If you suspect an incident, tell us immediately through the contact channel.

How to reach us

For any privacy question, or to exercise one of the rights above, write to the contact address listed in the company identity block above, or use the contact form on this site.

Changes to this policy

When we change this policy we update the effective date and the version number at the top of the page. For material changes affecting your rights we also notify you by email before the change takes effect.