Data Confidentiality Commitment

1. Your estimates belong to you

You keep full ownership of everything you create in Kpex — projects, estimates, WBS structures, equipment lists, quotations, procurement packages and attached documents ("Your Estimates"). CAF processes them only to provide the service to you.

2. Private by default — no access between users or organisations

• Every project and estimate is visible only to the user who created it. Nobody else — no other customer, no other organisation, no other user — can see, open, export or modify it.
• An estimate is seen by another person only when you decide so: when you share it with a named user, or when the project is linked to its owner organisation so that the owner can review it in read-only mode.
• Within your own organisation (Enterprise plans), estimates also stay private to their author until they are shared.
• Every request is authorised on our servers before any data is returned or changed — access does not depend on what the screen shows.
• Documents attached to your estimates are stored privately and can only be downloaded by people with access to that estimate.
• The client and contractor companies you register for your projects are private to you; other users never see them.

3. No disclosure to third parties

CAF does not sell, rent, publish or share Your Estimates with anyone — not with other customers, equipment vendors, data partners or any other third party. If you send a request for quotation to a vendor through the Kpex Exchange, the vendor receives only the information you choose to send.

4. Statistical use for Machine Learning — only with your consent

Kpex improves its cost models with statistics from real estimates. Your Estimates are used for this purpose only if you authorise it in writing — in your Enterprise agreement or by signing the annex to this Commitment. Without that consent, they are never used.

When you authorise it, the following guarantees apply:

• Identity is removed before any use. The project name, code and description, the owner, client and contractor, user and company names, site or city, attached documents and any free text are excluded.
• Only statistical elements are used: facility type, capacity and units, quantities, unit costs, the shares of the cost breakdown, the AACE class, the country or region and the cost basis date.
• Aggregated, never individual. These elements only feed aggregated statistics and the calibration of Kpex models. No statistic is shown to any user unless it combines at least five projects from at least three different organisations, and no individual estimate is ever published or shown to another customer.
• No re-identification. CAF will not attempt to identify the project, owner or organisation behind any statistic, and will not let anyone else do so.
• You can withdraw your consent at any time. From that moment, Your Estimates are excluded from any new use; statistics already aggregated cannot be traced back to you.

5. Access by CAF personnel

Access to customer data by CAF is limited to a small number of designated administrators, and only to provide the support you request, to keep the service secure and working, or when the law requires it. All CAF personnel and contractors are bound by confidentiality obligations.

6. Security

• Encryption of all data in transit (HTTPS/TLS) and of stored data at rest;
• Authorisation checks on every action, and role-based access with the principle of least privilege;
• Private storage for documents; passwords are never stored in readable form;
• Regular security reviews of the platform.

7. Incidents

If a security incident affects Your Estimates, CAF will inform you without undue delay — and within 72 hours of becoming aware of it — with what happened, the data concerned and the measures taken, in addition to the notifications required by data-protection law.

8. Retention and the end of the service

When your subscription ends, Your Estimates remain available for export (PDF and Excel) for 60 days, and are then deleted. If you had authorised statistical use, only the anonymised, aggregated statistics already incorporated into Kpex models remain — they contain nothing that identifies you or your projects.

9. Contractual assurance

For Enterprise customers this Commitment can be attached to the subscription agreement as a signed annex, together with a non-disclosure agreement and a data processing agreement where personal data is involved. Where this Commitment and other terms differ on the confidentiality of Your Estimates, the provision more protective for you prevails.

Questions and requests: legal@caf-corporation.com · support@caf-corporation.com