Privacy policy

• Controller: [pending]
• Tax ID (NIF): [pending]
• Address: [pending]
• Privacy contact: info@bema.cat

Bema is not yet a registered organisation. Until it is, the data controller is the person listed above. When the organisation is set up, it will become the controller and we will tell you beforehand.

• Account data: email address, username, password (stored encrypted; we cannot see it) and the town you choose.
• Phone number: only if you choose to add it to verify your account.
• Content you publish: diagnoses, proposals, images and, if you provide it, an approximate location.
• Participation: the supports you give and when.
• Communications: messages you send us, for example when you report a problem or write to us through the contact form (name, email and message).
• Technical data: IP address and basic browsing data kept in server logs for security.

We do not ask for special categories of data. If you include them in a public text (for example, about your health), bear in mind that everyone will be able to read them.

• Running your account and your participation: publishing, supporting and showing the town’s priorities. Legal basis: performance of the terms of use you accept when you sign up (Art. 6(1)(b) GDPR).
• Sending you necessary emails, such as account verification, password recovery or our reply to a problem you reported. Legal basis: performance of the terms of use.
• Answering contact-form messages. Legal basis: your consent when you send it (Art. 6(1)(a) GDPR).
• Protecting the platform against abuse, fake accounts and coordinated campaigns. Legal basis: our legitimate interest in running a reliable service (Art. 6(1)(f) GDPR).
• Sending proposals to the administration once they have enough support, when this feature is active. Only the proposal content and aggregated support figures are sent, never your account data. Legal basis: performance of the terms of use.

We do not advertise, sell data or build commercial profiles.

We use an artificial intelligence service (Google Gemini or a compatible provider) to review the wording of diagnoses and proposals, translate them and detect similar texts. We send it the text you write, not your account data.

The AI does not make decisions about you or your proposals: there is no automated decision-making with legal effects (Art. 22 GDPR). Please avoid including other people’s personal data in your texts.

The diagnoses and proposals you publish, and the number of supports they receive, can be seen on the town’s public pages, including by people without an account. Your email address is never shown, and your username does not appear next to what you publish.

To run the platform we rely on providers that process data on our behalf (processors), under contracts that require them to protect it:

• Server and database hosting: [pending].
• Brevo (Sendinblue SAS, France): sending emails and, if needed, verification text messages.
• Google (Firebase): storing the images you upload and protecting against abuse with reCAPTCHA Enterprise.
• Google (Gemini) or a compatible AI provider: the artificial intelligence features described above.
• Dinahosting (Spain): the team’s mailbox, where contact messages arrive.
• Telegram: internal alerts to the team when a contact message arrives (they include the name, email and message).

Some of these providers may process data outside the European Economic Area. In those cases, transfers rely on appropriate safeguards such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

We do not disclose your data to third parties unless required by law.

We keep your account data while your account is active. If you delete it, we will erase or anonymise your personal data. Diagnoses and proposals you have published may be kept anonymously so the public record of the process stays complete.

Contact-form messages are kept as long as needed to deal with them and follow up.

Server logs are kept only as long as needed for security. Some data may be kept blocked for the periods set by law, solely to deal with possible liabilities.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time. Write to info@bema.cat from your account’s email address and say which right you want to exercise. We will reply within one month at most.

If you think we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

You must be at least 14 to sign up, in line with Article 7 of the LOPDGDD. If we find an account belonging to someone under that age, we will delete it.

Connections to the website are encrypted (HTTPS) and passwords are stored encrypted. We limit access to data to the people who need it to run the platform.

If we change this policy, especially when the organisation that will run Bema is set up, we will publish it here and, if the change is significant, let you know by email.