BuildTrack — Construction ManagementStart trial
Privacy & Data Protection

Your site data stays on your site.

BuildTrack is multi-tenant by design — each contractor's projects, BOQs, costs and invoices are isolated in their own workspace. We never co-mingle tenant data and we log every access.

Last updated 30 August 2026 Encrypted at rest & in transit🇿🇲 Zambia DPA aligned

Overview

BuildTrack (“we”) provides construction management SaaS at buildtrackzm.com. This policy explains what we collect, why, and your choices. Data controller: BuildTrack, Chingola, Zambia.

Data we collect

Account & tenant

Name, email, phone, company name, TPIN, branch, role, password hash. Created at signup / invite.

Project & commercial

Projects, BOQs, budgets, purchase requests/POs, supplier data, invoices (Kwacha), payments, expenses, documents you upload.

Site & operations

Site reports, photos, attendance, labour, QC inspections, safety incidents, equipment logs.

Usage & technical

Device, IP, login times, session, audit logs, support tickets, cookies (see Cookies). We do not intentionally collect location outside attendance feature.

How we use data

  • Provide the service: tenant isolation, authentication, project calculations, reporting.
  • Billing: plan limits, invoicing via Lipila, dunning. No card stored by us — handled by Lipila.
  • Security: 2FA, login logs, anomaly alerts, audit trail.
  • Support & improvement: respond to tickets, aggregate usage to tune performance (never per-tenant data mining).
  • Legal: tax records, Data Protection Act requests.

Legal basis: contract, legitimate interest, consent (cookies, marketing), legal obligation.

Tenant isolation

Every query is scoped by company_id. Company A cannot read Company B’s projects, invoices or files even if they know the ID. Backups are per-tenant encrypted.

Sharing

We do not sell your data. Shared only with:

  • Processors: MySQL hosting, SMTP (Gmail App Password), Lipila (payments). Under DPA agreements.
  • Within tenant: your invited members per their roles.
  • Legal: if required by Zambian law or to prevent fraud/abuse.

Retention

Tenant data retained while subscription is active. After cancellation, data kept 90 days for export, then soft-deleted; audit logs 7 years for compliance. Backups rotate 30 days. You may request export or deletion via support.

Security

  • TLS 1.2+ in transit, AES-256 at rest (DB/files).
  • bcrypt passwords, session tokens hashed, 2FA, rate-limiting, CSRF on server functions.
  • Per-tenant RBAC (Owner/Admin/PM/QS etc.), requirePermission checks on every server function.
  • Breach notification within 72h per DPA.

Your rights (Zambia DPA)

Access, correction, deletion, restriction, portability, objection, and withdraw consent. Contact support — we respond within 30 days. Lodge a complaint with the Data Protection Commissioner if unresolved.

Cookies

Strictly necessary: session buildtrack_session (HttpOnly, Secure, SameSite=Lax). No advertising cookies. Analytics only if you consent via banner. Manage in cookie settings. See cookie banner on first visit.

Contact

support@buildtrackzm.com — Data Protection Contact

BuildTrack, Chingola, Zambia · +260 979 709 820

Updates

We will update the date above and, for material changes, notify workspace owners by email and in-app. Continued use after notice = acceptance.