Privacy policy

1. Who processes your data: two different roles

Bloka is a brand of Iccom S.r.l. (Via Paolo Veronese 216/5, 10148 Torino (TO), Italia; VAT IT01111140073). Depending on the data, we act in one of two roles:

• Controller: for data of visitors to this website, of people who contact us through the contact form or by email, and of our customers (property management firms) and their contact persons in the commercial, contractual and billing relationship.
• Processor (Art. 28 GDPR): for all data about communities, owners, residents, suppliers and other people that the property management firm enters or manages in the platform. In that case the controller is the property management firm that contracts Bloka (or, where applicable, the owners’ community it represents), and we process the data only on its documented instructions, under the data processing agreement.

If you are an owner or resident and wish to exercise your rights over your community’s data, please contact your property manager first. If you write to us, we will forward your request to the controller without delay.

2. Data we process

• Contact form: name, email, profile (manager, president, owner or other), approximate number of communities, your message and your acceptance of this policy.
• Customers: identification and contact details of the firm’s staff, billing data and account usage data.
• As processor, on behalf of the customer: identification and contact details of owners and residents, units and ownership shares, fees, payments and debts, incidents, votes and minutes, community documents and activity and security logs (logins, IP address, device).

We do not ask for special categories of data. We do not take decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR): fee, quorum and majority calculations are support tools validated by the property manager.

3. Purposes and legal bases (where we are controller)

Where we act as processor, the purpose and legal basis are determined by the controller (normally the management of the community under the Spanish Horizontal Property Law and the performance of the management contract).

4. Retention periods

• Contact requests: up to 12 months from the last contact, unless they lead to a contract. The server does not store the message content: it only forwards it to the info@bloka.com mailbox.
• Customer data: for the duration of the contract and afterwards for the legally required limitation and retention periods.
• Platform data (as processor), default rules: activity logs, 12 months; notifications, 18 months; community financial and accounting records, the period required by Spanish law (at least 6 years under Art. 30 of the Commercial Code, plus tax-law periods); text sent to AI features, 90 days; community minutes and documents, as long as the customer decides.
• Encrypted backups: daily copies 6 months and one monthly copy 5 years; deleted data disappears from them when these periods expire.
• When the contract ends, the customer has 30 days to export its data; it is then deleted, except data that must be kept by law.

5. Recipients and sub-processors

We do not sell personal data. To provide the service we use the following providers, bound by data processing agreements:

Data may also be disclosed to banks for fee collection, to other owners of the same community where the Horizontal Property Law requires it, and to authorities where there is a legal obligation. We will inform our customers in advance of any change of sub-processors.

6. International transfers

Some providers (Google, Stripe and Anthropic) may process data in the United States. These transfers rely on the EU-US Data Privacy Framework adequacy decision for certified entities and/or on the European Commission’s standard contractual clauses (Art. 46 GDPR), with supplementary measures such as encryption in transit. You can request a copy of the safeguards by writing to privacy@bloka.com.

7. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time without affecting the lawfulness of prior processing.

• In the app: from your profile you can download a copy of your data (export) and request deletion of your account. The account is deactivated immediately and the data is deleted or anonymised within 30 days, except data that must be kept by law (for example, the community’s financial records).
• By email: privacy@bloka.com. We will reply within one month. If the data belongs to your community, we will forward the request to your property manager, who is the controller.

8. Complaints

If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, https://www.aepd.es, or with the supervisory authority of your country of residence (in Italy, the Garante per la protezione dei dati personali). We would appreciate it if you contacted us first so we can try to resolve it.

9. Privacy contact and changes

For any privacy question write to privacy@bloka.com or by post to Iccom S.r.l., Via Paolo Veronese 216/5, 10148 Torino (TO), Italia. If we change this policy substantially, we will announce it in the platform or by email before the change takes effect; the current version and its date are shown on this page.