Privacy Statement

This Privacy Statement describes how Bimdoc AB ("Bimdoc", "we", "us") processes personal data in connection with the Bimdoc Portal application (the "Service"). Bimdoc is the data controller for personal data relating to user accounts within the Service. For Customer Data submitted by an organization's users, Bimdoc acts as data processor on behalf of that organization.

1. Authentication via Microsoft Entra ID

Sign-in to the Service is handled exclusively through Microsoft Entra ID (formerly Azure AD). Bimdoc never receives, stores, or processes user passwords. When you sign in, your Entra ID tenant returns a verified identity claim that we associate with your user record in the Service.

2. Personal data we process

• Identity claims from Microsoft Entra ID: object identifier (oid), tenant identifier (tid), display name, email address (UPN), and preferred username.
• Profile and role data: the organization(s) you belong to within the Service, your assigned role, and language preference.
• Usage telemetry: sign-in events, IP address, browser/user-agent, and application activity logs, used for security, debugging, and product improvement.
• Content you create: objects, documents, drawings, comments, and any other Customer Data you contribute through the Service.

3. Purposes and legal bases

• To provide the Service to you and your organization (contract / legitimate interest).
• To secure the Service against unauthorized access (legitimate interest, legal obligation).
• To comply with applicable laws and respond to lawful requests (legal obligation).
• To improve and develop the Service (legitimate interest, with anonymized data where possible).

4. Sub-processors and hosting

The Service is hosted on infrastructure operated by Bimdoc AB and on services provided by Microsoft Corporation (Microsoft Azure, Microsoft Entra ID). Personal data is stored in the EU unless otherwise agreed. Microsoft's data protection commitments apply to data processed through Entra ID.

5. Data sharing

We do not sell personal data. We share personal data only with (a) sub-processors required to operate the Service, (b) your own organization's administrators, and (c) authorities where required by law.

6. Retention

Personal data is retained for as long as your account is active or as required for the purposes described above. Usage logs are typically retained for up to 12 months. Customer Data is retained according to the agreement with your organization.

7. Your rights (GDPR)

If you are in the European Economic Area, you have the right to access, rectify, erase, restrict, object to, or port your personal data, and to lodge a complaint with the Swedish Authority for Privacy Protection (IMY). To exercise these rights, contact us at info@bimdoc.se. For Customer Data, please contact your organization's administrator.

8. Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, role-based access control, and audit logging. Access to personal data within Bimdoc is restricted on a need-to-know basis.

9. Changes to this Statement

We may update this Privacy Statement from time to time. The "Last updated" date at the top indicates when the latest revision was published.

10. Contact

The data controller is Bimdoc AB, Storgatan 29D, 703 63 Örebro, Sweden. Contact: info@bimdoc.se · www.bimdoc.se