Privacy policy

Data controller

Brandboutique
Yves Brunner
Christodoulou Karidi Street 14, 3031 Limassol, Cyprus
Email: hello@brandboutique.cy

This website is operated from Cyprus. The processing of personal data is governed by Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the Cyprus Protection of Natural Persons with Regard to the Processing of Personal Data Law of 2018 (Law 125(I)/2018).

Personal data

Personal data is collected on this website only to the extent technically necessary, or with your consent (see "Cookies" below). Under no circumstances is the data collected sold or passed on to third parties for other reasons, unless required by law.

Contact form

If you send us an enquiry via the contact form, the details you provide — including the contact data you enter — are stored by us for the purpose of processing your enquiry and in case of follow-up questions.

We keep enquiry data only as long as needed to handle your request and any follow-up, and routinely delete it within 12 months of the matter being closed — unless a legal obligation (for example tax or commercial record-keeping) requires us to retain it longer.

Processing: The contact form runs on our own infrastructure on Cloudflare — we do not use a third-party form service. When you submit the form, your details are stored in a Cloudflare database (Cloudflare D1, hosted in the EU) solely for the purpose of handling your enquiry. To guard against spam we use Cloudflare Turnstile, which performs a privacy-friendly bot check without tracking cookies. Cloudflare acts as our hosting provider; see the Cloudflare privacy policy.

Email delivery: A notification email is delivered to us through Resend (Resend Inc.), acting as our email-delivery processor, using its EU region so the submitted data is processed within the European Union. Resend Inc. is US-headquartered; any associated access is safeguarded by the EU Standard Contractual Clauses. See Resend's privacy policy.

Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (steps prior to entering into a contract).

If you contact us via WhatsApp, your message, your phone number and your WhatsApp profile name are processed by us and by WhatsApp Ireland Limited (Meta). We use WhatsApp only to answer your enquiry and to stay in touch about an ongoing project — never for marketing broadcasts. WhatsApp may transfer data to Meta Platforms, Inc. in the USA; these transfers are covered by the EU–US Data Privacy Framework and the EU Standard Contractual Clauses. If you would rather not use WhatsApp, simply contact us by email or phone instead. Further information: WhatsApp privacy policy.

Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract, or performance of a contract) and Art. 6(1)(f) GDPR (our legitimate interest in replying through the channel you chose).

Review requests

If you are a client of ours, we may ask you once, by email, whether you would like to leave a review of our work on Google. We send this request only once, to the contact person we already work with. Whether you leave a review is entirely up to you and has no effect on our work together. You can object at any time by replying to the email or writing to hello@brandboutique.cy, and we won't ask again. If you do leave a review, Google publishes it under your Google account; see the Google privacy policy.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in feedback on our services).

Cookies

Analytics and advertising cookies are set on this website only if you allow them. When you first visit, a cookie banner asks for your consent in two categories, which you can also choose separately under "Choose cookies":

Statistics: Google Analytics (see "Google Analytics" below).
Marketing: Google Ads conversion tracking and remarketing, including Google signals (see "Google Ads" below).

"Accept all" allows both categories, "Reject all" neither. Until you allow at least one category, no Google tag is loaded and nothing is sent to Google.

Your choice itself is saved in your browser's local storage (entry bb-consent), so we don't ask again on every page. We keep it for 12 months and then ask again. When you send one of our forms, the name of the form is also kept in your browser's session storage until the next page, so that a completed enquiry can be counted. It contains no personal data, is deleted straight away and is passed to Google only if you have consented. If you have rejected both categories, it isn't stored at all.

You can change or withdraw your consent at any time via "Cookie settings" at the bottom of every page. When you withdraw a category, we also delete the Google cookies already set for it on this website. Withdrawing your consent doesn't affect the lawfulness of processing before the withdrawal.

Legal basis: Art. 6(1)(a) GDPR (consent) and, for storing and reading information on your device, your consent under the Cyprus law transposing the ePrivacy Directive (Law 112(I)/2004, as amended). Storing your cookie choice is technically necessary: Art. 6(1)(f) GDPR (our legitimate interest in remembering your choice).

Google Analytics

If you allow Statistics, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It shows us how visitors use this website — for example which pages are viewed, how visitors found us and whether an enquiry was sent — so we can improve the site and our advertising.

For this, Google sets the cookies _ga and _ga_<ID>, which are stored for up to 2 years, and processes usage data such as the pages you visit, the time of your visit, your device and browser and your approximate location. Google Analytics 4 does not log or store IP addresses. We keep user-level data in Google Analytics for 14 months. Google processes the data on our behalf as our processor (Google Ads Data Processing Terms).

Google signals: If you also allow Marketing, Google Analytics uses Google signals. If you are signed in to a Google account and have turned on personalised ads there, Google can then link your visit to your account. This shows us, in aggregated form only, how visitors use our website across devices, and it allows visitors to be added to our remarketing audiences (see "Google Ads" below). We never see who you are. If you allow Statistics but not Marketing, Google signals stays off for your visit.

Data may be transferred to Google LLC in the USA. These transfers are covered by the EU–US Data Privacy Framework and the EU Standard Contractual Clauses. Further information: Google privacy policy.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw it at any time via "Cookie settings" at the bottom of every page.

Google Ads (conversion tracking and remarketing)

We advertise with Google Ads, a service of Google Ireland Limited (address above). If you allow Marketing, we use it for two things:

Conversion tracking records when someone who clicked one of our ads goes on to send an enquiry through one of our forms. This tells us which ads and search terms bring enquiries. We see only totals, such as the number of enquiries per ad — not who sent them.
Remarketing: Google notes that your browser has visited our website and which pages it viewed, so that we can show you our ads again later — on Google Search, on YouTube and on other websites and apps in the Google network. For this we build audiences in Google Ads and Google Analytics, such as "visitors of the last 180 days". A visitor stays in such an audience for at most 540 days, the longest period Google allows; the audiences we set up ourselves use 180 days. We see only how large an audience is, never who is in it.

For this, Google sets the cookie _gcl_au and, after a click on one of our ads, _gcl_aw; both are stored for 90 days. For remarketing, Google may also use cookies on its own domains, for example IDE on doubleclick.net, stored for up to 13 months.

For conversion tracking, Google processes the data on our behalf as our processor (Google Ads Data Processing Terms). For remarketing and personalised advertising, Google acts as an independent controller (Google Ads Controller-Controller Data Protection Terms). Data may be transferred to Google LLC in the USA. These transfers are covered by the EU–US Data Privacy Framework and the EU Standard Contractual Clauses. Further information: Google privacy policy. Independently of our banner, you can turn off personalised ads from Google in My Ad Center.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw it at any time via "Cookie settings" at the bottom of every page.

Hosting

This website is hosted on Cloudflare Pages. When you visit this website, Cloudflare may automatically store information in server log files that your browser transmits (IP address, browser type, operating system, referrer URL, time of request).

Further information: Cloudflare privacy policy.

Web fonts

This website loads fonts from Google Fonts (Google Ireland Limited). When a page is loaded, your browser connects to Google's servers, which transmits your IP address to Google. Further information: Google privacy policy.

Your rights

You have the right at any time to obtain, free of charge, information about your stored personal data, its origin and recipients, and the purpose of the data processing, as well as the right to rectification, restriction of processing or erasure of this data.

For this, and for any other questions about personal data, you can contact us at any time:

Email: hello@brandboutique.cy

Right to lodge a complaint

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority. In Cyprus, this is the Office of the Commissioner for Personal Data Protection.