Workvado Privacy Notice

Responsible organization and privacy contact

Litequo LLC, Wyoming, United States, controls Workvado account, security, marketplace and support processing. Write to the Privacy Officer / Litequo LLC management at contact@workvado.com or the business correspondence address displayed with this notice. A business supplying staff, customer or project records may be the separate controller; we assist and route a request appropriately without disclosing another organization's records. The business-processing terms appear in the Terms of Service.

Information, sources and purposes

From you, participating organizations and people you interact with, we receive account/contact identifiers, credentials, profile and work details, skills, rates, addresses, project/customer/staff and financial records, messages and uploaded files as used. For the public company directory we also collect business information from public records, as described below. We receive IP, session, request and security-event metadata from service use. Passwords are hashed. Uploaded text, images and documents can contain sensitive information or metadata; do not provide unnecessary health, national-ID, biometric or other sensitive data. Some restricted records can contain an identifier fragment, so avoid submitting one unless necessary and lawful.

Essential use and optional choices

We use account data for authentication and access; profile/location/work data for requested matching; business records/files for your workflows and sharing; communications for service delivery and support; and logs/receipts for security, rights, disputes and legal duties. Essential information is required for the corresponding feature. Optional analytics, used only with your consent, measures which screens are used so we can improve the service; optional marketing is not an active purpose. Declining either does not prevent core access. A notice acknowledgement is not consent to every use. New sensitive or optional purposes need their own lawful basis and any required separate consent.

Who can see information

Published marketplace information is visible within the relevant marketplace audience. Contractor business addresses may be displayed; worker location is normally town-level. Restricted contact/identity records and files have their own access rules. Your workspace members, intended counterparties and shared-project recipients receive selected content according to their permissions. Linked external sites, images, map searches or assistants/integrations you authorize can receive data or network metadata under their own practices; connecting an assistant is not automatic AI processing by Workvado.

Public company directory, tenders and news

Workvado publishes a directory of construction companies in the United States, Canada and Mexico, public tender summaries and construction news. These pages are open to everyone and can be indexed by search engines.

• Profiles added by Workvado are compiled from public records, such as licence boards, business registries and government contractor registers, and from the company's own public website. They cite those records and hold business information: name, trades, place, business address, phone, website and licence numbers. An email address, when present, is shown only to signed-in members.
• We publish these profiles so that customers and businesses can find construction companies and so that each company can claim and manage its own profile. We do not sell them or use them for advertising.
• A company that claims its profile or lists itself is reviewed by an administrator. The managing account can edit the profile, show it to signed-in members only, take it out of the directory or stop managing it. A profile nobody manages remains public.
• Anyone a profile identifies, including a sole proprietor, can ask us to correct, limit or remove it through /privacy/requests or contact@workvado.com, without an account. We review the request against the source record and explain the outcome. Search engines and other sites may keep copies until they refresh them.
• Claims keep the claimant's account, stated role and message and the administrator's decision and reason. Every change to a profile is recorded with who made it and when.
• Your tender pipeline, with its stages and private notes, and your saved stories belong to your account only. They are not shared with a company you select and are included in the Settings download.
• News stories report on events and organizations from the sources they cite. To ask for a correction, follow the editorial policy at /editorial-policy.

Device location is optional

If you choose the device-location action, browser permission can allow coordinates, potentially precise, to be processed in your browser to suggest a nearby town using our locality data. You can enter a town manually instead and change browser permission. The normal form saves the chosen locality; do not submit a precise home location in public fields. We do not claim that every uploaded file or custom API value is automatically stripped of precise location.

Providers and processing outside your country

Railway hosts the application, database and files in Amsterdam, Netherlands; provider operations or lawful access can also involve the United States. Brevo handles outgoing/incoming email, with stated database hosting in France, Germany and Belgium; relevant mail content and attachments are also stored in Workvado's Railway infrastructure. We disclose to authorized service providers for these functions, intended recipients, and authorities where legally required; any independent transfer requiring consent is addressed separately. Foreign law may permit authority access. Ask the privacy contact for written provider-country practices, purposes and safeguards; EU hosting does not mean all processing or access stays exclusively in the EU. If you allow analytics, Google (Google LLC in the United States; Google Ireland Limited for the EEA, the UK and Switzerland) processes screen-visit events for us as a service provider under its analytics data-processing terms, and can do so in the United States and other countries where it operates. Workvado sends a screen name instead of the page address and never sends record contents, names, account or workspace identifiers or search terms. Google signals, advertising features and data sharing with Google are off, Google states that Google Analytics 4 does not log or store IP addresses, and event data is kept for 2 months.

Retention, deletion and backups

Account/profile data supports the account; business records and communications support the relevant service, participant obligations and disputes; security logs, rights cases and legal receipts support security, evidence and legal duties. Retention depends on that category's purpose, legal requirements, sensitivity, active disputes and justified preservation, rather than one unlimited period. Deletion requests receive a human assessment and a reasoned outcome; some records belonging to others or required by law can remain with limited use. Provider copies and protected backups are not erased instantly. Ask for the applicable category's retention basis and any restriction; a request flag or download is not completed erasure. A directory profile stays published while its business information is current and lawful to show; a withdrawn or removed profile is no longer displayed, and its change history is kept for accountability.

Security and incidents

We use encrypted connections, password hashes and role/workspace-scoped access. These measures do not guarantee absolute security. We assess suspected privacy incidents, take proportionate protective action and provide notifications and records required by the applicable law. Report a suspected incident promptly to the privacy contact without including passwords or unnecessary sensitive evidence.

Make a request without creating an account

Use /privacy/requests or email contact@workvado.com for access, correction, deletion/cancellation, portability, restriction, objection, consent withdrawal or sale/targeted-ad opt-out as applicable. Give a reply address, relevant country/region, request type and enough non-sensitive detail to locate the records; explain proposed corrections. Email verification establishes contact control, not every identity fact. We verify identity/authority proportionately through a suitable follow-up, not by asking for identity documents in the public form. Settings provides a bounded account download; fuller access, communications, recipients, company-held or non-account information may need assisted handling and redaction. Submission is not immediate automated fulfillment.

Responses, representatives and complaints

We respond within the applicable legal period, explain a refusal or partial outcome and notify any lawful extension with reasons; identity checks do not automatically restart the clock. A representative may use the same routes with proportionate authorization; special opt-out rules may not require identity verification. To challenge a decision, select appeal/review or email with the case reference and reasons; we provide a reasoned review under the applicable appeal period. You may also contact the competent regulator or state Attorney General. We do not unlawfully discriminate for exercising rights. Any lawful fee for excessive requests is explained before charging; ordinary electronic requests are generally free. Withdrawal does not undo earlier lawful processing and can affect a feature needing that information, subject to legal limits.

United States: state rights and signals

State rights depend on residence, context, activity, thresholds and exemptions; an employment record and a consumer profile need not have identical coverage.

• Applicable rights can include confirmation/access, correction, deletion, portable copies, sale/targeted-ad/significant-profiling opt-out, sensitive-data choices and appeal.
• The regional guide distinguishes state laws and effective dates; absence of an omnibus law does not remove consumer/security duties.
• Most covered ordinary requests allow 45 days plus a justified 45-day extension; Iowa starts at 90 days and Florida has a 15-day extension.
• Appeal periods differ, including 45 days in Colorado, Minnesota, New Jersey and Oregon and often 60 elsewhere; lawful extensions are state-specific.
• Nevada's covered no-sale requests use 60 days with a possible 30-day extension.
• We do not sell data, share it for cross-context advertising or run targeted-ad trackers.
• GPC keeps optional analytics and marketing choices off here; there is no sale or advertising use to stop.
• Legacy Do Not Track does not change essential processing, and we do not authorize third-party cross-site advertising tracking through Workvado.
• We do not deploy third-party cross-site advertising tracking. Optional Google Analytics, when you allow it, uses first-party workvado.com cookies only for our own measurement. Operators of externally hosted images or destinations may receive identifying network data when content loads or a link opens, and may associate it with activity elsewhere under their own notices.

California supplement

CalOPPA website transparency duties are separate from CCPA/CPRA coverage thresholds.

• When CCPA applies, you may request categories/specific information and sources, purposes, recipient categories, correction, deletion and a portable copy, and exercise applicable sale/sharing opt-out and sensitive-use limitation without unlawful retaliation.
• The categories, purposes, sources, recipients and retention criteria above explain our processing; ask for the relevant period and disclosure detail.
• We use no sale/sharing advertising model or data-based financial incentive.
• Covered know/correct/delete requests are acknowledged within 10 business days and answered within 45 calendar days, with a lawful 45-day extension.
• Covered opt-out/limitation requests are acted on as soon as feasible within 15 business days; qualifying GPC signals must not be overridden.
• Necessary service uses and legal exceptions have their own limits.
• A new account is not required; agents can provide proportionate authority.
• CCPA has no universal ordinary-request internal appeal requirement, but our review/contact route remains available.
• Public choices at /cookies require no email or account.
• A sale/sharing opt-out does not require identity proof; you may also contact us without it.
• The request form’s reply-email check for case communication or private fulfillment is not a condition for a browser opt-out.

Canada: all provinces and territories

PIPEDA can apply to commercial activity and cross-border flows; Québec, Alberta and British Columbia have their own covered private-sector rules. Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, Saskatchewan and Northwest Territories, Nunavut and Yukon also have relevant federal/provincial/territorial or sector-specific protections. A public-sector or health statute does not automatically govern every marketplace record. Applicable rights include information about use/disclosure, access, correction, consent withdrawal and complaints, and portability/deletion where provided. PIPEDA access is normally 30 calendar days, with only lawful extension grounds and notice; BC PIPA normally uses 30 business days. Contact our privacy officer first or the Office of the Privacy Commissioner of Canada / competent provincial commissioner; a complaint does not require a Workvado account.

Québec

For covered processing, access, correction and applicable computerized-data portability normally receive a response within 30 days. Portability does not cover every inferred or third-party-derived record. You may ask about applicable cessation of dissemination/de-indexing rights and any exclusively automated decision affecting you. Consent, where required, is specific and separate; sensitive information can need express consent. Information can be processed outside Québec in the countries described above. Questions or complaints go to the Privacy Officer / Litequo LLC management; you can seek recourse with the Commission d'accès à l'information.

Alberta and overseas providers

For covered Alberta PIPA access, the ordinary response period is 45 calendar days, subject to lawful extensions. Railway processes hosting/database/files in the Netherlands with possible US provider operations; Brevo's stated email database countries are France, Germany and Belgium. The functions and possible foreign lawful access are described above. To obtain written overseas-provider practices and ask about collection, use or disclosure outside Canada, contact the Privacy Officer / Litequo LLC management at contact@workvado.com. Complaints can be brought to Alberta's OIPC. BC requests follow BC PIPA and its OIPC route, not Alberta's deadline. If you allow analytics, Google processes screen-visit events in the United States or other countries where it operates, as described above.

Mexico: ARCO and privacy notice

Litequo LLC and the displayed correspondence address identify the responsible organization.

• Account, service, security, business-record and communications purposes above are primary; optional marketing is separate and may be refused without denying the core service.
• Do not supply unnecessary sensitive data.
• Financial/property and sensitive information need the legally required express or written consent unless a specific legal exception applies; agreeing to Terms is not a blanket authorization.
• Use the request routes for ARCO (access, rectification, cancellation, opposition), limits on use/disclosure and consent revocation.
• You or a representative supply contact details, record-locating information and, for rectification, proposed changes/support; identity/authority is checked proportionately through follow-up.
• Where the federal private-sector law applies, the decision is communicated within 20 business days from receipt and an accepted request implemented within the following 15 business days; each period can be extended once by an equal period only with lawful justification.
• Electronic access is normally free; a partial/refused outcome gives reasons.
• Independent recipient transfers need notice/consent or a specific legal exception; processor handling is distinct.
• You may seek rights protection before the Secretaría Anticorrupción y Buen Gobierno, ordinarily within 15 business days after a response, or after the response deadline if none is received.
• This notice applies across Mexico's states; state public-sector laws are not presented as the rule for every private account.

Children and notice changes

Accounts are for people meeting our age and legal-capacity rules. Do not knowingly submit children's or other people's unnecessary information. Tell the privacy contact if such data appears. Material processing changes receive a new dated notice and appropriate communication; fresh consent is obtained when legally required. Prior notices remain available. Browser language can suggest interface and service-email language; it does not determine residence, legal jurisdiction, optional consent or contract-language choice.