Mobile app privacy policy
This policy covers the OBRASET app for Android and iOS — the read-only companion for construction company owners and site managers. The website has its own policy.
Controller
SET AND PARSECS, S.L. — Sociedad Unipersonal, tax ID B93850683, Placeta Adelina Gregoriano 4, 08224 Terrassa (Barcelona), Spain. Contact: hola@obraset.es.
What the app does and the data it processes
The app is a viewing window onto your company's data, which lives in the OBRASET desktop (app.obraset.es), hosted on our servers in the European Union. It processes:
- Your account: name, email and the company or companies you belong to. There is no public sign-up: accounts are created by the firm managing the service.
- Your company's business data: works, budgets, certifications, amounts, alerts and subcontractor compliance documents. We process them on your company's behalf as a data processor (art. 28 GDPR).
- Delivery-note photos you choose to take or pick from your gallery. They are sent encrypted and stored on the server's private disk. The app only accesses the camera or gallery when you start that action.
- A device identifier for notifications (Firebase Cloud Messaging token), only if you switch on «Alerts on my phone». It is deleted when you switch it off or sign out.
- A local cache: the app keeps the latest copy of your data on your phone so you can check it without coverage. It is wiped when you sign out.
What the app does not do
- No ads, no third-party analytics, no trackers.
- No location access, and no permissions it does not need.
- We never sell or share your data with third parties.
Processors and transfers
To deliver notifications we use Firebase Cloud Messaging (Google Ireland Ltd.) as a processor: it receives your device token and the content of each alert, which our server writes. Google may process data outside the European Economic Area under standard contractual clauses. All other data stays on our EU servers.
Security
All communication is encrypted (TLS). Access is per-device: you can revoke a lost phone without affecting the others, and signing out removes that phone's notification token and local cache.
Retention and deletion
Business data is kept for as long as the relationship with your company lasts — your company decides over it. To delete your user account or exercise your rights of access, rectification, erasure, objection, restriction and portability, write to hola@obraset.es — we reply within 30 days. You may also complain to the Spanish Data Protection Agency (aepd.es).