Privacy notice

1. Who we are and who this notice covers

il-blokka is provided by Ryan Galea, a sole trader trading as il-blokka, of Barumbara Court, Mgr Alfred Mifsud, Birkirkara, Malta, VAT registration number 32953510 (“we”). For anything about your personal data, write to [email protected].

We handle personal data in two different roles:

• As controller, we decide how data is used for: people who visit our website, send us an enquiry or sign up; and the il-blokka login of everyone who has one, whether staff of a management company, owners and tenants using the resident portal, or suppliers using the supplier portal.
• As processor, we handle the data that management companies keep in il-blokka about owners, tenants, suppliers, their own staff and their buildings. For that data the management company is the controller: it decides what is recorded and why, and questions about it should go to the management company first. We act only on its instructions, under our data processing agreement.

2. What we collect as controller

• Login data: name, email address, password (stored only as a hash), two-factor authentication settings, sign-in times, and the browser and IP address of active sessions.
• Company and billing data: company name, number of units, billing address and VAT number of the customer, and the name and email of the person who signed up and accepted our terms. Card details are collected and held by Stripe, not by us.
• Enquiries: what you send through the Talk to us form.
• Security records: an audit log of important actions (such as sign-ups, role changes, financial postings, approvals and exports) with the IP address they came from, records of any support access, and server logs.
• Abuse protection: to limit repeated sign-ups and enquiries we keep a keyed hash of your IP address, not the address itself, for up to a day.

3. Why we use it, and our legal basis

• To provide il-blokka to the business that signed up, and to bill it: performance of our contract with that business, and our legitimate interest in running the service its people use.
• To give staff, residents and suppliers a secure login: our legitimate interest, and the management company’s, in a service only the right people can use.
• To keep the service secure, prevent abuse and fix errors: our legitimate interests.
• To answer enquiries and send service messages, such as trial reminders: our legitimate interests.
• To keep tax and accounting records of our own sales: a legal obligation.

We don’t sell personal data, run advertising, or use third-party analytics or tracking.

4. Data we process for management companies

This can include owners’ and tenants’ names, contact details, identity card numbers where the management company records them, unit ownership and occupancy, amounts charged, paid and owed, correspondence, maintenance requests, meeting attendance and votes, and documents such as invoices and minutes. We use it only to provide il-blokka to that management company: to store it, show it to the people it authorises, generate statements and notices, send the emails it asks for, and run the AI features below.

Each management company’s data is kept separate from every other’s, and access is limited by role. Residents see only their own units and what their building’s administrator chooses to share.

5. Artificial intelligence

il-blokka sends content to an AI provider (currently OpenAI) to:

• read invoices, receipts, bank statements, contracts, insurance policies, quotations and meeting minutes that staff upload;
• suggest which bank lines match which payments;
• answer questions in the AI assistant. The question and the records used to answer it can include names, units and balances.

The provider processes this content under a data processing agreement, does not use it to train its models, and keeps it for up to 30 days to detect abuse before deleting it. A person reviews everything an AI reads before it is recorded, the assistant cannot send or change anything, and no decision about a person is made automatically. A management company that needs its data processed only in the EU can ask us to switch it to our EU provider (Amazon Bedrock in Frankfurt).

6. Sub-processors

We use these providers to run il-blokka:

These are used only when switched on for a management company, or for everyone after the notice below:

We give management companies 30 days’ notice by email before adding or replacing a provider.

7. Transfers outside the EU

Where a provider handles data outside the European Economic Area, we rely on the EU-US Data Privacy Framework for certified US companies, or on the European Commission’s standard contractual clauses, with the safeguards listed above.

8. How long we keep it

• Login data: while the login is in use. When a management company closes its account, its people’s logins end and their data is deleted or anonymised.
• Management companies’ data: as the management company decides while it is a customer, and deleted 90 days after its subscription ends (see our terms, section 13).
• Our own billing records: 9 years after the transaction, as Maltese tax law requires.
• Enquiries: 2 years after we last correspond.
• Assistant conversations: 90 days.
• Server logs: rotated automatically by size, so older entries are overwritten by newer ones.
• Backups: encrypted, and expire on a rolling schedule of up to 12 months.

9. Security

Data is encrypted in transit, and backups are encrypted and kept separately from the servers that run il-blokka. Staff accounts require two-factor authentication. Documents are only served through short-lived links after a permission check, and uploads are scanned for malware. Every management company’s data is isolated at the database level. We look at a management company’s data only when it asks for support, through time-limited access that its admins can see in their audit log.

10. Cookies and browser storage

We use only what is needed for the service to work, or what you choose:

• a sign-in cookie, and a short-lived cookie during two-factor sign-in;
• a cookie that keeps a supplier signed in to the supplier portal;
• a cookie that remembers whether the sidebar is open, and browser storage for your theme and table density;
• if you turn on notifications, a service worker and a push subscription in your browser;
• where we use it, Cloudflare’s anti-bot check on sign-up.

We don’t use advertising or analytics cookies, so we don’t ask for cookie consent. Stripe sets its own cookies on its payment pages to prevent fraud.

11. Your rights

You can ask to access, correct, delete or export your personal data, to restrict or object to how we use it, or to withdraw consent where we rely on it. Write to [email protected]. If your data is held by a management company in il-blokka, contact that company; we will pass your request on and help it respond. You can also complain to the Information and Data Protection Commissioner in Malta (idpc.org.mt).

12. Changes

We will post changes here and email customers’ company admins about material ones before they take effect.