How Bricks processes Customer Data

For personal data the Customer submits to or generates in its workspace, the Customer is the controller and Bricks is the processor. Each party is independently responsible for personal data it processes as a controller, as described in the Privacy Policy.

These terms apply for the period Bricks processes Customer Data to provide the service and survive termination for as long as that processing continues.

Bricks will process Customer Data only to provide, secure, support and maintain the service; comply with the Customer’s documented use of the product and support requests; and meet applicable legal obligations. The Terms, the Customer’s product configuration and lawful support requests are documented instructions.

If Bricks reasonably believes an instruction violates applicable data-protection law, it may pause the affected processing and ask the Customer to amend or confirm the instruction. Where law requires Bricks to process data independently, Bricks will inform the Customer unless legally prohibited.

The Customer is responsible for the lawfulness, fairness and accuracy of Customer Data; required notices and consents; data-subject requests; the authority of its users; and configuring access consistently with data minimisation. The Customer must not instruct Bricks to process data unlawfully.

Bricks limits Customer Data access to personnel and service providers who need it for their role. Those people are subject to confidentiality duties or equivalent legal obligations and receive access appropriate to their responsibilities.

Bricks maintains measures appropriate to the nature of the service and the risks of the processing, including tenant/workspace isolation, role-based access, encryption in transit and at rest, additional protection for selected sensitive fields, logging, monitoring, backup and recovery controls, and vulnerability and incident handling.

Security measures evolve with risk and technology. Bricks may update them provided the overall protection of Customer Data is not materially reduced.

The Customer generally authorises Bricks to use subprocessors needed to provide the service. The current categories and principal providers are listed in the Privacy Policy. Bricks remains responsible for imposing appropriate data-protection obligations on subprocessors for the processing they perform for Bricks.

Bricks will keep the published list current. A Customer with a reasonable data-protection objection to a new subprocessor should contact Bricks promptly so the parties can discuss an alternative. If no reasonable alternative is available, either party may end the affected service without that ending excusing fees already due.

The Customer authorises processing in the locations identified in the Privacy Policy. Where Customer Data is transferred outside the UAE, Bricks will use the contractual, organisational and technical protections required for the applicable transfer and will provide reasonable transfer information on request.

Taking account of the nature of processing and the information available to Bricks, Bricks will reasonably assist the Customer with data-subject requests, security, breach assessment, impact assessments and regulator enquiries relating to the service. The Customer remains responsible for deciding how to respond as controller.

Bricks will notify the Customer without undue delay after confirming a personal-data breach affecting Customer Data and will provide available information reasonably needed for the Customer’s assessment and notification duties. Notification is not an admission of fault or liability. The Customer is responsible for notifying affected people and authorities unless the parties agree otherwise in writing.

During the service, the Customer can use available product functions and may request reasonable assistance to export Customer Data. Following termination or a verified request, Bricks will return or delete Customer Data unless retention is required by law. Export and erasure are currently request-based processes rather than guaranteed self-service or fixed-day automated jobs.

Residual encrypted backups are protected from ordinary use and removed through their normal lifecycle, unless they must be preserved for security, dispute or legal reasons.

Bricks will provide information reasonably necessary to demonstrate compliance with these terms. If that information is insufficient, the Customer may request a reasonable review no more than once annually, unless an incident or regulator requires otherwise. Reviews must protect other customers, security, confidentiality and service continuity.

Subject matter: hosting and operating property-management software.

Duration: the service term plus limited retention and backup periods.

People: Customer personnel, tenants, landlords, occupants, signatories, vendors, prospects and other people recorded by the Customer.

Data: account and contact details; property, ownership, tenancy, maintenance, inspection, financial-record and communication data; identity documents and identifiers; signatures; and security/audit information.

Operations: collection, organisation, storage, retrieval, display, transmission, backup, protection, support, export and deletion as instructed through the service.

If these terms conflict with the Terms of Service on processing Customer Data, these terms control for that issue. The liability provisions in the Terms of Service apply to these terms to the maximum extent permitted by law.