Privacy Policy & Personal Data Protection
Last Updated: July 12, 2026
1. Introduction & Processing Roles
Safeguarding your privacy and transparently managing your data are a core priority and commitment of the BMExpert team. This Privacy Policy has been drafted to clearly and honestly explain how our online building management platform (hereinafter the “Platform”, “we” or “us”) collects, protects, and processes your information, in full compliance with the General Data Protection Regulation (GDPR).
- For Administrators / Management Companies: When you register as a client on our Platform, BMExpert acts as the “Data Controller” for your own account and subscription details.
- For Owners & Tenants: For data relating to the residents of a building, the respective Administrator or Management Company acts as the “Data Controller”, as they determine the purpose of entering it into the system. BMExpert acts exclusively as the “Data Processor”, merely providing the technological infrastructure for recording it.
2. What data do we collect?
Based on the infrastructure of our Platform, we collect strictly and only the data absolutely necessary for the operation of the management system. We do not store national identity documents (e.g., ID cards) or tax identification numbers of users.
2.1 Data we collect directly from you
- Profile & Account Details: Full name, phone number, country of residence, email address (via the authentication system), and notification preferences.
- Building & Property Details: Building address, city, postal code, country of building location, apartment number, residency/ownership history (from/to dates), and architectural plans.
- Financial Details & Subscriptions: Payment history, amounts, payment method, subscription and customer identifiers via the payment provider, as well as expense document details (invoice number, supplier name, receipt files).
- Communications & Activity: Maintenance requests, participation/voting rights in votings, and announcements.
2.2 Data we collect about you from third parties
We may collect data about you (such as full name, email, apartment number) not directly from you, but through your building's Administrator or your apartment's Owner, in order to send you an access invitation (invite) to the Platform or to allocate your communal charges.
2.3 Information collected automatically
- Usage & Device Data: How you interact with the platform, IP addresses, login times, and security metadata during your authentication.
3. Why do we process your data and on what legal basis?
We process your personal data on the following bases:
- Performance of Contract: To provide you with the Platform's services (e.g., communal charge calculation, maintenance request recording, conducting votes) and to execute the Terms of Service.
- Legitimate Interests: For the continuous improvement of the Platform, technical support, and ensuring the security of our systems against malicious activities.
- Legal Obligation: To comply with applicable laws and regulations.
- Consent: Where you have given us explicit consent (e.g., for sending newsletters).
4. Data Sharing & Recipients
We do not sell or trade your personal details to third parties. Your data may be shared exclusively with:
- Building Members (Internal): Other residents, owners, and administrators of your building gain access to specific information about you, strictly based on their role permissions (Role-Based Access Control).
- Data Processors (Partners): Trusted third-party providers that support our technological infrastructure, such as the database hosting company (Supabase) and the electronic payment processing provider (Stripe) through which financial transactions are executed.
5. How long do we retain your data?
We retain your data for as long as your account remains active (rental/ownership history) or for as long as required to provide you with our services.
In the event of deletion of your account or building, the data is deleted. We may retain certain data (e.g., subscription history, financial transaction records) for a longer period, exclusively to comply with legal/tax obligations or for the defence of legal claims.
6. Data Security
We implement modern technical and organisational measures (such as Row Level Security in the database, strict access control protocols, and encryption) to protect your personal data from unauthorised access, loss, alteration, or destruction.
7. Your Rights
Under the GDPR, you retain the following rights regarding your personal data:
- Access: To request information about the data we hold about you.
- Rectification: To request the correction of inaccurate or incomplete data.
- Erasure (Right to be Forgotten): To request the deletion of your data, provided there is no legal or operational reason for retaining it (e.g., active financial obligations).
- Restriction & Objection: To request restriction of processing or to object to it.
- Portability: To export the data you have provided us yourself, through the available reports and functions of the Platform.
- Withdrawal of Consent: To withdraw your consent at any time, where it was requested.
8. Contact
To exercise your rights or if you have any questions regarding this Privacy Policy, please contact us:
- Email: support@bmexpert.com
- Website: https://bmexpert.org