Privacy & Terms

1. Information We Collect

• Account Information: Your work email address, selected trade categories, and coverage territories specified at signup.
• Public Register Data: Public building permit records, published by municipal, county, or national statutory authorities. These are open government records by law; we redistribute and index them with official citations.

2. Our Role and Lawful Basis (GDPR)

For subscriber account information, PermitSiren is the data controller. We process it to provide the alert service you requested (contract performance, Art. 6(1)(b) GDPR).

For personal data that appears in public building-permit records, PermitSiren is also an independent controller when we collect, index, filter, retain, and redistribute those records commercially. We rely on legitimate interest (Art. 6(1)(f) GDPR): notifying trade professionals of statutory construction activity while preserving access to information that public authorities publish by law.

We have completed a documented Legitimate Interest Assessment for this processing. It considers the public character of the registers, the limited fields we retain, the professional purpose of alerts, the absence of behavioural profiling or scoring of individuals, and the rights and safeguards described below. We do not infer financial status, target vulnerable people, build behavioural dossiers, or publish enriched profiles of applicants.

3. Rights of Listed Individuals

If your name or contact details appear in a permit record indexed by PermitSiren, you may ask us to:

• Access: identify the source record we hold for you.
• Object: object to inclusion in commercial alert distribution.
• Suppress: remove your identifying details from alert-facing results while retaining a minimal source citation where necessary.
• Erase: request deletion where no overriding lawful basis applies.
• Rectify: correct inaccurate identifying details.

Email contact@permitsiren.com. We review listed-individual requests separately from subscriber-account requests, verify sufficient identity context, and respond within 30 days. You may also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit) or your local authority.

4. Data Retention

Public permit records are retained for 12 months, then automatically removed through scheduled purge jobs. Subscriber records are maintained until cancellation; unconfirmed signup tokens are purged automatically. Unsubscribing permanently deletes your subscriber record within 24 hours. Suppression entries for objections remain only so we do not reintroduce the same individual in later imports.

5. Subscriber GDPR Rights

You have full rights to access, correct, export, or erase your account data at any time. Email contact@permitsiren.com — requests are fulfilled within 72 hours. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit).

6. Infrastructure & Sub-Processors

• Cloudflare — CDN, edge computing workers, and D1 database storage. (Covered by Standard Contractual Clauses).
• Resend — Transactional alert email dispatch. (EU sending region; DKIM/SPF authenticated).

We never sell, rent, or trade your contact information to third parties.

7. Acceptable Use & Marketing Regulations

PermitSiren provides intelligence from statutory public records. When contacting property owners or applicants, you are responsible as an independent controller for determining your own lawful basis and adhering to local telemarketing and advertising regulations (TCPA and CAN-SPAM in the US; GDPR and telemarketing registries in NL/BE). Our suppression handling does not replace your own outreach-compliance checks.