1. Who are we?

PPMos™ is the data controller for your personal data. Our platform PPM OS is a cloud-based Project Portfolio Management system hosted in the Netherlands.

2. What data do we collect?

• Account data: name, email address, password (hashed), organisation name
• Profile data: job title, phone number, avatar (optional)
• Project data: portfolio structures, projects, tasks, budgets and risks you enter
• Payment data: billing details (processed via Stripe — we never store card data)
• Usage data: login times, IP addresses, browser type, actions in the application (activity log)
• AI interactions: prompts and results of risk assessments via Claude AI (not used for model training)

3. Legal basis and purposes

• Contract performance: delivering the PPM OS service
• Legitimate interest: security, fraud prevention, product improvement
• Consent: marketing communications (you can opt out at any time)
• Legal obligation: fiscal retention requirements and legal reporting

4. Retention periods

We do not retain your data longer than necessary. Account data is retained as long as your account is active and up to 30 days after deletion. Financial data is retained for 7 years in accordance with Dutch fiscal law.

5. Your rights

Under GDPR you have the following rights:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to lodge a complaint with the Dutch DPA (autoriteitpersoonsgegevens.nl)

You can exercise your rights by contacting us at info@ppmos.com.

6. Security

PPM OS uses TLS encryption, hashed passwords, regular backups and access controls to protect your data. See our security page for details.

7. Contact details