Privacy Policy

01Overview and scope

This Privacy Policy applies to personal information that Brendy & Partners processes in connection with our websites, applications, and the client resource management platform (collectively, the "Services"). It does not apply to third-party products or services that we do not control, or to any customer that uses the Services under its own privacy notice.

"Personal information" (also called personal data) means information that identifies, relates to, or could reasonably be linked with a particular individual or household. By using the Services, you acknowledge the practices described in this Policy.

02Our role: controller and processor

We handle personal information in two distinct capacities:

• As a controller. For information about our own account holders, website visitors, and business contacts — for example, registration details, billing information, support communications, and marketing preferences — Brendy & Partners decides why and how the information is processed and acts as the controller. This Policy governs that processing.
• As a processor (service provider). When a customer uploads or submits information about its own clients or other individuals into the Services, the customer is the controller of that information and Brendy & Partners processes it only on the customer's documented instructions to provide the Services. For that information, the customer's privacy notice applies, and individuals should contact the customer to exercise their rights. See Section 11.

03Information we collect

Information you provide

• Account and registration data — such as name, business email, organisation, job title, and the credentials used to authenticate.
• Content you submit — documents, files, messages, and other Customer Data you choose to store or exchange through the Services.
• Communications — information you provide when you contact us for support, sales, or other enquiries.
• Billing details — where fees apply, billing contact and transaction information (payment card details are handled by our payment processors, not stored by us in full).

Information collected automatically

• Usage and log data — actions taken in the Services, feature usage, timestamps, and referring pages.
• Device and connection data — IP address, browser type, operating system, device identifiers, and language settings.
• Security data — authentication events, access logs, and information used to detect and prevent fraud, abuse, and security incidents.

Information from third parties

• Identity and single sign-on providers — where you authenticate through an identity provider, we receive limited profile and authentication information.
• Your organisation — an administrator may create or manage your access and provide related information.

04Cookies and similar technologies

We and our providers use cookies and similar technologies to operate and secure the Services, remember your preferences (such as theme and language), keep you signed in, and understand how the Services are used. We categorise them as:

• Strictly necessary — required for core functions such as authentication, session management, and security. These cannot be switched off through the Services.
• Functional — remember choices you make to improve your experience.
• Analytics — help us measure and improve performance in aggregate.

Where required by law, we request consent for non-essential cookies. You can control cookies through your browser settings; disabling some cookies may affect functionality. We honour applicable browser-based opt-out signals where legally required.

05How we use information

We use personal information for the purposes below. Where the EU or UK General Data Protection Regulation applies, the relevant legal basis is indicated.

We do not use Customer Data that a customer processes as a controller for our own independent purposes, except as needed to provide the Services or as instructed by the customer. We do not use your personal information to make solely automated decisions producing legal or similarly significant effects.

06How we share information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We disclose personal information only as described below:

• Service providers and subprocessors — vendors who process information on our behalf to host, operate, secure, and support the Services, under contracts that require appropriate confidentiality and security safeguards and limit use to our instructions.
• Within our corporate group — affiliates that help provide the Services, consistent with this Policy.
• Your organisation — administrators of your Account may access information relating to your use of the Services.
• Legal and compliance — where we reasonably believe disclosure is required to comply with law, legal process, or a lawful governmental request, or to protect the rights, property, safety, and security of Brendy & Partners, our customers, or the public.
• Business transfers — in connection with a merger, acquisition, financing, reorganisation, or sale of assets, information may be transferred subject to this Policy.
• With your consent — for any other purpose disclosed to you at the time.

07International data transfers

We may process and store personal information in countries other than the one in which it was collected, including where our service providers operate. These countries may have data-protection laws that differ from those in your jurisdiction. Where we transfer personal information across borders that are subject to transfer restrictions (for example, from the European Economic Area, the United Kingdom, or Switzerland), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. You may request further information using the contact details in Section 15.

08Data retention

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, including to provide the Services, maintain your Account, comply with our legal, tax, accounting, and regulatory obligations, resolve disputes, and enforce our agreements. Customer Data that we process as a processor is retained and deleted in accordance with the customer's instructions and the applicable agreement. When information is no longer needed, we delete or de-identify it, subject to routine backup cycles and any legal-hold requirements. Retention periods vary according to the type of information and the purpose for which it is processed.

09How we protect information

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorised access, disclosure, alteration, and destruction. These include encryption of data in transit and at rest, access controls and least-privilege principles, network protection, logging and monitoring, and personnel confidentiality obligations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Where we are legally required to do so, we will notify affected individuals and authorities of a personal-data breach without undue delay.

10Your privacy rights

Depending on where you live and the capacity in which we process your information, you may have some or all of the following rights.

European Economic Area, United Kingdom, and Switzerland

You may have the right to access your personal data; to rectify inaccurate data; to erase data; to restrict or object to processing; to data portability; and to withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local supervisory authority.

California and other U.S. states

Subject to applicable law, you may have the right to know and access the categories and specific pieces of personal information we collect; to delete personal information; to correct inaccurate information; and to opt out of the "sale" or "sharing" of personal information and the use of sensitive personal information beyond permitted purposes. As stated in Section 6, we do not sell or share personal information for cross-context behavioural advertising. We will not discriminate against you for exercising your rights, and you may use an authorised agent where permitted.

How to exercise your rights

To make a request, contact us using the details in Section 15. We may need to verify your identity before acting on a request, and we will respond within the timeframe required by applicable law. If your information was provided to us by a customer that acts as controller, we will refer your request to that customer or assist them in responding. See Section 11.

11Data processed for customers

Much of the information in the Services is submitted by our customers about their own clients and personnel. For that information, the customer is the controller and Brendy & Partners is the processor. We process it only to provide and support the Services, on the customer's documented instructions, and in accordance with our agreement and any applicable data processing agreement. If you are an individual whose information a customer has placed in the Services and you wish to exercise your rights or have questions about that processing, please contact the relevant customer directly. If you contact us, we will forward your request to the appropriate customer where we can identify them.

12Children's privacy

The Services are intended for business use by professionals and are not directed to children. We do not knowingly collect personal information from children under the age of 16 (or the minimum age required in your jurisdiction). If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

13Third-party links

The Services may link to or integrate with third-party websites and services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy notices of any third-party service you use.

14Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice through the Services or by email. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

15Contact us

If you have questions about this Policy or wish to exercise your rights, you can reach Brendy & Partners:

• Privacy enquiries and requests: privacy@bnpcrm.com
• Data Protection Officer: dpo@bnpcrm.com
• Postal: Brendy & Partners, Attn: Privacy Team, at the registered office address stated on our website.

If you are located in the European Economic Area or the United Kingdom and we are required to designate a representative, contact details for our representative will be provided on request to the address above.