Privacy Policy
Spanish contractual version — governing text. Last updated: 28 September 2026.
In the event of any discrepancy between this version and any translation into another language, the Spanish version shall prevail.
1. Data controller
Proxima Data Solutions SL (“PDS”, “BrickChoice”), CIF ESB70870316, Passeig de Gràcia 95, 5-1ª, Barcelona, 08008, Spain. Contact: privacy@brickchoice.net.
PDS is not required to appoint a Data Protection Officer (DPO) pursuant to Article 37 GDPR, but handles privacy-related requests through the address indicated above.
2. What data we process
- Identification and contact data: name, email address and company name (optional).
- Access and authentication data: login credentials and access logs (through Microsoft Entra External ID).
- Preferences: user settings, language preference and saved filter lists.
- Navigation data: IP address, browser type, pages visited and cookies.
- Billing data: necessary for payment and subscription management (processed through Stripe/Finseed).
- Investment file data: notes, investment status and bidding records that you add yourself to an auction file.
- Input data for AI analysis: auction data provided to the AI model for analysis; personal data from the file is deliberately not provided, as set out in section 8.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account management and access to the Platform | Performance of the contract (Article 6(1)(b) GDPR) |
| Provision of the contracted service and subscription management | Performance of the contract (Article 6(1)(b) GDPR) |
| Service-related communications (notices, incidents, changes) | Performance of the contract (Article 6(1)(b) GDPR) |
| Personalisation of the user experience | Legitimate interest (Article 6(1)(f) GDPR) |
| Commercial communications | Consent (Article 6(1)(a) GDPR) |
| Platform security and fraud prevention | Legitimate interest (Article 6(1)(f) GDPR) |
| Compliance with tax, accounting and legal obligations | Legal obligation (Article 6(1)(c) GDPR) |
| Statistical analysis and service improvement | Legitimate interest (Article 6(1)(f) GDPR) |
Where the legal basis is consent, you may withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.
4. Retention periods
- Account/profile data: for the duration of the contractual relationship. After termination, it will be retained in blocked form for 5 years, in accordance with the general limitation period for personal actions without a specific period under Article 1964.2 of the Civil Code. During this period it will only be available for handling potential legal claims and not for normal use of the Platform.
- Billing data: 6 years from the date of issue of the invoice, in accordance with the obligation to retain business books and documentation under Article 30 of the Commercial Code. This period also covers the 4-year tax limitation period under applicable tax legislation.
- Navigation data: maximum 13 months, in accordance with the criterion applied by BrickChoice to this type of data and the applicable AEPD guidelines.
- Cookies and local storage technologies: retention periods and device-persistence conditions are described in the Cookie Policy. The local storage technologies described there may remain on the device for the periods indicated in that Policy, which may differ from the retention periods for navigation data processed by BrickChoice.
- Data processed on the basis of consent: until consent is withdrawn, without prejudice to any legal retention obligations that may apply.
Once these periods have expired, the data will be irreversibly deleted or anonymised.
5. Disclosure to third parties
BrickChoice may disclose data to the following data processors, exclusively to the extent necessary for them to provide their services and under the corresponding data processing agreement:
- Stripe — payment processing.
- Finseed (Chapter Five SL) — VAT determination and invoicing in accordance with Verifactu.
- Microsoft Azure OpenAI — AI-generated investment analysis.
- DeepL — automatic translation of source data.
- Microsoft Azure Communication Services — transactional email (invoices, notifications).
- Microsoft Entra External ID — identity and login management.
BrickChoice never sells, rents or transfers personal data to third parties for commercial purposes.
6. International transfers
Some of the processors listed above are established in the United States or are linked to US entities (Microsoft/Stripe). Transfers outside the EEA are carried out using the appropriate safeguards required by applicable law, including, where applicable, the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses (SCCs) approved by the European Commission.
You may request additional information from privacy@brickchoice.net.
7. Data subject rights
In accordance with Articles 15 to 22 GDPR and Organic Law 3/2018 of 5 December (LOPDGDD), you may exercise the following rights at any time by sending a request to privacy@brickchoice.net. Where necessary to verify your identity, we may request a copy of an identification document, applying the appropriate safeguards and data-minimisation criteria:
- Access (Article 15 GDPR): to know what personal data we process about you.
- Rectification (Article 16 GDPR): to correct inaccurate or incomplete data.
- Erasure (Article 17 GDPR): to request deletion of your data where it is no longer necessary or where a legal ground applies.
- Restriction (Article 18 GDPR): to request restriction of processing in certain circumstances.
- Objection (Article 21 GDPR): to object to processing, including profiling where applicable.
- Data portability (Article 20 GDPR): to receive your data in a structured, commonly used and machine-readable format.
We will respond within a maximum of 1 month, with the possibility of extending this by a further 2 months in the case of complex or numerous requests, in accordance with the GDPR.
8. Automated decision-making and profiling
BrickChoice does not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR.
The AI-generated investment analysis is an informational tool. You personally make any investment decision.
9. Right to lodge a complaint
If you believe that the processing of your personal data infringes applicable law, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
10. Security
BrickChoice applies appropriate technical and organisational measures, in accordance with Article 32 GDPR, to protect personal data against unauthorised access, alteration, disclosure or destruction.
11. Cookie Policy
Please consult the Cookie Policy, a separate document, for complete information about the cookies and storage technologies used, their purposes and how to manage them.
12. Changes to this Privacy Policy
We may amend this Privacy Policy to adapt it to legislative or regulatory changes. Material changes will be communicated through the Platform or by email. We recommend checking this page periodically.
13. Applicable law and jurisdiction
This Privacy Policy shall be governed by Spanish and European data protection law, in particular Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).
In the event of a dispute, the courts and tribunals of Barcelona (Passeig de Gràcia 95, 5-1ª, Barcelona, 08008, Spain) shall have jurisdiction, without prejudice to the mandatory rules that apply where the user has the status of consumer and confer jurisdiction on the courts and tribunals of the consumer’s domicile.
In the event of any discrepancy between language versions, the Spanish version shall prevail.
Last updated: 28 September 2026