Privacy Policy

# Privacy Policy — OX Field Services & OX Team

**Effective date:** August 10, 2026

## 1. Who we are

The controller of your personal data is **OXS SERVICES, UNIPESSOAL, LDA**, registered at Rua do Mar, 8, 2825-074 Caparica, Portugal ("OX", "we"). We provide construction and renovation services, mainly in Belgium, and operate the mobile applications **OX Field Services** (for clients) and **OX Team** (for field crews and site managers), as well as the associated web portal.

Privacy contact: **info@oxservices.org**

## 2. What data we collect

**Account data** — name, e-mail address, phone number, profile picture, preferred language and login credentials.

**Project and work data** — photos and videos evidencing construction progress, documents (quotes, contracts, invoices, floor plans), digital signatures, messages and comments, phase and task records.

**Location (OX Team app only)** — the OX Team app collects the device's precise location, **including in the background** (while the app is closed or not in use), **only while the worker has an active work session**. We use it to: track working time at the job site, automatically detect arrival at the site (geofencing), and attach time records to the correct location. The worker's location is visible to their team manager. Background collection only starts after the user sees an in-app explanation and grants the system permission; it can be revoked at any time in the device settings. The OX Field Services app (clients) does **not** collect location.

**Audio (OX Team app only)** — if you use the voice assistant, the microphone records your command, which is converted to text to execute your request. There is no continuous listening.

**Payments (OX Field Services app only)** — payments are processed by Stripe. We do not store card numbers; we only receive payment confirmations and the transaction history linked to your account.

**Technical and diagnostic data** — device identifiers for push notifications, crash logs and diagnostic data, used to keep the apps running and fix problems.

## 3. Why we use the data and on what legal basis

- **Performance of the contract** — managing projects, quotes, crews, payments and communication between client and crew.
- **Consent** — background location (OX Team) and voice recording; you can withdraw it at any time.
- **Legitimate interest** — account security, fraud prevention, and improving the stability of the apps (crash diagnostics).
- **Legal obligation** — retention of invoices and accounting records required by law.

## 4. Who we share data with

We never sell your data. We show no advertising. We share only with:

- **Your own crew/client** — project information is visible to the people involved in that project (for example, a worker's location during an active session is visible to their manager; progress photos are visible to the project's client).
- **Technical processors** acting on our behalf under data-protection agreements: Supabase (database and file storage), Stripe (payments), Google Firebase (push notifications and crash reporting), Resend (e-mail delivery) and OpenAI (speech-to-text and assistant features).
- **Authorities**, where required by law.

Some processors may process data outside the European Economic Area; in those cases we apply the safeguards provided for by the GDPR (European Commission standard contractual clauses).

## 5. How long we keep data

We keep data while your account is active and the project requires it. After account closure we delete or anonymise personal data, with two exceptions: documents of fiscal relevance (invoices, accounting records), which the law requires us to keep for up to 10 years, and data needed to establish or defend legal claims.

## 6. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, object to processing, and to data portability. You can exercise them:

- **In the app** — Profile → Privacy & Security → "Delete my account" (and other data requests);
- **By e-mail** — write to info@oxservices.org from the address linked to your account;
- **On the web** — instructions at https://api.oxfieldservices.org/legal/delete-account

We respond within 30 days at the latest. You also have the right to lodge a complaint with a supervisory authority: the CNPD in Portugal (www.cnpd.pt) or the Belgian Data Protection Authority (www.autoriteprotectiondonnees.be / www.gegevensbeschermingsautoriteit.be).

## 7. Security

We use encryption in transit (TLS), role- and organisation-based access control, and restricted storage access policies. No system is 100% secure, but we handle incidents in accordance with legal notification obligations.

## 8. Children

Our apps are intended for professional use and for clients of construction services. They are not directed at children under 16 and we do not knowingly collect data from minors.

## 9. Changes to this policy

If we make material changes to this policy, we will notify you in the app or by e-mail before the change takes effect. The current version is always available at https://api.oxfieldservices.org/legal/privacy

## 10. Contact

OXS SERVICES, UNIPESSOAL, LDA · Rua do Mar, 8, 2825-074 Caparica, Portugal · info@oxservices.org