Privacy statement (online service)
Version: 2 November 2026
1. Who we are
Places Builder Online is provided by ralpheckhard.com, a sole proprietorship operated by Ralph Eckhard, Westerwerf 3F, 1911 JA Uitgeest, the Netherlands. Chamber of Commerce number: 78690277. VAT number: NL003372112B37.
Privacy enquiries and requests may be sent to ralph@ralpheckhard.com.
2. Scope and roles
This statement applies to the hosted Places Builder Online pilot at placesbuilder.online.
For floor plans, office addresses, room information and other content that an organisation places in its workspace, the organisation determines why that information is processed and is the controller. The provider processes that content on the organisation’s behalf under the data processing agreement.
For account, membership and security information needed to provide, administer and protect the service, the provider is the controller.
If a request concerns personal data contained in an organisation’s workspace, the person should normally contact that organisation first. The provider will assist the organisation in accordance with the data processing agreement.
3. Information processed as controller
| Information | Purpose | Basis used for the pilot | Retention |
|---|---|---|---|
| Microsoft tenant ID, user object ID, name and sign-in address | Sign-in, create and administer workspace membership, and provide invitations | Necessary to provide the requested service and administer the workspace relationship | While the organisation uses the service; removed under the deletion process after the organisation stops |
| Invitation: the invited sign-in address, the user ID of the person who invited and the date | Show the owner the open invitations and match an invitation to the person who later signs in | Necessary to provide the invitation and membership function | Until the person joins or the invitation is withdrawn |
| Acceptance of the terms: the version accepted and the time, stored with the member record | Show that a person accepted a version of the terms and the privacy statement | The provider’s legitimate interest in being able to show which terms apply | While the person is a member of the workspace |
| Masked workspace-owner name and address | Show people from the same organisation whom to contact when an invitation is required | Necessary to administer access to the requested service | While the workspace exists |
| Technical logs, including time, page, status, IP address, browser information and, for actions that create, change, delete, import or export data, the user ID | Operate, diagnose and secure the service; detect misuse and investigate security events | The provider’s legitimate interest in securing and administering the service and preventing abuse | 30 days |
The service uses the Microsoft tenant ID and user object ID as account identifiers. The sign-in address is not used as the persistent account identifier.
An invitation record contains the invited sign-in address (the file name of the record is a hash of that address), the user ID of the inviter and the date. The record is deleted when the person joins or the invitation is withdrawn.
The service uses only the session cookie set by Microsoft sign-in (App Service authentication) to keep you signed in. It does not use analytics, advertising or tracking cookies.
4. Customer content processed on behalf of organisations
Customer content may include offices, addresses, floors, floor-plan files, room information from Microsoft Places exports and personal data that an organisation includes in those materials.
The provider processes this information only to host the organisation’s workspace, convert source materials into IMDF packages, provide requested service functions, secure the service and follow the organisation’s documented instructions. The organisation is responsible for determining its own legal basis, providing information to affected individuals where required, and deciding what content may be uploaded.
5. Where information is processed
The hosted application and customer content use Microsoft Azure in the West Europe region. The Microsoft services used for the pilot include Azure App Service, Azure Storage, Azure Key Vault, Azure Maps, Azure Monitor and Microsoft Entra for sign-in.
The public website uses Azure Static Web Apps and may be delivered through Microsoft’s global network.
Microsoft is the only subprocessor identified for the current pilot. Stripe is not used for the free pilot. Voluntary GitHub sponsorship is separate from access to the hosted service.
No transfer of customer content outside the European Economic Area is intended. The provider will review the position if the hosting configuration, subprocessors or support arrangements change.
6. Sharing
Information is shared with Microsoft as needed to operate and secure the Azure-hosted service. Information may also be handled where a binding legal requirement applies.
Public GitHub issues are not a private support channel. Users must not post floor plans, personal data, credentials, confidential tenant information or details of a security incident in a public issue.
7. Retention and deletion
Account and workspace information is kept while the organisation uses the service, subject to the specific periods in the table above.
On a valid deletion request, or when an organisation stops using the service, the active workspace and its customer content will be removed within 14 days. Azure storage safeguards may keep deleted files recoverable for up to a further 14 days. Complete deletion may therefore take up to 28 days.
Information may be retained for longer only where necessary to meet an applicable legal obligation or to establish, exercise or defend a legal claim.
8. Individual rights
A person may contact ralph@ralpheckhard.com to exercise the data-protection rights that apply to the provider’s processing of account, membership and security information.
The provider may ask for information reasonably needed to confirm the requester’s identity.
Where the requested information is contained in an organisation’s workspace, the request should normally be directed to that organisation. The provider will assist the organisation as processor.
A person may submit a complaint to the Dutch Data Protection Authority.
9. Whether information is required
Microsoft work or school account information is required to sign in and participate in a workspace. Without the necessary tenant and user identifiers, the hosted service cannot create or administer membership.
Providing customer content is optional, but the conversion functions cannot operate without the source materials selected by the organisation.
10. Security
Measures used for the pilot include Microsoft Entra sign-in, separation of organisations within the application, automated tests of that separation, managed identities, secrets held in Azure Key Vault, encryption in transit, and monitoring with alerts.
No online service can promise absolute security. Suspected security incidents should be reported privately to ralph@ralpheckhard.com and not through a public GitHub issue.
11. Changes
This statement may be updated when the service, hosting arrangements or processing activities change. Material changes will be announced through the service or its associated website before they take effect where reasonably practicable. The version date above identifies the current text.
12. Contact
ralpheckhard.com / Ralph Eckhard
Westerwerf 3F
1911 JA Uitgeest
The Netherlands
ralph@ralpheckhard.com