Skip to main content
Free AI Diagnosis

Last updated: April 2025

Legal Documents

United States Entity

Databranding LLC
121 S. Orange Ave, Suite 1500
Orlando, FL 32801, USA

Mexico Entity

Inbound Latam S.A. de C.V.
Sierra Madre 115, Lomas de Chapultepec
Ciudad de México, C.P. 11000

Document 5 of 5

GDPR Privacy Notice
for EEA, UK & Switzerland

Applicable to visitors and users located in the European Economic Area (EEA), United Kingdom, and Switzerland · Governing regulation: EU General Data Protection Regulation 2016/679 (GDPR) · Effective: April 2025

This notice supplements our general Privacy Notice and applies specifically to individuals located in the European Economic Area (EEA), the United Kingdom, and Switzerland ("European Users"). If there is any conflict between this notice and the general Privacy Notice, this notice prevails for European Users.

Note on EU Representative (Art. 27 GDPR): Databranding LLC and Inbound Latam S.A. de C.V. do not currently maintain a formally designated representative within the EU/EEA. Processing of European user data is occasional, not systematic or large-scale. Should our data processing activities involving European residents become regular or large-scale, we will designate an EU representative as required under Article 27 GDPR and update this notice accordingly.

1. Data Controller

The data controller responsible for processing your personal data is:

Databranding LLC
121 S. Orange Ave, Suite 1500, Orlando, FL 32801, USA
Email: info@databranding.net

For matters related to Mexican operations: Inbound Latam S.A. de C.V., Sierra Madre 115, Lomas de Chapultepec, C.P. 11000, Ciudad de México, México. Data protection contact: Miguel Ángel Tolsá — info@databranding.net.

We have not appointed a formal Data Protection Officer (DPO) as our processing activities do not meet the thresholds requiring mandatory DPO designation under Article 37 GDPR. For all data protection inquiries, please contact us directly at info@databranding.net.

2. Personal Data We Collect

We collect and process the following categories of personal data about European Users:

  • Identity data: First name, last name, company name, job title.
  • Contact data: Email address, telephone number, postal address.
  • Technical data: IP address, browser type and version, operating system, device identifiers, time zone setting, browser plug-in types and versions.
  • Usage data: Information about how you use our website, products, and services — including pages visited, time spent on pages, links clicked, and content downloaded.
  • Marketing and communications data: Your preferences in receiving marketing from us and your communication preferences.
  • AI interaction data: Inputs submitted to AI-powered tools or chatbots on this site, where applicable.
  • Cookie and tracking data: As described in Section 6 below.

We do not intentionally collect any Special Categories of Personal Data (as defined under Article 9 GDPR) — including data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data — through this website. If you voluntarily submit such data (e.g., in a free-text form field), it will be treated with the highest level of protection.

3. Legal Basis for Processing (Article 6 GDPR)

We process your personal data only where we have a valid legal basis to do so. The legal bases we rely on are:

  • Consent (Art. 6(1)(a)): Where you have given clear, freely given, specific, informed, and unambiguous consent. This applies to: marketing communications, non-essential cookies and tracking technologies, and AI chatbot interactions. You may withdraw consent at any time without affecting the lawfulness of prior processing.
  • Contract performance (Art. 6(1)(b)): Where processing is necessary to perform a contract to which you are party or to take pre-contractual steps at your request. This applies to service inquiries, proposals, and service delivery.
  • Legal obligation (Art. 6(1)(c)): Where processing is necessary to comply with a legal obligation to which we are subject, including applicable tax, accounting, and regulatory requirements.
  • Legitimate interests (Art. 6(1)(f)): Where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your interests, rights, or freedoms. Our legitimate interests include: operating and improving our website and services, preventing fraud and ensuring security, and conducting internal analytics. We conduct a Legitimate Interests Assessment (LIA) for each processing activity relying on this basis.

4. Cookies & Consent Management (ePrivacy / GDPR)

In compliance with GDPR and the ePrivacy Directive, we obtain your prior, granular consent before placing any non-essential cookies or activating tracking technologies. Our cookie consent management is implemented through HubSpot's native GDPR cookie consent tools.

Cookie categories and their legal basis:

  • Strictly necessary cookies (no consent required): Essential for site functionality. Legal basis: legitimate interests / contract performance.
  • Analytics cookies (consent required): Google Analytics GA4 and HubSpot analytics. Legal basis: consent (Art. 6(1)(a)). Activated only upon your affirmative consent via our cookie banner.
  • Marketing cookies (consent required): HubSpot tracking, Meta Pixel, Google Ads tags — activated only during active campaigns and only upon your affirmative consent. Legal basis: consent (Art. 6(1)(a)).
  • Functionality cookies (consent required): Remembering preferences and personalizing your experience. Legal basis: consent (Art. 6(1)(a)).

You may withdraw or modify your cookie consent at any time via the cookie preference center accessible through our cookie banner or footer link. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

We use web beacons (pixel tags) in conjunction with cookies to track email open rates and page interactions. These are activated only with your consent where required.

5. Your Rights Under GDPR (Articles 15–22)

As a data subject located in the EEA, UK, or Switzerland, you have the following rights under GDPR:

  • Right of access (Art. 15): You have the right to obtain confirmation of whether we process your personal data, and if so, to receive a copy of that data along with supplementary information about how it is processed.
  • Right to rectification (Art. 16): You have the right to request correction of inaccurate personal data and completion of incomplete data without undue delay.
  • Right to erasure / "right to be forgotten" (Art. 17): You have the right to request deletion of your personal data where: it is no longer necessary for the purposes for which it was collected; you withdraw consent and there is no other legal basis; you object to processing and there are no overriding legitimate grounds; the data has been unlawfully processed; or erasure is required by law. This right is subject to exceptions where processing is necessary for legal claims or legal obligations.
  • Right to restriction of processing (Art. 18): You have the right to request that we restrict processing of your personal data in certain circumstances, including where you contest the accuracy of the data or have objected to processing pending verification of legitimate grounds.
  • Right to data portability (Art. 20): Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller.
  • Right to object (Art. 21): You have the right to object at any time to processing based on legitimate interests (Art. 6(1)(f)), including profiling. You also have an absolute right to object to processing for direct marketing purposes, including profiling related to direct marketing. Upon such objection, we will cease processing immediately unless we demonstrate compelling legitimate grounds that override your interests.
  • Rights related to automated decision-making and profiling (Art. 22): You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning you. We do not currently engage in fully automated decision-making of this nature. Where AI-assisted features provide recommendations, a human review component is maintained.
  • Right to withdraw consent (Art. 7(3)): Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, submit a written request to info@databranding.net with the subject line "GDPR Data Subject Request." We will acknowledge your request within 72 hours and respond substantively within 30 calendar days. In complex cases, this period may be extended by a further two months, in which case we will notify you of the extension and the reasons within the initial 30-day period (Art. 12(3) GDPR).

We will not charge a fee for processing your request unless it is manifestly unfounded or excessive (Art. 12(5) GDPR).

6. International Data Transfers (Articles 44–49 GDPR)

As Databranding LLC is based in the United States, processing your personal data involves a transfer of data to a third country (the USA) that does not benefit from an EU adequacy decision under Article 45 GDPR (noting that the EU-US Data Privacy Framework exists but may be subject to change).

We ensure appropriate safeguards for such transfers through one or more of the following mechanisms:

  • Standard Contractual Clauses (SCCs): We rely on the European Commission's standard contractual clauses (Commission Implementing Decision (EU) 2021/914) with our third-party processors, including HubSpot, Inc., Google LLC, and Meta Platforms, Inc., to govern international data transfers.
  • Adequacy decisions: Where transfers are made to countries covered by an EU adequacy decision, no additional safeguard is required.
  • Derogations (Art. 49): In limited circumstances where SCCs are not applicable, we may rely on your explicit consent (Art. 49(1)(a)) or the necessity of the transfer for contract performance (Art. 49(1)(b)).

You may request a copy of the applicable transfer mechanism by contacting us at info@databranding.net.

7. Data Retention (Article 5(1)(e) GDPR)

We retain personal data for no longer than is necessary for the purposes for which it was collected, in accordance with the storage limitation principle. Our general retention periods are:

  • Prospect / inquiry data: 24 months from last contact, unless a commercial relationship begins.
  • Client / contract data: Duration of the contractual relationship plus 7 years, to comply with tax and accounting obligations.
  • Marketing / newsletter data: Until you withdraw consent or unsubscribe, after which data is deleted within 30 days.
  • Cookie / analytics data: As configured in each tool (GA4: 14 months; HubSpot: 13 months by default).
  • AI interaction logs: Up to 90 days for quality assurance purposes, then anonymized or deleted.
  • Legal claims / disputes: For the duration of the limitation period applicable to the relevant claim.

At the end of each retention period, data is securely deleted or anonymized so that it can no longer be associated with an identifiable individual.

8. Data Security (Article 32 GDPR)

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of our processing activities. These measures include:

  • Encryption of personal data in transit (SSL/TLS) and, where applicable, at rest.
  • Ongoing confidentiality, integrity, availability, and resilience of processing systems.
  • Regular assessment and evaluation of the effectiveness of security measures.
  • Access controls and role-based permissions limiting access to personal data.
  • Data processor agreements with all third parties handling personal data on our behalf.

9. Personal Data Breaches (Articles 33–34 GDPR)

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

  • Notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach (Art. 33 GDPR), unless the breach is unlikely to result in a risk to individuals' rights and freedoms.
  • Communicate the breach to you without undue delay if it is likely to result in a high risk to your rights and freedoms (Art. 34 GDPR), unless an exemption applies (e.g., data was encrypted and remains inaccessible to unauthorized parties).

10. Third-Party Processors (Article 28 GDPR)

We engage the following categories of third-party processors under written data processing agreements (DPAs) that comply with Article 28 GDPR:

  • HubSpot, Inc. (CRM, marketing automation, forms, analytics, cookie consent) — USA, SCCs in place.
  • Google LLC (Google Analytics GA4, Google Ads) — USA, SCCs in place.
  • Meta Platforms, Inc. (Meta Pixel, advertising) — USA, SCCs in place. Activated only when campaigns targeting European users are active.
  • Third-party AI providers (chatbot and diagnostic tool infrastructure) — DPAs in place; no training on your data without explicit consent.
  • Hosting and infrastructure providers — processing under written DPA.

We do not authorize any processor to sub-process your data without our prior written consent and equivalent data protection obligations.

11. Right to Lodge a Complaint (Article 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority — in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement — if you consider that our processing of your personal data violates GDPR.

A list of EU data protection supervisory authorities is available at: edpb.europa.eu.

For UK residents, the relevant authority is the Information Commissioner's Office (ICO): ico.org.uk.

For Swiss residents, the relevant authority is the Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch.

We would, however, appreciate the opportunity to address your concerns before you approach a supervisory authority. Please contact us first at info@databranding.net.

12. Changes to This GDPR Notice

We will update this notice to reflect changes in law, our processing activities, or our services. Material changes will be communicated through a prominent notice on our website. The effective date at the top of this document will be updated accordingly. We encourage you to review this notice periodically.

Data Protection Contact

info@databranding.net
Subject: "GDPR Data Subject Request"

Controller Address

Databranding LLC
121 S. Orange Ave, Suite 1500
Orlando, FL 32801, USA