Last updated: 11 March 2026
DSJ Holdings MB ("CONCAM", "we", "us", "our") is the data controller responsible for your personal data processed through the CONCAM platform.
This Privacy Policy applies to all personal data we process in connection with the CONCAM construction site monitoring platform (the "Service"). We process personal data in compliance with:
When you create an account or are invited to the platform, we collect your name, email address, and organisation membership. Authentication is handled by our identity management provider (see Section 6).
We may log server-side events such as API request timestamps, IP addresses, and error traces for the purposes of security monitoring and debugging. These are not used for profiling.
Cameras installed on construction sites capture images of the site at configured intervals. These images may incidentally contain images of workers or other individuals on site. Site operators are responsible for displaying appropriate notices on-site in accordance with applicable national law. Imagery is stored on EU-based cloud storage infrastructure.
We use strictly necessary cookies for session management and authentication. See our Cookie Policy for details.
| Processing Activity | Legal Basis (GDPR Art. 6) |
|---|---|
| User authentication and account management | Art. 6(1)(b) — performance of a contract |
| Delivery of the monitoring platform to clients | Art. 6(1)(b) — performance of a contract |
| Security logging and abuse prevention | Art. 6(1)(f) — legitimate interests |
| Compliance with legal obligations | Art. 6(1)(c) — legal obligation |
| Site photography (construction documentation) | Art. 6(1)(b) or 6(1)(f) — contract / legitimate interests of the site operator |
| Processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Identity Management Provider | Authentication & user management | USA (EU data region) | Standard Contractual Clauses (SCCs) |
| EU Cloud Infrastructure Provider | Cloud storage for site imagery & platform hosting | Germany (EU) | EU jurisdiction — GDPR applies directly |
We do not sell, rent, or share your personal data with any other third parties for marketing purposes.
Some personal data (account and authentication data) is processed by our identity management provider, headquartered outside the EU. These transfers are subject to Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to GDPR Article 46(2)(c). All site imagery and metadata are stored exclusively on EU-based cloud infrastructure.
Under the GDPR and applicable national laws, you have the following rights:
To exercise any of these rights, including data access requests, data export, or account deletion, contact us at info@dsj.lt. All requests are handled manually by our team and we will respond within 30 days in accordance with GDPR Article 12.
If you believe your personal data is being processed in breach of applicable law, you have the right to lodge a complaint with the supervisory authority in your country of residence. Our primary supervisory authority is:
State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija — VDAI)
https://vdai.lrv.ltResidents of other EEA/EU countries may also lodge complaints with their local supervisory authority (e.g., IMY in Sweden, Datatilsynet in Norway/Denmark, Tietosuojavaltuutettu in Finland, Datu valsts inspekcija in Latvia, AKI in Estonia, UODO in Poland).
We implement appropriate technical and organisational measures to protect personal data, including encrypted data transfer, server-side authentication, role-based access control, secured camera connections, and firewall hardening on all infrastructure.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, in accordance with GDPR Article 33. Where the breach is likely to result in a high risk to your rights, we will also notify you directly without undue delay, as required by Article 34.
We may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email or via a notice in the client portal at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
For any privacy-related queries, please contact our data protection contact at: info@dsj.lt