Privacy policy

Brand New Day takes the fair handling of the data you entrust to us seriously. This policy sets out what data this website collects, why, on what legal basis, how long it is kept, who it is shared with, and what rights you can exercise.

It is drawn up in accordance with Regulation (EU) 2016/679 (GDPR) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

1. Who processes your data

• Controller: BrandNewDay SRL
• Registered office: Rue Albert 1er 19, 7100 La Louvière, Belgium
• Company number (CBE): BE 0683.536.036
• Contact for any question about your data: contact@brandnewday.agency

No data protection officer has been appointed. Appointment is not required under Article 37 GDPR: the processing described here involves neither regular and systematic monitoring of individuals on a large scale, nor large scale processing of special category data.

2. What this policy covers

It covers the processing carried out by the brandnewday.agency website: its forms and the hosting of the pages you visit.

It does not cover the work Brand New Day carries out for its clients, where the agency usually acts as a processor. That work is governed by the contracts signed with each client.

3. The data you give us

The site collects no data without your knowledge. There is no user account, no profiling, and no automated decision producing legal effects concerning you within the meaning of Article 22 GDPR.

Two forms, and only these two, collect personal data. That data is what you type into them, and nothing else.

3.1 The contact form

What you give us: your contact details (name and email address), your company name if you choose to provide it, and the content of your message.

Why: to read your enquiry and answer it, to acknowledge receipt, and where relevant to continue the conversation your enquiry starts.

Legal basis: legitimate interest (Article 6(1)(f)). You write to us in order to get an answer. Answering is the agency's legitimate interest and matches what you reasonably expect when you send the form. The information requested is limited to what allows us to reply, is used for no other purpose, and is passed to no one for marketing purposes. You may object at any time (section 7).

3.2 Signing up to the Content Club guest list

What you give us: your contact details (first name, last name, email address), the capacity in which you introduce yourself (creator or brand), a link to your profile or portfolio if you wish to share one, and your explicit agreement.

The link is the one you choose to share. The site extracts no information from it automatically.

Why: to record your registration, to tell you when applications open and what the programme holds, and to tailor that information to the capacity you gave.

Legal basis: your consent (Article 6(1)(a)), collected through a dedicated, unticked checkbox, without which the form is not accepted.

You may withdraw your consent at any time, as easily as you gave it, by writing to the address in section 1. Withdrawal deletes your registration and does not affect what was done before it.

3.3 What the site does not do

• Your IP address is not kept. Protection against automated submissions relies on an

anonymous fingerprint, erased automatically after one hour.

• No audience measurement: no Google Analytics, no Matomo, no equivalent.
• No advertising trackers, no social network pixels.
• No resource loaded from a third party server: displaying a page exposes your browser

to no outside service.

• No special category data within the meaning of Article 9 is requested. Please do not

include any in the free text of your message.

4. How long it is kept

Once the period has elapsed, the data is deleted.

5. Who has access

Your data is never sold, rented or transferred to third parties for commercial purposes.

• Internally: the staff responsible for client relations and for running the Content

Club, limited to what their work requires. Enquiries are stored privately and are never displayed publicly.

• Our technical providers, who act only on our instructions and may not use your data

for their own purposes (Article 28): hosting of the site and its database, and delivery of the emails triggered by the forms. Their identity is available on request at the address in section 1.

• Public authorities, where the law requires it and strictly within the limits of that

obligation.

Location and transfers. Your data is hosted and processed within the European Union. As one of our providers is a company incorporated in the United States, access from a third country cannot be entirely ruled out. Such access is governed by a data processing agreement incorporating the European Commission's standard contractual clauses.

6. Cookies

The site sets no audience measurement, advertising or social network cookie, and uses neither browser local storage nor session storage. No consent banner is shown, because there is nothing to consent to.

There are two exceptions, both strictly necessary. One cookie remembers the display language you chose, so as to offer it again on your next visit. On that basis it falls under the consent exemption of Article 129 of the Belgian Act of 13 June 2005, and it allows neither identifying you nor tracking you across sites. The other cookies concern administrator accounts only: a visitor who does not log in receives none.

You can set your browser to refuse them. Refusing the language cookie does not prevent access to the site. It will simply ask you to pick your language again on each visit.

7. Your rights

Under Articles 15 to 22 GDPR, you may:

• access your data and receive a copy of it;
• have it rectified where it is inaccurate or incomplete;
• request its erasure;
• request restriction of processing, for instance while an accuracy check is carried

out;

• object to processing based on legitimate interest, on grounds relating to your

particular situation. Objection to direct marketing is unconditional and immediate;

• receive your data in a machine readable format and have it sent to another controller

(portability);

• withdraw your consent at any time, for the processing that relies on it;
• give instructions about what happens to your data after your death.

How to exercise them. Write to the address in section 1, stating which right you wish to exercise and, if possible, which form you used and roughly when. We answer within one month, extendable by two months for a complex request, in which case we tell you within the first month. Exercising these rights is free of charge. Proof of identity is requested only where there is reasonable doubt as to who you are.

8. Complaints

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the Belgian supervisory authority:

Data Protection Authority Rue de la Presse 35, 1000 Brussels https://www.dataprotectionauthority.be

You may also contact the authority of your place of residence or work, or bring court proceedings.

9. Security

We implement appropriate technical and organisational measures to protect your data: encrypted transmission (HTTPS), private storage of enquiries, protection against automated submissions and against submissions from third party sites, restricted administrator access, and no retention of IP addresses.

Should a data breach be likely to result in a high risk to your rights, you would be informed under the conditions of Article 34 GDPR.

10. Changes

This policy may change to reflect developments in the site, in its providers or in the law. The version that applies is the one published at the time you read it. Any substantial change affecting processing based on your consent would be notified to you.