BND Legal
Privacy Policy
This Privacy Policy explains how Brand New Digital B.V. handles personal data in connection with its website, enquiries, business relationships and services, including BNDX and Academy.
Last revised: 4 November 2026
1. Who is responsible for your personal data?
Brand New Digital B.V. is responsible for the processing described in this policy.
Brand New Digital B.V.
De Moerkens 39
4614 GT Bergen op Zoom
The Netherlands
Chamber of Commerce (KvK): 80567843
VAT identification number: NL861719256B01
hello@brandnewdigital.com
BNDX is BND’s specialist label for AI and agentic commerce. Academy provides in-company training for one organisation, tailored to its team. Brand New Digital B.V. remains responsible for the processing described in this policy across these activities.
Our services are intended for businesses and professional teams. Personal data about their employees, representatives and other contacts is still protected by data-protection law.
2. What this policy covers
This policy covers personal data we process for our own purposes, such as responding to enquiries, managing business relationships, organising training and maintaining our administration.
Some client assignments involve processing personal data on the client’s instructions. Where we act as a processor, that processing is governed by the client’s instructions and the applicable data-processing agreement. This policy does not replace that agreement or the client’s own privacy information.
3. Personal data we process
Depending on your interaction with BND, we may process:
Your name, professional role and company.
Your work email address and any other contact details you provide.
Your company website and service interests.
Messages, enquiry details and relevant business correspondence.
Information needed to prepare proposals, manage assignments and organise meetings.
Contract, billing and payment information, where it identifies an individual.
Participant contact details and relevant learning needs supplied when organising Academy training.
Limited technical information associated with website delivery, security and audience measurement.
We generally receive this information directly from you. We may also receive professional contact or participant information from your employer, a colleague or an authorised representative organising an assignment.
Please do not include passwords, payment-card details, sensitive personal data or unnecessary information about other people in the general contact form.
Website requests can disclose your IP address, requested URL and query parameters, referrer, browser and device information and request time to the relevant provider. Framer measures website use and performance. CookieYes records consent choices, their timing and associated consent and technical information. HubSpot Forms processes technical form requests and entered values as explained below. With Analytics consent, Google Analytics 4 (GA4) measures page views and visits using browser identifiers, session information, page addresses, referral or campaign information, technical device information and approximate location. Google receives the measurement requests; names, email addresses and enquiry messages are not intentionally sent to GA4. Please avoid putting personal or confidential information in page addresses or query parameters.
4. Why we use personal data and our legal bases
Enquiries and prospective business relationships
We use enquiry details to answer questions, understand the support requested, prepare proposals and arrange relevant follow-up.
For people contacting us on behalf of a business, we rely on our legitimate interest in responding to business enquiries and assessing potential working relationships.
Where an individual is personally the prospective contracting party, including an individual operating a sole proprietorship, we rely on taking steps at that person’s request before entering into a contract, to the extent the processing is necessary for those steps.
Client relationships and delivery
We use professional contact information to coordinate assignments, communicate with client representatives, deliver agreed work and manage the relationship.
For representatives of corporate clients, we rely on our legitimate interest in providing and administering our business services. Where the individual is personally a party to the agreement, we rely on contractual necessity for processing required to perform that agreement.
Academy
We use necessary participant information to organise sessions, communicate practical details, tailor agreed learning activities and provide materials or follow-up.
For participants nominated by an employer or corporate client, we rely on our legitimate interest in delivering and administering the agreed training. Where a participant is personally the contracting party, contractual necessity applies to processing required for that agreement.
Participation in training does not automatically subscribe anyone to marketing communications.
Administration and legal obligations
We process relevant billing and financial information to comply with applicable tax, accounting and other legal obligations.
We may retain necessary records to establish, exercise or defend legal claims, based on our legitimate interest in protecting our legal position.
Security
We process necessary information to protect our communications and systems, prevent misuse and investigate security incidents. We rely on our legitimate interest in maintaining secure and reliable business operations.
When relying on legitimate interests, we assess the necessity of the processing and balance our interests against the rights and reasonable expectations of the people concerned.
Optional marketing
An enquiry or client relationship does not by itself constitute consent to a newsletter.
If we introduce optional communications that require consent, we will request that consent separately. You can withdraw consent at any time and can object to the use of your personal data for direct marketing.
Website measurement and preferences
We use GA4 to understand visits and improve our website, content and navigation. The legal basis for this optional measurement and its analytics cookies is your consent (Article 6(1)(a) GDPR). You can refuse Analytics and withdraw consent through Cookie Settings. The current limitations of withdrawal are explained in section 9; a recorded refusal does not always stop further measurement.
Necessary page delivery and proportionate security measures serve our legitimate interest in operating a reliable website. We rely on the same legitimate interest for remembering and applying your cookie choice, limited to respecting that choice. Recording necessary evidence of consent serves our legal obligation to demonstrate consent where required. These purposes do not make optional analytics necessary. Framer Analytics currently operates outside the Analytics choice. Its necessity and legal basis for operation without consent have not yet been established by a completed assessment. The same applies to additional HubSpot form measurement beyond what is needed to handle an enquiry or secure the form. We do not present those activities as having passed a necessity or legitimate-interest assessment. An enquiry or training participation is not consent to analytics, advertising or newsletters.
5. Contact forms and required information
Our contact form requests your name, work email address, company and a description of your enquiry. Your website and service preference are optional.
We use the information to respond and discuss relevant services. If required information is not provided, we may be unable to process the form or respond meaningfully.
You can also contact us directly at
hello@brandnewdigital.com
Submitting an enquiry does not by itself create a service agreement.
Our Dutch and English contact forms use HubSpot. It processes enquiries for BND and stores submitted information in our CRM. As you fill in or leave a field, your name, email address, company and message may already be sent to HubSpot for checking, before you press Submit. The forms also request settings and visitor information and send counter and security requests before a cookie choice and after refusal. These may include page, browser, form or session details. The enquiry-related legal bases in section 4 apply to handling your question; proportionate protection against misuse has a security purpose. This does not establish a legal basis or strict necessity for every additional form measurement. General HubSpot website tracking has been removed. An enquiry does not give consent to newsletters or optional tracking.
6. Service providers and other recipients
We use suppliers to support our website and business operations, including:
Framer: website hosting and built-in website analytics.
Microsoft 365, including Outlook: business email and communications.
HubSpot: embedded contact forms and customer relationship management.
The information a supplier receives depends on the functions used. This does not mean that every enquiry is automatically transferred to every supplier.
Freelancers and other specialists may receive information where necessary for their role in an assignment. Access should be limited to the information needed for that work and covered by appropriate confidentiality and data-protection arrangements.
We may also disclose necessary information to professional advisers or public authorities where required by law or necessary for legitimate legal and administrative purposes.
Where a supplier processes personal data on our behalf, an appropriate data-processing agreement is required.
CookieYes Limited provides our banner, preferences and consent records. HubSpot provides embedded forms, entry checks and CRM; its former banner, general website tracking and external-form collection code have been removed. Cloudflare, Inc. provides bot protection through HubSpot Forms. GA4 is provided by Google under its European Analytics terms with Google Ireland Limited; processing can involve Google LLC in the United States. Google receives the visit and technical data described in section 3. Google Signals and advertising personalisation have been switched off. Advertising-related Google requests can nevertheless occur, including to DoubleClick and Google Ads audience endpoints with a non-personalised-advertising signal (npa=1). That signal does not mean there is no data transfer, and those requests do not by themselves prove that remarketing is being used. A supplier’s role depends on the service and purpose; not every recipient is necessarily our processor for all of its activities.
7. Processing outside the European Economic Area
The European Economic Area (EEA) consists of the EU Member States, Iceland, Liechtenstein and Norway.
European hosting does not mean that all processing stays in the EEA. Framer B.V. is based in the Netherlands. CookieYes Limited is based in the United Kingdom, which is covered by an EU adequacy decision. CookieYes lists storage providers in Ireland, Malta and the UK, and international infrastructure providers including Cloudflare. Support and subprocessors can involve other countries.
Google LLC, HubSpot, Inc., Microsoft Corporation and Cloudflare, Inc. in the United States publish participation in the EU–US Data Privacy Framework (DPF). For transfers covered by their certification, that framework provides an adequacy basis. Their published terms also describe standard contractual clauses for transfers where applicable. Framer’s and CookieYes’s published data-processing terms provide for EU standard contractual clauses for restricted transfers where required. These clauses impose data-protection obligations on recipients outside the EEA. They do not mean that processing is confined to Europe or that all recipients have the same role. Information about the safeguards relevant to your data and a copy of applicable clauses can be requested using the contact details below.
You can contact
hello@brandnewdigital.com
for information about applicable transfer safeguards and how to obtain a copy, subject to necessary protection of confidential information.
8. How long we keep personal data
We retain personal data for the purposes described in this policy and apply the following retention rules.
Enquiries that do not lead to an engagement
We delete or anonymise enquiry records no later than 12 months after the last substantive contact, unless there is a specific agreed follow-up or another documented reason to retain limited information.
Routine automated communications do not restart this period.
Active client contacts
We retain relevant contact information while it is needed for the working relationship. We review it at least annually and remove or update information that is no longer necessary.
Former client contacts
We remove routine operational contact information within 24 months after the engagement ends, unless it remains necessary for a continuing relationship, outstanding matter or another identified purpose.
Records needed for accounting, contractual evidence or legal claims are assessed separately.
Training participants
We delete routine participant lists and practical training correspondence within 12 months after the programme ends, unless continued support has been agreed.
Billing records and any evidence that must be retained for contractual or legal purposes follow the relevant retention rules below.
Financial administration
We retain financial records for the applicable statutory period, generally seven years for Dutch fiscal records. The start of the period and any exceptions depend on the type of record and applicable law.
This requirement does not mean that all messages or personal data are retained for seven years.
Contractual and legal records
We retain necessary agreements, evidence of delivery and relevant correspondence for as long as reasonably needed to meet legal obligations and establish, exercise or defend legal claims.
We determine this period by reference to the agreement, applicable limitation periods and any ongoing complaint, dispute or investigation. Access to archived records is restricted.
Data processed on a client’s behalf
Return, deletion and retention follow the applicable data-processing agreement, lawful client instructions and any overriding legal obligations.
Deletion and backups
Retention rules apply to relevant records across our systems and exports. Copies in backups may remain until the applicable backup cycle expires. Such copies are not retained for ordinary business use, and deletion requirements must be reapplied if a backup is restored.
Browser cookies and server records have different lifetimes. The Cookie Policy lists the cookies; removing them or withdrawing consent does not itself erase information already received.
In GA4, the configured retention periods are 2 months for event data and 14 months for user data. The user-data period resets with new activity. These controls concern data associated with identifiers and do not set the lifetime of most aggregated standard reports, separate exports or every Google record. Aggregated reporting may therefore remain available after the underlying retention period.
CookieYes consent records document choices, changes and timing. Under the currently used Pro service, CookieYes offers access to consent logs for up to five years; availability depends on the service plan. This is separate from the 365-day browser preference cookie. The purpose of retaining consent evidence is to demonstrate choices and deal with related complaints or claims; withdrawal does not automatically erase that evidence. CookieYes’s standard data-processing terms provide for deletion within 60 days after termination, with a backup exception of up to one year and exceptions for legal retention.
Framer’s one-day visitor-counting window is not a deletion period. Its analytics history depends on the plan. Its standard processing terms tie processing to the service agreement and provide for deletion on written request, subject to legal and inaccessible-backup exceptions. For technical records retained for a specific security incident, the criterion is the time needed for investigation, recovery and related legal handling. This is not a verified fixed rotation period for all suppliers’ hosting or form logs. Such records, aggregated reports and backup copies do not automatically follow the browser-cookie or GA4 event periods. You can exercise the rights set out in section 12.
9. Website analytics, cookies and external links
Framer Analytics runs when the website loads, including before a cookie choice and after refusal or withdrawal of optional consent. It measures page use and performance using page addresses, query parameters, timing and technical browser information. Framer describes cookieless measurement without persistent visitor identifiers and a one-day window for counting unique visitors; location can be estimated from the IP address. Cookieless does not automatically mean anonymous or exempt from consent. We have not completed the necessity and legal-basis assessment for this measurement without consent.
CookieYes manages the banner, choices and consent records. HubSpot supplies contact forms and CRM separately from Framer Analytics. GA4 is active after Analytics consent and uses the cookies described in the Cookie Policy. The website uses the Google tag directly, without a Google Tag Manager container. Google Signals and advertising personalisation are off, but this does not eliminate all advertising-related Google requests. Framer Campaign Tracking is not enabled. Page addresses, including campaign parameters, can still reach website suppliers and analytics services through normal requests.
Our Cookie Policy explains the website technologies in more detail.
Cookie Policy
Social media links, affiliate links and other external links lead to services operated by their respective providers. Their privacy and cookie practices apply when you use those services.
Use Cookie Settings in the footer to reopen CookieYes, turn Analytics off and save your choice. You have the right to withdraw consent at any time. A known technical limitation means that Google measurements can still be sent after withdrawal when you move between pages without a full reload or keep another previously consenting tab open. We cannot promise an immediate or complete network stop. Closing other open tabs and reloading with Analytics refused can help prevent a previously loaded tag from continuing in those documents; this does not erase data already received. Website delivery, preference records, Framer Analytics and the described form requests operate separately from the Analytics choice. The Cookie Policy explains browser-cookie removal and section 12 explains your rights.
10. BNDX, AI tools and training activities
Offering AI-related services does not mean that enquiries or client data are automatically submitted to AI tools.
Where an assignment involves personal data and AI tools, the relevant purposes, responsibilities, suppliers and safeguards must be established before that processing begins. Client-controlled processing is addressed through the engagement and any required data-processing agreement.
New processing activities, including any proposed training recordings, require their own assessment and appropriate information to the people involved. This policy does not itself authorise recording sessions or using client information to train AI models.
11. Protecting personal data
BND is responsible for implementing technical and organisational measures appropriate to the nature of the data and the risks of processing. These include managing access, using suitable supplier arrangements and limiting the information shared for an assignment.
No method of transmission or storage can eliminate every risk. Contact us if you believe personal data shared with BND has been exposed or misused.
12. Your rights
Depending on the circumstances, you may have the right to:
Access your personal data.
Correct inaccurate or incomplete information.
Request deletion.
Request restriction of processing.
Object to processing based on legitimate interests.
Receive eligible data in a portable format.
Withdraw consent where processing relies on consent.
You can object at any time to processing for direct marketing. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.
These rights are subject to the conditions and exceptions in applicable law.
Send requests to
hello@brandnewdigital.com
We may request proportionate information to verify your identity.
We normally respond within one month. Where legally permitted because of the complexity or number of requests, this may be extended by up to two further months. We will explain the extension within the first month.
13. Complaints
You can raise a privacy concern directly with BND.
You also have the right to complain to the
Dutch Data Protection Authority — Autoriteit Persoonsgegevens
or another competent supervisory authority. You do not have to contact BND first to exercise that right.
14. Changes to this policy
We update this policy when relevant processing activities or legal requirements change. The date above identifies the latest revision.
Where a change requires additional information or a new legal basis, updating this page alone is not sufficient; the required steps must be taken separately.
15. Contact
For questions about this policy or the handling of your personal data:
Brand New Digital B.V.
De Moerkens 39
4614 GT Bergen op Zoom
The Netherlands
hello@brandnewdigital.com