Privacy Policy

The controller of the processing of personal data carried out via the Website is Brandnamic Srl, represented by its legal representative pro tempore, with registered office at Strada Satzl/Satzlstrasse no. 4, 39042 Bressanone/Brixen (BZ), Italy, VAT no./tax code IT02610190213 (“Brandnamic” or the “Controller”).

Brandnamic has appointed a Data Protection Officer, who can be contacted at the following address: dpo@no-spam.brandnamic.no-spam.com.

Personal data are processed when using the Website and the services offered – for example when filling in contact forms, submitting support requests, subscribing to the newsletter, applying via the “Career” section or accessing protected areas (collectively, the “Services”).

These include in particular: first name and surname, identification data and online identifiers, contact details (telephone number, e-mail address, postal address) and other information that identifies or makes a person identifiable (the “Personal Data”). This may also include special categories of personal data within the meaning of Art. 9 of the Regulation.

The following Personal Data are processed via the Website:

3.1 Browsing and usage data
The IT systems and software procedures used to operate the Website collect, in the course of their normal operation, certain Personal Data whose transmission is inherent in the use of Internet communication protocols. This information is not collected in order to be associated with specific individuals. By its very nature, however, it could – when combined with other data held by third parties – enable users to be identified.

These data include in particular: IP addresses or domain names of the devices used, URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file returned, the numerical code indicating the status of the server response (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment.

These data are used exclusively to obtain anonymous statistical information on the use of the Website, to check that it is functioning correctly and to detect anomalies and/or misuse. The legal basis is Brandnamic’s legitimate interest in the secure and proper operation of the Website (Art. 6(1)(f) of the Regulation). The data are deleted immediately after processing. They may be used to establish liability in the event of offences committed against Brandnamic or third parties.

3.2 Personal Data provided voluntarily
Personal Data may be transmitted when using certain Services of the Website. The use of some Services requires the provision of certain data. Where Personal Data are provided voluntarily via contact forms, requests on the Website or by e-mail to the addresses indicated there, the data communicated are processed. These include in particular first name and surname, e-mail address, telephone number (mobile or landline), home address and consent to receive replies to the respective request. Brandnamic uses these data exclusively to provide the requested Services and to handle the requests. Data are only disclosed to third parties where this is necessary to fulfil these purposes.

Where Personal Data of third parties are transmitted in the course of using the Website, the person transmitting them must ensure that an appropriate legal basis within the meaning of Art. 6 of the Regulation exists for this purpose.

3.3 Special categories of personal data
Special categories of personal data may be transmitted when using certain areas of the Website. The legal basis for processing such data is either the fulfilment of legal obligations or the exercise of specific rights of the Controller or the data subject in the field of employment law or – where provided voluntarily – the explicit consent of the data subject (Art. 9(2)(a) and (b) of the Regulation).

Such data should only be transmitted to the Controller where necessary. If they are nevertheless transmitted, the Controller processes them exclusively within the limits permitted by law and applying appropriate security measures.

4. Cookies and other tracking technologies

4.1 What are cookies and tracking technologies?
Cookies are small text files that are stored on the device (computer, smartphone, tablet) when a website is visited. They enable the website to remember certain actions and settings, such as login details, the selected language or display settings. Cookies may originate from the website visited (first-party cookies) or from other providers (third-party cookies). Depending on their type, they are deleted when the browser is closed (session cookies) or remain stored until a set expiry date (persistent cookies).

In addition to cookies, other tracking technologies are also used, in particular so-called tracking pixels. These are small, invisible images (usually 1x1 pixel in size) that are loaded from a server when a website or an e-mail is opened, thereby transmitting information about usage behaviour. From a legal perspective, tracking pixels are treated in the same way as cookies (Art. 122 of the Privacy Code). As they are not stored in the browser in the same way as cookies, they cannot be deleted via the browser settings; however, consent given can be withdrawn at any time via the cookie banner.

4.2 Cookies used on the Website
The Website uses the following categories of cookies and tracking technologies:

• Strictly necessary technical cookies: these are required for the operation of the Website, e.g. for navigation, session management or storing cookie preferences. No consent is required for them.
• Functional cookies: these store selected settings, such as the language, thereby improving the use of the Website. They are considered technical cookies and do not require consent.
• Analytics cookies: these record, in aggregated form, how many users visit the Website and how it is used. Where they are used directly by the Website operator and do not allow conclusions to be drawn about individual persons, they are treated in the same way as technical cookies; otherwise, consent is required.
• Marketing and profiling cookies and tracking pixels: these are used to create user profiles and display advertising in line with the interests expressed while browsing the Internet. They are only used with consent. This processing does not involve any automated decision-making within the meaning of Art. 22 of the Regulation that produces legal effects concerning the data subject or similarly significantly affects them.

This classification corresponds to the requirements of the Italian Data Protection Authority, in particular the Linee guida cookie e altri strumenti di tracciamento (Guidelines on cookies and other tracking tools) of 10 June 2021 (the “Cookie Guidelines”).

Note: if technical cookies or functional cookies are disabled, the Website may not work or may only work to a limited extent, and certain settings may have to be made again on each visit.

4.3 Consent and cookie banner
Active consent is required for all cookies and tracking technologies that are not technically necessary. Consent is managed via a Consent Management Platform (CMP): when the Website is accessed for the first time, a cookie banner appears through which all cookies, individual categories or individual cookies can be accepted or rejected. The choice made is stored and applied on the next visit. Consent can be withdrawn or changed at any time via the “Privacy settings” link in the footer of the Website. A detailed overview of all cookies and tracking technologies used, including their purpose and retention period, is available in the cookie banner.

4.4 Third-party cookies
Some cookies are set by third-party providers who use them for their own purposes. These third parties generally act as independent controllers of the related data processing and, in accordance with the Cookie Guidelines, are themselves responsible for providing information and obtaining consent. Information on this and options for selecting and deselecting such cookies can be found in the privacy policies of the respective providers. Brandnamic has no control over cookies set by the service providers of these third parties.

4.5 Push notifications
The Website offers browser push notifications (“Push Notifications”). This service is provided by Project K GmbH, Richard-Wagner-Straße 9, 6020 Innsbruck, Austria, via the PushPanda.io platform (“PushPanda”). Project K GmbH acts as a processor within the meaning of Art. 28 of the Regulation on the basis of a contract concluded with the Controller. Push Notifications are messages that can be displayed on the device even when the Website is not open. They are only activated after explicit subscription (opt-in). In this case, only an identification key generated by the browser manufacturer and anonymised location information derived from the IP address are transmitted to PushPanda; data that directly identify a person (e.g. the full IP address) are not stored. The data are only stored for as long as necessary for the service and are deleted upon unsubscription (opt-out). Information on unsubscribing is available here.

4.6 Tracking pixels in e-mails and newsletters
E-mails from Brandnamic, in particular newsletters and promotional communications, may contain tracking pixels, which make it possible to determine whether and when an e-mail has been opened. Their use complies with the Linee guida in materia di utilizzo di tracking pixel nelle comunicazioni di posta elettronica (Guidelines on the use of tracking pixels in e-mail communications) issued by the Italian Data Protection Authority on 17 April 2026 (Decision No. 284/2026):

• Statistical analysis without personal reference: where open rates are only analysed in aggregated and anonymised form, e.g. to improve e-mail deliverability or prevent spam, no consent is required.
• Security and service communications: no consent is required either for e-mails that serve security purposes (e.g. activating an account or changing a password) or whose sending is required by law.
• Analysis per recipient: where opens are attributed to individual recipients, e.g. to measure the effectiveness of campaigns or to adapt content and sending frequency, this only takes place with consent (Art. 122 of the Privacy Code and Art. 6(1)(a) of the Regulation). This consent is obtained together with consent to receive the newsletter or promotional communications.

Consent can be withdrawn in full or in part at any time: via the link in the footer of every e-mail, it is possible either to unsubscribe from the newsletter altogether or to deactivate tracking only. In the latter case, e-mails will continue to be delivered, but without tracking pixels. Withdrawal does not entail any other disadvantages. To protect recipients, Brandnamic uses random, non-attributable identifiers for tracking, so that the e-mail address itself is not transmitted when the pixel is loaded.

4.7 Managing cookies via the browser
Cookies can also be accepted, blocked or deleted, in full or in part, via the browser settings. The selected settings only apply to the device and browser used. Instructions for the most common browsers:

• Firefox
• Chrome
• Safari
• Edge

The Personal Data are processed by the Controller for the following purposes:

• Provision of the requested Services (i.e. (i) replying to requests submitted via the contact forms; (ii) providing requested demo versions of Brandnamic software; (iii) assistance with remote support requests). The legal basis is the performance of pre-contractual measures and/or of the contract (Art. 6(1)(b) of the Regulation), as the processing is necessary to provide the Services or to reply to the requests. The provision of data is voluntary; without it, however, the Services cannot be provided or the requests cannot be answered. The data are only retained for as long as strictly necessary for these purposes and in any case for a maximum of 24 months. This corresponds to Brandnamic’s internal retention policy, which is based on the principle of storage limitation pursuant to Art. 5(1)(e) of the Regulation and takes into account the period typically required for following up on a request and any subsequent communication.
• Analysis of CVs and feedback to applicants. The legal basis is the performance of pre-contractual measures and of the contract (Art. 6(1)(b) of the Regulation), as the processing is necessary for the analysis and assessment of the CVs submitted. For the analysis of professional social media profiles freely available on the Internet (e.g. LinkedIn), the legal basis is Brandnamic’s legitimate interest in assessing the applicant’s suitability for the position to be filled (Art. 6(1)(f) of the Regulation). In the course of the selection process, the Controller may receive special categories of personal data. These are processed exclusively where necessary to fulfil the obligations and exercise the rights of the Controller or the data subject in the field of employment law or – where provided voluntarily – on the basis of the applicant’s explicit consent (Art. 9(2)(a) and (b) of the Regulation). Applicants are therefore asked not to include any such data in their CV that are not necessary for the position. If this nevertheless occurs, the Controller processes such data only within the limits permitted by law and applying appropriate security measures. Applications and CVs are retained for as long as the relevant position remains open or – in the case of unsolicited applications – for up to 12 months. The Controller may contact the applicant shortly before this period expires to request an extension of the retention period.
• Fulfilment of any legal, accounting or tax obligations. The legal basis is compliance with a legal obligation to which Brandnamic is subject (Art. 6(1)(c) of the Regulation). The Personal Data are retained for as long as required by the relevant legal obligation or applicable statutory provision.
• Sending of promotional communications, newsletters and market research. The legal basis for sending promotional communications, newsletters and market research concerning Brandnamic products or services, both by automated means (e.g. e-mail) and by non-automated means (e.g. post), is the specific consent of the data subject (Art. 6(1)(a) of the Regulation). Failure to give such consent does not affect the use of the Services. In addition, pursuant to Art. 130(4) of the Privacy Code, the Controller may use the e-mail address and postal address of customers without consent to send advertising for products or services similar to those already purchased (so-called “soft spam”), unless the customer objects. Such an objection can be made at any time by e-mail to privacy@no-spam.brandnamic.no-spam.com. For the use of tracking pixels in these e-mails, see section 4.6. The Personal Data are retained for these purposes until consent is withdrawn or an objection is made, but for no longer than 24 months.
• Prevention and handling of disputes and other legal matters, and defence in legal proceedings. The legal basis is Brandnamic’s legitimate interest in preventing or settling disputes and defending itself in court (Art. 6(1)(f) of the Regulation). For this purpose, the Personal Data are stored for a period of 10 years unless an objection is made beforehand, plus the duration of any legal proceedings.

Further information on retention periods and the criteria used to determine them is available at the following address: privacy@no-spam.brandnamic.no-spam.com.

An automated messaging system (the “Chatbot”) is available on the Website. It is based on artificial intelligence technologies and provided by HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, United States (“HubSpot”).

The Chatbot answers questions about the products and services offered on the Website on the basis of the information available there. Answers are initially generated by an artificial intelligence system; the Controller’s staff intervene if this is expressly requested or if the Chatbot is unable to provide an adequate answer.

No Personal Data should be entered in the Chatbot unless this is strictly necessary to handle the request.

6.1 Purpose, legal basis, retention period
If Personal Data are entered in the Chatbot, they are processed exclusively to handle the request made and to facilitate the resolution of problems relating to the products and services offered on the Website. The legal basis is the consent of the data subject, given by accepting the corresponding cookie (Art. 6(1)(a) of the Regulation). Personal Data entered in the Chatbot are retained for a maximum of 3 months and then deleted, subject to any statutory retention obligations.

6.2 Recipients and transfers of Personal Data
Personal Data entered in the Chatbot may be transmitted to HubSpot. HubSpot acts as a processor on the basis of a contract concluded with the Controller pursuant to Art. 28 of the Regulation.

The Personal Data are transferred to the United States, where HubSpot is based. This transfer takes place in accordance with the Regulation, in particular on the basis of the European Commission’s adequacy decision of 10 July 2023 on the “EU-US Data Privacy Framework”.

The Personal Data may be disclosed to the following recipients:

• persons acting under the authority of Brandnamic who are authorised to process Personal Data within the scope of their duties pursuant to Art. 29 of the Regulation and who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (e.g. employees, authorised persons);
• processors within the meaning of Art. 28 of the Regulation who process Personal Data on behalf of the Controller on the basis of a contract concluded with it, such as (i) persons, companies or law firms that assist and advise Brandnamic in accounting, administrative, legal, tax and financial matters and debt collection; (ii) entities with which cooperation is necessary for the provision of the services (e.g. hosting providers, resource providers); (iii) persons entrusted with technical maintenance work (system administrators);
• bodies or authorities to which Personal Data must be disclosed by virtue of legal provisions or orders issued by authorities.

Some Personal Data are shared with recipients who may be located outside the European Economic Area (EEA). The Controller ensures that processing by these recipients complies with the Regulation. Transfers may be based on an adequacy decision, the standard contractual clauses (SCCs) approved by the European Commission or another appropriate legal basis.

Further information on processing by third parties and on the transfer of Personal Data is available at the following address: privacy@no-spam.brandnamic.no-spam.com.

Pursuant to Art. 15 et seq. of the Regulation, data subjects have the right at any time to access the Personal Data concerning them that are processed by Brandnamic and to obtain the rectification or erasure of such data. They also have the right to object to processing, to request restriction of processing in the cases provided for in Art. 18 of the Regulation and, in the cases provided for in Art. 20 of the Regulation, to receive their data in a structured, commonly used and machine-readable format. Requests can be sent to the following address: privacy@no-spam.brandnamic.no-spam.com.

Consent given can be withdrawn at any time for all processing that is not necessary for the provision of the Services. In particular, the receipt of newsletters and promotional communications can be objected to at any time (opt-out), either via the unsubscribe link at the end of every e-mail or by e-mail to privacy@no-spam.brandnamic.no-spam.com. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal (Art. 7(3) of the Regulation).

In addition, pursuant to Art. 77 of the Regulation, there is a right to lodge a complaint with the competent supervisory authority (in Italy: Garante per la protezione dei dati personali) if the processing of Personal Data is considered to infringe applicable data protection legislation.

This privacy policy applies from 1 October 2026. Brandnamic reserves the right to amend or update the content of this privacy policy in whole or in part, in particular as a result of changes to applicable legislation. Changes will be announced by publication on the Website; the current version can be accessed on this page at any time.