Privacy Policy

This policy explains how Branded Mark Limited ("BrandedMark", "we", "us") collects and uses personal data when we decide why and how it is used, in other words when we are the controller. It also explains, in section 3, the much larger set of data we handle on behalf of the brands that use our platform, where the brand is the controller and we are its processor.

We have tried to write this the way we would want to read it: short sentences, no surprises. If anything is unclear, email [email protected].

#1. Who we are

We have not appointed a Data Protection Officer, because the law does not require us to. You can reach the person responsible for data protection at [email protected].

Our representative in the EU. People in the EU or EEA and their data protection authorities can contact DataRep instead of us (see the table above). We remain the controller and accountable to you.

#2. Who this policy covers

This policy applies to personal data about:

1. Website visitors: people who browse brandedmark.com and our other marketing pages.
2. Prospects and enquirers: people who join our waitlist, answer our industry survey, request or use a demo, sign up for a trial, or contact us about our services.
3. Customer contacts and Authorised Users: the people at our customers (the brands and manufacturers who subscribe to BrandedMark) who hold accounts on our platform, sign contracts with us, pay our invoices or receive service notices.
4. Partner contacts: people at our own referral, reseller and technology partners. (Staff of a brand's dealers, installers and service agents who sign in to that brand's tenant are covered by the brand's privacy notice, not this policy, because the brand controls that data; see section 3.)
5. People who contact our support or security teams, including security researchers who report vulnerabilities.
6. Job applicants (see section 13).
7. People who view material we share by link through BrandedMark Share (*.brandedmark.sh); see section 4.6.

It does not cover personal data that brands collect from their own customers through the BrandedMark platform. Section 3 explains that.

#3. When we act for brands (as a processor)

BrandedMark is a platform that brands and manufacturers ("our customers") use to give each of their products a digital identity. Their customers (consumers, installers and business buyers) scan a product's QR code, register a product, claim on a warranty, raise a support case, return an item, buy spare parts or chat with the brand's support assistant.

For all of that consumer data, the brand is the controller and BrandedMark is its processor. That covers registrations, warranty and claim records, support cases and conversations, returns, orders, scans, marketing preferences and anything else a consumer gives a brand through a brand's portal or product passport. We process it only on the brand's documented instructions, under a Data Processing Agreement that meets Article 28 of the UK GDPR and the EU GDPR.

What this means for you as a consumer:

• The brand's privacy notice explains how your data is used. It is linked from every page of the brand's portal, usually as "Privacy".
• To exercise your rights (access, correction, erasure and so on), contact the brand. Most brand portals also let you download or delete your data yourself from your account page.
• If you contact us by mistake, we will pass your request to the brand promptly and tell you we have done so. We will not answer it ourselves unless the brand asks us to.

We do keep a small amount of data from brand portals for our own purposes as controller: security and abuse-prevention logs. Section 5 covers these. Any usage statistics we make from brand portals are de-identified and aggregated, and we make them for the brand, as its processor.

#4. What we collect, and where it comes from

#4.1 Website visitors

• Technical data: IP address, browser and device type, pages viewed, the referring page, and the approximate location derived from your IP address.
• Analytics data: we measure use of our website with Cloudflare Web Analytics, which sets no cookies and gives us only aggregate statistics (pages viewed, referrers, countries, device types, page speed). You can opt out in the website footer, and we honour Global Privacy Control. See our Cookie Policy.
• Your choices: whether you accepted or rejected analytics, stored in your browser's local storage.

#4.2 Prospects and enquirers

• Waitlist and contact forms: first and last name, work email, company, role and any message you send.
• Industry survey: your company name, industry, company size, your answers and (if you want the report) your email address.
• Demo: the work email you enter to unlock a demo (stored in your browser) and anything you tell us during a demo call.
• Trial or plan signup: name, work email, company, country, business size, your message and the marketing campaign tags (UTM parameters) in the link you followed.
• Correspondence: emails and meeting notes.
• From other sources: business contact details from public sources such as company websites, LinkedIn and Companies House, when we research companies we think may benefit from BrandedMark.

#4.3 Customer contacts and Authorised Users

• Account data: name, work email, phone number, job title, the brand you belong to and your role and permissions.
• Sign-in and security data: password (stored only as a salted hash, never in readable form), passkeys (we store only the public key), two-factor settings, sign-in history (time, IP address and approximate location), recognised devices and "new sign-in" alerts.
• Usage data: which features you use, when, and errors you encounter, collected through our application logs and telemetry.
• Billing data: billing contact, company address, VAT number, subscription and invoice history. Card and bank details are collected and held by Stripe, not by us.
• Contract data: who signed or accepted which agreement, when, from what IP address, and which version of our terms was accepted.
• Support access records: when our support team accessed a customer's tenant (including "view as" a user), who, when and why, with the ticket or incident reference. A customer's administrator can ask us for a copy.
• Support data: support requests and our replies.

#4.4 Partner contacts

• Name, work email, phone number, company and role. Lead registrations, deal and commission records, and correspondence.

#4.5 Support and security contacts

• Your name, email, the content of your message and any attachments. For vulnerability reports, the technical details you send.

#4.6 People who view material we share by link (BrandedMark Share)

• When we send you a proposal, deck, document or video through a *.brandedmark.sh link, we record: your email (if the link was sent to you or you signed in with a code), when you opened it, your country and approximate city, your browser, the page that referred you, how long you viewed it, and how far you played any video.
• BrandedMark Share sets a cookie with a random identifier (it lasts up to a year) so that repeat visits from the same browser count as one viewer. It does not fingerprint your device or track you on other sites.
• We use this to follow up with you and improve our material, on the basis of our legitimate interests. If you would rather we did not keep a record of your views, email [email protected] and we will delete it.

We do not ask for, and do not want, special category data (such as health or ethnic origin) or criminal-offence data. Please don't include it in messages to us.

#5. Why we use it, and our lawful basis

Where we rely on legitimate interests we have weighed them against your rights and expectations. You can ask us for that assessment, and you can object (section 10).

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our AI features help brands answer their customers. They do not decide anything about our own customers' staff or prospects.

#6. Marketing

We send marketing only to business contacts, about our own products and services.

• Business email addresses (for example [email protected]) belong to "corporate subscribers" under the Privacy and Electronic Communications Regulations 2003 (PECR). We may email them about BrandedMark on the basis of our legitimate interests, always with a clear way to opt out.
• Personal email addresses (for example a sole trader's Gmail) get marketing only if you gave us your details in the course of a sale or negotiation and did not opt out (the "soft opt-in"), or if you consented.
• Every marketing email includes a one-click unsubscribe link. You can also email [email protected]. We keep a short suppression record (your email address and the date you opted out) so we never email you again by mistake.
• We do not buy email lists, and we do not send marketing by SMS or phone.

#7. Cookies

Our website uses a small number of cookies and similar technologies. Our product uses cookies that are strictly necessary for sign-in, security and remembering your settings. The full list, what each one does, how long it lasts and how to change your choices are in our Cookie Policy.

#8. Who we share personal data with

We do not sell personal data, and we do not share it for advertising.

We share it only with:

• Our service providers. They host, secure and run our platform and business: cloud hosting, network security, payments and billing, email and text-message delivery, maps, address lookup and AI features, and the tools we use to run the company, such as email, documents and accounting. They act on our instructions under contracts that protect your data. The providers that process our customers' platform data are listed, with what they do and where, at https://www.brandedmark.com/legal/subprocessors.
• Partners, where a partner introduced you or your company. We share what the partner needs to track the referral, such as company name, deal status and fees for commission, and nothing more.
• Professional advisers, such as lawyers, accountants and insurers, under a duty of confidentiality.
• Authorities, where the law requires it, for example HMRC or a court order. We will push back on requests that are not lawful and proportionate, and where the law allows we will tell the affected customer first.
• A buyer or investor, if BrandedMark is sold or reorganised, under confidentiality. This policy would continue to apply to your data.

#9. International transfers

Where our platform data lives: Microsoft Azure data centres in the European Union: the Netherlands, with a geo-redundant copy in Ireland. Our own business systems (such as email and accounting) may hold data in the UK, the EU or the United States.

How transfers are protected:

• UK to EU/EEA: the UK recognises the EU/EEA as providing adequate protection.
• EU/EEA to UK: the European Commission renewed its adequacy decision for the UK in December 2025, valid until 27 December 2031.
• To other countries, including the US: we use providers certified under the EU-US Data Privacy Framework and its UK Extension where available. Otherwise we use the EU Standard Contractual Clauses (2021/914) with the UK International Data Transfer Addendum, or the UK International Data Transfer Agreement, and we assess the risks of each transfer.

You can ask [email protected] for a copy of the safeguards that apply to your data.

#10. How long we keep it

We keep personal data only as long as we need it, then delete or anonymise it.

#11. How we protect it

We protect personal data with controls appropriate to the risk, including:

• encryption in transit (TLS 1.2 or higher) and at rest (AES-256);
• hosting in Microsoft Azure EU data centres, with production separated from development;
• strict, role-based access, with no stored passwords between our services;
• network protection against attacks and abuse;
• uploaded files scanned for malware;
• regular backups.

You can ask [email protected] for more detail about our security programme. No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the regulator as the law requires.

#12. Your rights

Under the UK GDPR, and the EU GDPR where it applies to you, you have the right to:

• access your personal data and receive a copy;
• correct inaccurate data;
• erase your data where we no longer have a reason to keep it;
• restrict how we use it while a concern is resolved;
• object to our use of it based on legitimate interests, and always to direct marketing;
• portability: receive data you gave us, in a machine-readable format, where we process it by consent or contract;
• withdraw consent at any time, for example to receiving our survey report, without affecting earlier processing.

How to use them: email [email protected]. Authorised Users can also update most account details themselves in the app. We may need to confirm your identity. We will respond within one month, which can be extended by two further months for complex requests (we will tell you if so). If we need more information to find what you are asking for, the time limit pauses until you reply. Our searches will be reasonable and proportionate, as the Data (Use and Access) Act 2025 allows.

If your data is held for a brand (section 3), contact the brand. We will help them answer you.

#13. Job applicants

If you apply to work with us, we use your CV, cover letter, interview notes and references to assess your application (legitimate interests, and steps before a contract). We keep them for 6 months after the role is filled unless you agree we can keep them longer. We carry out right-to-work checks only for successful candidates, as UK law requires.

#14. Children

Our website and platform are for businesses. They are not aimed at children, and we do not knowingly collect children's data as controller. Brand portals may be used by members of the public. The brand's privacy notice covers that use.

#15. Complaints

We would like the chance to put things right.

1. Complain to us first at [email protected], or by post to our registered office (marked "Data protection complaint"). We will acknowledge your complaint within 30 days, investigate it without undue delay, and tell you the outcome and what we have done. This is our complaints process under the Data (Use and Access) Act 2025.
2. You can also complain to a regulator:
   • in the UK, the Information Commissioner's Office, ico.org.uk/make-a-complaint, 0303 123 1113;
   • in the EU/EEA, the data protection authority where you live or work, or where the issue happened. For example, in the Netherlands that is the Autoriteit Persoonsgegevens. Once our EU representative is appointed (section 1), you can also raise your complaint through them.

Complaining to us first is not required, but it is usually the fastest route.

#16. Changes to this policy

We review this policy at least every six months, and whenever our processing changes. We publish each version with its date and list the changes in the version history below. We keep every previous version, and will send you a copy of one on request. If a change materially affects how we use your data, we will tell customers and partners by email at least 30 days before it takes effect.

#17. Contact us

• Privacy questions and rights requests: [email protected]
• Security issues: [email protected] (see our Responsible Disclosure Policy)
• In the EU/EEA: [email protected], or our EU representative once appointed (section 1)
• Post: Branded Mark Limited, Broomfield House, Blakedown, Kidderminster, DY10 3LA, United Kingdom

#Version history