Privacy Policy

1. Introduction

POWERENT Ltd. ("we", "us", "our") operates the Helionix platform – a software-as-a-service solution for construction project management, workforce management, and task coordination.

We respect your privacy and are committed to protecting your personal data in accordance with:

• General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679 of the European Parliament and of the Council
• Bulgarian Personal Data Protection Act (ЗЗЛД)

This Privacy Policy explains what personal data we collect, the purposes for which we process it, and your rights as a data subject.

2. Who is the data controller?

3. What personal data do we collect?

3.1 For Organizations (B2B Clients)

• Legal entity name
• Registered business address

3.2 For system users

• First and last name
• Email address
• Position/role in organization
• Password (hashed, not stored in plain text)

3.3 For construction site workers

• First and last name
• Phone number
• Specialty/profession
• Hourly rate

3.4 Platform Usage Data

• Working hours: clock-in and clock-out timestamps (check-in/check-out)
• Geolocation data: collected ONLY at the time of check-in/check-out for the purpose of verifying the worker's presence at the designated work site. GPS coordinates are not used for continuous tracking and are not stored as a standard server attendance record – they are processed for validation and may be held temporarily on the device or pending synchronization in offline mode until validation or cleanup is completed.
• Device identifier: An encrypted unique identifier used to associate one worker with one device
• IP address: Logged in audit records for security and action tracking purposes

4. Why do we process your data?

How We Use Your Data

We process your personal data for the following purposes:

• Project Management – creation and tracking of construction projects, tasks, and phases
• Time Tracking – recording check-in/check-out times to calculate worked hours and wages
• GPS Location Validation – verifying that workers are at the correct work site at check-in/check-out
• Security and Fraud Prevention – device binding, IP logging, and audit trails to prevent unauthorized access
• Communication – sending service notifications, system alerts, and important updates
• Billing and payments – subscription management, payment status, invoices, tax/VAT handling, and billing support. Payment card data is handled by Stripe and is not stored by Helionix.
• Analytics and Improvement – aggregated or technical telemetry used to improve platform performance only when the relevant analytics/performance feature is enabled.

How We Protect Your Data

We implement industry-standard security measures to protect your personal data:

Technical Measures

• HTTPS/TLS – all data in transit is encrypted using TLS 1.3
• Password Hashing – passwords are hashed using bcrypt with salting
• Data at Rest Encryption – database encryption using AES-256
• Row Level Security (RLS) – strict tenant isolation in the database
• Secure Cookies – HttpOnly, Secure, SameSite attributes on all cookies
• Rate Limiting – protection against brute-force and DDoS attacks

Organizational Measures

• Access Control – role-based access control (RBAC) with least privilege principle
• Audit Logging – all sensitive operations are logged for accountability
• Regular Backups – automated daily backups with encryption
• Incident Response – documented procedures for security incident handling

5. Who do we share data with?

We DO NOT sell, rent, or trade your personal data. We share personal data only with trusted providers that are necessary to operate, secure, bill, and support the Helionix platform:

Subprocessor updates: The current Subprocessor List is available at /en/subprocessors. We will provide appropriate notice before material additions or replacements of active subprocessors where required by the DPA or applicable law.

List last updated: 15 May 2026

6. Your rights

Under the GDPR, you have the following rights with respect to your personal data:

• Right of Access (Art. 15) – to obtain a copy of your personal data
• Right to Rectification (Art. 16) – to correct inaccurate or incomplete data
• Right to Erasure (Art. 17) – "Right to be Forgotten"
• Right to Data Portability (Art. 20) – to receive your data in a structured, machine-readable format (JSON/CSV)
• Right to Object (Art. 21) – to object to certain types of processing

7. Cookies

By default, and without optional cookie-banner permission, we use only strictly necessary cookies required for the platform to function:

Note: Consent is not required for strictly necessary cookies pursuant to GDPR Recital 30 and the ePrivacy Directive.

If Google reCAPTCHA or analytics/performance telemetry is enabled, it is loaded only after cookie-banner permission, and additional browser, device, interaction, IP, or performance signals may be processed by the relevant provider as described in the Subprocessor List and applicable provider terms.

Data Retention Periods

We retain personal data only for as long as necessary for the purposes set out in this policy, in compliance with GDPR Article 5(1)(e) - Storage Limitation Principle:

After the retention period expires, data is either securely deleted or anonymized in accordance with our data retention policies.

8. Contact