Privacy Policy

1. Introduction

Sikmo Digital ("we", "us", "our") operates bIDMIO, a multi-tenant cloud-based ERP platform for construction project management. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our platform.

2. Data Controller

Sikmo Digital
CVR: 32014283
Address: Præstbrovej 22, 8464 Galten, Denmark
Contact: privacy@bidmio.com

For account, billing and website-visitor data, Sikmo Digital is the controller. For data you enter about your employees, customers and projects (tenant data), you are the controller and Sikmo Digital is the processor under the Data Processing Agreement.

3. Personal Data We Collect

3.1 Account Data

• Name, email address, phone number
• Company/organization details
• Job title and role
• Login credentials (securely hashed)

3.2 Employee Data

• Employee profiles (name, contact, job information)
• Work schedules and time logs
• Absence records (vacation, sick leave). Sick leave is a special category of personal data only if you choose to record it
• Emergency contact information

3.3 Project Data

• Customer and supplier information
• Project details and budgets
• Invoices and financial records
• Documents and files you upload

3.4 Technical Data

• IP addresses and device information
• Browser type and version
• Usage patterns and access logs
• Cookies and similar technologies

3.5 Acquisition Data

When you arrive on bIDMIO from an advertisement, a search engine or one of our marketing websites, we record how you got here so that we can measure which channels bring us customers:

• The address you landed on and the website that referred you
• Campaign parameters in the link you followed (source, medium, campaign, term, content)
• Advertising click identifiers supplied by Google, Microsoft or Meta
• Google analytics and advertising cookie identifiers, where they are readable

This information is held in a short-lived cookie during signup and, if you create an account, is stored once against that account. It is never linked to your activity inside the platform.

3.6 Google Ads Enhanced Conversions

After you successfully create an account, and only if you have granted marketing consent, we may send Google a normalized, one-way SHA-256 hash of the email address used for signup together with a conversion event. Google compares the hash with hashes associated with signed-in Google accounts to attribute the signup to an advertising interaction and improve conversion measurement and bidding.

• Data: The normalized SHA-256 hash of the signup email address and conversion-event metadata. The hash is pseudonymized personal data, not anonymous data. The raw email address is not placed in our marketing data layer or sent by this integration.
• Purpose and legal basis: Advertising measurement and campaign optimization, based on your consent.
• Recipient: Google, under the Google Ads Data Processing Terms and Customer Data Policies.
• Retention: bIDMIO does not retain the hash after dispatch; Google processes it under its applicable terms and policies.
• Your choice: Withdrawing marketing consent in Cookie settings stops future Enhanced Conversions transmissions. We do not use this processing to create Customer Match or conversion-based customer lists.

3.7 Mobile apps (Android and iOS)

The bIDMIO mobile apps for Android and iOS can use the following device functions:

• Location for automatic work logs (GPS): Location is used only if your employer has enabled automatic work logs and you turn them on yourself in Work zone > GPS tracking. The app first explains how location is used and only then asks for the system permission. The app collects precise location, also when the app is closed or not in use, but only during the working hours set by your employer (starting up to one hour before the shift so that an early arrival is recorded). The app does not start tracking on days off, public holidays or full-day absences recorded in bIDMIO, and positions sent on such a day are rejected by the server and not stored. Location is used to check whether you are at one of your company's job sites. Location is not used for advertising and is not sold.
• What is stored about your location: The coordinates themselves are not stored on bIDMIO's servers. The servers store the job site with your arrival and departure times, and the time and outcome of the most recent position report so that tracking problems can be diagnosed. Arrivals and departures become time entries: drafts that you review or, if your employer has turned on automatic confirmation, confirmed time entries. Your employer (the organization you work for) sees arrival and departure times, not a location history. When you delete your GPS data in Work zone > GPS tracking, your arrival and departure records and the GPS drafts of time entries that have not been confirmed yet are deleted, and GPS tracking is turned off. Time entries that have already been confirmed (by you, or automatically if your employer has turned on automatic confirmation) are not deleted: they are part of your employer's work records, and your employer decides about them as the controller. The time and outcome of the most recent position report also remain stored with your GPS settings; they are not deleted when you turn tracking off or delete your GPS data, but are replaced by the next report.
• Temporary storage on the device: If a position cannot be sent right away (for example, without an internet connection), it is kept temporarily on the device and sent later. A position is deleted from the device once it has been sent. In the Android app, a position older than 12 hours is never sent and at most 720 positions are kept; in the web version in the browser, the limits are 6 hours and 50 positions. Positions beyond these limits are not sent and are deleted the next time the app processes its queue, that is, when it next records or sends a position; until then they can remain on the device. In the Android app, waiting positions are also deleted when you turn GPS tracking off in the app or when the server no longer accepts the app's sign-in. In the web version, turning GPS tracking off does not delete waiting positions: they stay in the browser until it next processes the queue, and positions within the limits may then still be sent. Deleting your GPS data (see above) also stops tracking on the device you delete it from and deletes the positions waiting there, in the Android app and in the browser.
• Stopping tracking: You can stop tracking at any time in the app by turning off Work zone > GPS tracking and, while you are at a job site, also with the End work button in the app. You can also withdraw the location permission at any time in your phone's system settings. On Android, a persistent notification with an End work button is shown while tracking runs, provided notifications are allowed for the app. If you do not allow notifications, tracking can run without this notification.
• Camera, photos and files: Used only when you take a photo or pick a file. The content is stored with your company's records.
• Microphone: Used only when you dictate text, record a voice note or give a spoken instruction. The recording is sent to OpenAI (see section 6.1) to be transcribed into text. bIDMIO does not store the recording itself, only the recognized text where you use it (for a voice note, the transcript is added to the construction log; dictated text is saved only when you save the form). These are optional AI features that your company can turn off.
• Push notifications: To deliver notifications, the Android app uses Firebase Cloud Messaging (Google) and the iOS app uses Apple Push Notification service (APNs, Apple). The provider receives a device token and the content of the notification.
• No advertising: The apps do not use the advertising ID and contain no advertising SDKs.

4. Legal Basis for Processing

We process personal data based on:

• Contract Performance: To provide our services
• Legitimate Interest: For security, analytics, and service improvement
• Legal Obligation: Compliance with applicable laws
• Consent: For optional features and marketing

5. How We Use Your Data

• Provide and maintain the bIDMIO platform
• Process transactions and manage subscriptions
• Send service notifications and updates
• Provide customer support
• Improve and develop our services
• Ensure platform security and prevent fraud
• Comply with legal obligations

6. Data Sharing

We may share data with:

• Service Providers: Cloud hosting, payment processing, email services, analytics, and customer support tools
• Within Your Organization: Other authorized users in your workspace
• Legal Requirements: Courts, regulators, or law enforcement
• Business Transfers: In case of merger or acquisition

6.1 Third-Party Service Providers

We use the following third-party services to operate and improve bIDMIO:

• Hetzner: Application hosting in Germany and object storage for uploaded files in Nuremberg (nbg1).
• Neon: PostgreSQL database in the EU (Frankfurt).
• Stripe: Subscription payments (Ireland). Card numbers are not stored on Bidmio servers.
• Resend: Transactional email delivery service.
• OpenAI: Optional AI features, including transcription of dictation and voice notes into text. EU organisations must accept a non-EU processing consent before prompts may leave the EEA. AI can be turned off.
• Zoho PageSense / SalesIQ: Analytics and live chat on our bidmio.* marketing websites (page views, interactions, chat transcripts and visitor information). Not used for tenant ERP records.
• Google Firebase Cloud Messaging: Delivery of push notifications to the Android app (device token and notification content).
• Apple Push Notification service (APNs): Delivery of push notifications to the iOS app (device token and notification content).

The complete, current list of sub-processors with their purpose and location is on the Sub-processors page.

7. Google API Services

bIDMIO may allow users to connect their Google account to enable certain features or integrations.

When a user authorizes Google integration, bIDMIO may access limited Google account information as permitted by the user. This data may include:

• Basic profile information
• Email address
• Other data necessary for the requested integration

bIDMIO uses this data only to provide the requested functionality and does not sell or use this data for advertising purposes.

bIDMIO's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. International Transfers

Data may be transferred outside the EU/EEA. We ensure appropriate safeguards through:

• EU Standard Contractual Clauses
• Adequacy decisions by the European Commission
• Other approved transfer mechanisms

9. Data Retention

• Active Accounts: Data retained while account is active
• After Termination: operational tenant data is retained for 30 days to allow export, then deleted
• Backups: retained for up to 90 days
• Accounting records: 5 years from the end of the relevant fiscal year where tax law requires it
• Advertising Click Identifiers: Campaign parameters and click identifiers stored with an account are deleted after 24 months, and immediately when the organization is deleted
• GPS arrival and departure events: Kept for the period set by your employer (90 days by default; discarded events 30 days), then deleted automatically

10. Your Rights (GDPR)

You have the right to:

• Access: Request copies of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data
• Restriction: Limit how we use your data
• Portability: Receive data in a portable format
• Object: Object to certain processing activities
• Withdraw Consent: Where processing is based on consent

Deleting your account and data: The page /app/account-deletion explains how to delete your account and data. It works without the app and can also be reached from Profile in the app.

11. Data Security

We implement robust security measures:

• Encryption in transit (TLS) and at rest
• Multi-tenant data isolation
• Automated security checks of the code before every release
• Access controls and authentication

12. Cookies and Tracking Technologies

We use the following types of cookies and tracking technologies:

• Essential Cookies: Required for platform functionality, authentication, and security. These cannot be disabled.
• Analytics Cookies: Used by Zoho PageSense to understand how users interact with our platform. These help us improve usability and features.
• Chat Cookies: Used by Zoho SalesIQ to provide live chat support and remember conversation history.
• Preference Cookies: Remember your settings such as language and theme preferences.
• Attribution Cookie: A first-party cookie that remembers how you first reached bIDMIO so a signup can be credited to the right campaign. It expires after 30 days and is deleted as soon as an account is created.

Statistics, marketing and chat cookies are only set once you allow them. You can change or withdraw that choice at any time via Cookie settings in the footer of any page. Our Cookie Policy lists every cookie we set, its category, purpose and lifetime. You can also manage cookies through your browser settings, but note that disabling essential cookies may affect platform functionality.

13. Children's Privacy

bIDMIO is not intended for users under 16. We do not knowingly collect data from children.

14. Changes to This Policy

We may update this policy periodically. Significant changes will be communicated via email or platform notification.

15. Contact Us

For privacy inquiries or to exercise your rights, contact us at:
Email: privacy@bidmio.com

Last updated: October 18, 2026

Version 3.7