Legal

Privacy policy

BRICKTECH LABS, S.L.U. · NIF B-88967906 · Version 1.2 · In force since 8 July 2026 (last updated: 5 October 2026)

This is an English translation provided for convenience. In case of any discrepancy, the Spanish version (Política de privacidad) prevails.

This Privacy Policy (hereinafter, the “Policy”) describes how BRICKTECH LABS, S.L.U. (hereinafter, “Bricktech”, “we” or the “Controller”, unless otherwise indicated) processes the personal data of the persons who interact with the website https://bricktech.es/ (hereinafter, the “Website”) and with the Bricktech CRM platform (hereinafter, the “Platform”), including the artificial intelligence conversational agent “Sofía” and the “Bricktech Intelligence” scoring engine.

This Policy is structured in three blocks, according to the type of person whose data is processed: (A) Website visitors (persons who browse https://bricktech.es/, fill in the contact form or request a demo); (B) Clients (real estate agencies, professionals and their Authorized Users who subscribe to and use the Platform); and (C) Contacts (leads or prospective clients of a Client who interact with Sofía or other features of the Platform). Capitalized terms not expressly defined in this Policy have the meaning given to them in the Terms and Conditions of Use published on the Website.

1. Controller

  • Company name: BRICKTECH LABS, S.L.U.
  • NIF/CIF: B-88967906
  • Registered office: Calle Fernán González, 74, 28009, Madrid (Spain).
  • Contact email / exercise of rights: hola@bricktech.es
  • Website: https://bricktech.es/

As detailed in sections 5 (Clients) and 6 (Contacts), Bricktech does not always act as controller: in each block, this Policy identifies the role that corresponds to Bricktech.

Block A · Website visitors

2. Data we process about visitors

When you browse the Website, request a demo or contact us through the forms provided, we may process the following categories of data:

  • Identification and contact data: first name, surname, email address, telephone number and name of the agency or company, provided voluntarily when requesting a demo or commercial information.
  • Browsing data: IP address, device and browser type, pages visited and browsing time, obtained through technical cookies and, where applicable, analytics cookies, in accordance with the Cookie Policy published on the Website.
  • Communications: the content of the messages you send us through the contact form, email or WhatsApp to request information about the Platform.

3. Purposes and legal basis (visitors)

  • To manage your request for a demo or commercial information about Bricktech. Legal basis: performance of pre-contractual measures requested by you (Article 6(1)(b) GDPR).
  • To respond to your enquiries and communications. Legal basis: Bricktech’s legitimate interest in handling the requests received (Article 6(1)(f) GDPR).
  • To analyze the use of the Website for statistical purposes (when you accept analytics cookies). Legal basis: your consent (Article 6(1)(a) GDPR), in accordance with the Cookie Policy.
  • To send you commercial communications about Bricktech, if you expressly request them. Legal basis: your consent (Article 6(1)(a) GDPR and Article 21 LSSI-CE). You may unsubscribe at any time.

4. Retention (visitors)

The contact data provided to request a demo or information will be kept for as long as necessary to handle your request and, if no contractual relationship is formalized, for a maximum of 12 months from the last contact, unless you request its erasure earlier. Browsing data will be kept in accordance with the periods indicated in the Cookie Policy.

Block B · Clients (agencies and their Authorized Users)

5. Data we process about Clients and Authorized Users

When an agency or professional (Client) subscribes to the Platform, Bricktech processes the following data as controller:

  • Account data: agency name, NIF/CIF, address, billing and payment data.
  • Authorized User data: first name, surname, corporate email address, telephone number, job title and access credentials of each person enabled by the Client to use the Platform.
  • Platform usage data: activity logs, Account configuration, usage statistics and interactions with the KPI dashboard, for the purposes of providing the service, support and improving the Platform.
  • Support data: the content of communications with Bricktech’s support team.
  • Google Calendar data: only if an Authorized User voluntarily connects their Google account, on the terms of section 7a.

6. Purposes and legal basis (Clients)

  • To manage registration, the Account and the provision of the subscribed service. Legal basis: performance of the service contract (Article 6(1)(b) GDPR).
  • Billing and compliance with tax and accounting obligations. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).
  • Customer service and technical support. Legal basis: performance of the contract and Bricktech’s legitimate interest (Articles 6(1)(b) and 6(1)(f) GDPR).
  • Improvement and development of the Platform, including the Sofía and Bricktech Intelligence models, based on aggregated or pseudonymized data. Legal basis: Bricktech’s legitimate interest (Article 6(1)(f) GDPR), balanced against your rights and interests; you may object to this processing on the terms of section 9. Data obtained from Google Calendar is excluded from this purpose (section 7a).
  • Sending commercial communications about the Platform to Authorized Users. Legal basis: legitimate interest within the framework of the existing contractual relationship (Article 6(1)(f) GDPR and Article 21 LSSI-CE), with the option to object in each communication.

7. Retention (Clients)

Account and Authorized User data will be kept for as long as the contractual relationship is maintained and, thereafter, for the applicable statutory limitation periods (in particular, the limitation periods for tax and commercial obligations, generally up to six years under the rules on the retention of accounting records, without prejudice to any different periods that may apply).

7a. Connection with Google Calendar

Each Authorized User may voluntarily connect their own Google account to the Platform from Settings → Availability (Configuración → Disponibilidad) or Settings → Integrations (Configuración → Integraciones). The connection is made through Google’s authorization system (OAuth 2.0), which shows you which permissions are requested before you grant them; Bricktech never knows your Google password. This feature serves to make the visits you manage in Bricktech appear in your calendar and to ensure that Sofía does not offer your Contacts times when you are already busy. Not connecting Google Calendar does not limit any other feature of the Platform.

Permissions we request:

  • openid and email: to identify the Google account you have connected and show you its email address in the Platform.
  • https://www.googleapis.com/auth/calendar.events: to read and write events in your primary calendar, exclusively for the purposes described below. We do not access other calendars in your account or any other Google service (mail, files, contacts, etc.).

What we do with your calendar data:

  • Writing your visits. When a visit assigned to you in the Platform is scheduled, rescheduled or cancelled, Bricktech creates, updates or deletes the corresponding event in your primary calendar. The event contains only the Contact’s first name (or their company name), the title and address of the property, the date and time of the visit, whether it is confirmed or pending, and a link to the Contact’s record within the Platform, accessible only with your session. It does not include the Contact’s telephone number, email address or notes, and Google does not send invitations to anyone.
  • Respecting your busy time. Every 15 minutes, and whenever Google reports a change, Bricktech queries the events in your primary calendar between the previous day and the following 61 days. For each event it only requests its identifier, its start and end time, whether it is cancelled, whether you marked it as “Free” and your attendance response; it does not request or keep the title, description, location or the other attendees. It keeps only the start time, end time and identifier of the events that make you busy, in order to subtract those intervals from the slots that Sofía and your booking page offer to your Contacts. Events marked as “Free”, cancelled events and events you have declined are not taken into account. Anyone viewing your booking page only sees that those times are not available, never the details of the event.
  • Notifying you of changes to your visits. If you move or delete from Google Calendar an event created by Bricktech, the Platform flags it on the visit so that you can decide what to do. Bricktech never modifies the visit or writes to the Contact on its own as a result of that change.

Legal basis: performance of the service contract (Article 6(1)(b) GDPR), at your request when you activate the connection, which you can withdraw at any time.

Retention and security. The token that Google issues to maintain the connection is stored encrypted (AES-256-GCM) and is only decrypted at the moment it is used; short-lived access tokens are not stored. The busy intervals are completely replaced at each synchronization, so an event you delete in Google also disappears from Bricktech. Your calendar data is only accessible to the Platform on your behalf: it is not shown to other users in your agency, except for the absence of free slots that results from it.

Disconnection. You can disconnect Google Calendar at any time from the Platform. The same happens automatically if your agency removes you as a user of the Platform. On disconnection, Bricktech stops reading from and writing to your calendar, stops Google’s notifications, deletes the token, the busy intervals and the email address of the connected account, and revokes the authorization with Google, unless that same Google account remains connected by another Authorized User, in which case the authorization is kept only for that other user. Bricktech keeps only the date of connection and disconnection and the technical identifier of the events it created, so as not to duplicate them if you reconnect. Visit events already created remain in your calendar, because they form part of your schedule; you can delete them yourself. You can also remove Bricktech’s access from your Google account’s permissions page (https://myaccount.google.com/permissions).

Limited Use of Google data. Bricktech's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Bricktech:

  • only uses Google Calendar data to provide and improve the features described in this section, which are visible to you in the Platform;
  • does not sell that data, and does not use it for advertising (including personalized or retargeting advertising) or to determine creditworthiness or for lending purposes;
  • does not transfer it to third parties, except to Google to create and update your events, where necessary to comply with the law or to protect the security of the Platform, or as part of a merger, acquisition or sale of assets, with prior notice;
  • does not allow any person to read it, except with your express consent for a specific case (for example, a support incident), where necessary for security reasons or to comply with the law, or in aggregated and anonymized form for internal operations;
  • does not use it to develop, improve or train artificial intelligence or machine learning models, and does not send the content of your events (titles, descriptions, attendees or their times) to the providers of the AI models behind Sofía and Bricktech Intelligence. To offer a visit, Sofía only receives the list of open time slots in your schedule, which reveals no detail of any of your events, and uses it only to serve your Contacts at that moment.

Block C · Contacts (leads who interact with Sofía)

8. Bricktech’s role regarding Contacts’ data

If you have interacted with Sofía as a lead or prospective client of a real estate agency or professional that uses the Platform —whether via WhatsApp, Facebook Messenger or Instagram direct messages, by filling in a contact form on the agency’s social media or through its website—, it is important that you know the following:

  • The controller of your personal data is, as a general rule, the real estate agency or professional (Client) with whom you have or have initiated a commercial relationship, and not Bricktech. That Client must identify itself to you and inform you of your rights in accordance with Articles 13 and 14 of the GDPR.
  • Bricktech processes your data, as a general rule, as processor on behalf of the corresponding Client, providing the technological support (Sofía and Bricktech Intelligence) necessary to handle and qualify your enquiry. Bricktech does not decide the purposes or essential means of this processing; it acts on the Client’s instructions.
  • To the extent that Bricktech uses data from your interactions with Sofía in aggregated, anonymized or pseudonymized form, without it being possible to identify you, for the purpose of generally improving its artificial intelligence models, Bricktech acts as an independent controller solely for that specific purpose of technological improvement.

9. Data processed about Contacts

  • Identification and contact data: name, telephone/WhatsApp number and, where applicable, email address, provided by you when starting the conversation with Sofía or filling in a contact form of the agency.
  • Conversation content: the messages exchanged with Sofía, including your answers to the qualification questions (intent, budget, financing, property preferences, etc.).
  • Source channel: the channel through which you initiated contact (WhatsApp, Facebook Messenger, Instagram direct messages, contact form on social media, real estate portal or the agency’s website), and the specific ad or property from which you arrived, when that information is available.
  • Data from contact forms on Meta platforms: when you fill in a contact form (“lead form”) published by an agency on Facebook or Instagram, Bricktech receives from Meta Platforms, Inc. the answers you have provided in that form —generally, name, telephone number, email address and the answers to the questions the agency has configured— for the sole purpose of delivering them to that agency through the Platform. Bricktech does not obtain from Meta any data from your profile other than what you yourself have entered in the form, and does not use that data for any purpose of its own.
  • Bricktech Intelligence score: an indicative purchase-intent score (0 to 100), generated from the content of the conversation and your behavior.
  • Commercial follow-up data: the status of your request within the Client’s pipeline and the follow-up reminders managed by its team.

10. Purposes and legal basis (Contacts)

  • To handle and qualify your enquiry or request for real estate information. Legal basis: performance of a pre-contractual relationship with the Client (Article 6(1)(b) GDPR) and/or the Client’s legitimate interest in managing its commercial activity (Article 6(1)(f) GDPR).
  • To assign an indicative interest/intent score through Bricktech Intelligence, in support of the commercial work of the Client’s human team. Legal basis: the Client’s legitimate interest (Article 6(1)(f) GDPR). This score is not used, on its own, to make decisions with significant legal effects on you without human intervention (Article 22 GDPR).
  • To manage the commercial follow-up of your request by the Client’s team. Legal basis: performance of the pre-contractual or contractual relationship with the Client (Article 6(1)(b) GDPR).
  • Aggregated and anonymized improvement of Bricktech’s AI models (Sofía and Bricktech Intelligence), where appropriate. Legal basis: Bricktech’s legitimate interest (Article 6(1)(f) GDPR), limited to data that does not allow you to be identified.

11. Automated decisions (Contacts)

The score assigned by Bricktech Intelligence is an indicative estimate, not an automated decision with significant legal effects on you within the meaning of Article 22 of the GDPR. The final decision on how your request is handled commercially always rests with the Client’s human team, not with an automated system. If you consider that a decision significantly affecting you has been made based solely on automated processing, you may request the corresponding Client to provide human intervention, express your point of view and contest the decision.

12. Transparency on the use of artificial intelligence (Contacts)

Sofía identifies itself as an automated conversational assistant / artificial intelligence system, without causing confusion as to its non-human nature, in accordance with the applicable algorithmic transparency requirements (including, where applicable, Article 50 of Regulation (EU) 2024/1689 on Artificial Intelligence). You may request at any time to be attended to by a person from the Client’s team.

13. Retention (Contacts)

The data from conversations with Sofía and the associated score will be kept for as long as necessary for the Client’s commercial handling of your request and in accordance with the retention criteria that the Client establishes as controller, without prejudice to the blocking and retention periods that may result from legal obligations applicable to the Client or to Bricktech.

Data from contact forms published on Meta platforms follows the same criterion: it is kept for as long as the Client needs it for the commercial handling of your request. Bricktech also keeps a copy of the original submission received from Meta for a maximum of 90 days, for the sole purpose of being able to reprocess the delivery in the event of a technical failure; after that period, the copy is deleted automatically. Access to this data within the Platform is restricted to the Authorized Users of the recipient agency and to the Bricktech technical staff strictly necessary to provide support.

Block D · Common provisions

14. Recipients and processors

As a general rule, your data will not be disclosed to third parties except in the following cases:

  • Technology infrastructure providers (hosting, cloud computing), acting as Bricktech’s processors.
  • Meta Platforms, Inc. (WhatsApp Business Platform, Facebook and Instagram), to the extent that the Platform integrates with its services in order to: route conversations with Sofía through WhatsApp, Facebook Messenger and Instagram direct messages; publish the agency’s property listings on its Facebook Page and Instagram account; receive the answers to the contact forms that the agency publishes on those platforms; and create and measure, on the agency’s behalf, the advertising campaigns and the property catalog associated with its account. This processing is additionally governed by Meta Platforms, Inc.’s own terms and privacy policies. Bricktech accesses these services only with the authorization that the agency expressly grants when connecting its accounts, and the agency may revoke it at any time from the Platform.
  • Google LLC (Google Calendar), only when an Authorized User connects their Google account: Bricktech sends Google the visit data described in section 7a to create and update the events in their calendar, and reads the busy intervals from it. This processing is additionally governed by Google’s terms and privacy policy.
  • Providers of the artificial intelligence models underlying Sofía and Bricktech Intelligence, acting as processors or sub-processors, subject to the corresponding contractual safeguards.
  • Public authorities, courts and tribunals, where there is a legal obligation to disclose.
  • Professional advisors (administrative agency, legal advisors, auditors), subject to the corresponding duty of confidentiality.

15. International data transfers

Some of the providers listed in the previous section are established outside the European Economic Area, mainly in the United States. This is the case of Meta Platforms, Inc., of Google LLC (when Google Calendar is connected) and of the providers of the artificial intelligence models on which Sofía and Bricktech Intelligence operate. The provision of the service therefore involves international transfers of personal data.

These transfers are covered by one of the mechanisms provided for in Chapter V of the GDPR, depending on the provider concerned: an adequacy decision of the European Commission, where the provider is certified under the EU-U.S. Data Privacy Framework; or, failing that, the Standard Contractual Clauses approved by the European Commission.

The Platform’s hosting infrastructure and databases are located in data centers in the European Union. You may request additional information about the safeguards applicable to any of these transfers, or a copy of them, by writing to hola@bricktech.es.

16. Data subjects’ rights

Any person whose data is processed by Bricktech as controller (Website visitors, Clients and Authorized Users, and Contacts with respect to the aggregated processing described in section 8.3) has the right to:

  • Access: know what data of yours we process.
  • Rectification: request the correction of inaccurate data.
  • Erasure: request the deletion of your data when it is no longer necessary or you withdraw your consent.
  • Objection: object to processing based on legitimate interest, including profiling.
  • Restriction of processing: request that the processing of your data be temporarily restricted.
  • Portability: receive your data in a structured, commonly used format, or request its transmission to another controller.
  • Withdraw your consent: at any time, where the processing is based on it, without affecting the lawfulness of prior processing.

You may exercise these rights by contacting Bricktech at the email address hola@bricktech.es, stating the right you wish to exercise and attaching a copy of a document that allows your identity to be verified.

How to request the deletion of your data. To request the deletion of the personal data that Bricktech processes about you, including data from conversations with Sofía on WhatsApp, Facebook Messenger or Instagram and data received through contact forms published on Meta platforms, write to hola@bricktech.es with the subject “Data deletion” («Eliminación de datos»), stating the telephone number, email address or profile from which you contacted us. We will handle your request within a maximum of one month. If the data was provided to an agency that uses the Platform, we will forward your request to that agency as controller and will inform you of this.

Google Calendar data. If you have connected your Google account, you can delete at any time the data from your calendar kept by Bricktech by disconnecting Google Calendar from the Platform, as described in section 7a, or by writing to hola@bricktech.es.

If you are a Contact and wish to exercise your rights regarding the data processed in the context of your relationship with an agency (Client), you must contact that agency directly as controller. If you contact Bricktech, we will redirect you to the corresponding Client, without prejudice to providing such cooperation as may be appropriate under the agreement entered into with that Client.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), at https://www.aepd.es, if you consider that the processing of your data does not comply with the regulations in force.

17. Data security

Bricktech applies appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR, including, among others, encryption of communications, access control, regular backups and internal security incident management policies.

18. Minors

The Platform and the Website are aimed at professionals and companies in the real estate sector, as well as adults acting as leads or prospective clients of those agencies. Bricktech does not knowingly collect data from minors. If you become aware that a minor has provided personal data through the Platform, please let us know via the contact email address.

19. Changes to this Policy

Bricktech may amend this Policy to adapt it to legislative or case-law developments or to changes in its services. Material changes will be notified through the Website or the Platform, or by email where appropriate.

20. Contact

For any matter relating to this Privacy Policy or the exercise of your rights, you may contact BRICKTECH LABS, S.L.U. by email at hola@bricktech.es or through the contact channels available on the Website https://bricktech.es/.