Exercising your GDPR rights

YOUR RIGHTS

This English translation is provided for convenience; the French version prevails. Version 1.2 of 15 October 2026.

You have the following rights:

• access to your data and to a copy of them (GDPR, art. 15);
• rectification of inaccurate data (art. 16);
• erasure (art. 17), except where the law requires them to be kept;
• restriction of processing (art. 18);
• portability of the data you provided, for processing based on the contract (art. 20);
• objection to processing based on legitimate interest, on grounds relating to your particular situation, and at any time, without giving reasons, to prospecting (art. 21);
• instructions on what happens to your data after your death (French law no. 78-17 of 6 January 1978, art. 85).

WHERE TO SEND YOUR REQUEST

Your portal account, your agency's invoicing, prospecting, support or security logs: BUSINESS BRAIN is the controller. Write to support@mybusinessbrain.eu, or by post to BUSINESS BRAIN, 64 promenade du Maréchal Leclerc de Hauteclocque, 06500 Menton, France.

The data that an agency processes by means of the service (if you are a client, principal, owner, buyer, visitor or correspondent of an agency): the agency is the controller, and it is the agency that answers you on the substance. Send your request to the agency. If you write to us, we forward your request to the agency concerned within five working days, and we do not answer you ourselves: the agency answers you, including to tell you that your request has reached it. BUSINESS BRAIN, its processor, helps it answer you.

HOW WE ANSWER

We reply within one month of receiving your request. This period may be extended by two months if the request is complex or if there are many requests; we then inform you within the first month, with the reasons. The reply is free of charge.

We do not ask you for an identity document. If we have reasonable doubts about your identity, we may ask you for additional information, limited to what is necessary to confirm it (GDPR, art. 12.6).

Our processing is not based on your consent. Erasure does not apply to the data that the law requires us to keep: accounting records and the identification data of the authors of public property pages.

IF THE AGENCY IS RESPONSIBLE FOR YOUR DATA

The procedure that BusinessBrain offers to agencies provides for the following steps. The agency records your request with its date of receipt: the one-month period, which may be extended by two months, runs from that date. It asks you for additional information about your identity only in case of reasonable doubt; it does not systematically require a copy of an identity document and, if it asks for one, does not keep it beyond the check.

The agency searches for your data in everything the service keeps for it (owners, buyers and their searches, mandates, offers and sales, viewings, e-mails and attachments, address book, the assistant's index), but also outside the service: its mailbox at its provider, its paper files. What the portal does not yet allow, it asks BUSINESS BRAIN to do, which undertakes to carry it out within ten working days.

The agency answers you in writing. Its reply mentions the data kept despite your request and the grounds for keeping them, and reminds you of your right to refer the matter to the CNIL. It informs the recipients to whom your data were disclosed (notary, other party) of any rectification, erasure or restriction, unless this requires disproportionate effort.

WHAT THE TOOL ALLOWS TODAY, RIGHT BY RIGHT

For the data that an agency processes by means of the service, here is what the service allows to date, and what remains to be done.

• Access: there is no complete per-person extraction. The agency gathers the data found; the procedure provides that it may ask BUSINESS BRAIN for an extraction of the e-mails and of the index. The reply states in particular the recipients of your data, including BUSINESS BRAIN and Mistral AI (or Anthropic, if the agency has chosen that option in writing, with the transfer to the United States and its safeguards), the absence of automated decision-making and the use of an artificial intelligence assistant.
• Rectification: records are corrected in the portal, and their histories keep a trace of it. An entry recorded in the register of mandates cannot be rewritten: any change to its terms goes through an amendment. For an error in the principal's identity or contact details, no rectification path exists in the portal to date: the agency draws up a signed rectifying amendment, files it in the property's file and mentions it in its reply.
• Erasure: the tool replaces identifying data in place (the record remains) for address-book contacts, e-mails, viewings, owners, draft mandates and buyers' documents. Offers, buyers' identity and the assistant's index are not yet covered: the procedure provides that BUSINESS BRAIN handles them manually, within the ten-working-day period, pending complete tools by 31 December 2026 at the latest. The register of mandates (10 years) and the documents required against money laundering (5 years after the end of the relationship) are not erased before their expiry; they are limited to their legal purpose.
• Restriction: the tool only allows the documents required against money laundering to be set aside, during an erasure. During a dispute, the procedure provides that the agency refrains from using the record and validates no artificial intelligence draft concerning you.
• Portability: it covers the data you provided, processed on the basis of the contract or of pre-contractual measures. The tool only exports the register of mandates and the e-mail exchanges; for the rest, the procedure provides for an extraction by BUSINESS BRAIN, in a structured, machine-readable format (CSV or JSON).
• Objection to prospecting: it is absolute and requires no reason. The agency immediately stops all sending and records your objection on your record, in the portal's address book; any first message written from BusinessBrain to your address is then refused. If you are not in the address book, or if the agency prospects with another tool, it keeps the list in that tool. The objection is kept for 3 years.
• Objection to the processing of your messages by artificial intelligence: the tool does not yet allow a correspondent to be excluded; their messages received at the connected address continue to be read and sent to the model. In the meantime, the procedure provides that the agency offers you a channel that the tool does not collect, and validates no artificial intelligence draft for you.
• Automated decision-making: no decision with legal effect is taken without a human. Forwarding an offer, entering or having a mandate signed, and checking an identity are human acts.

AFTER AN ERASURE

• Copies remain for up to 30 days in the database backups (7 days for documents and the index; OVH's automated backup only keeps the last night) before disappearing.
• The messages you sent remain in the agency's mailbox at its provider: the agency deletes them itself if it grants your request.
• Data already sent to Mistral AI cannot be erased by BUSINESS BRAIN. Mistral AI keeps them for 30 days for abuse detection, without using them to train its models, after which they disappear. If the agency has chosen Anthropic, they are deleted from Anthropic's systems within 30 days at most.

COMPLAINT

You may lodge a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at www.cnil.fr.