Privacy Policy
This Privacy Policy applies to branddeck.co, app.branddeck.co, BrandDeck accounts, customer administration, billing, support, demos, communications, free tools and platform use. Customer Content processed solely on a customer's instructions is governed primarily by the Data Processing Agreement.
1. About this policy and scope
This Privacy Policy explains how Snoepfabriek B.V., trading as BrandDeck ("BrandDeck", "we", "us" or "our") processes personal data. It is intended to provide clear information under Articles 12, 13 and, where applicable, 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
It applies when you visit our public website, use the BrandDeck application, create or manage an account, purchase or administer a subscription, contact us, request a demonstration, use our public tools, receive service communications or otherwise interact with us.
This policy does not replace the privacy information that a BrandDeck customer must give to people whose personal data the customer uploads or otherwise processes in BrandDeck. In those situations, the customer normally determines the purposes of processing and BrandDeck acts as processor or sub-processor. See Section 7 and the Data Processing Agreement.
2. Who we are and how to contact us
Item
Details
Legal entity
Snoepfabriek B.V., trading as BrandDeck
Business and correspondence address
Vondellaan 146, 3521 GH Utrecht, the Netherlands
Website
branddeck.co
Privacy contact
hello@branddeck.co
Security or suspected breach contact
Data Protection Officer
No Data Protection Officer is currently listed. If BrandDeck appoints one, the contact details will be added here.
For processing for which BrandDeck is the controller, BrandDeck is responsible for deciding why and how the personal data is processed. For Customer Content, the relevant BrandDeck customer is normally the controller or an upstream processor.
3. Our privacy roles
3.1 BrandDeck as controller
BrandDeck acts as controller for personal data used for its own business and service purposes, including:
website operation, public tools and website security;
account registration, authentication and account administration;
customer, contract, subscription and billing administration;
service communications, customer support and relationship management;
security logging, misuse prevention, incident management and service continuity;
limited product and usage analytics used for BrandDeck's own improvement purposes; and
compliance with legal obligations and the establishment, exercise or defence of legal claims.
3.2 BrandDeck as processor or sub-processor
BrandDeck acts as processor when a customer determines the purpose and essential means of processing personal data contained in brand assets, guidelines, files, comments, project boards, workspaces, invitations or other Customer Content. If the customer itself processes those data for another controller, BrandDeck acts as sub-processor.
The applicable customer is responsible for its own legal basis, privacy information, instructions, access choices and use of public, protected or invitation-only sharing. BrandDeck processes the data only on documented instructions, except where Union or Member State law requires otherwise.
3.3 Customer-enabled integrations
BrandDeck may allow a user or customer to connect third-party identity, design, collaboration or AI services. The privacy role depends on the technical and contractual setup. Where BrandDeck selects and contracts a provider to process Customer Personal Data on its behalf, the provider must appear in the current sub-processor register. Where a customer contracts directly with, supplies credentials for or independently selects a provider, that provider may be a recipient chosen by the customer rather than BrandDeck's sub-processor.
4. Personal data we collect and where it comes from
Category
Examples
Source
Account and profile data
Name, business email address, organisation, role, account status, language and display preferences.
You; an account administrator; an invitation sender.
Authentication data
Password hash, authentication tokens, password-reset records, multi-factor status where available, and identity-provider identifiers where you use an external sign-in option.
You; BrandDeck systems; the identity provider you select.
Subscription and billing data
Plan, billing contact, invoice details, organisation and tax information, payment status, transaction reference and limited payment metadata.
You; your organisation; payment provider (Mollie).
Usage and audit data
Features used, brands and workspaces created, invitations, access level, login and logout activity, administrative actions, date and time, IP address, browser, device and operating-system information.
Automatically from your device and BrandDeck systems.
Website and cookie data
Cookie or local-storage identifiers, consent choices, page views, navigation, referring page, approximate location derived from IP address, device and browser data.
Your browser or device; consent-management and analytics tools where enabled.
Communication and support data
Emails, contact-form content, support messages, attachments, call or demo notes and the information needed to investigate a request.
You; your organisation; support channels.
Marketing and relationship data
Business contact details, communication preferences, campaign engagement and records of consent or objection (processed via Brevo for newsletters and product updates).
You; prior customer interactions; publicly available business sources where lawfully used.
Customer Content
Brand assets, images, logos, fonts, videos, files, guidelines, comments, project-board content, metadata and any personal data contained in those materials.
The customer, its users, invited collaborators or people whose data appears in the materials.
Integration data
Authorisation tokens, account identifiers and the data a user instructs BrandDeck to send to or receive from an enabled integration (e.g. Google Sign-in).
You; the customer; the connected provider.
Legal and security data
Records relating to suspected misuse, fraud, security events, complaints, legal requests, disputes and compliance checks.
BrandDeck systems; you; advisers; authorities or other relevant parties.
We only collect the data fields necessary for the stated purpose, and we don't request identity documents unless a proportionate verification method is genuinely required.
5. Purposes and legal bases
Purpose
Legal basis
Create and administer an account; authenticate users; provide the requested platform features.
Performance of a contract or steps requested before entering a contract (Article 6(1)(b) GDPR).
Administer subscriptions, invoices, payments and contractual notices.
Performance of a contract (Article 6(1)(b)); compliance with tax and accounting obligations (Article 6(1)(c)).
Send essential service, security, availability, billing and policy messages.
Performance of a contract (Article 6(1)(b)); legitimate interests in operating a secure and transparent service (Article 6(1)(f)).
Answer enquiries, provide support, investigate defects and maintain customer relationships.
Performance of a contract or pre-contractual steps (Article 6(1)(b)); legitimate interests in customer support and service quality (Article 6(1)(f)).
Protect accounts and systems; log access; prevent misuse; detect, investigate and respond to security incidents.
Maintain, troubleshoot and improve the service using privacy-preserving, necessary or consented analytics.
Legitimate interests for strictly limited, low-impact analytics (Article 6(1)(f)) where legally permitted; otherwise consent (Article 6(1)(a)).
Remember user-requested settings such as language or display preferences.
Performance of the requested service or legitimate interests (Article 6(1)(b)/(f)); consent where the technology is not exempt from the Dutch cookie rules.
Send newsletters or product-update communications via Brevo.
Consent (Article 6(1)(a)), unless applicable law permits communication to an existing business customer on another basis. Every message provides an easy opt-out.
Enable an integration selected by the user or customer (e.g. Google Sign-in).
Performance of the contract and the customer's documented instruction (Article 6(1)(b)); consent where required for a user-controlled connection.
Comply with law, respond to lawful requests and establish, exercise or defend legal claims.
Legal obligation (Article 6(1)(c)); legitimate interests in legal protection (Article 6(1)(f)).
Manage a corporate transaction, restructuring or due diligence.
Legitimate interests in business continuity and corporate administration (Article 6(1)(f)), subject to confidentiality and data-minimisation safeguards.
Where BrandDeck relies on legitimate interests, it must assess necessity, proportionality and the impact on individuals. You may object to processing based on legitimate interests as explained in Section 12.
Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
6. When providing data is required
Account and authentication data are required to create and secure an account. Subscription and billing data are required when you purchase a paid plan. Information marked as optional is not required for the core service.
If required data is not provided, BrandDeck may be unable to create the account, authenticate the user, provide a requested feature, issue a legally valid invoice, process payment or respond to the request. BrandDeck should clearly mark mandatory fields at the point of collection.
7. Customer Content
Customer Content may contain personal data relating to customer employees, clients, suppliers, freelancers, models, photographers, end users or other people appearing in files, images, comments or brand materials. The customer controls which content is uploaded, who may access it and whether it is shared through a public, protected or invitation-only link.
BrandDeck processes Customer Personal Data only to provide, secure, support and maintain the service and according to the customer's documented instructions.
BrandDeck does not sell Customer Content and must not use Customer Personal Data to train a general-purpose or shared AI model unless the customer gives an explicit documented instruction and a separate lawful arrangement is in place.
A person whose data appears in Customer Content should normally direct a privacy request to the relevant customer. BrandDeck will forward a direct request to that customer and provide reasonable assistance under the Data Processing Agreement.
Customers must not upload special-category, criminal-offence or children's data unless the processing is necessary, lawful and covered by appropriate safeguards and any additional agreement required by BrandDeck.
8. Recipients and service providers
BrandDeck does not sell personal data. It may disclose only the data necessary to the following categories of recipients:
Hetzner Online GmbH (Gunzenhausen, Germany) for application-server infrastructure and uploaded files, and Supabase (Frankfurt region) for the managed database holding account and authentication data;
Mollie B.V. for payment processing where used. Mollie normally acts as an independent controller for regulated payment services and is not authorised to receive Customer Content;
Sendinblue SAS, trading as Brevo, for newsletters and product-update emails sent to registered users, separately from the platform itself; BrandDeck is controller for this marketing communication;
Google Identity Services as a live, optional external sign-in method;
security, logging, monitoring, error-detection and support providers where used;
professional advisers, auditors, insurers and financial service providers under confidentiality obligations;
competent public authorities where disclosure is legally required; and
a buyer, investor or successor in a genuine corporate transaction, subject to appropriate confidentiality and purpose limitations.
Providers that process Customer Personal Data on BrandDeck's behalf must be listed in the current sub-processor register attached to, or referenced by, the Data Processing Agreement. Some recipients, such as payment providers or customer-selected integrations, may act as independent controllers for parts of their processing; their own privacy information then applies.
Provider
Purpose
Privacy role
Status
Hetzner Online GmbH
Application-server hosting; may process request data, IP addresses, logs, temporary data and data passing through the application.
Sub-processor
Confirmed: Gunzenhausen, Germany (EEA). Also stores uploaded files (Customer Content). Backups are encrypted and rotated within 14 days of deletion.
Supabase Pte. Ltd.
Managed PostgreSQL database, including account and authentication data. Uploaded files are stored separately by Hetzner, not Supabase Storage.
Sub-processor
Confirmed: Supabase Pte. Ltd. (Singapore-registered), EU project region Frankfurt. Transfer covered by the EU Standard Contractual Clauses under the Supabase Data Processing Agreement, accepted by BrandDeck.
Sendinblue SAS (Brevo)
Newsletters and product-update emails, recipient name and email, message variables, delivery and security logs.
Independent recipient (BrandDeck is controller for this marketing activity)
Confirmed: used for newsletters and product updates sent to registered users, separately from in-app transactional email. Every message includes an unsubscribe option.
Mollie B.V.
Payment processing where used; limited billing and transaction data.
Independent controller for standard payment services
Confirmed: Mollie is live for subscription and website payments.
Google Identity Services
Optional external authentication; identifier, name, email and authentication/security data.
Independent provider / role depends on configuration
Confirmed: Google Sign-in is live as an optional login method.
9. International data transfers
BrandDeck uses a component-based architecture. The application server and uploaded files (Customer Content, brand assets and images) are hosted on Hetzner infrastructure in Gunzenhausen, Germany. The managed database, holding account and authentication data, is provided by Supabase in the Central EU (Frankfurt) region; the contracting Supabase entity, Supabase Pte. Ltd., is established in Singapore, and this transfer is covered by the EU Standard Contractual Clauses under the Supabase Data Processing Agreement accepted by BrandDeck. Brevo processes newsletter and marketing-communication data for registered users as an activity for which BrandDeck is controller, Mollie processes payment data where used and acts as an independent controller, and Google processes authentication data only when the optional Google sign-in is selected.
BrandDeck aims to use EEA-based primary processing. Primary EEA storage does not exclude all international processing, remote support or onward sub-processing. Where personal data is transferred outside the EEA, BrandDeck uses an adequacy decision, the European Commission Standard Contractual Clauses or another lawful mechanism and applies supplementary safeguards where required. The current sub-processor register identifies relevant locations and safeguards.
10. Retention and deletion
BrandDeck retains personal data only for as long as necessary for the stated purpose, legal obligations and proportionate legal claims.
Data
Retention standard
Account and profile data
For the active account and normally 30 days after account deletion or termination, to allow a controlled export or recovery; then deleted from active systems.
Customer Content
For the service term and according to customer instructions; normally deleted from active systems within 30 days after termination unless exported or legally retained.
Backups
Encrypted backup copies are overwritten through the documented rotation cycle and no later than 14 days after deletion from active systems, unless isolated for security or legal evidence.
Invoices and tax records
Seven years or another period required by applicable Dutch tax and accounting law, limited to records covered by that obligation.
Payment data held by a payment provider
Security, access and audit logs
Normally up to 12 months, unless a shorter period is sufficient or longer retention is necessary for an investigation, legal claim or security evidence.
Support and business communications
Normally up to 24 months after closure of the matter, unless linked to an active contract, dispute or legal obligation.
Marketing records
Until withdrawal or objection, and otherwise normally no longer than 24 months after the last meaningful interaction. Suppression records may be retained to honour the opt-out.
Cookie consent records
For the period necessary to demonstrate the consent choice and normally no longer than five years after the choice is replaced or withdrawn.
Legal and dispute records
For the applicable statutory limitation period and as needed to establish, exercise or defend claims.
Deletion from backup media may occur by secure overwrite at the end of the backup cycle. Until then, the data remains isolated from ordinary use and is restored only for continuity or incident-recovery purposes.
11. Security
BrandDeck applies technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. HTTPS/TLS is used for user and service-to-service connections. Supabase provides encryption at rest for managed database data and provider-managed database backups. BrandDeck is responsible for operating-system hardening, access controls, secrets, logging, patching and file-storage protection on the Hetzner application server. Mollie, Google and Brevo each protect data within their own service scope under their own security practices. BrandDeck is not currently ISO 27001 certified and is working towards certification; this does not affect the contractual security commitments in the Data Processing Agreement. The exact live configuration must match the Technical and Organisational Measures annex to the DPA.
The complete minimum control set is described in the Technical and Organisational Measures annex to the Data Processing Agreement. No internet service can be guaranteed to be completely secure. Users must keep credentials confidential, use strong unique passwords and enable available multi-factor authentication.
Please report suspected unauthorised access or vulnerabilities promptly to hello@branddeck.co. BrandDeck will notify affected controllers and individuals where required by the GDPR and the Data Processing Agreement.
12. Your data protection rights
Right
What it means
Access
Ask whether BrandDeck processes your personal data and receive a copy and related information.
Rectification
Ask BrandDeck to correct inaccurate data and complete incomplete data.
Erasure
Ask for deletion where the legal conditions are met. This right may be limited by legal retention duties or overriding grounds.
Restriction
Ask BrandDeck to restrict processing in the circumstances set out in Article 18 GDPR.
Object
Object to processing based on legitimate interests. BrandDeck will stop unless compelling legitimate grounds override your interests, rights and freedoms or processing is needed for legal claims.
Object to direct marketing
Object at any time. BrandDeck must then stop using the data for direct marketing.
Withdraw consent
Withdraw consent at any time without affecting processing that was lawful before withdrawal.
Human review
Request human intervention where a decision is based solely on automated processing and produces legal or similarly significant effects, if such processing is ever introduced.
Complain
Lodge a complaint with the Autoriteit Persoonsgegevens or another competent supervisory authority.
To exercise a right, contact hello@branddeck.co. BrandDeck will respond without undue delay and in principle within one month. For a complex request or multiple requests, the period may be extended by up to two further months; BrandDeck will explain the extension within the first month.
BrandDeck may ask for information reasonably necessary to verify identity and prevent disclosure to the wrong person. It will not request a full copy of an identity document unless this is genuinely necessary and legally permitted. Requests are generally free of charge, subject to the GDPR rules for manifestly unfounded or excessive requests.
13. Automated decision-making and profiling
BrandDeck does not currently make decisions based solely on automated processing that produce legal effects or similarly significant effects for individuals. If this changes, BrandDeck will provide the information and safeguards required by Articles 13, 14 and 22 GDPR before the processing begins.
14. Children
BrandDeck accounts are intended for persons aged 18 or older. BrandDeck does not knowingly offer accounts directly to children. Customer Content may nevertheless contain information about children where a customer lawfully uploads it; in that case BrandDeck acts only on the customer's instructions and the customer is responsible for the legal basis and safeguards.
15. Changes to this policy
BrandDeck may update this policy to reflect legal, operational or service changes. The current version will be published at branddeck.co/privacy. Material changes affecting registered users will be communicated through an appropriate channel before they take effect where reasonably practicable. The version number and effective date will be updated.
16. Complaints and supervisory authority
Please contact BrandDeck first at hello@branddeck.co so that we can investigate and try to resolve your concern. You also have the right to lodge a complaint with the Dutch supervisory authority: Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl. You may also contact the supervisory authority in the EEA country where you live, work or believe an infringement occurred.
