Privacy Policy — ECS SaaS Platform

1) Scope

This Privacy Policy applies to the ECS SaaS Platform ("Service"), a cloud-based Primavera P6 reporting and schedule management platform. This policy describes how we collect, use, store, and protect your information when you use our Service.

2) Information We Collect

2.1 Account Information

• Identity Data: Name, email address, company name
• Authentication Data: Credentials or SSO tokens (encrypted)
• Profile Data: Job title, department, phone number (optional)

2.2 Project Data

• Schedule Files: Primavera P6 XER files and Microsoft Project files you upload
• Processed Data: Parsed schedule data, calculated metrics, and exports
• Version History: Project versions, baselines, and historical snapshots

3) How We Use Your Information

We use your information to:

• Process schedule files and provide data for Power BI reporting
• Manage version control and baselines
• Enable team collaboration features
• Monitor system performance and reliability
• Send service notifications and updates

4) Third-Party Services

We use trusted third-party services to operate our platform:

• Amazon Web Services (AWS): Cloud hosting and data storage (Sydney, Australia)
• Stripe: Payment processing (we do not store your full credit card details)
• Microsoft/Google: Single sign-on authentication (if you choose to use SSO)

These providers process data on our behalf under strict contractual obligations. We do not sell or share your data with third parties for their own marketing purposes.

5) Cookies and Tracking

The ECS platform uses only essential cookies required for authentication and session management. We do not use advertising cookies, third-party tracking pixels, or analytics services that track your behaviour across other websites.

6) Data Storage and Security

• Hosting: AWS cloud infrastructure in Australia (Sydney region)
• Encryption: TLS encryption for data in transit, AES-256 for data at rest
• Access Control: Role-based permissions and multi-tenant data isolation
• Authentication: Single sign-on available (Microsoft, Google)

7) Data Retention

We retain your data for as long as your account is active or as needed to provide you with our services. Specifically:

• Active Accounts: Data retained for the duration of your subscription
• Closed Accounts: Data deleted within 90 days of account closure, unless you request earlier deletion
• Billing Records: Retained as required by law (typically 7 years)

You can export or delete your data at any time through the platform or by contacting us.

8) Your Rights

You have the right to:

• Access and view all your account and project data
• Export your data in standard formats
• Download your original schedule files at any time
• Update or correct your account information
• Delete individual projects or request complete account deletion
• Unsubscribe from marketing communications

9) Data Location

ECS operates from Australia. All customer data is stored and processed in Australia. We do not transfer your data overseas.

10) Children

The ECS platform is designed for business use and is not directed at children under 16 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

11) Additional Rights for EU Residents (GDPR)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Legal basis: We process your data to perform our contract with you (providing the Service) and for our legitimate business interests (improving the Service, communicating with you)
• Right to restriction: Request that we limit how we use your data
• Right to portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time
• Right to lodge a complaint: File a complaint with your local data protection authority

Data Controller: Engineering and construction systems pty Ltd (ECS), ACN 655 876 154, Australia. For GDPR inquiries: support@ecs.app

12) Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know: Request information about the categories and specific pieces of personal information we collect
• Right to delete: Request deletion of your personal information
• Right to correct: Request correction of inaccurate personal information
• Right to opt-out of sale/sharing: We do not sell or share your personal information for cross-context behavioral advertising
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

Categories of personal information collected: Identifiers (name, email), commercial information (subscription details), and professional information (job title, company).

To exercise your California privacy rights, contact us at support@ecs.app. We will respond within 45 days.

13) Changes to This Policy

ECS may update this policy from time to time. Changes will be posted with a new Effective Date. Material changes will be communicated to you via email or through the platform.

14) Contact

15) Governing Law

This policy is governed by the laws of Queensland, Australia.