Data protection policy
FunBIM application (app.funbim.com, iOS and Android). Last updated: 18 September 2026. This English version is provided for convenience; the French version prevails.
This policy explains which personal data is processed when a company uses the FunBIM application to track its construction sites, why, by whom, for how long, and what the rights of the people concerned are. It complements the privacy policy of the funbim.com website, which covers website visitors, and article 14 of the General Terms of Sale, which sets out FunBIM’s contractual commitments.
1. Who is responsible for what
The application is published by FUNBIM, a French simplified joint-stock company (SAS) with a share capital of €1,241, registered with the Paris Trade and Companies Register under number 833 433 725, whose registered office is at 17 avenue d'Eylau, 75016 Paris, France, reachable at contact@funbim.com or on +33 1 89 70 38 08. For any question about personal data, write to this address with the subject “Personal data”.
Two situations coexist in the application:
- Project data (drawings, documents, observations, forms, reports, photos, signatures, accounts of invited users) is uploaded to FunBIM by the customer company, for its own sites. The customer is the data controller. FunBIM acts as a processor, within the meaning of article 28 of the GDPR, on the customer’s instructions, under the conditions of article 14 of the General Terms of Sale.
- Account and service data (logins, billing, support, security, technical logs) is processed by FunBIM to provide and secure the service. FunBIM is the data controller for it.
2. The data processed
| Category | Examples | Source |
|---|---|---|
| User account | First name, surname, e-mail, phone, company, job title, role in the project, login and password (stored hashed), preferences | Entered by the user or by the customer’s administrator who invites them |
| Project data | Drawings and documents, observations and punch list items, quality check forms, progress, site reports, comments, action history (who did what and when) | Uploaded by the customer and its users |
| Site photos | Photos attached to observations, forms and reports. They may show identifiable people present on site | Taken or imported by users |
| Geolocation | GPS position attached to a photo or an observation, when the user has allowed the app to use the device’s location | User’s device, with their permission |
| Voice dictation | Audio recording transcribed into text to create an observation. The recording is kept in the project, attached to the observation with its transcription | Device microphone, with the user’s permission |
| Electronic signatures | Handwritten signature drawn on screen, applied to reports and minutes, with the signatory’s name, date and time | Entered by the signatory |
| Billing | Company name, address, billing contact details, subscription and payment history. Bank details are entered with our payment provider and never pass through FunBIM | Entered by the customer when subscribing |
| Support | Exchanges by e-mail, chat or phone with the FunBIM team, screenshots sent | Provided by the user |
| Technical data | IP address, device and browser type, app version, connection timestamps, error logs | Collected automatically through use |
FunBIM asks for no so-called sensitive data. Photos, geolocation and voice dictation are optional: the application works without the corresponding device permissions, which can be withdrawn at any time in the device settings.
3. Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Provide the service: create accounts, host and display projects, sync devices, generate reports | Performance of the contract (General Terms of Sale) |
| Invoice subscriptions and keep accounts | Performance of the contract and legal obligations |
| Answer support requests and help with onboarding | Performance of the contract |
| Secure the service: authentication, detection of abnormal access, logging, backups | Legitimate interest of FunBIM and its customers in the security of the service, and legal obligations |
| Improve the application from aggregated usage statistics | Legitimate interest, without individual profiling |
| Inform users about new features and service maintenance | Legitimate interest, with the option to unsubscribe from e-mails not essential to the service |
| Geolocation and voice dictation | Permission granted on the device, which can be withdrawn at any time |
For project data, the customer defines the purposes and legal basis of its processing, generally the performance of its works contracts and compliance with its quality and safety obligations. It is up to the customer to inform its employees, subcontractors and partners whose data appears in its projects, including people visible in photos.
4. Our commitments as a processor
For project data, FunBIM undertakes to:
- process it only to host and run the service, on the customer’s instructions, never for its own account or to sell it;
- guarantee its confidentiality and give access only to the team members who need it, who are bound by secrecy;
- help the customer respond to data subjects’ requests to exercise their rights, and forward without delay those received directly;
- inform the customer of any personal data breach within 72 hours of discovering it, with the information needed to notify the supervisory authority if necessary;
- inform the customer before any change of sub-processor;
- keep a record of the processing carried out on its behalf and provide the documentation needed for its audits;
- return or delete the data at the end of the contract, under the conditions of section 8 below.
5. Who hosts and who receives the data
Data is processed by the FunBIM team and by service providers who act on our instructions and are bound by contract to the same confidentiality and security rules. They fall into the following categories:
- Cloud hosting of the database, files (drawings, photos, documents) and service e-mails, in the European Union: database in Belgium, files in France;
- Delivery of the web interface of the application (app.funbim.com), with no storage of project data;
- Subscription and payment management;
- Support and customer relations: chat, e-mails, help centre and tickets;
- Transactional e-mails: invitations, notifications;
- App stores for the distribution of the mobile apps, with no access to project data.
The named list of these providers, with their role and place of processing, is given to customers on request at contact@funbim.com, and customers are informed before any change of provider. FunBIM does not sell data and does not pass it on to any other third party, except where required by law or requested by a competent authority.
6. Transfers outside the European Union
The providers for support and customer relations, billing and transactional e-mails process data in the United States. These transfers rely on the EU-US Data Privacy Framework, for providers certified under it, or on the European Commission’s standard contractual clauses. Project data itself, drawings, photos, documents and observations, is hosted in the European Union.
7. Security
- Exchanges between devices, the application and the servers are encrypted (HTTPS/TLS). Data is encrypted at rest on the hosting servers.
- Passwords are never stored in clear text.
- Regular backups are made; they are kept for 30 days for the database and 5 days for files.
- Access to production data is restricted to authorised members of the technical team, protected by strong authentication and logged.
- Development and production environments are separate.
The customer remains responsible for managing its users: choosing strong passwords, removing access for people who leave the project, checking the rights granted to read-only guests.
8. Retention periods
| Data | Retention |
|---|---|
| Project data | For the whole duration of the subscription. After the end of the contract, it is kept and can be restored as long as the customer does not request its deletion, so that the customer can recover its sites or resume the service. It is deleted within 30 days of the customer’s written request, and in any event 3 years after the end of the contract. |
| A user’s account | As long as the account is active. Deleted at the request of the user or the customer’s administrator, except for project data authored by the user, which stays attached to the project under their name for site traceability. |
| Billing and accounting records | 10 years from the end of the financial year, legal obligation. |
| Support exchanges | 3 years after the last exchange. |
| Technical and connection logs | 30 days. |
| Backups | Overwritten on a rolling basis: 30 days for the database, 5 days for files. Deleted data disappears from backups at the end of that period. |
9. Your rights
Anyone whose data appears in the application may request access to their data, its rectification, its erasure, the restriction of its processing, its portability, or object to processing based on legitimate interest.
- For project data (you are an employee, subcontractor or partner of a company that uses FunBIM): contact that company first, as the data controller. If you write to us directly, we forward your request to the company and help it respond.
- For your account and service data: write to contact@funbim.com with the subject “Personal data”. We reply within one month.
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL: www.cnil.fr.
10. Photos, location and voice: what you should know
- Photos: they document the state of the site. The customer must inform the people present on its sites that they may appear in photos added to the project file, and avoid photographing people when it is not necessary.
- GPS position: it is only recorded if the user has allowed location on their device, and is used to place a photo or an observation on the site. It does not allow users’ movements to be tracked.
- Voice dictation: speech is transcribed into text to fill in an observation. The audio recording is kept in the project with its transcription, like a photo attached to the observation, and deleted with it. Users should avoid including remarks about third parties that are not useful to the site.
11. Minors
The application is intended for construction professionals. It is not intended for people under 18 and we do not knowingly collect their data.
12. Changes
This policy may change with the service and the regulations. The date at the top of the page indicates the latest version. Significant changes are announced in the application or by e-mail to customers’ administrators.