Privacy policy

1. Who is responsible for your information?

For business contacts, website enquiries, billing, licensing and administration of our own services, Brixit determines the processing purposes and acts as a controller, subject to applicable law.

For personal data held in a customer’s CRM, the customer normally determines the purposes and means of processing and is the controller. Hosting the software on the customer’s infrastructure does not give Brixit routine access to the whole database.

Where Brixit processes customer information on that customer’s behalf for authorised support, migration or managed services, we act under the relevant instructions and processing agreement. Our role depends on the actual service and purpose; we are not solely a processor for every interaction.

If you are a brokerage’s client, prospect or employee and want to exercise rights over its CRM records, contact that brokerage first. For information Brixit controls, use the contact details below.

2. Information Brixit receives

• Website and sales enquiries: your name, work contact details, company, team size, enquiry type, your optional answer about how you found us and anything you choose to submit. An enquiry also includes a broad referral category and a recognized landing-page path to help us understand acquisition; we do not attach full referring URLs, arbitrary query values or browsing history. The website’s contact form currently uses FormSubmit to deliver enquiries to Brixit. Please do not include sensitive CRM records in a sales form.
• Commercial and account records: customer and authorised-contact information, accepted orders, licence and AMC terms, invoices, payment status and transaction references. If a payment processor is used, it handles the payment details presented to it; the processor’s terms and privacy notice also apply.
• Licence and operational information: installation identifier, company and domain, software version, licence status and dates, purchased capacity, dated billable-employee counts, connection activity and security or diagnostic logs. A licensing user-count report is an aggregate count, not an export of the customer’s contact database.
• Support and deployment information: correspondence, files, logs or records deliberately shared, and information accessed under an authorised support or migration arrangement. The scope depends on the assistance requested.
• Connected-service information: relevant messages, contacts, listing information, identifiers, device or push tokens, and connection credentials or metadata needed for the particular integration. What is processed depends on the enabled feature and provider.
• Website and service-access information: IP addresses, request times, browser or device information and security logs that our hosting and service providers receive when handling requests.

3. Why we use information

We use relevant information to answer enquiries, arrange demonstrations, supply and verify licences, reconcile user capacity, manage mandatory AMC renewals, maintain accounts and invoices, deliver agreed support and connected services, protect systems, investigate issues and comply with legal obligations.

We use a lawful basis appropriate to the purpose and applicable law, including performance of an agreement or requested pre-contract steps, legal obligations, and consent where required. Where we rely on consent, withdrawal does not affect processing already lawfully carried out or other processing that remains legally required.

Information shared for a specific support or integration purpose is not permission to use the customer’s entire database for unrelated purposes. This policy does not provide blanket consent to AI-model training or unrestricted marketing use of CRM records.

4. On-premise storage and access

The customer selects and operates, or appoints an operator for, its CRM infrastructure and local data storage. The customer manages local account access, infrastructure security, backups, retention and recovery. Any Brixit-managed hosting or backup service must be separately agreed.

On-premise does not mean every feature is offline or that no data leaves the installation. Licensing communications, authorised support and enabled integrations can transmit information outside the customer’s environment. Review those flows and provider permissions as part of deployment.

AMC or licence expiry can restrict CRM operation and managed services, but does not itself delete the customer’s locally stored database or files. The customer remains responsible for its local retention and deletion decisions.

5. Service providers, integrations and AI

We share information only as needed for the stated purposes with relevant hosting and infrastructure providers, enquiry delivery providers, payment processors when used, authorised support providers, connected platforms and professional advisers, or where lawful disclosure is required. Provider access and processing arrangements should match their role and the services supplied.

When a customer enables email, messaging, portals, automation or AI connections, relevant information may be transmitted to the selected providers directly or through Brixit-managed services. Customers should review the provider’s permissions, processing locations, retention and any AI-data-use settings before connecting business data.

An AI feature can process the information used to generate its output, such as contact activity, notes and email context. Provider handling depends on the chosen service and configuration. On-premise storage is not a representation that an external AI provider never receives data.

We do not sell personal data or authorise providers to use information supplied by us for their own unrelated marketing. A separate provider relationship established directly by the customer is governed by that relationship’s terms and applicable law.

6. Processing locations and transfers

Customer-held CRM storage follows the deployment selected by the customer. Information received by Brixit or connected providers may be processed in the UAE or other countries according to the actual service and provider. We do not promise that all connected-service data remains within the UAE.

Where applicable law requires safeguards or another lawful condition for an international transfer, those requirements must be met. Acceptance of this policy is not, by itself, blanket consent to every international transfer. Contact us to review the relevant processing arrangements for a proposed deployment.

7. Security and incidents

We apply access restrictions and appropriate technical and organisational safeguards to the services and information we operate. The safeguards for a customer-hosted server also depend on its configuration and operator; encryption at rest, backup coverage and recovery are not automatically guaranteed by installing Brixit.

Use secure channels for support access and diagnostic material, and share only what is needed. Report suspected incidents involving Brixit services to info@brixit.io. We investigate incidents affecting our services and provide legally or contractually required notifications and assistance. No software or infrastructure is risk-free.

8. Retention and deletion

Customers determine retention of their own CRM records and backups. For information held by Brixit, retention depends on the service purpose, active agreements, accounting or other legal requirements, security needs and applicable limitation periods. Information is deleted or anonymised when those reasons no longer require retention, subject to applicable law.

Copies held for support or migration are handled under the agreed scope and processing instructions. Terminating a licence does not authorise Brixit to erase the customer’s server. It also does not require immediate deletion of invoices or other records Brixit must lawfully retain.

9. Your choices and rights

Depending on applicable law and the circumstances, you may request access, correction, deletion, restriction, objection or portability, withdraw consent where processing relies on it, or raise a complaint with the competent data-protection authority. Rights may be subject to lawful conditions and exceptions.

Contact the customer organisation for records it controls in its installation. Contact info@brixit.io for information Brixit controls. We may need to verify identity and authority before responding, and will handle requests within applicable legal requirements. We assist customer controllers as required by our processing arrangements.

Customers can manage local permissions and review connected-provider access. Disabling a connection does not automatically erase information already held by that provider. Necessary licence verification and billing records may remain required for continued service or legal obligations.

10. Website storage and external links

Our website and service providers may use technical storage or request information needed to deliver and secure the site and forms. This policy does not assume that every customer deployment has the same cookies or tracking tools; the operator must disclose its own configuration and obtain any required consent.

Google Analytics loads only after you choose Allow analytics. It measures recognized page paths and successful inquiries using cookies and technical request information, but we do not send form names, emails, phone numbers, messages or arbitrary URL query values to Google. Advertising features are disabled. Use Analytics preferences in the footer to decline or withdraw consent. Your choice is stored locally for up to 180 days; declining does not prevent use of the site or contact form. External websites and provider pages have their own privacy notices. Visiting a linked provider does not mean Brixit controls its processing.

11. Updates and contact

We update this policy when our processing or legal obligations change and identify the version date above. Material changes will be communicated as appropriate. A policy update does not remove rights or replace consent where fresh consent is legally required.

Privacy contact: Brixit LLC-FZ, registered in Meydan Free Zone, Dubai, United Arab Emirates. Email info@brixit.io. For customer-held CRM information, also contact the organisation operating that installation.