In short
- Who this is for: people who use CORUZ Control or CORUZ Process with an account, and the organisations that use them.
- Who decides what: the data an organisation enters is its own responsibility, and I process it on its behalf; I process the account data myself, as controller.
- Where it is kept: in a European Union region (Supabase; Process in Paris).
- Control test: 30 days; at the end the organisation becomes read-only and can download its data.
- Your rights: in the app, under Options, "My data", or at contact@coruz.pt.
This policy applies to people who use CORUZ Control or CORUZ Process with an account, and to the organisations that use them. For the coruz.pt website (forms, calendar, cookies), see the website Privacy Policy. The rules of use of the tools are in the CORUZ Control terms and the CORUZ Process terms.
1. CORUZ Control (test version, with an account)
The test version of CORUZ Control, at coruz.pt/control, is only available with an account and by invitation. Access is requested on a public page and each request is approved by hand. This section explains the data processed in that application, which is different from the rest of the site.
- Account: name, email and access profile in the organisation (Administrator, Manager, Contributor or Viewer). I do not see the password: it is stored in protected form by the authentication provider.
- Beta access request: the company name, tax number (NIF), your name and work email and, if you wish, your sector and a message; it also records when you accepted the policy and the beta conditions. Only I see them and I use them to decide whether the company joins the beta and to send the invitation (pre-contractual steps, at your request). Requests that are refused or unanswered are deleted after 30 days; approved ones are kept while the organisation exists.
- Acceptance of the terms of use: when you accept the CORUZ Control Terms of Use (when requesting access, accepting an invitation or signing in), we store your account identifier, the organisation, the version of the terms accepted and the date and time. We do not store your IP address or browser data for this purpose. We use this record to prove that you accepted the terms in force and to ask you again when they change (performance of the contract and legitimate interest in proving acceptance). We keep it for as long as the organisation exists; if you delete your account, the record no longer identifies you. You can see it under "My data".
- Trial and feedback: the trial lasts 30 days; afterwards the organisation becomes read-only and the data can still be downloaded. The feedback you write in the application (and your email, only if you tick that you may be contacted) is used to improve the tool and, if you ask, to tell you about the paid version.
- What your organisation enters: jobs, tasks, risks, decisions, drawn processes, clients and contacts, contracts (the value is only visible to people with the Manager or Administrator profile), attached files and brand images (logo, banner and background). A client (with its contacts), a supplier or an item with nothing linked to it can be permanently deleted by the organisation.
- Budgets: planned and actual amounts per line, suppliers and document references, written notes and justifications, and who requested, approved or recorded each change. A budget can be linked, if the organisation wishes, to a job, a client and a contract. Only people with the Manager or Administrator profile can see them; the action log is read by the Administrator only. Nothing is deleted: changes only change status.
- Items and suppliers: the item catalogue (descriptions, prices, costs, photos and stock), the data of your suppliers, including contact people (name, role, email and phone), and the orders the organisation places with those suppliers (items, quantities, costs and expected dates). Stock goes up when an order is received and goes down when a budget's baseline is closed. Only people with the Manager or Administrator profile can see them. Records are deactivated and, if nothing is linked to them, can be permanently deleted (stock movements are only ever added and orders are cancelled).
- Client portal (optional): if the organisation invites one of its clients, that person's name and email are stored, together with an access account, what they viewed and when, and any answers they give to change proposals. The client only sees what the organisation chooses to show (never internal costs, suppliers or internal notes unless expressly chosen) and access can be revoked at any time. The organisation is responsible for having a legal basis and a contract or data processing agreement before inviting its client.
- History: a record of who changed what and when, within the organisation.
- In your browser: the signed-in session and a few preferences (theme, chosen organisation, task view and whether you have seen the guided tour), in local storage. The application has no analytics or advertising cookies.
Who decides what. The data each organisation enters (for example, its clients and contacts) is the responsibility of that organisation, which decides what it puts there. I process it only to provide the application, on its behalf. I ask you not to enter sensitive data (for example, health data) or data you are not entitled to use. Account data (name, email and profile) is processed by me, as controller, to create and maintain access and to keep it secure.
Where it is kept. The data is kept in a region of the European Union, with the provider Supabase (database, authentication and file storage). Supabase is a company headquartered outside the EU: any access or transfer outside the EU, for example for technical support, follows the applicable transfer framework. The application's emails (invitations and password recovery) are sent from the coruz.pt domain.
Separation and access. Each organisation only sees its own data and each person sees what their profile allows. Only the Administrator assigns profiles.
How long, and your rights. The data is kept while the account and the organisation exist. In the application, under Options, "My data", you can download your data and request deletion of your account; you can also write to contact@coruz.pt. An organisation's data is deleted at its request. I reply within the legal deadline.
2. CORUZ Process (closed test)
CORUZ Process is an application for companies to write and control their processes. It is in closed testing: only account holders can log in, and there is no public sign-up, offer or price yet. The data processed is the account (name, email and access profile), what each organisation enters (processes, steps, control points, approvals and the history of who changed what), attached files and preferences stored in the browser. It is kept in a database in the European Union (Paris), separate from CORUZ Control's. How long it is kept and your rights are as described in the previous section. Whatever you send me through the site forms is handled as described in sections 2 to 5 of the website Privacy Policy.
3. Rights and complaints
To exercise your rights, use the app, under Options, "My data", or write to contact@coruz.pt. Your rights, the response deadlines and the right to complain to the CNPD are described in section 7 of the website Privacy Policy.