Legal document
Privacy policy
This policy explains what personal data BrandForge processes, for what purposes, how long it keeps it and what rights you have in relation to it.
This English version is a translation provided for convenience. The Romanian version is the legally binding text and prevails in case of any difference between the two.
Contents
2.1 The data controller
The controller of personal data is NEBO SAFETY SRL, trading under the BrandForge brand.
NEBO SAFETY SRLTax ID (CUI) 42021319
Registered office: Str. Belizarie nr. 14, bl. XI/2A, sc. A, et. 3, ap. 14, Sector 1, Bucharest, postcode 013967, Romania
Data protection email: [email protected]
Phone: +40 733 243 480
Any request concerning personal data can be sent to the email address above.
2.2 Data processed
Depending on how you interact with BrandForge, we may process, as applicable:
- first name and surname;
- email and phone number;
- company name, if the order is placed on behalf of a company;
- billing details and tax ID;
- address;
- information about the service ordered (social media or website, price, subscription status);
- access to social media accounts, if we manage posting content directly on them;
- the brief provided for creating the content or the website: information about the product and business, text, logos and, optionally, images, video or voice;
- technical data: IP address, browser type, security logs;
- correspondence with BrandForge and complaints submitted;
- consents given (for example for marketing or the portfolio);
- billing and payment data (bank transfer or another agreed method), such as the amount and date of payment, without full card details.
BrandForge does not intend to receive or store the client’s full bank card details.
2.3 Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Performing the contract (providing the social media or website services) | Performance of a contract to which the data subject is party |
| Pre-contractual steps, at your request (for example, offers or information before an order) | Steps taken at the request of the data subject before entering into a contract |
| Invoicing and accounting obligations | Legal obligation |
| Support and order-related correspondence | Performance of the contract / legitimate interest in responding to requests |
| Handling complaints | Legal obligation / legitimate interest in resolving complaints |
| Security and fraud prevention | Legitimate interest in protecting the website and the service against abuse |
| Defending BrandForge’s rights, including in court | Legitimate interest in defending legal rights |
| Marketing communications | Consent, where required |
| Using the result in the portfolio | Separate consent, given optionally by the client |
| Analytics / cookies | According to the choices made by the user; see the Cookie policy |
2.4 Data about third parties
If you include in the brief the photo, voice or likeness of other people (for example, your employees, collaborators or customers), you must:
- have the right to provide this data to BrandForge for the purpose of creating the content or the website;
- inform those people, where required by law;
- obtain the necessary consents for the use of their likeness, voice or data;
- avoid uploading excessive personal data that is not needed for the service ordered.
2.5 Recipients
Data may be shared, to the extent necessary for the purposes described above, with:
- hosting providers for the websites built for clients;
- file storage services;
- email services;
- WhatsApp, the main contact channel used by the buttons on the website, for correspondence with clients and prospective clients;
- the client’s social platforms (Facebook, Instagram, TikTok, YouTube), when we publish content on the client’s accounts;
- banks, for processing transfers and the recurring invoicing of subscriptions;
- providers of artificial intelligence tools used in creating content or websites, which receive only information and images meant for publication; account login details (usernames, passwords) are never sent to them;
- IT and technical maintenance services;
- accounting;
- legal advisers;
- public authorities, where there is a legal obligation to do so.
The public website brandforge.digital is hosted on GitHub Pages, which may process technical access data (for example, the IP address) as an infrastructure provider. Websites built for clients under the subscription may also be hosted on GitHub Pages or by other providers, communicated to the client on delivery.
The brandforge.digital website does not send visitor data to database providers, analytics platforms or artificial intelligence tools. AI tools are used only in the process of creating content and websites for clients, under the conditions above.
2.6 International transfers
Some of the providers we use are companies based, or with infrastructure, outside the European Economic Area (EEA), particularly in the United States. When data leaves the EEA, the transfer takes place only on the basis of one of the mechanisms provided by Chapter V of Regulation (EU) 2016/679 (GDPR): an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework, for certified entities) or standard contractual clauses approved by the European Commission.
| Provider | Purpose | Data | Transfer and safeguards |
|---|---|---|---|
| GitHub, Inc. (USA): GitHub Pages | Hosting brandforge.digital and some websites built for clients | Visitors’ IP addresses, recorded by GitHub for security purposes; the public content of the websites | Possible transfer to the USA. GitHub states that it adheres to the EU-U.S. Data Privacy Framework and uses the European Commission’s standard contractual clauses. |
| WhatsApp Ireland Limited (Meta group) | Communicating with clients and prospective clients | Phone number, profile name, and the messages and files sent in the conversation | WhatsApp states that it transfers data outside the EEA, including to the USA, on the basis of adequacy decisions (including the EU-U.S. Data Privacy Framework) and standard contractual clauses. |
| Cloudflare, Inc. (USA): Email Routing | Receiving messages sent to [email protected] and forwarding them to the BrandForge mailbox | The sender’s address, the message content and attachments | Possible transfer to the USA. Cloudflare states that it relies on its certification under the EU-U.S. Data Privacy Framework and, should that cease, on standard contractual clauses. |
| Microsoft (Outlook.com) | The mailbox in which messages sent to [email protected] are received and stored | The sender’s address, the message content and attachments | Possible transfer to the USA. Microsoft states that it complies with the EU-U.S. Data Privacy Framework and uses standard contractual clauses approved by the European Commission. |
The other categories of recipients in section 2.5 (for example, AI tools, email and storage services) are subject to the same rule: if they process data outside the EEA, they do so only on the basis of one of the mechanisms above. The client’s social platforms process data as independent controllers, under their own policies, accepted by the client when creating the accounts.
You can ask at any time for information about the safeguards that apply to a particular transfer, at [email protected].
2.7 Retention periods
- Contract data and invoices: according to the legal periods that apply to financial and accounting documents.
- Files uploaded by the client: until the order is performed, plus an additional technical period needed for post-delivery support.
- Final results (posted content, the website code and files): for as long as the service or subscription remains active, plus a reasonable period after it ends.
- Correspondence and complaints: for the period needed to resolve them and, where applicable, to defend the parties’ rights.
- Consent for the portfolio: until the client withdraws it or until it is no longer needed for the purpose for which it was given.
- Technical logs: brandforge.digital is a static website and BrandForge does not run its own server that keeps access logs. Visitors’ IP addresses are recorded by GitHub, as the hosting provider, under its own policies (see section 2.6).
2.8 Data subject rights
Under the conditions and within the limits provided by law, you have the right to: access your data, rectification, erasure, restriction of processing, objection, data portability and withdrawal of consent, where processing is based on consent.
These rights are subject to the conditions provided by law and do not apply identically in every situation (for example, the right to erasure may be limited by legal obligations to keep financial and accounting documents).
To exercise any of these rights, you can contact us at [email protected].
You also have the right to lodge a complaint with the Romanian data protection authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP): www.dataprotection.ro.
2.9 Automated decisions
The use of artificial intelligence tools in the creative process of creating content or a website does not, in itself, constitute a solely automated decision with legal effects on you.
BrandForge does not intend to take solely automated decisions that produce legal effects on the client or similarly significantly affect them.
2.10 Security
BrandForge applies reasonable technical and organisational measures to protect data, including: access control, authentication, encryption of communications in transit, limiting access to the data each role needs, backups, monitoring, controlled deletion of data and regular updates of the systems used.
No method of transmitting or storing data is completely secure; BrandForge makes reasonable efforts to protect data but cannot guarantee absolute security.
2.11 Minors
BrandForge’s commercial services are not intended for people who do not have the legal capacity needed to enter into a contract on their own under the applicable law.