Who We Are

Brixx is operated by Brixx Online Limited, which is the data controller responsible for the personal data described in this Privacy Policy.

Contact email: info@brixx.com
Address: Grangehurst, La Grange, St Peter Port, Guernsey. GY1 2QH

Data Protection Officer (DPO): Barrie Baxter
DPO email: barrie.baxter@brixx.com

What Data We Collect

We collect personal data to provide Brixx as a financial forecasting and business planning platform where users create accounts to build financial models, cash flow forecasts, and business plans. The types of personal data we collect include:

Account and profile data: name, email address, password (stored in a protected form), and account settings.

Financial forecasting and planning content you submit: the information you enter into your models, forecasts, and business plans (for example, revenue and cost assumptions, cash flow inputs, and planning notes).

Payment and billing information: billing contact details and payment-related information needed to process payments (payment processing is handled through payment processors; we do not need to receive or store full payment card details to process a transaction).

Marketing contact data: your email address and your marketing preferences when you sign up to receive marketing emails from us.

Social media data: information you provide or share when you interact with our social media pages or use social media features made available on our website (the data you share may depend on your social media account settings).

Usage data (with your consent): information about how you use our website and platform collected through analytics technologies, which may include pages viewed, features used, and interactions with the service.

Cookie consent preferences: your choices about cookies and similar technologies, recorded through our consent management system.

Device and technical data: IP address, browser type, device identifiers, operating system, and similar technical information necessary to load and protect the service.

Sources of personal data:

Directly from you: when you create an account, enter information into the platform, contact us, subscribe to marketing, make a purchase, or interact with our social media presence.

Automatically: when you use the website and platform, we collect device and technical data and certain logs generated by your browser and our systems.

From cookies and similar technologies: we store essential cookies as needed for the site to function, and we collect non-essential analytics and advertising-related data only when you choose to allow those cookies.

Whether you must provide data:

Some personal data is required to create and manage your account and to provide the platform and paid features. If you do not provide this data, we may not be able to provide the service to you.

Providing data for analytics, advertising-related cookies, and marketing emails is optional and depends on your choices. You can withdraw your consent at any time.

How We Use Your Data

We use your personal data for the purposes below. For each purpose, we rely on either contract performance or your consent, depending on the activity.

To provide the Brixx platform and operate your account (contract): to create and manage your account, enable you to build and store financial models, cash flow forecasts, and business plans, and provide core platform functionality.

To provide customer support and respond to your requests (contract): to respond when you contact us and to help resolve issues related to your account or use of the platform.

To process payments (contract): to set up subscriptions or paid services and to process transactions through payment processors.

To measure and improve how the website and platform are used (consent): to collect analytics data to understand usage patterns and improve performance and user experience.

To send marketing emails (consent): to send you marketing communications where you have chosen to receive them, and to manage your marketing preferences.

To display personalized advertising (consent): to support advertising-related technologies that may be used to tailor advertising based on your interactions, where you choose to allow advertising cookies.

Who We Share Your Data With

We share personal data only as needed to provide the service and for the purposes described in this Privacy Policy.

We use our own consent management system (Trustwards) to record and manage your cookie preferences. This data is processed internally and not shared with third parties.

We may share personal data with the following categories of third-party service providers, depending on how you use the service and the choices you make (for example, your cookie preferences). These providers process personal data under their own privacy policies and, where they act on our instructions, under contractual terms designed to protect your data:

Content delivery network and security services (Cloudflare): to help deliver website content, protect against malicious traffic, and support performance and security. This may involve processing device and technical data such as IP address and related request metadata, and may involve the use of cookies or similar technologies for security and performance purposes.

Payment processors: to process subscription payments and related billing activities.

Email service providers: to send service-related messages and, where you have consented, marketing emails.

EngageBay CRM: to manage customer relationship information and communications workflows.

Analytics services: to collect usage data for measurement and improvement, where you have consented to analytics cookies.

Advertising networks: to support advertising-related technologies, where you have consented to advertising cookies.

Social media platforms: when you interact with our social media pages or use social media features on our website, those platforms may receive data in accordance with their own privacy policies and your settings.

International Data Transfers

We are based in Guernsey. Some of the third-party service categories we use (such as payment processors, email service providers, CRM, analytics services, advertising networks, and social media platforms) may involve processing in other countries, depending on the specific providers used and how their infrastructure is configured.

Cloudflare is a US-based provider and may process personal data in the United States and other locations where it operates, depending on how its infrastructure is configured.

Where personal data of individuals in the EU/EEA, UK, or Switzerland is transferred internationally, we use appropriate safeguards recognized for international transfers, such as Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum (where relevant), and/or reliance on an adequacy decision where applicable (for example, where a provider is certified under the EU-U.S. Data Privacy Framework), depending on the destination and provider.

Our consent management system (Trustwards) is based in Spain (EU), so consent data is not transferred internationally.

How Long We Keep Your Data

We keep personal data for different periods depending on the type of data and why we use it. Each retention period below is independent.

User account and service data: “When the services are terminated or completed, plus 6 months.”

Cookie consent records: 10 years (to demonstrate compliance and address potential claims within legal limitation periods).

Security logs and technical records: 12 months.

Tax and accounting records: 10 years (legal requirement).

Analytics data: until consent is withdrawn or according to the analytics tool retention settings.

Advertising/marketing tracking data: until consent is withdrawn.

Marketing email data: until consent is withdrawn or user unsubscribes.

Social media integration data: until consent is withdrawn.

Your Rights

Depending on where you live and the laws that apply, you may have the following rights regarding your personal data:

Access: the right to request access to the personal data we hold about you.

Correction: the right to correct inaccurate personal data and, in some jurisdictions, to complete incomplete data.

Deletion: the right to request deletion of your personal data in certain circumstances.

Restriction: the right to request that we limit the processing of your personal data in certain circumstances.

Portability: the right to receive certain personal data in a structured, commonly used format and to request that it be transferred to another provider where technically feasible.

Objection: the right to object to certain processing of your personal data.

Withdraw consent: where we rely on consent, the right to withdraw your consent at any time (this does not affect processing already carried out before you withdrew consent).

Not to be subject to certain automated decisions: the right not to be subject to automated decision-making or profiling that produces legal effects or similarly significantly affects you.

How to exercise your rights: please contact us at info@brixx.com. We may need to verify your identity before fulfilling your request.

Response timing: we aim to respond within one month where GDPR or LGPD applies, within 45 days where CCPA/CPRA applies (and we may extend by an additional 45 days with notice where permitted), and within 30 days where PIPEDA applies.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Children’s Privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

Data Security

We implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. No method of transmission over the Internet or method of electronic storage is 100% secure, so we cannot guarantee absolute security. We take reasonable precautions to reduce risk and to help protect your information.

Data Breach Notification

We maintain procedures to detect, report, and investigate security incidents. If a personal data breach occurs that poses a high risk to your rights and freedoms, we will notify you without undue delay and provide information about the nature of the breach, the likely consequences, and the measures taken or proposed to address it. If you suspect a security issue, please contact us at info@brixx.com.

How to Lodge a Complaint

We encourage you to contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with the competent authority in your jurisdiction.

California consumers may contact the California Privacy Protection Agency (CPPA): https://cppa.ca.gov/

Brazilian data subjects may contact the ANPD (Autoridade Nacional de Proteção de Dados): https://www.gov.br/anpd/

Canadian individuals may contact the Office of the Privacy Commissioner of Canada (OPC): https://www.priv.gc.ca/

Updates to This Policy

We review and update this Privacy Policy periodically. The “Last updated” date at the top of this policy indicates when changes were last made. If we make significant changes, we will provide notice through the website or by email. Changes take effect from the date indicated at the top of this policy. Where processing is based on consent, we will request new consent when required.

Contact Us

Email: info@brixx.com
Address: Grangehurst, La Grange, St Peter Port, Guernsey. GY1 2QH
Data Controller: Brixx Online Limited

California Privacy Rights (CCPA/CPRA)

This section applies to California consumers.

Notice at Collection: In the last 12 months, we have collected the following categories of personal information, depending on how you use Brixx and the choices you make:

Identifiers: such as name, email address, IP address, and online identifiers.

Customer records information: such as billing contact details associated with your account.

Commercial information: such as subscription status and transaction-related records for purchases you make.

Internet or other electronic network activity information: such as interactions with our website and platform, including analytics data where you allow analytics cookies.

Inferences: such as preferences inferred from your interactions for marketing or advertising-related purposes where you allow relevant cookies.

Business and commercial purposes for collection: to provide and operate the platform, manage accounts, process payments, provide customer support, measure and improve the service, send marketing emails where you have chosen to receive them, and support advertising-related technologies where you allow advertising cookies.

Sale or sharing: We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

Your rights: You have the right to know what personal information is collected, used, shared, or sold; the right to delete personal information; the right to correct inaccurate personal information; the right to opt-out of the sale or sharing of personal information through a “Do Not Sell or Share My Personal Information” request; the right to limit the use and disclosure of sensitive personal information; and the right to not be discriminated against for exercising your rights.

How to submit requests: You can submit a request by contacting us at info@brixx.com. Please describe your request with enough detail for us to understand and respond.

Verification: We will take reasonable steps to verify your identity before responding, which may include verifying access to the email address associated with your account and requesting additional information where necessary to protect against unauthorized access.

Timing: We respond to verified requests within 45 days. If we need more time, we may extend by an additional 45 days and will notify you of the reason for the extension.

Global Privacy Control: Where required, we treat browser-based Global Privacy Control (GPC) signals as valid requests to opt out of sale or sharing for the browser or device that sends the signal.

Brazilian Data Protection (LGPD)

This section applies to Brazilian data subjects.

Legal bases: We process personal data to provide the Brixx platform and related support based on performance of a contract. We process analytics data, advertising-related tracking data, marketing email data, and social media integration data based on your consent, which you can withdraw at any time.

Your rights: You may request confirmation that we process your data and access to it; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary data; portability where applicable; deletion of personal data processed with consent; information about sharing; and withdrawal of consent.

How to exercise rights: Contact us at info@brixx.com. You may also contact our Data Protection Officer, Barrie Baxter, at barrie.baxter@brixx.com.

Complaints: You have the right to petition the ANPD (Autoridade Nacional de Proteção de Dados).

Canadian Privacy Rights (PIPEDA)

This section applies to Canadian individuals.

Accountability: We are responsible for personal information under our control and have policies and practices designed to help protect it and handle it appropriately.

Meaningful consent: We seek meaningful consent for the collection, use, and disclosure of personal information, and we provide choices for optional processing such as marketing emails and non-essential cookies used for analytics and advertising-related purposes.

Access and accuracy: You have the right to request access to your personal information and to challenge the accuracy and completeness of the information, and to have it amended as appropriate.

Withdrawing consent: You can withdraw consent for processing that is based on consent, subject to legal or contractual restrictions, by contacting us at info@brixx.com or by using available controls such as unsubscribing from marketing emails and adjusting cookie preferences.

Complaints: You have the right to complain to the Office of the Privacy Commissioner of Canada (OPC).