PRIVACY POLICY

1. Data controller

2. Purposes of processing

Personal data provided through the Website, the contact form or any other channel made available by BRS will be processed for the following purposes:

● Handling and managing requests for information, quotes and enquiries submitted by users.
● Providing relocation, immigration and real estate advisory services contracted by the client.
● Managing the contractual and pre-contractual relationship with clients, including invoicing and compliance with legal, tax and accounting obligations.
● Sending commercial communications about BRS services, provided the user has given express consent or there is a pre-existing contractual relationship, in accordance with Article 21 of the LSSI-CE.
● Complying with the legal obligations applicable to BRS’s activity.

3. Legal basis

The legal basis for processing is, as applicable: (i) performance of a contract or pre-contractual measures requested by the data subject (Art. 6(1)(b) GDPR); (ii) the data subject’s express consent (Art. 6(1)(a) GDPR), particularly for sending commercial communications; (iii) compliance with legal obligations applicable to the controller (Art. 6(1)(c) GDPR); and (iv) BRS’s legitimate interest in the ordinary management of its business activity and the security of its Website (Art. 6(1)(f) GDPR), an interest that never overrides the fundamental rights and freedoms of the data subject.

4. Data Protection Officer

BRS has appointed a Data Protection Officer (DPO), a role performed by SECUONE AI, S.L., who may be contacted by data subjects for any matter relating to the processing of their personal data and the exercise of the rights recognisedunder the GDPR, at the contact address indicated in section 1 of this Privacy Policy.

5. Categories of data processed

Depending on the service requested, BRS processes the following categories of data: identification and contact data (name, surname, e-mail address, telephone number, postal address); employment or professional data related to the relocation process; and, where applicable, data relating to the relocated individual and their family members (ID document, passport or foreign identity number, immigration status) where strictly necessary for the provision of the contracted immigration advisory service. No special categories of data are requested or processed unless strictly necessary and subject to the reinforced safeguards required under Article 9 GDPR.

6. Recipients and data processors

Personal data will not be disclosed to third parties savewhere legally required. However, BRS relies on the following providers, which act as data processors under Article 28 GDPR and with which the corresponding data processing agreement is in place:

● Google Analytics (Google Ireland Limited), for measuring and statistically analysing Website usage.
● Mailchimp and Moosend, as email marketing platforms used exclusively to send newsletters and commercial communications to users who have given their consent.

Where any of these providers is located outside the European Economic Area, the international data transfer will be carried out subject to the safeguards set out in Chapter V of the GDPR, in particular through the Standard Contractual Clauses approved by the European Commission.

7. Retention period

Data will be retained for as long as necessary to fulfil the purpose for which it was collected and, in any event, for the legally required periods, including the limitation period for any liability arising from the processing, after which it will be deleted or, where applicable, blocked.

8. Data subject rights

Users may exercise their rights of access, rectification, erasure, objection, restriction of processing and data portability at any time, and may withdraw consent at any time, by writing to info@brs-mobility.com or to the registered office indicated in section 1, enclosing a copy of a valid identity document. Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if they consider that the processing of their data does not comply with applicable law.

9. Minors

The services offered through the Website are intended for adults. Nevertheless, in accordance with Spanish law, the processing of data of minors aged 14 or over is permitted where they act with the consent of their parents, guardians or legal representatives when required by law.

10. Security measures

BRS has implemented the technical and organisationalmeasures necessary to ensure the security, integrity and confidentiality of the personal data processed, and to prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data and the risks to which it is exposed.