PRIVACY POLICY

This Privacy Policy describes the policies of SDB Digital Ltd, United Kingdom, on the collection, use and disclosure of your information when you use our website (brambla.co.uk). By accessing or using the Service, you consent to our practices described in this policy.

Information We Collect

When you interact with our website or services, we may collect the following information:

• Name
• Email address
• Phone number
• Company name
• Project details (budget, services required, timeline)
• IP address and approximate location (captured automatically by our hosting provider Vercel in edge logs, retained for up to 30 days for security and abuse prevention)
• Anonymous first-party analytics data (page views, device type, browser, approximate session path) captured without cookies in our marketing_funnel_events database table for internal product analytics. This data is not linked to your personal identity unless you submit a form.

Personal details (name, email, phone, company, project details) are collected only when you submit our contact form or start-a-project form. We also collect anonymised usage data through cookies and analytics tools (see our Cookie Policy for details).

Lawful Basis for Processing

Under UK GDPR, we process your personal data on the following lawful bases:

• Consent — when you submit a form or accept analytics cookies
• Contractual necessity — to deliver services you have engaged us for
• Legitimate interest — to respond to enquiries and improve our website

How We Use Your Information

We use the information we collect to:

• Respond to your enquiry or project brief
• Deliver the services you have engaged us for
• Send you a confirmation email when you submit a form
• Improve our website and services based on usage patterns

Third-Party Processors

We use the following third-party services to operate our website and deliver our services. Your data may be processed by these providers, each of which operates under their own privacy policy:

• Supabase — database hosting for form submissions (EU hosted)
• Microsoft 365 — transactional email delivery via Graph API
• Vercel — website hosting and delivery
• Google Analytics — anonymised website usage analytics
• Google Tag Manager — tag management
• Stripe — payment processing for paid services and subscriptions
• Meta (Facebook/Instagram) — Meta Pixel for conversion measurement from our paid advertising (fires only with consent)
• Microsoft Advertising — UET tag for conversion measurement from Bing/Microsoft Search paid advertising (fires only with consent)

We will not sell your personal data to any third party. We may disclose your personal information to comply with applicable law, enforce our terms, or protect the rights, property, or safety of SDB Digital Ltd, our clients, or others.

Use of AI Tools

Brambla uses AI assistants (including Anthropic's Claude) to accelerate code generation, content research, and design iteration in our internal workflow. We do not feed your personal data (names, emails, phone numbers, project details, or any form submissions) into external AI or LLM services for automated decision-making, profiling, or content generation about you personally. Form submission content is routed only to our own database, our email system, and our human team.

We do not use automated decision-making or profiling as defined under UK GDPR Article 22. All decisions about whether to work with you, what to build, and how to price a project are made by human team members.

For full transparency on how we use AI in our workflow, see How we build.

Where Your Data Is Stored

Form submissions are stored in Supabase (EU-hosted infrastructure). Emails are sent via Microsoft 365 (UK/EU data centres). Website analytics data is processed by Google in accordance with their data processing terms. All data transfers are protected by appropriate safeguards.

Retention of Your Information

• Form submissions (contact_submissions): up to 2 years after your last interaction, unless a longer retention period is required for an ongoing service or legal obligation.
• CRM records (crm_clients, crm_contacts, crm_activities): retained for the duration of the client relationship plus 7 years after the final invoice, for accounting and legal record-keeping.
• Email logs (email_logs): retained for 1 year for troubleshooting and delivery audit purposes.
• First-party funnel events (marketing_funnel_events): retained for 6 months for internal analytics, then purged.
• IP addresses (via hosting provider): up to 30 days.
• Analytics data (Google Analytics): according to the 14-month default retention setting in GA4.

Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your personal data (right to be forgotten)
• Restrict or object to the processing of your data
• Receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, please contact us at hello@brambla.co.uk.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection.

Cookies

We use cookies on our website. Please refer to our Cookie Policy for full details on the types of cookies we use and how to manage your preferences.

Children's Data

Our services are designed for businesses and professional users. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has submitted information to us, please contact hello@brambla.co.uk and we will delete it.

Security

The security of your personal information is important to us. We implement reasonable technical and organisational measures to protect your data from unauthorised access, disclosure, alteration, or destruction.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, and will inform affected individuals where required under UK GDPR.

Contact Us

If you have any questions or concerns about this Privacy Policy or your personal information, please get in touch:

hello@brambla.co.uk