Privacy policy

Website Privacy Policy

Last updated: 2026-08-04

Purpose and scope

This Privacy Policy describes how ODEI CONSTRUCTION SOFTWARE, S.L. (hereinafter, “ODEI”) processes the personal data of natural persons who interact with ODEI through the website odei.io (hereinafter, the “Website”).

This policy applies exclusively to the Website odei.io. ODEI’s SaaS service, accessible through the subdomain app.odei.io and through the official mobile applications, is governed by its own contractual documents (General Terms of Service and Privacy Framework), which regulate the processing of personal data in the context of that service.

This policy has been drafted in accordance with Regulation (EU) 2016/679 (hereinafter, “GDPR”), Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights (hereinafter, “LOPDGDD”) and Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (hereinafter, “LSSI”).

Data controller

Corporate name: ODEI CONSTRUCTION SOFTWARE, S.L.

Tax ID (CIF): B44648996

Registered office: Avda. Sabino Arana 37, 12 DD, 48013 Bilbao (Bizkaia), Spain

Registration details: company incorporated for an indefinite term by deed executed before notary Mr. Vicente María del Arenal Otero on 2 February 2023, protocol number 2023/235, and registered with the Commercial Registry of Bizkaia, Volume 66164, Folio 22, Sheet BI-80098.

General contact e-mail: hello@odei.io

Privacy e-mail: privacy@odei.io

Data Protection Officer

ODEI has not designated a Data Protection Officer because the mandatory designation scenarios of article 37 GDPR do not apply to the processing activities carried out through the Website. However, ODEI has established a functional privacy mailbox accessible at privacy@odei.io, to which data subjects may direct any query or request relating to the processing of their personal data.

Personal data we process

ODEI processes the following categories of personal data through the Website:

Identification data: name and surname.

Professional contact data: corporate e-mail address, and professional telephone number when the User chooses to provide it.

Professional data: company, position, sector of activity, company size, country and other similar information that the User provides in the forms.

Data freely provided by the User: content of the message or any other data that the User chooses to include in the open fields of the forms.

Technical and browsing data: IP address, device identifiers, browser type and version, operating system, pages visited, time spent, referrer, and similar information automatically collected during browsing. Detailed information on cookies and similar technologies used is set out in the Cookie Policy.

The User must provide the data truthfully and keep it up to date. Failure to provide the data marked as mandatory in the forms will prevent the requested functionality from being delivered.

Purposes and legal bases of processing

ODEI processes the personal data collected through the Website for the purposes described below, with the specific legal bases indicated in each case.

Handling requests for a SaaS service demo

When the User completes the demo request form, ODEI processes the data to contact the User, qualify their interest, arrange the demonstration and respond to related queries.

Legal basis: pre-contractual measures at the request of the data subject (article 6.1.b GDPR).

Facilitating access to the videodemo and to Website resources

When the User completes a form to access the videodemo or to download resources published on the Website (guides, whitepapers or other content), ODEI processes the data to give access to such content and to manage delivery.

Legal basis: performance of the User’s request (article 6.1.b GDPR) and ODEI’s legitimate interest in understanding the User’s interest in its activity and content (article 6.1.f GDPR).

Sending commercial communications about similar services

ODEI may send the User, by electronic means, commercial communications relating to its own services which are similar to those in which the User has shown interest (demo request, videodemo or download of resources).

Legal basis: ODEI’s legitimate interest in commercial prospecting in relation to persons who have previously shown interest in its services (article 6.1.f GDPR, in conjunction with article 21.2 LSSI, soft opt-in regime). A balancing test has been conducted; its outcome may be requested at privacy@odei.io.

The User may object to receiving these communications at any time and free of charge, through the unsubscribe link included in each communication or by contacting privacy@odei.io.

Newsletter subscription

When the User expressly subscribes to the newsletter, ODEI processes the data to manage the subscription and to send the corresponding content.

Legal basis: express consent of the data subject (article 6.1.a GDPR and article 21.1 LSSI), given by voluntarily completing the subscription form.

The User may withdraw consent at any time and free of charge, through the unsubscribe link included in each communication or by contacting privacy@odei.io. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.

Website usage analytics

ODEI processes technical and browsing data to understand the aggregate use of the Website, measure its performance, improve its content and optimise the User experience.

Legal basis: ODEI’s legitimate interest in improving the Website and its content (article 6.1.f GDPR). Where the use of cookies or similar technologies requires consent, such consent will be collected as set out in the Cookie Policy.

If ODEI incorporates in the future digital marketing tools involving the processing of data for profiling, behavioural advertising or retargeting purposes, such processing will be carried out with the User’s prior consent, with the detailed information set out in the Cookie Policy.

Compliance with legal obligations

ODEI processes personal data to comply with the legal obligations that apply to it and to respond to requirements from competent authorities.

Legal basis: compliance with a legal obligation (article 6.1.c GDPR).

Retention periods

ODEI retains personal data for the time necessary to fulfil the purposes for which it was collected. The specific criteria are as follows:

Data provided in demo requests, videodemo or resource downloads: up to two (2) years from the last significant interaction of the User with ODEI, unless the User is converted into a customer, in which case the data will be processed in accordance with the Privacy Framework of the SaaS service.

Data provided in newsletter subscription: until the User withdraws consent. Following unsubscription, ODEI will retain only the identifiers strictly necessary to ensure the effectiveness of the objection and to avoid including the User in future communications.

Data derived from commercial communications (soft opt-in): until the User objects. The same criteria as in the previous point apply after the objection.

Technical and browsing data: in accordance with the periods indicated in the Cookie Policy.

Data related to claims or legal requirements: until the final resolution of the matter and the expiration of the applicable statute of limitations.

Once the indicated periods have expired, the data will be deleted or, when this is not technically possible, irreversibly anonymised.

Recipients of the data

ODEI does not sell or transfer personal data to third parties for commercial purposes. The recipients of the personal data processed through the Website may be:

ODEI’s data processors: technology providers that render services to ODEI under a contract in accordance with article 28 GDPR, with documented instructions, confidentiality obligations and equivalent security measures. The main ones are:

HubSpot: for the management of the relationship with the User (CRM), the sending of commercial communications and the newsletter, and the management of the forms on the Website.

Google (Google Analytics): for the aggregated analytics of Website usage.

Public administrations, courts and tribunals: where there is a legal obligation to disclose the data or an official request.

ODEI’s professional advisors: lawyers, auditors and consultants, subject to confidentiality duties, where necessary for the defence of rights or regulatory compliance.

International transfers

Some of the processors indicated in the previous section process personal data outside the European Economic Area, in particular in the United States (HubSpot Inc. and Google LLC). In such cases, ODEI ensures an adequate level of protection through the mechanisms provided for in Chapter V of the GDPR:

EU-U.S. Data Privacy Framework, pursuant to the adequacy decision of the European Commission of 10 July 2023, for providers certified under that framework.

Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, supplemented by any additional measures required following the transfer impact assessment, in accordance with Recommendations 01/2020 of the European Data Protection Board.

The User may request additional information on the applicable safeguards through privacy@odei.io.

Data provided about third parties

When the User provides ODEI with personal data of third parties (for example, contacts of colleagues or collaborators in the messages of the forms), the User warrants that they have previously informed such persons of the processing of their data by ODEI in accordance with this policy, and that they have obtained, where applicable, their consent.

Without prejudice to this obligation of the User, ODEI will comply with its own information obligations towards the third party under article 14 GDPR when applicable and not disproportionate.

Minors

The Website is aimed at professionals and adults interested in the services and activities of ODEI. ODEI does not knowingly collect personal data of minors under 14 years of age. If it becomes aware that a minor under 14 has provided personal data without the consent of those exercising parental authority or guardianship, the data will be deleted following contact at privacy@odei.io.

Security measures

ODEI has adopted the technical and organisational measures necessary to ensure a level of security appropriate to the risk, in accordance with article 32 GDPR, including encryption of communications in transit, access controls to the data by ODEI’s personnel and its processors, incident management and continuity processes, and confidentiality commitments of personnel.

Notwithstanding the measures adopted, the User acknowledges that no information system can be considered fully secure and undertakes to take reasonable precautions when using the Website.

Rights of data subjects

Users may exercise, at any time and free of charge, the following rights recognised by the GDPR:

Access: to know what personal data is being processed and obtain a copy of it.

Rectification: to request the correction of inaccurate or incomplete data.

Erasure: to request the deletion of the data when it is no longer necessary or there is no legal basis justifying the processing.

Objection: to object to the processing on grounds relating to the User’s particular situation where the legal basis is legitimate interest. Unconditional objection where the processing is for direct marketing purposes.

Restriction: to request that the processing be restricted in the cases provided for in article 18 GDPR.

Portability: to receive the data in a structured, commonly used and machine-readable format, and transmit it to another controller.

Withdrawal of consent: to withdraw consent at any time, without this affecting the lawfulness of the processing carried out prior to withdrawal.

Complaint to the supervisory authority: to lodge a complaint with the Spanish Data Protection Agency (c/ Jorge Juan 6, 28001 Madrid; www.aepd.es).

In particular, the User may object at any time and unconditionally to the sending of commercial communications by ODEI, regardless of the applicable legal basis, through the unsubscribe link included in each communication or by contacting privacy@odei.io. The objection will be effective without the need for justification.

To exercise these rights, the User may contact privacy@odei.io or the postal address indicated in the “Data controller” section, specifying the right they wish to exercise.

In accordance with the principle of proportionality, ODEI will verify the identity of the requester using the information already available. An identity document will only be requested where there are reasonable doubts about the identity of the requester and it is strictly necessary.

Requests will be handled within one month of receipt, extendable by two additional months depending on complexity and volume of requests.

Cookies

The Website uses cookies and similar technologies. Detailed information on the cookies used, their purposes and retention periods, as well as the mechanisms for configuring the User’s preferences, is set out in the Cookie Policy, available at odei.io/en/cookie-policy.

Amendments to the Privacy Policy

ODEI may amend this Privacy Policy to adapt it to regulatory, jurisprudential, organisational or functional changes to the Website. The current version will always be available on the Website with the date of the last update.

Where amendments are substantial and affect processing based on consent, a new consent will be obtained from the User.

Complaints to the supervisory authority

Without prejudice to the possibility of contacting ODEI to resolve any matter relating to the processing of personal data, the User has the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with any other competent supervisory authority.

1. Data controller.

The entity responsible for the processing of personal data provided through the Application is ICX, a Spanish company with registered office at Avda. Sabino Arana 37 – 12 DD, 48013 Bilbao (Bizkaia). You can contact us at [hello@icx.group] or through the contact channels that you will find on our website https://icx.group .

2. What information we process.

In order to enjoy the functionalities of the Application, it is necessary for you to create an account. In order to do so, we need to collect and process certain personal information. Sometimes this information is provided to us by you (when you register and create your account, when you contact us or when you activate certain features) and sometimes the information is collected automatically by the system itself when you use the Application. Below, we show you the type of data we process:

Registration Data. This is the information you provide to us when you register on the App and includes identifying and contact information such as your name, e-mail, username and password.
Inquiries and support. This is the information we collect when you contact us with a query or request support, such as your name, username, e-mail address and the content of your query or issue.
Mobile device technical information. This information includes certain technical information about the mobile device on which you download and use the App, such as the model, operating system and version of the App you have installed.
App usage information. This is information about how you interact with the App and how you use the various features and content available on the App, such as which features are most used when you log in to your user account.
Location data. Only in case you activate and allow the use of location information on your mobile device, we can access this information on an ad hoc basis, for example, to locate your position at the time you check-in at a construction site (we do not store this information).

3. What we use the information for.

We use your personal data for the following purposes:

To enable you to access the services available on the App and provide you with the best possible experience. For example, we use registration data to create and manage your account, including verifying your email address, registering you in our system and allowing you to access and use the App, as well as to send you important notifications about the App or your user account. We use your device’s technical information to tailor our App and its features to the characteristics of your device to improve your user experience.
To send you information. We may also use your contact information to send you e-mail communications about new developments in our system or to keep you updated about our services and activities, unless you opt out at any time.
To offer you support and answer your queries. We use the information you provide when you contact us to respond to your inquiries, provide support and help you resolve incidents appropriately.
To prevent the security of our system, diagnose problems and perform maintenance. We may use the information we collect to ensure the security of our system, detect anomalous usage patterns that may compromise the security of our computer systems, resolve incidents, or troubleshoot and perform maintenance.
To optimize the performance of our App and develop new features. We may use App usage information to analyze and understand how the App is used and, in this way, to detect bugs, identify potential improvements, optimize its operation and performance, develop new features and improve our services.
To comply with our legal obligations and to exercise or defend claims. We may process and retain certain information to comply with the legal and contractual obligations to which we are subject in each case, as well as to maintain the necessary records in order to exercise or defend our rights against potential claims or requirements that we may receive.

4. What is the legal basis that legitimizes the treatment.

When we collect and process your personal information, we do so because there is a legal basis that justifies and legitimizes the processing of the data. Therefore, our processing of your information will be based on one of the following reasons.

Because it is necessary to provide you with our services [art. 6.1.b) RGPD]. We need to collect and process the information as we have indicated in order to provide you with our services and to allow you to enjoy the functionalities of our App. Otherwise, we could not provide the service or manage the relationship we have with you, as a user of our App.
Because we have obtained your consent to do so [art. 6.1.a) RGPD]. For example, the use of your location data may be necessary to provide you with our services provided that you have activated some functionality in the App that necessarily requires the use of such information. However, we will only use location data when you have given us permission for your mobile device to share this information with us and we will only have access to this information on an ad hoc basis (we do not store this information or geolocate the device on an ongoing basis). You may at any time prevent location data from being shared with us by configuring the appropriate settings on your mobile device.
Because it is necessary to meet our legitimate interests [art. 6.1.f) GDPR]. Legitimate interest constitutes a legitimate basis, provided that such interest in processing the data is within reasonable expectations based on your relationship with ICX as a user of our App. We consider that our interests in preventing the security of our systems, detecting and preventing misuse, diagnosing failures, performing maintenance work and analyzing how our App is used to improve its performance and develop new features, are legitimate, because this will allow us to adapt to the needs of our users and improve their experience in using our services. Likewise, we have a legitimate interest in collecting and retaining certain information that allows us to exercise our rights in the event of potential claims or requests, as well as to keep you informed about news that we believe may be of interest to you.
Because it is necessary to comply with legal obligations [art. 6.1.f) RGPD]. Sometimes the collection and processing of information may be justified because we need to do so in order to comply with legal obligations to which we are subject or to comply with certain regulations.

5. With whom and in what cases the information is shared.

In ICX in no case we sell the personal information of our users, nor do we commercialize with their personal data for advertising purposes. If we share information, we will do it with the due guarantees and in full compliance with the legislation.

As any other company, ICX needs to resort to external suppliers that provide us with computer hosting services or support to our customer service channels, which are necessary for our users to be able to enjoy the services. Our suppliers may have limited access to certain personal information of users under our instructions, but only for the purpose of providing us with their services and with the due guarantees of confidentiality. If we use providers that are located outside the European Economic Area, we take additional measures and use providers that have accreditations that demonstrate that they provide equivalent safeguards to those in the European Union (such as the US-EU Privacy Shield certificate of compliance that ensures that US providers treat data in accordance with the requirements of European law).

If we are required to do so, we may share certain information when necessary to comply with our legal obligations or in response to official requests from public authorities. Otherwise, we will only share your information with your consent or as necessary to provide you with our services and to run the App features you choose to use.

6. How we protect information.

We take reasonable technical and organizational measures in accordance with industry standards to provide for the protection and security of user information from loss, misuse, unauthorized access or alteration. These security measures include careful selection of our information storage providers, as well as a variety of other measures such as data encryption, firewalls and access controls. To store user information, we use the services of a leading technology provider: Amazon Web Services, a company that has various measures and controls to protect the information stored in its services, as well as various certifications of conformity that accredit it as a provider of guarantees in the protection and security of information.

Although we strive to maintain the security of our systems and services, given that no information system can be completely secure, users should be aware that no company can guarantee absolute security of their information on the Internet. The security and protection of your personal information also depends on you. It is the responsibility of each user to maintain the confidentiality and security of their passwords, account information and devices from unauthorized use by third parties.

7. Conservation period.

We will retain your information for as long as we need it to provide our services to you and you maintain an account with us, until you choose to close your account with us or request deletion of the information. After you close your account with us, we may retain, subject to appropriate legal safeguards, certain personal information for a reasonable period to maintain necessary records as long as we need to retain it to satisfy our legal obligations or to defend against potential claims.

We do not collect or store user location data on our systems. Only if the mobile device has been configured to share location data, we will use this information on a temporary basis only to provide the service or functionality that requires that information. Once the user modifies the configuration of the mobile device, our system will no longer have access to that information.

8. What are your rights.

Information: You have the right to be informed in a clear and transparent manner about how and for what purpose we use your personal information. For this reason, we provide you with detailed and accurate information in this Privacy Policy.
Access and rectification: You have the right to access the personal information we have about you, as well as the right to rectify your data if it is inaccurate or outdated. In some cases, you may be able to do so from your own user account or, otherwise, by contacting us.
Deletion: You can ask us to delete your personal information, for example, when it is no longer needed for the purposes for which it was collected, unless there is a legal obligation to retain it or there are no other legitimate reasons that require its retention.
Object: Under certain circumstances, you may object to our processing of your personal information for certain purposes or processing activities, even if we rely on a legitimate interest in doing so.
Revoke your consent: When we use information on the basis of your consent, you may withdraw your consent at any time. For example, you can withdraw your consent to our use of your data for marketing purposes by clicking on the “unsubscribe” option found in all our marketing communications. From that moment, we will stop sending you commercial communications. The legality of the processing carried out up to that moment will not be affected.
Limitation: Under certain legally established circumstances, you may have the right to request that we limit the processing of your personal information, for example, when you question the accuracy of that information, in which case it may only be retained for the exercise or defense of claims.
Portability: You have the right to request the portability of your data for reuse. This right allows you to receive personal data in a structured, commonly used and machine-readable format and, if technically feasible, to transmit it directly to another data controller indicated by the user.
To exercise any of the above rights, users must contact ICX proving their identity by means of a photocopy of their ID card or equivalent official document and detailing their request, either through our postal address or through our contact email. If you believe that the processing of your personal information is in breach of data protection legislation, you also have the right to lodge a complaint with the data protection authority (in Spain, the Spanish Data Protection Agency, c/ Jorge Juan 6, 28001 Madrid, www.aepd.es). In any case, we would appreciate it if you would first give us the opportunity to resolve any questions or complaints you may have.

9. Modification.

We may modify this Privacy Policy to adapt it to future regulatory changes, as a result of changes in the nature of our services or in the event that we change the way we treat personal information. In such event, we will update the content of the Privacy Policy available on the App and, if the changes are significant, we will notify you of the changes more prominently by means of a notice on the App or by informing you by email. By continuing to actively use our services after we inform you of the changes, you acknowledge and accept the changes. In any case, if required by law, we will ask for your consent.