Who is responsible
Brintsy is a project being organised, not an incorporated company. The identity of the people determining processing purposes and means, correspondence address and verified contact must be completed before this becomes a final notice. Not having a company does not remove data protection responsibilities.
Data we use
The enquiry form asks for your name, email and message; company or website is optional. We use these to respond and discuss a project. Do not send passwords, medical data or confidential customer information.
The mini-audit needs no account or email. Answers, sector and business size are processed in the browser. Optional progress storage stays on your device and does not include contact form names or emails.
Only submitting the results form transmits your name, email, optional company/website, sector, business size, scores, coverage, language and method version. Individual answers are not sent. You are not automatically subscribed to a newsletter.
Hosting may involve technical logs containing IP, request time, page and browser information to deliver and secure the service. Actual settings must be confirmed before publication.
Purposes and legal bases
Project enquiries may rely on steps requested before a contract under GDPR Article 6(1)(b), when you are the prospective contracting party. For company representatives and other requests, the proposed basis is the legitimate interest in answering correspondence under Article 6(1)(f), subject to your rights.
Optional profile submission for follow-up relies on consent under Article 6(1)(a). You may withdraw without affecting earlier lawful processing. Security relies on legitimate interests; applicable legal duties on Article 6(1)(c). Browser storage is optional.
Recipients and transfers
Authorised enquiry handlers and hosting, enquiry management and email providers may access data within their roles. Forms reach the Brintsy management system only when configured; failed submissions are reported in the interface.
Providers, processing locations and any transfers outside the EEA must be confirmed. For any transfers, the final notice must identify the mechanism, safeguards and how to obtain a copy. We do not claim all data stays in the EU without verification.
Retention
Local progress has no automatic expiry and remains until cleared on the storage page, in the mini-audit or browser settings. A new audit replaces saved progress only if you choose saving.
Enquiry retention criteria include resolution, continuing a business relationship, legal duties and a justified need to establish or defend claims. Operational periods for enquiries, logs and backups must be set and implemented before the final notice. Data must not be kept indefinitely simply because no period has been set.
Your rights
Subject to GDPR conditions, you may request access, correction, erasure, restriction and portability, object to legitimate-interest processing and withdraw consent. Rights depend on the basis and circumstances; erasure does not override legal retention duties.
Send requests to the controller’s verified contact, still to be completed. Responses are normally due within one month. A justified extension of up to two further months must be notified within the first month. Proportionate identity verification may be needed.
You may complain to Romania’s ANSPDCP or the competent authority in the EU country where you live, work or believe an infringement occurred.
Choices and automated results
Required fields enable us to process enquiries; without them the form cannot be processed, but free audit results remain available. Scores are indicative automated self-assessments without legal or similarly significant effects. They do not determine eligibility for services, finance or employment.
We update this notice when the controller, providers or functions change. An update does not replace consent where required.