Skip to main content

We build your website for free — then from £30 a month, no contract.

See how →
Brambla

PRIVACY POLICY

Last updated: 24 September 2026

This Privacy Policy describes the policies of SDB Digital Ltd, United Kingdom, on the collection, use and disclosure of your information when you use our website (brambla.co.uk).

Information We Collect

When you interact with our website or services, we may collect the following information:

  • Name
  • Email address
  • Phone number
  • Company name
  • Project details (budget, services required, timeline)
  • IP address and approximate location (captured automatically by our hosting provider Vercel in edge logs, retained for up to 30 days for security and abuse prevention)
  • Site statistics: anonymous, cookie-free records of the pages viewed in a visit (page views, device type, browser, and where the visit came from), stored in our own database (marketing_funnel_events) to improve the site and deleted after 6 months. They are on by default and you can switch them off at any time on our Cookie Policy page. They are not linked to you unless you send us an enquiry (see below).
  • For security and to spot abuse and automated traffic, we also store your country and a one-way hashed form of your network address. The hash is made with a random key that changes every day and is deleted after 48 hours; we never store the network address itself, and once the key is deleted the hash can't be traced back to it. We don't use it to identify individuals or for marketing.

Personal details (name, email, phone, company, project details) are collected only when you submit one of our forms. When you do, we attach the pages you viewed during that visit to your enquiry, so we can understand what you were looking for. We also collect anonymised usage data through cookies and analytics tools if you accept them (see our Cookie Policy for details).

Lawful Basis for Processing

Under UK GDPR, we process your personal data on the following lawful bases:

  • Consent — when you submit a form or accept analytics cookies
  • Contractual necessity — to deliver services you have engaged us for
  • Legitimate interest — to respond to enquiries and improve our website, and to keep the website secure and prevent abuse (including the hashed network address described above)

Our cookie-free site statistics rely on the statistical-purposes exception in the Privacy and Electronic Communications Regulations: they are on by default, and you can object at any time by switching them off on our Cookie Policy page. If your browser sends a Global Privacy Control signal, we treat that as switched off.

How We Use Your Information

We use the information we collect to:

  • Respond to your enquiry or project brief
  • Deliver the services you have engaged us for
  • Send you a confirmation email when you submit a form
  • Improve our website and services based on usage patterns
  • Keep our website secure and spot abuse and automated traffic

Marketing Communications

If you contact us or enquire about our services, we may occasionally email you about related Brambla services, offers, or useful updates. This is done on the basis of our legitimate interest (soft opt-in) in marketing similar services to people who have shown interest in us.

  • You can decline at the point of enquiry — every enquiry form has an opt-out checkbox.
  • Every marketing email includes a one-click unsubscribe link, and you can opt out at any time.
  • You can also email hello@brambla.co.uk to be removed from our marketing list.
  • Opting out of marketing never affects essential messages about services or projects you have with us.

We do not sell or share your email address with third parties for their own marketing.

Third-Party Processors

We use the following third-party services to operate our website and deliver our services. Your data may be processed by these providers, each of which operates under their own privacy policy:

  • Supabase — database hosting for form submissions (EU hosted)
  • Microsoft 365 — transactional email delivery via Graph API (UK/EU data centres)
  • Vercel — website hosting and delivery
  • Cloudflare — DNS resolution and bot-protection (Turnstile challenge). Sees IP addresses for traffic to brambla.co.uk and verifies human visitors
  • RnkCookie — our consent-management platform (operated by SDB Digital Ltd), which displays the cookie banner and records your consent choice via the rnk_cookie_consent cookie (with a localStorage mirror). Each page load sends a minimal beacon (site ID and script ID only) to confirm the banner loaded — no per-view record is stored and no raw IP address is stored
  • Google Analytics — anonymised website usage analytics. It loads for every visitor under Google Consent Mode v2 with analytics storage denied by default, and storage is granted only after you consent.
  • Google Tag Manager — tag management. It loads for every visitor under the same Google Consent Mode v2 settings, with storage denied by default until you consent.
  • Microsoft Clarity — anonymised session recordings (mouse movement, scroll, clicks) to help us improve the site. Fires only with consent. Form fields and personal data are automatically masked by Clarity before the recording is created.
  • Stripe — payment processing for paid services and subscriptions. Stripe stores your name, email, billing address, and card details (we never see the full card number); transaction history is retained for accounting purposes. Stripe's European entity processes EU customer data per its DPA.
  • Meta (Facebook/Instagram) — Meta Pixel for conversion measurement from our paid advertising (fires only with consent)
  • Microsoft Advertising — UET tag for conversion measurement from Bing/Microsoft Search paid advertising (fires only with consent)

We will not sell your personal data to any third party. We may disclose your personal information to comply with applicable law, enforce our terms, or protect the rights, property, or safety of SDB Digital Ltd, our clients, or others.

Use of AI Tools

Brambla uses AI assistants (including Anthropic's Claude) to accelerate code generation, content research, and design iteration in our internal workflow. We do not feed your personal data (names, emails, phone numbers, project details, or any form submissions) into external AI or LLM services for automated decision-making, profiling, or content generation about you personally. Form submission content is routed only to our own database, our email system, and our human team.

We do not use automated decision-making or profiling as defined under UK GDPR Article 22. All decisions about whether to work with you, what to build, and how to price a project are made by human team members.

For full transparency on how we use AI in our workflow, see How we build.

Where Your Data Is Stored

Form submissions are stored in Supabase (EU-hosted infrastructure). Emails are sent via Microsoft 365 (UK/EU data centres). Payment data is processed and stored by Stripe under its European data processor obligations. Website analytics data is processed by Google and Microsoft Clarity in accordance with their data processing terms. Cloudflare may see your IP address when serving DNS or processing a bot challenge — these requests are not stored as personally-linked profiles.

All data transfers between these providers are protected by appropriate safeguards (Standard Contractual Clauses where data leaves the UK/EU).

Retention of Your Information

  • Form submissions (contact_submissions): up to 2 years after your last interaction, unless a longer retention period is required for an ongoing service or legal obligation.
  • CRM records (crm_clients, crm_contacts, crm_activities): retained for the duration of the client relationship plus 7 years after the final invoice, for accounting and legal record-keeping.
  • Email logs (email_logs): retained for 1 year for troubleshooting and delivery audit purposes.
  • First-party funnel events (marketing_funnel_events): retained for 6 months for internal analytics, then purged. The daily key used to hash network addresses is deleted after 48 hours.
  • IP addresses (via hosting provider): up to 30 days.
  • Analytics data (Google Analytics): kept for 14 months, the data retention period set on our GA4 property.

Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate or incomplete data
  • Erase your personal data (right to be forgotten)
  • Restrict or object to the processing of your data
  • Receive your data in a portable format
  • Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, please contact us at hello@brambla.co.uk.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection.

Cookies

We use cookies on our website. Please refer to our Cookie Policy for full details on the types of cookies we use and how to manage your preferences.

Children's Data

Our services are designed for businesses and professional users. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has submitted information to us, please contact hello@brambla.co.uk and we will delete it.

Security

The security of your personal information is important to us. We implement reasonable technical and organisational measures to protect your data from unauthorised access, disclosure, alteration, or destruction.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, and will inform affected individuals where required under UK GDPR.

Contact Us

If you have any questions or concerns about this Privacy Policy or your personal information, please get in touch:

hello@brambla.co.uk