This is an informational translation. In case of any discrepancy, the Spanish version shall prevail. View the Spanish version

Privacy Policy of Bloqia

Última actualización: 16 de octubre de 2026

Bloqia is an application for the management and community living of communities of owners. This policy explains what personal data we process, for what purposes, on what legal basis, and what rights you have, in accordance with Reglamento (UE) 2016/679 (RGPD) and Ley Orgánica 3/2018 (LOPDGDD).

1. Data controller

• Responsable: Mario Burgos
• Contacto de privacidad: privacidad@bloqia.es

Bloqia is currently in a closed testing phase. Once the company owning the service is incorporated, this section will be updated with its corporate name, CIF, and registered office.

2. Two distinct roles: your account and your community

Bloqia operates in two different capacities, and it is important for you to know which one applies to each category of data:

1. Bloqia as controller. For your user account data (registration, authentication, security, support, app usage statistics), Bloqia decides how and for what purposes they are processed: we are the data controller.

2. Bloqia as processor. The data generated within your community (minutes and documents, accounting, incidents, communications between neighbors, reservations, voting) belong to the life of the community of owners. Pursuant to the criteria of the Agencia Española de Protección de Datos, the community of owners is the data controller for such processing, and Bloqia acts as the data processor, subject to the data processing agreement included in the Terms of Use (data processing annex, art. 28 RGPD).

   In practice: for any matter regarding who is a member, what is published, voting, documents, or your community’s accounting, your primary point of contact is your community’s board, directly through the app. Bloqia only steps in for matters that the community cannot resolve: technical infrastructure, platform security, and your user account data.

3. What data we process

Account data (Bloqia as controller):

Community data (community as controller, Bloqia as processor):

• The unit you occupy and your role in the community (owner, resident, president, etc.), and verification status as a neighbor.
• Messages in community chats and any files you attach.
• Community documents (minutes, invoices, budgets) and its accounting.
• Incidents, events, and common area reservations.
• Voting: how you vote is recorded by unit and is visible to the other neighbors in your community, just like in an in-person meeting. Your name is only shown if you have enabled “show my name”.
• Unit emails: the email address and role (owner, tenant or relative) that the board records on a unit for a neighbor who does not use Bloqia yet, so that the board’s communications reach them by email. The recipient is informed in the first email and can unsubscribe with the link included in every message.

We do not process special categories of data (health, political opinions, religion…) and we ask you not to include them in chats or documents.

4. Purposes and legal bases

We do not make automated decisions with legal effects on you, nor do we build commercial profiles. We do not sell your data or share it for advertising purposes.

5. How long we retain data

• Account: as long as it is active. You can delete your account directly from the app (Profile → Delete account): your user profile, community memberships, personal files, and login account will be deleted, and references to your identity in community content (messages, incidents, audit logs, support reports) will be irreversibly anonymized.
• Community content: belongs to the community and is retained as long as the community uses the service (your contributions are anonymized if you delete your account).
• Deleted documents: those from official community folders (minutes, meetings, contracts…) go to a trash folder with no automatic expiration — as community records, only the board can permanently delete them, and this action is logged. Documents in folders created by users are permanently deleted 30 days after being trashed. Attachments from chats and incidents are deleted immediately upon deletion.
• Stamped copy of official documents: when minutes, a meeting notice, an annex to minutes, a debt status certificate, or a payment demand is issued, we save a copy of the PDF and its electronic stamp in a write-once storage that prevents deletion for 6 years (the retention period for board documents under the Ley de Propiedad Horizontal, plus a margin). This copy is not deleted earlier even if the community leaves the service or an account is deleted (the certificate and the demand include the unit and its recorded debt, never the owner’s name): it is retained to comply with legal obligations and for defense against potential claims (art. 17.3 b y e RGPD). The stamp identifies the signatories by their office and unit, not by their name.
• Questions to the help assistant: conversations with “Ask help” (Pregunta a la ayuda), in the app or on the web, are not saved. On the web, to limit the number of questions, your IP address is only saved as an encrypted hash that is deleted within 24 hours. Only when the assistant does not know how to answer do we save the text of the question and the language, without identifying the person who asked it, for 90 days, to write the missing help content. Please avoid including personal data in your questions.
• Invitations and how you reached us: screen invitations expire after 24 hours; printed posters are valid until canceled by the person who created them (or the board). The log of opens and sign-ups containing the encrypted IP and installation hashes is deleted after 90 days. How you joined Bloqia and each community is retained for as long as you have the account and is deleted with it; furthermore, if you delete your account, any invitations you created will be canceled.
• Vote challenges: retained for 5 years (the retention period for board documents), with the location if it was provided.
• Unit emails: for as long as the board keeps them. If you unsubscribe, the address is kept marked as unsubscribed so that it receives no more emails; if you join the community with it, it is no longer used as a unit email and is deleted when you leave the community or delete your account.
• Expulsion logs: retained for 7 days for the purposes of the waiting period to rejoin; they are deleted when the account is deleted.
• Demo communities: self-destruct after 15 days.
• Technical and security logs: for the minimum time necessary for security purposes and the limitation period for potential liabilities.

6. Who accesses your data (processors and recipients)

We do not transfer data to third parties unless legally required. We use the following providers as processors/sub-processors under a data processing agreement:

Within your community, other neighbors see only the information that the permission system allows them to see (by design: your unit is visible, your name is visible only if you choose, and your email and phone number are never visible).

7. International data transfers

Service data (database and files) are stored in the European Union (Madrid). Some auxiliary services of Google (authentication, push, analytics, diagnostics) may involve transfers to Google LLC in EE. UU., covered by the EU-U.S. Data Privacy Framework (Marco de Privacidad de Datos UE-EE. UU.), in which Google LLC is a certified participant, and Standard Contractual Clauses as an additional safeguard. Aggregate web analytics for bloqia.es and anti-bot verification for the web help assistant are provided by Cloudflare, Inc. (EE. UU.), which is likewise certified under the same Framework. Emails are stored in Zoho data centers in the UE; for technical support, Zoho group companies in India, Mexico, and Colombia may access them on an occasional basis, under Standard Contractual Clauses approved by the European Commission.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing, and data portability by writing to privacidad@bloqia.es from your account’s email address (or by attaching proof of identity). Maximum response time: one month.

• Erasure is also available as a self-service option in the app (Profile → Delete account).
• If the data relates to processing for which your community is the controller, we will forward your request to the community and cooperate with them to address it.
• If you believe that we have not properly addressed your rights, you may lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es).

9. Minors

Bloqia is not directed at minors under 14 years of age, and we do not create accounts for them. If we detect an account belonging to a minor under 14 years of age without the consent of those holding parental authority, we will delete it.

10. Security

We implement appropriate technical and organizational measures: encryption in transit (HTTPS/TLS) for all communications, server-side authorization rules for every data access, verification of neighbors before accessing any community data, audit logging of sensitive actions, anti-abuse usage limits, device attestation, and minimization by design (neighbors are identified by unit, not by name). In the event of a security breach that poses a risk to your rights, we will notify the AEPD within a maximum of 72 hours and inform you when applicable.

11. Changes to this policy

We will publish any changes here and, if they are substantial, we will notify you in the app before they take effect.