3.2 Where we rely on legitimate interests, we have considered that our processing is necessary for that purpose and that it is not overridden by your interests, rights or freedoms. You can ask us for more detail about this balancing exercise at any time using the contact details in clause 1.3.

3.3 We do not sell your personal data to any third party. Where we rely on your consent for a marketing purpose in the table above, you can withdraw that consent at any time — for cookies and advertising, through our cookie settings; for marketing emails, using the unsubscribe link in any email or by contacting us; and for a published review, testimonial, or case study, by contacting us to ask for it to be taken down. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it, and does not affect our ability to deliver a Service you have already purchased.

3.4 Reports involve some automated processing (including artificial intelligence) to generate risk ratings and scores, and the outcome is a discovery document to assist you in your decision-making process. We do not use artificial intelligence or other automated processing to make any decision about you that has a legal or similarly significant effect, and no purely automated decision-making producing such effects about you takes place under Article 22 UK GDPR.

4.  Who we share your data with

4.1 We only share your personal data where necessary to provide the Services, comply with the law, or protect our legitimate interests. This includes sharing with:

• Stripe, to process your payment;

• an Independent Attorney (as defined in our Terms and Conditions), but only where you specifically ask us to make an introduction for filing or other professional services;

• service providers who host the Platform, deliver our emails, or provide the AI infrastructure used to generate Reports, acting on our instructions and under contract;

• Google, Meta (Facebook and Instagram) and LinkedIn, where you have consented to advertising cookies, to show you relevant ads, measure their performance, and, where you have separately consented, match or exclude you from an audience using a hashed version of your contact details;

• our email marketing platform to send marketing emails you have opted into or that fall within the soft opt-in described in clause 3.1;

• review and reputation platforms where we invite you to leave a review;

• our professional advisers (such as our accountants, auditors, insurers and lawyers), where reasonably necessary;

• a regulator, court, or law enforcement body, where we are required to do so by law or to establish, exercise or defend legal claims; and

• a buyer or successor, if we sell or reorganise our business, subject to that party agreeing to protect your personal data on terms consistent with this Privacy Policy.

5.  Where your data is stored

5.1 We store the personal data used to deliver our Services to you — for example, your account, order, payment and Content data — and require our service providers handling that data to store it, only on servers located in the United Kingdom or the European Economic Area (EEA). Because the UK and the EEA are each recognised as providing an adequate level of data protection under UK data protection law, no additional safeguards are required for that processing.

5.2 Some of the marketing and advertising tools described in clauses 3 and 4 — currently Google, Meta and LinkedIn — are provided by companies based outside the UK and EEA, principally in the United States. Where you consent to marketing or advertising cookies, or to a marketing purpose that relies on one of these providers, a limited amount of personal data (typically online identifiers such as cookie or advertising IDs, and, where you have separately consented to this, hashed contact details) may be transferred to the United States. Appropriate safeguards are in place for transfers outside the UK/EEA.

5.3 You can find out more about, and object to, this processing at any time through our cookie settings or by withdrawing your consent as described in clause 3.3.

6.  Cookies and similar technologies

6.1 We use cookies and similar technologies to operate the Platform, remember your preferences, keep it secure, and understand how it is used. Full details, including how to manage your cookie preferences, are set out in our Cookie Policy.

6.2 Cookies and tracking technologies used for advertising (including Google Ads, the Meta Pixel, and the LinkedIn Insight Tag) are not essential to the Platform working and only run once you have given your consent through our cookie banner, in accordance with the Privacy and Electronic Communications Regulations 2003. You can change your mind at any time through our cookie settings.

7.  Children

7.1 Our Services are not directed at, and are not intended to be used by, anyone under the age of 18. We do not knowingly collect personal data from children.

8.  How long we keep your data

8.1 We only keep your personal data for as long as we need it to provide the Services to you. As a general rule, once we have delivered your Report(s) and any Order has been completed (including the expiry of any applicable cancellation, refund or complaint-handling period), we will delete or anonymise your personal data.

8.2 Litigation exception: if a dispute arises, or we reasonably believe that legal proceedings may be brought by or against us in connection with your Order or use of the Platform, we will retain the personal data reasonably necessary to establish, exercise or defend those legal claims for as long as that prospect reasonably continues, and in any event no longer than necessary.

8.3 Legal and accounting records exception: we are required by the Companies Act 2006 and by HM Revenue & Customs' record-keeping rules to retain certain financial records (such as invoices and evidence of payments received) for a minimum statutory period, currently six years from the end of the relevant financial year. We retain the minimum personal data necessary to meet this obligation for that period and use it only for that purpose.

8.4 Where you have created an account with us but have not completed an Order, we will delete your account data after a period of inactivity of 6 months, unless we are otherwise required or permitted to keep it under clause 8.2 or 8.3.

8.5 We use a third-party service provider to manage payments on our Platform. The third-party service provider retains payment and transaction data in its own right, as an independent controller, in accordance with its own retention policies and applicable payment services regulation; please refer to the service provider’s privacy notice for details.

8.6 Marketing exception: where you have opted in to marketing (for example, cookies, advertising audiences, or marketing emails), we keep the personal data needed for that purpose for as long as you remain opted in, and will delete or anonymise it within a reasonable period after you withdraw consent or, if earlier, after a period of 12 months of no engagement with our marketing. Google, Meta and LinkedIn each retain advertising data in their own right, as independent controllers, in accordance with their own retention policies.

9.  Your rights

9.1 Under UK data protection law, you have the right to:

• be informed about how we use your personal data (as set out in this Privacy Policy);

• access the personal data we hold about you;

• have inaccurate personal data corrected, or incomplete personal data completed;

• have your personal data erased, in certain circumstances;

• restrict, or object to, our processing of your personal data in certain circumstances;

• receive a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller, where the processing is based on contract or consent and carried out by automated means; and

• lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator, although we would welcome the opportunity to address your concerns first.

9.2 You have an absolute right to object to your personal data being used for direct marketing (including any related profiling, such as building an advertising audience) at any time, free of charge, and without needing to give a reason. Once you object, we will stop that processing as soon as reasonably possible. You can do this using the unsubscribe link in any marketing email, through our cookie settings, or by contacting us using the details in clause 1.3.

9.3 To exercise any of the other rights listed above, please contact us using the details in clause 1.3. We will respond within one month, and will not normally charge a fee, save where permitted by law (for example, where a request is manifestly unfounded or excessive).

9.4 The ICO can be contacted at ico.org.uk.

10.  Keeping your data secure

10.1 We use appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction, including restricting access to personal data to those who need it, and requiring our service providers to maintain equivalent standards of security.

10.2 No method of transmission over the internet, or method of electronic storage, is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

11.  Changes to this Privacy Policy

11.1 We may update this Privacy Policy from time to time, for example to reflect changes in our Services, our service providers, or the law. We will post the updated version on the Platform and update the effective date at the top of this document. If we make a material change, we will take reasonable steps to notify you.

12.  Contact us

12.1 If you have any questions, concerns, or requests relating to this Privacy Policy or our handling of your personal data, please contact us at: privacy@brandsprintlab.com