Privacy Policy

3.1 Account Data

When you create an account or are invited to the platform, we hold your name, email address and the organisation you belong to. Sign-in is handled by our identity provider (see Section 6), which also keeps the technical records needed to run your sessions.

3.2 Client Contact Data

For each construction project we record the client representative's name, email address, phone number, company and the project location. We use these details only to administer the contract and to contact the client about the service.

3.3 Site Imagery and Blurring

The platform holds (a) photographs taken at set intervals by fixed cameras installed on site, (b) drone photographs uploaded by the client and (c) 360° images uploaded for site walks. Any of these may incidentally show workers, visitors or other people on site. The site operator is responsible for on-site notices and for informing the people concerned as required by national law. All imagery is stored on EU infrastructure and is encrypted at rest with keys held only by us.

People and selected areas in camera photographs can be blurred automatically before anyone sees them. Blurring can be switched on for a whole site, for selected cameras and periods, or for a single photograph. It is carried out by our own servers; no third party is involved and no face recognition or identification of any kind takes place. It applies to photographs from cameras we operate; photographs from a third-party webcam linked to a project are shown as they are received. Where blurring is on for a camera, a new photograph is shown only once its blurred version exists, which may delay it by a few minutes. The unedited original is kept, with access restricted to our administrators, for the period set for the project — which can be as short as immediately after the blurred version exists — and is then deleted for good; from that point only the blurred version exists in the live system, and the original leaves all backup copies within the period in Section 5. Automatic blurring may miss a person; signed-in users can report this from the photograph itself (Section 3.4).

3.4 Blur Reports

When a signed-in user reports a person the automatic blur missed, we record who made the report, the photograph concerned, the areas marked, any note typed with it and the time. The report is applied automatically within minutes and may be reviewed by our staff. The previous blurred version of the photograph is kept for a short time so that a mistaken report can be undone (see Section 5).

3.5 Device Identifiers

We hold technical identifiers for the cameras and routers connected to the platform, such as network addresses, device names and a site label, together with their status and connectivity data. These describe hardware, not people.

3.6 Security and Activity Records

To keep the platform and the imagery secure, and to be able to show who accessed what, we record sign-ins, downloads of photographs and archives, visits to shared links (including failed password attempts) and administrative changes made by administrators, for example to projects, devices, organisations or user roles. Each record holds the account concerned where the person was signed in, the time, the IP address, the browser type and an approximate location at city or country level, which we estimate ourselves from the IP address and do not share with anyone. Our web servers also keep standard traffic logs. None of this is used for marketing or profiling. Retention periods are in Section 5.

3.7 Shared Links

For each shared link an administrator creates we keep its identifier, when it was last opened and how many times it has been opened. Anyone holding the link can view the photographs chosen for it; visits are logged as described in Section 3.6.

3.8 Issue Reports

When you report a problem from within the platform, we record the category, your description, the page you were on, basic browser details, your IP address and the time, and your account if you are signed in. We use this only to resolve the problem.

3.9 Consent and Acceptance Records

When you accept our Terms of Service and this Privacy Policy, or make a cookie choice, we record what you accepted or chose, the version concerned, the time, your IP address and browser type, and your account where you are signed in. We also archive the exact text of each policy version in each language, so that we can show what you accepted (GDPR Art. 7(1)).

3.10 Contract Acceptance Records

When an administrator of your organisation accepts or declines a contract we have issued through the platform, we record the decision and any comment, the signer's name and position, their confirmation that they may act for the organisation, their account, the exact document and policy versions concerned, the time, and technical details of the signing session (IP address, browser, session). Where we require it, or the signer chooses to provide it, we also keep a document showing the signer's authority — for example a power of attorney or a company register extract — visible only to administrators of your organisation and to us.

3.11 Cookies

We use strictly necessary cookies for sign-in and session management. See our Cookie Policy for details.

3.12 Advertising Measurement and Website Statistics

On our public website only, and only if you accept marketing cookies in the cookie banner, Google Ads receives a click identifier, the page visited, basic browser details and conversion events so that we can measure our advertising. Without your consent no advertising cookies are set and only aggregated conversion counts are sent. No advertising tag runs in the customer portal. Separately, we measure how the public website is used with a cookieless statistics tool on our own EU server: it records the page viewed, the referring site, the browser and device type, the language and the country, stores no IP address and no personal data, and is never loaded in the customer portal or on shared links. It needs no consent.

3.13 Business Contacts We Approach

When we offer our services to construction companies and public bodies, we may contact a named employee by email in their professional role. For this we hold the person's name, job title, work email address and employer, and the construction project they are listed for. These details come from commercial industry databases of construction projects, from public sources such as company websites and tender notices, or from the person themselves. We use them only to contact the person about our services. Everyone we write to can object at any time by replying to the email or writing to info@concam.lt; we then stop contacting them and keep only their address on a list that prevents further emails. On request we tell you which source your details came from.