Privacy policy

• DeployMeUp, S.L., Tax ID B25977679
• Passatge del Sindicat Agrícola, 29, 25200 Cervera (Lleida), Spain
• Commercial Registry of Lleida, sheet L-37372, section 8, entry 1
• Privacy contact: [email protected]

DeployMeUp, S.L. is the controller of the data of users who sign up to Brotet and of customer companies (name, email, company, billing details), and of any messages you send us.

However, when a company uses Brotet to manage its own data —for example the contacts and subscribers of its newsletters, replies to its forms or its employees' time records— the customer company is the data controller and Brotet acts as a data processor (art. 28 GDPR): we process that data only to provide the service and on the customer's instructions, never for our own purposes.

If you are a newsletter subscriber or an employee of a company that uses Brotet and want to exercise your rights, please contact that company first. If your request reaches us, we will forward it to them.

• Account and use of the service: name, email or login, one-time login codes (stored hashed, expire in minutes), language, optional photo, companies and roles. Legal basis: performance of the contract (art. 6.1.b GDPR).
• Billing and payments: company tax details and invoice history. Card or SEPA account details are handled directly by Stripe; we do not store them. Basis: contract and legal obligation (art. 6.1.b and 6.1.c).
• Security: technical logs (IP address, access times, errors) to protect the service and prevent abuse. Basis: legitimate interest (art. 6.1.f).
• Communications: service emails (login codes, notices, invoices). Basis: contract. If we ever send you marketing, it will only be with your consent or as a customer, and you can unsubscribe at any time.
• Contact: the data you send us by email, in order to reply. Basis: legitimate interest or pre-contractual steps.

To provide the service we rely on these providers, with whom we have signed the corresponding data processing agreements:

• Amazon Web Services EMEA SARL (Amazon SES, region eu-north-1, Stockholm, EU): sending service emails and the newsletters of customer companies.
• Stripe Payments Europe, Ltd. (Ireland): collecting subscription payments by card or SEPA direct debit.
• Application and database hosting: [hosting provider and server location — to be defined].
• If a company connects its social media accounts, posts are sent to the relevant platforms (Meta, LinkedIn, etc.) on its instructions.

Some of these providers may access data from outside the European Economic Area; such transfers rely on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. We never sell data.

• Account data: while the account is active. When you delete it, it is erased (see below).
• Data we process on behalf of customer companies: for the duration of the contract; afterwards it is deleted or returned as the customer instructs.
• Invoices and tax data: for the statutory period (6 years under the Spanish Commercial Code and 4 years for tax purposes).
• Security logs: [period to be confirmed, e.g. 12 months].

After these periods, data may be kept blocked solely to deal with possible legal claims.

You can delete your account at any time from the app (Profile → Delete account) or on the web at brotet.com/app/profile. We will email you a code to confirm.

Your user and any companies where you are the only member are deleted, with all their data. If you are the sole owner of a company with other members, you must transfer ownership first. If you have hours recorded in a company that continues (working-time records the company must keep by law), your user is anonymised instead of deleted.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw consent where processing is based on it, by writing to [email protected] or by post to the address above, stating which right you wish to exercise and proving your identity. We will reply within one month.

You can view, correct and export much of your data directly in the app.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), one-time login codes (hashed, no passwords), third-party secrets encrypted in the database, per-company data separation and role-based access control.

If we change this policy in a significant way, we will let you know by email or in the app.