DEKINNexus Etap

Privacy Policy

Effective date: 15 September 2026 (15.09.2026)

1. Who are we?

DEKINNexus Etap (the “Application”) is a business tracking application operated by SARL DEK IN SAN (the “Company”, “we”, “us”), a construction contractor operating in Algeria, and accessible at etap.dekinnexus.com. It is used to track projects, administrative approval processes, contracts and work orders (ODS), procurement and subcontractor progress payments. The Company is the data controller for the personal data processed in the Application. For any questions: etap@dekinnexus.com

2. Scope

The Application is an internal business tool and there is no public registration: accounts are created only by Company administrators, for employees and authorised business partners. This policy applies to the data of account holders and of the supplier, subcontractor, public body and site contact persons recorded in the Application. The applicable law is Algerian law, in particular Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data. The rules for using the Application are set out in the Terms of Use.

3. Data we process

  • Account data: username, full name, job title, telephone number, e-mail address, role (and super admin privilege), active/inactive status of the account, time of creation, assigned sites/units; language, note colour, notification preferences and whether the introductory tour has been viewed.
  • Security information: only an irreversible bcrypt hash of the password (passwords are not stored in plain text), the hashes of the last 5 previous passwords, the time of the last password change, initial password status and a login counter; and only the SHA-256 hash of the single-use password reset link, which is valid for 60 minutes.
  • Business data: project and contract information (contracting authority, contract number and dates, contract value, bank details, work orders, bank guarantees, insurance policies); process steps, notes and documents; purchase requests, quotations, approvals, purchase orders, deliveries, invoices, payments and correspondence; subcontracts and subcontractor progress payments.
  • Third-party contact information: company name, NIF/RC/NIS/AI numbers, address, telephone number, e-mail address, authorised representative and notes contained in supplier, subcontractor, public body and site records.
  • Other: personal reminders (visible only to their owner), announcements, in-app notifications, the WhatsApp contact list and the usage records described in Section 6.

4. How do we obtain data?

Account information is obtained from the administrators who create your account; profile information, records, notes and documents from you; supplier, subcontractor and public body information from your colleagues in the course of business processes; and session and activity records automatically while you use the Application. Some contract/ODS records, together with their associated guarantee, insurance and document records, were transferred from another internal application of the Company (hr.dekinnexus.com). If the optional artificial intelligence feature is enabled, certain form fields are suggested by reading them from an uploaded contract document (Section 8).

An account cannot be created without the mandatory fields of the account creation form. If optional fields such as telephone number and e-mail address are left blank, the corresponding notification channel, the sending of login details via WhatsApp or the password reset link cannot be used.

5. Purposes and legal bases

  • Account management and authentication — performance of the employment or commercial contract between you and us.
  • Carrying out project, contract, procurement and subcontracting work; storage of documents — performance of contracts and the Company's legal obligations.
  • Data of supplier, subcontractor, public body and site contact persons (requesting quotations, placing orders, handling progress payments and official correspondence) — performance of the contract between the Company and the organisation to which these persons belong, and the Company's legitimate interest.
  • Notifications (in-app, e-mail, WhatsApp) — timely execution of business processes; you can restrict the channels from your profile.
  • Security, prevention of abuse, audit trail and usage statistics — the Company's legitimate interest and legal obligations.
  • Protection of rights and requests from competent authorities — legal obligations.

6. Activity and security logs

We want to be clear: your activity in the Application is recorded.

  • Activity audit log: for requests made by logged-in users (excluding static files, system health checks, user guide pages and automatic polling requests; for requests made without logging in, the limitation set out below applies): user ID and name, role, event type (operation, page view, document opening, Excel/PDF export, login, logout, rejected request), screen path, result code, short summary, related record, parameters filtered according to privacy rules (e.g. record number, status, date or amount, search term, record name or title, the username entered in a login attempt), IP address, full browser information (not stored for page views), language and processing time.
  • Session history: login, last activity and logout times, session duration, how the session ended, IP address and a short browser summary (for example “Chrome · Windows”). Failed login attempts are recorded with the username entered, IP address, browser summary and a reason code.
  • Change logs: who changed which value, to what and when, in the process, contract/ODS, procurement and subcontractor modules.
  • Technical logs: application logs are kept on a rotating basis, with the oldest entries deleted once a certain file size is reached; some lines may contain a username, an e-mail address or a requested URL. In addition, the server's web server (reverse proxy) writes the IP address, time, requested URL (including query parameters), referring page and browser information to access logs for each request; these logs are retained in accordance with the server's log management.

What is not recorded in audit and session logs: passwords (including passwords entered in failed attempts), access keys, the session cookie and document contents. Form contents are not stored as submitted: password-like fields are written as “***”; description, note, justification, address, telephone and e-mail fields are discarded; only the name and size of uploaded files are retained. For requests made without logging in, only rejected requests and login/logout attempts are recorded.

Who can see them? The audit log and usage statistics screens are accessible only to super admin accounts; the administrator (admin) role alone is not sufficient. These screens explain what is recorded. Access to change logs is subject to the role and scope rules described in Section 11.

7. Google user data

Uploaded documents may be stored in the Google Drive storage of a Google account belonging to the Company. The connection is established by a Company administrator via Google OAuth for the Company's own Google account; on the Google consent screen, the application appears under the name “ETAP Drive”. Employees' personal Google accounts are not connected.

  • drive.file: The Application can access only the files and folders that it has created itself and files that a user has explicitly opened or shared with this application; it cannot see any other files in Drive. This permission is used to save uploaded business documents to the “DEKINNexus Etap Belgeleri” folder, to make them available to authorised users within the Application, and to remove them from Drive as well when a document is permanently deleted. The files of procurement documents that have been deleted reversibly remain in Drive; if the Drive connection has been removed, files cannot be deleted from Drive by the Application.
  • userinfo.email: the e-mail address of the connected account; it is stored in order to show administrators which account is connected and, upon reconnection, to determine whether the same account is being connected and thus whether the existing document folder should be used.
  • Retention: the connection's refresh token is stored encrypted with AES-256-GCM; documents reside in the Company's Drive, and the document records hold each file's Drive file ID and link. When the connection is removed from the Application, the refresh token is deleted; the e-mail address of the connected account and the ID of the document folder continue to be stored so that documents remain in a single folder if the same account is reconnected. Removing the connection from the Application does not automatically revoke the permission granted on Google's side; to remove the permission completely, the “ETAP Drive” access must be removed from the third-party access section of the Company's Google Account settings (myaccount.google.com/permissions).

Limited Use commitment: Data obtained from Google APIs is not sold, is not used for advertising purposes, is not used to determine creditworthiness or for lending purposes, and is not used to develop or train generalised artificial intelligence or machine learning models (the optional Gemini feature does not read data from Drive; it processes only the document selected by the user in the form). Data obtained from Google APIs is transferred only to the extent necessary to provide or improve the Application's user-facing document storage and viewing feature, to protect security or to comply with the law; it is not transferred to advertising platforms, data brokers or information resellers.

Data obtained from Google APIs is not read by any person other than users who are authorised to view the documents within the Application. The only exceptions to this are: (a) the explicit consent of the relevant user for specific documents, (b) security purposes, such as investigating abuse, (c) compliance with applicable law, and (d) internal operations, provided that the data has been aggregated and anonymised.

DEKINNexus Etap's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Third-party services

  • Google Drive: uploaded documents (Section 7). If there is no Drive connection or uploading to Drive fails, documents are saved to the Company's Google service account if one is configured, and otherwise to the server's own disk. If a service account is used, the Application accesses that account's Drive storage with full Drive permission, and documents are not shared via a public link unless this is explicitly enabled in the configuration.
  • Google Gemini (only if enabled): disabled by default; it operates if an administrator explicitly permits documents to be sent to Google. When a user with write permission selects a PDF or image using “Read from Document (AI)”, the selected image file in its entirety, or only the first pages of a PDF file (3 for contracts, 4 for subcontracts), is sent to Google together with instructions for extracting fields. Within the Application, the result only fills in the form; it is not saved automatically. The document sent is processed and may be stored by Google in accordance with the Gemini API terms; for free-of-charge use of the Gemini API, those terms may permit the submitted content to be used to improve Google products and to be reviewed by humans.
  • WhatsApp: notifications are sent via the WhatsApp account that the Company has linked by QR code, to your telephone number according to your preferences and to groups/contacts defined by administrators. Messages may contain the project, step, public body, supplier, amount, date, names of individuals, description and a link; each message sent is logged with its content, status and telephone number. The “Send login details” feature transmits the name, the Application's address, the username and a new initial password generated at that moment; the previous password becomes invalid, and the password is masked in the logs.
  • E-mail: event notifications (according to your preferences), password reset links and daily summaries, sent via the SMTP server defined by the administrator.
  • Requests for quotation to suppliers: sent by e-mail or WhatsApp, containing the Company's details, the requested items, the name of the supplier's authorised representative, and the name, e-mail address and telephone number of the sending employee.
  • Webhook (only if configured): the notification title, message, link and the recipients' telephone numbers.

These services are subject to their own terms and privacy policies (for example, the Google Privacy Policy). The Application contains no analytics, advertising or tracking tools; PDF documents are generated on the server without being sent to any external service.

9. Cookies and browser storage

The Application uses only a strictly necessary session cookie (connect.sid): it cannot be read by JavaScript (httpOnly), it is restricted for cross-site requests (SameSite=Lax), in production it is by default sent only over encrypted connections, and it is valid for 8 hours. It is created at login or when a language is selected; session information is stored in the database on the server. There are no advertising or tracking cookies.

Only interface preferences are stored in the browser. localStorage: the open/closed state of help panels (ak_…), the last contract tab (marche_sekme), the progress payment sort order (marche_hakedis_sira), the menu state (sv_menu_kapali, sv_menu_gizli), the number of the last notification seen (sv_last_notif_id) and the “not translated” notice dismissed in the user guide (kl_dil_not_…). sessionStorage: postponement of the introductory tour (etap_tur_sonra) and the menu scroll position (sv_menu_scroll).

10. Retention periods

  • Read/archived notifications are deleted after 90 days; WhatsApp message logs and page-view audit records after 180 days; and completed WhatsApp send queue entries after 30 days. Sent e-mails are not separately recorded in the database. Expired sessions are purged during daily maintenance.
  • Not deleted automatically: session history, audit records other than page views, and change logs (retained as an audit trail); used or expired password reset records remain until the user is deleted.
  • Business records and documents are not deleted automatically; they are managed by administrators according to the Company's business and legal retention needs. Deletion of procurement documents is reversible; “clearing” notifications archives them.
  • When an account is deleted, its site assignments, notifications, password history, reset records, personal reminders and pending WhatsApp messages are deleted; audit records, session history, change logs, WhatsApp logs and comments are retained together with the recorded name.
  • The server may be backed up; deleted data may remain in backups until the backup rotation period has expired.

11. Security and access control

  • Encrypted connection (HTTPS); the application server and the database are not directly exposed to the internet.
  • Password policy: at least 8 characters, and common passwords are rejected; a new password cannot be the same as either of the last two passwords; a change is mandatory at the 3rd login with a password assigned by an administrator and every 365 days (to prevent lockout from the system, super admin accounts are exempt from these two requirements). When a password is changed, other sessions are terminated.
  • Constant-time password comparison; rate limits on login, password reset and deletion attempts; regeneration of the session ID at login; the account is verified on every request, and a deactivated account is logged out immediately.
  • Re-entry of the password for irreversible actions such as deletion; Content Security Policy, security headers and origin checks against cross-site request forgery (CSRF).
  • The SMTP password, the Gemini key and the Drive refresh token are stored encrypted with AES-256-GCM; a file type allowlist is applied to uploads, and documents are served in an isolated (sandboxed) manner.
  • Role-based access (administrator, senior management, responsible person, procurement, contract/ODS officer): responsible persons see only the projects of which they are the project manager, to whose site they are assigned, or in which they are responsible for a process or step. Permissions are checked on the server on every request.

No system is entirely free of risk; if you suspect a security issue, report it to an administrator or to etap@dekinnexus.com.

12. Data sharing

Your personal data is not sold and is not shared for advertising purposes. Personal data is visible within the Company and to authorised business partners who hold an account, in accordance with role and scope rules; the team section of the contact directory (name, job title, role, telephone number, e-mail address) is shown only to the administrator, senior management and procurement roles, and may be exported to Excel by those roles. Outside the Company, data is transferred only to the following recipients, and only to the extent necessary for the relevant purpose: the server hosting provider on which the Application is hosted; an off-server backup storage destination, if configured; the service providers listed in Section 8; WhatsApp groups and contacts defined by administrators; the webhook recipient, if configured; suppliers selected in requests for quotation; and competent authorities where required by law.

13. Transfers outside Algeria

Data sent to services such as Google (Drive and, if enabled, Gemini), WhatsApp and the e-mail provider, as well as data held in the Application's hosting and backup services where those services are located outside Algeria, may be processed on servers outside Algeria. These transfers are limited to what is necessary for the relevant feature and are subject to the conditions laid down in the provisions of Law No. 18-07 governing transfers abroad (including the requirements of authorisation by the national authority and an adequate level of protection in the recipient country).

14. Your rights

Under Law No. 18-07, you have the right to be informed of who processes your data and for what purpose, the right of access to your data, the right to request the updating and rectification of inaccurate or incomplete data, the right to object to processing on legitimate grounds, and the right to request the erasure or blocking (restriction) of data that is unnecessary or unlawfully processed. Records constituting an audit trail, and data that must be retained for legal or business reasons, might not be erased for as long as that requirement persists.

How can you exercise them? You can change your full name, telephone number, password, note colour, language and notification preferences yourself from your profile. For changes to your username, e-mail address or role, and for access, erasure and objection requests, contact an administrator or write to etap@dekinnexus.com; the Application does not provide a function for deleting your own account or exporting your data. We may need to verify your identity before processing your request. You retain the right to apply to Algeria's national authority responsible for the protection of personal data (ANPDP). Supplier, subcontractor or public body contact persons whose details are recorded in the Application may also write to the same address.

15. Children

The Application is a business tool for employees and business partners; it is not directed at minors, and accounts are not knowingly created for them.

16. Changes to this policy

We may update this policy to reflect changes to the Application or to legislation. The current version is published on this page with its effective date; significant changes are announced within the Application.

17. Contact

SARL DEK IN SAN — DEKINNexus Etap. For privacy-related questions and requests: etap@dekinnexus.com

Terms of Service Log In