Introduction
This Privacy Policy describes how Cedrus ("we", "us", or "our") collects, uses, and shares information about you when you use our services. Effective Date: June 11, 2026. Version: a0c6a150.
If you have questions about this policy, please contact us at [email protected].
Information We Collect
We collect the following categories of personal data for the purposes described below. Under GDPR Article 6, we rely on the lawful bases shown for each processing purpose:
| Category | Fields collected | Purpose | Lawful basis |
|---|---|---|---|
| Account Information | Name, Email address, Username, Profile picture, Role, Organisation, Language preference | Authenticate users, manage accounts, apply permissions, and personalize the application. | Performance of a contract (Article 6(1)(b)) |
| Contact Information | First name, Last name, Job function, Phone number | Manage organisation users, support collaboration, and contact users about the service. | Performance of a contract (Article 6(1)(b)) |
| Authentication Data | Session tokens, JWT access tokens, Cognito identifier, Cognito groups | Secure sessions, issue access tokens, prevent unauthorized access, and maintain account security. | Performance of a contract (Article 6(1)(b)) |
| Building And Asset Data | Building names, Building addresses, Geographic coordinates, Building geometry, Parcel and public building identifiers, Asset groups | Create building inventories, map assets, run portfolio analysis, and display location-based building insights. | Performance of a contract (Article 6(1)(b)) |
| Energy And Utility Data | Electricity consumption, Gas consumption, Metering point identifiers, Energy management data sources | Retrieve and analyze utility consumption, monitor energy performance, and power energy-management features. | Performance of a contract (Article 6(1)(b)) |
| Building Technical Data | Building surfaces, Usage types, Envelope characteristics, Equipment data, Renovation measures, Scenario assumptions | Model performance, calculate uncertainty, evaluate resilience and ESG indicators, and generate retrofit scenarios. | Performance of a contract (Article 6(1)(b)) |
| Uploaded Documents | Inventory files, Building documents, Energy data files, Generated reports | Store source documents, process building information, analyze files, and generate PDF exports. | Performance of a contract (Article 6(1)(b)) |
| Usage And Diagnostics Data | Page views, Feature usage, Session activity, Error reports, Device and browser information | Measure product usage, improve reliability, diagnose errors, and protect the service. | Legitimate interests (Article 6(1)(f)) |
Right to Withdraw Consent
Where we rely on your consent for any processing of your personal data, you have the right to withdraw that consent at any time by contacting us at [email protected]. Withdrawing your consent does not affect the lawfulness of any processing we carried out before you withdrew it. Where consent is required to provide a particular feature or service, withdrawing it may mean we are no longer able to offer that feature or service.
Data Retention
We retain your data for the following periods:
| Category | Retention period |
|---|---|
| Account Information | Until account deletion |
| Contact Information | Until account deletion |
| Authentication Data | Until session expiry |
| Building And Asset Data | Until account deletion |
| Energy And Utility Data | Until account deletion |
| Building Technical Data | Until account deletion |
| Uploaded Documents | Until account deletion |
| Usage And Diagnostics Data | 1 year |
Whether You Are Required to Provide This Data
For each category of personal data we collect, we set out below whether you are required to provide it — by law, under our contract with you, or as a precondition to entering into a contract — or whether provision is voluntary, together with the consequences of failing to provide it.
| Category | Requirement | Consequences |
|---|---|---|
| Account Information | Required under our contract with you | We cannot provide authenticated access without this information. |
| Contact Information | Required under our contract with you | Some account administration and support features may not work without this information. |
| Authentication Data | Required to enter into a contract | You cannot sign in or use protected features without authentication data. |
| Building And Asset Data | Required under our contract with you | The platform cannot analyze buildings or portfolios without asset data. |
| Energy And Utility Data | Required under our contract with you | Energy analysis and monitoring features require utility and metering data. |
| Building Technical Data | Required under our contract with you | Technical analysis features require building characteristics and scenario data. |
| Uploaded Documents | Voluntary | If you do not upload documents, document analysis and export features may be limited. |
| Usage And Diagnostics Data | Voluntary | You can use the service without optional analytics, but diagnostics help us maintain reliability. |
Third-Party Services
We share data with the following third-party services:
| Service | Purpose | Privacy policy |
|---|---|---|
| AWS Cognito | Authenticate users and provide identity profile attributes. | View |
| Amazon Web Services | Host backend services, store application data, and process building and user information. | View |
| PostHog | Provide product analytics, exception capture, and usage diagnostics. | View |
| Tolgee | Load application translations and manage localization. | View |
| Cloudflare | Generate PDF reports using browser rendering services. | View |
| Enedis | Retrieve authorized electricity data for energy-management features. | View |
| GRDF | Retrieve authorized gas data for energy-management features. | View |
| OpenStreetMap Nominatim | Search and reverse-geocode building addresses for map-based inventory workflows. | View |
| MapLibre and Cedrus map server | Display maps, building tiles, and geographic building data. |
Your Rights
You have the following rights regarding your personal data:
- Right to access your personal data
- Right to correct inaccurate data
- Right to request deletion of your data
- Right to receive your data in a portable format
- Right to restrict how we process your data
- Right to object to processing
GDPR Supplemental Disclosures
This section applies to individuals in the European Economic Area (EEA) under the General Data Protection Regulation (GDPR).
Data Controller: Cedrus Solutions, France
We have not appointed a Data Protection Officer. Our processing activities do not meet the thresholds in GDPR Article 37(1) that would require one. For any questions about this policy or how we handle your personal data, please use the contact details above.
You have the right to lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or place of the alleged infringement. A list of EEA supervisory authorities is available at edpb.europa.eu/about-edpb/about-edpb/members_en.
Where we transfer your personal data outside the EEA, we rely on one or more of the safeguards permitted under Chapter V of the GDPR: (a) transfers to countries the European Commission has determined provide an adequate level of data protection (the current list is published at commission.europa.eu/.../adequacy-decisions_en); (b) Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46(2)(c); and (c) Binding Corporate Rules approved under Article 47 where applicable. You may request further information about the specific safeguards applied to a particular transfer by contacting us at [email protected].
UK Privacy Rights (UK-GDPR)
This section applies to individuals in the United Kingdom under the UK General Data Protection Regulation (UK-GDPR), as tailored by the Data Protection Act 2018.
Data Controller: Cedrus Solutions, France
We have not appointed a Data Protection Officer. Our processing activities do not meet the thresholds in GDPR Article 37(1) that would require one. For any questions about this policy or how we handle your personal data, please use the contact details above.
The supervisory authority for data protection in the UK is the Information Commissioner's Office (ICO). If you believe we have not handled your data in accordance with UK data protection law, you have the right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint.
If we transfer your personal data outside the United Kingdom, we ensure appropriate safeguards are in place in accordance with the UK-GDPR, including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses where applicable.
Contact Us
Contact us:
- Legal Name: Cedrus Solutions
- Address: France
- Email: [email protected]
- Website: https://dashboard.cedrus.solutions