Platform Privacy Policy
Last updated: September 2026
1. Scope
This policy describes the processing of personal data in the use of the Factic Brain platform. The processing of data relating to visitors of the corporate website is governed by the Website Privacy Policy.
2. Roles of the parties
- With respect to data uploaded by the customer to the Platform, the customer is the data controller and Factic Solutions acts as processor, processing it solely in accordance with the customer's instructions.
- With respect to the user account data required to manage access, authentication and support, Factic Solutions acts as controller.
3. Data processed
- Account data: user identifier, name, business email address and the organisation the user belongs to.
- Usage data and technical logs necessary for security, traceability and the operation of the service.
- Data the customer chooses to upload to the Platform, the content of which is determined by the customer.
4. Purposes
To provide the contracted service, manage access and authentication, provide support, ensure the security and traceability of the service and comply with applicable legal obligations.
5. Legal basis
Performance of the agreement, legitimate interest in the security and continuity of the service, and compliance with legal obligations. For data processed on behalf of the customer, the legal basis is determined by the customer as controller.
6. Processors and sub-processors
Factic Solutions may rely on suppliers acting as sub-processors, subject to contractual obligations equivalent to those undertaken by Factic Solutions. An up-to-date list of sub-processors is available to customers on request. Factic Solutions will give reasonable prior notice of any change so that the customer may object on the terms set out in the data processing addendum.
7. International transfers
Where provision of the service requires an international transfer of data, it will be carried out under one of the mechanisms provided for in Chapter V of the General Data Protection Regulation.
8. Retention
Data processed on behalf of the customer is retained for the term of the agreement and, upon termination, returned or deleted as agreed. Account data is retained for as long as necessary for the purpose justifying it and thereafter blocked for the applicable statutory limitation periods.
9. Security
Factic Solutions applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, and reviews them periodically. Further information on those measures is available to customers on request.
10. Security incidents
Factic Solutions will notify the customer, without undue delay, of any personal data breach of which it becomes aware and which affects the customer, providing the information needed for the customer to comply with its own obligations.
11. Data subject rights
Individuals whose data the customer processes on the Platform should address their requests to the customer, as controller; Factic Solutions will provide reasonable assistance in responding to them. With respect to account data, individuals may exercise their rights of access, rectification, erasure, objection, restriction of processing and portability by contacting [email protected]. They may also lodge a complaint with the Spanish Data Protection Agency.
12. Changes to this policy
This policy may be updated. The version in force is the one published on this page, stating its update date.