GanttPRO

GDPR overview

GDPR implementation is concrete. The vendor is established in the EU (Kraków, Poland), so no Article 27 representative is required and none is named. The security page states an explicit commitment to the GDPR through a privacy compliance framework. A Data Processing Addendum is published and forms part of the contract as soon as personal data is processed, with Standard Contractual Clauses annexed for transfers outside the EEA. A named subprocessor list is public, with purpose, EU and US locations and a link to each provider's own DPA. Rights are listed in full: access, rectification, erasure, restriction, portability, objection, withdrawal of consent and no automated decision-making, which the vendor says it does not practise. The supervisory authority named is the President of the Polish Personal Data Protection Office. Requests go to support@ganttpro.com. No effective date or version number appears on any legal document.

Who owns the data?

The privacy policy splits ownership clearly. Customers remain the controller of the personal data they enter into the application, and DPM Solutions acts only as a processor working on their documented instructions, formalised through the published Data Processing Addendum under Article 28 GDPR. Customers keep responsibility for their User Content; the vendor and its licensors retain every right over the software itself, which is licensed and never sold. Access to project content is limited to the customer's own credentials and to the collaborators they explicitly authorise. Vendor staff may reach customer data only for incident response, and the security page states they ask the customer's personal permission first.

Reuse rights

Customers may reuse their own project data freely and without asking permission: plans can be exported to PDF, PNG, XLSX and XML, shared through a secret public link in dynamic or static form, and printed, and export is available even during the trial. What the customer cannot do is reuse the software itself. The terms grant a limited, personal, non-exclusive, non-transferable worldwide licence for the customer's own use, explicitly not for resale or further distribution, and forbid copying, reverse engineering, sublicensing or renting access. On its own side, the vendor uses collected data for account creation and support, personalisation, request handling, technical operation, traffic analysis and threat detection, each purpose tied to a legal basis under Article 6 GDPR. It states that it does not sell, trade or transfer personally identifiable information, sharing it only with the subprocessors it lists publicly. Marketing emails require consent and can be switched off in the account notification settings.

Data retention & training

Hosting summary

Data is hosted on Microsoft Azure, with servers located in the EU region; the vendor states that all data is stored in secure Azure data centres within the EU. User documents, images and files sit in Azure geo-redundant storage under encrypted paths with strictly limited access and malware scanning on upload. The backup model combines real-time database replication with a full daily backup held in an encrypted environment physically isolated from the primary server, and backups created in the EU region remain in the EU for data sovereignty. A dedicated virtual private network built inside Azure is presented as protecting data cryptographically from access by Microsoft or any third party, and Cloudflare sits in front for CDN, DDoS mitigation and web application firewall. Traffic is encrypted with HTTPS and SSL/TLS. One nuance is stated openly: sensitive data at rest is encrypted, but the database as a whole is not, in order to preserve access speed, and is instead protected by SSL inside a private network. No individual host country is named, only the EU region.