Privacy policy
1. Who processes your data
| Controller | Brickstarter, S.L. |
| Tax ID (CIF) | B98901952 |
| Address | Avenida Cortes Valencianas 35, 32 · 46015 Valencia (Spain) |
| Data protection contact | info@brickstarter.com |
2. What data we process
We only process data that you provide to us or that is generated by your use of the service. We do not buy databases and we do not obtain your data from third parties.
| Category | Specific data | Source |
|---|---|---|
| Identification | First name, surnames, email address, language | Registration form |
| Tax | Tax residence, tax identification number; for company accounts, company name and tax ID | Personal details page |
| Contact | Postal address, telephone | Personal details page |
| Identity verification (KYC) | Identity document, image of the document, verification selfie and the outcome of the check | Verification process, through our provider |
| Banking | IBAN, account holder, country and proof of ownership | Bank account registration |
| Financial | Balance, movements, deposits, withdrawals, holdings, orders and returns | Generated by your activity |
| Access and security | Encrypted password, access date and time, IP address, two-factor verification codes | Generated automatically |
| Browsing | Pages visited and technical device data | Cookies and similar technologies, only with your consent |
⚠️ We do not process special categories of data (health, beliefs, trade union membership, biometrics for identification purposes) other than what is strictly derived from documentary identity verification, which is carried out by a specialist provider and required by anti-money laundering legislation.
3. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account and providing the service | Performance of a contract (Art. 6(1)(b) GDPR) |
| Verifying your identity and your bank account | Legal obligation (Spanish Law 10/2010 on anti-money laundering) |
| Managing deposits, withdrawals, holdings and returns | Performance of a contract |
| Applying tax withholdings and reporting to the tax authorities | Legal obligation (tax legislation) |
| Handling your enquiries and complaints | Performance of a contract and legitimate interest |
| Platform security, fraud prevention and access logging | Legitimate interest (Art. 6(1)(f)) |
| Sending you commercial communications and the newsletter | Consent (Art. 6(1)(a)), which you may withdraw at any time |
| Analytics and advertising cookies | Consent (Art. 22(2) of Spanish Law 34/2002) |
| Retaining accounting and tax records | Legal obligation |
Withdrawing your consent for marketing does not affect anything else: your account continues to work normally.
4. How long we keep it
- For as long as your account is active, and thereafter blocked for the applicable legal periods.
- Accounting and tax data: 6 years (Art. 30 of the Spanish Commercial Code) and 4 years for tax obligations (Art. 66 of the General Tax Law), counted from the end of the filing period.
- Anti-money laundering documentation: 10 years (Art. 25 of Law 10/2010).
- Newsletter data: until you unsubscribe.
- Browsing data: according to the retention period of each cookie, detailed in the Cookie Policy.
Blocked means the data is kept solely at the disposal of courts and public authorities to address possible liabilities, with no commercial use and without being transferred to third parties. Once the periods expire, the data is deleted.
5. Who we share it with
We do not sell your data and we do not transfer it to third parties for commercial purposes. Only those necessary to provide the service are involved:
| Who | Purpose |
|---|---|
| Identity verification provider | Verifying your identity under anti-money laundering legislation |
| Hosting and infrastructure provider | Hosting the platform and its backups |
| Email provider | Sending you service notices and, with your consent, commercial communications |
| Developer and technical maintenance | Maintaining and fixing the platform |
| Bank | Executing the transfers for your withdrawals |
| Project developer companies | Managing your holding in the property you invest in |
| Tax and accounting advisers | Meeting legal obligations |
| Public authorities | Where required by law: tax authorities, SEPBLAC, courts |
All providers act as processors, under a contract signed in accordance with Art. 28 GDPR, and may only process the data following our instructions.
The up-to-date list of providers is available on request at info@brickstarter.com.
6. International transfers
Some providers may be located outside the European Economic Area. In that case the transfer is covered by an adequacy decision of the European Commission or by standard contractual clauses, with any additional safeguards required. You may request a copy of these safeguards at info@brickstarter.com.
7. Your rights
You may exercise the following rights at any time:
- Access — to know what data of yours we process.
- Rectification — to correct inaccurate data.
- Erasure — to request deletion, subject to the limits in section 4: we cannot delete what tax, accounting and anti-money laundering legislation requires us to keep, which will remain blocked.
- Objection — to object to processing based on legitimate interest.
- Restriction — to have data kept but not used while a claim is resolved.
- Portability — to receive your data in a structured format or have it sent to another controller.
- Withdrawal of consent at any time, without retroactive effect.
- Not to be subject to automated decisions producing significant legal effects.
How to exercise them: write to info@brickstarter.com, stating the right you are exercising and attaching a copy of a document proving your identity. We will reply within one month, extendable to two if the request is complex, in which case we will let you know.
This is free of charge, except for manifestly unfounded or excessive requests.
Complaints: if you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), without prejudice to contacting us first.
8. Security
We apply technical and organisational measures appropriate to the risk: encryption of communications, encrypted password storage, two-factor verification available for your account, role-based access control, operation logging and backups.
Should a security breach occur that may pose a high risk to your rights, we will inform you without undue delay and will notify the Spanish Data Protection Agency within 72 hours in accordance with Art. 33 GDPR.
9. Minors
The service is intended exclusively for persons over 18. We do not knowingly collect data from minors. If we detect that a minor has registered, we will close the account and delete their data.
10. Changes to this policy
We may update this policy to reflect regulatory or service changes. If the change is substantial, we will notify you by email or through a prominent notice on the platform before it takes effect.