1. Data Controller

For the purposes of the EU GDPR and UK GDPR, the data controller is: Brawl

​

• Registered Address: Brawl, Airebank House, 419 Kirkstall Road, Leeds, LS4 2EZ

• Email: hello@brawlagency.com

• Company Number: 3657947

If you have questions about this Privacy Policy or your personal data, contact us using the details above.

 

...

2. Scope
This Privacy Policy applies to individuals located in:

​

• The European Economic Area (EEA)

• The United Kingdom (UK)

• Switzerland (where applicable under similar principles)

​

...

3. Categories of personal data we may collect

A. Identity Data

• Full name

• Job title

• Company name

B. Contact Data

• Email address

• Telephone number

• Billing and mailing address

C. Account Data

• Username

• Encrypted password

• Account settings

D. Technical Data

• IP address

• Browser type and version

• Device identifiers

• Operating system

• Time zone

E. Usage Data

• Website interaction data

• Pages viewed

• Feature usage

F. Marketing & Communications Data

• Communication preferences

• Records of correspondence

We do not intentionally collect special category data (e.g., health, biometric, political, religious data).

 

...

4. How we collect personal data:

​

• Directly from you (forms, contracts, communications)

• Automatically (cookies, analytics tools, server logs)

• From third parties (service providers, business partners, where applicable)

​

...

5. Legal Bases for Processing

We rely on the following lawful bases:

A. Contractual Necessity

• To perform a contract with you or take steps before entering into a contract.

B. Legal Obligation

• To comply with legal and regulatory obligations.

C. Legitimate Interests For:

• Service improvement

• Security monitoring

• Fraud prevention

• Business administration

• We ensure our legitimate interests do not override your fundamental rights.

D. Consent

• Where required (e.g., marketing emails, non-essential cookies). You may withdraw consent at any time.

 

...

6. Purposes of Processing

We process personal data to:

​

• Provide and maintain our services

• Manage user accounts

• Process transactions

• Provide customer support

• Improve our website and services

• Send administrative and marketing communications

• Ensure IT security

• Comply with legal obligations

 

...

7. Cookies
We use essential and non-essential cookies.
Where required under EU or UK law, we obtain your consent before placing non-essential cookies.
You can manage preferences via our cookie banner or your browser settings.
 

...

8. Data Sharing
We may share personal data with:

​

• IT and hosting providers

• Cloud service providers

• Payment processors

• Professional advisors

• Regulatory or law enforcement authorities when legally required

All processors are bound by GDPR-compliant data processing agreements.
We do not sell personal data.

...

9. International Transfers
If we transfer personal data outside the EEA or UK, we ensure appropriate safeguards such as:

​

• EU Standard Contractual Clauses (SCCs)

• UK International Data Transfer Agreement (IDTA)

• UK Addendum to EU SCCs

• Adequacy regulations

You may request further information about safeguards by contacting us.

...

10. Data Retention
We retain personal data only as long as necessary to:

​

• Fulfill contractual obligations

• Meet legal and regulatory requirements

• Resolve disputes

• Enforce agreements

Retention periods vary based on data type and legal requirements.

...

11. Data Security
We implement appropriate technical and organizational measures including:

​

 

• Encryption

• Access controls

• Secure infrastructure

• Regular monitoring

No system can guarantee absolute security.

...

12. Your Rights (EU & UK Data Subjects)
Under EU GDPR and UK GDPR, you have the right to:

​

• Access your personal data

• Request rectification

• Request erasure

• Restrict processing

• Object to processing

• Request data portability

• Withdraw consent

• Not be subject to automated decision-making

To exercise your rights, contact: hello@brawlagency.com
We respond within one month as required by law.

...

13. Complaints
If you are in the EU, you may lodge a complaint with your local supervisory authority. A list of authorities is available from the European Data Protection Board.

​

• If you are in the UK, you may lodge a complaint with the Information Commissioner's Office (ICO).

• We encourage you to contact us first so we can attempt to resolve your concern.

...

14. Changes to This Policy
We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised “Last Updated” date.
Where legally required, we will provide additional notice of significant changes.