Privacy Policy
Last updated:
This policy explains what personal data brillQ processes when you visit brillq.today or contact us, why we process it and what rights you have. It describes only what this website actually does.
1. Who is responsible for your data
The controller of your personal data is:
brillQ sp. z o.o.
Aleja Prymasa Tysiąclecia 83A/824
01-242 Warsaw, Poland
KRS 0001233446 · NIP 5273213074 · REGON 544413376
Email: hello@brillq.today
For any question about your data, or to exercise your rights, write to hello@brillq.today.
2. What data we process and why
We process only the data needed for the purposes below. We do not sell personal data and do not use it for advertising.
Contact forms
- Where
- the Contact tab available on every page.
- Data
- your name, email address and message; optionally your company name and, in the Contact tab form, your phone number.
- Purpose
- replying to your message and, if you ask about our services, taking steps before a possible contract.
- Legal basis
- Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in answering messages sent to us).
- How it works
- the form content is sent to our mailbox as an email through Resend (Resend, Inc., USA), our email delivery provider. Our mailbox is hosted by Google Workspace (Google Ireland Limited), where the message and our correspondence are stored for the retention period below. The website does not store form submissions in a database.
- Retention
- we keep the correspondence for as long as needed to handle your inquiry and then for up to 3 years after our last exchange. If a contract follows, we keep it for the term of the contract and for as long as the law requires afterwards.
Spam and abuse protection
- Data
- your IP address when you submit a form.
- Purpose
- limiting the number of submissions from one IP address (5 per minute) to prevent spam and abuse.
- Legal basis
- Art. 6(1)(f) GDPR (our legitimate interest in protecting the website and our mailbox).
- Retention
- the counter linked to your IP address is used only for the one-minute limit and is deleted automatically shortly afterwards: within about two minutes in the Redis database run by Upstash, Inc. (USA) on our behalf, or, when it is held in the server’s working memory, at the latest when that short-lived server instance shuts down.
Google reCAPTCHA (when form protection is active)
- Provider
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
- Data
- your IP address, browser and device information and how you interact with the page. Google may set or read cookies on its own domains. The reCAPTCHA script loads only when you open the Contact tab.
- Purpose
- checking that forms are sent by people, not bots.
- Legal basis
- Art. 6(1)(f) GDPR (our legitimate interest in protecting our forms from spam).
- More information
- Google Privacy Policy and Google Terms of Service.
Analytics (Google Analytics 4), only with your consent
- Provider
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
- When
- only after you click “Accept” in the cookie banner. Without your consent the analytics script is not loaded and no data is sent to Google Analytics.
- Data
- pages viewed, referring website, approximate location (country, city), device and browser type, and a random identifier stored in the _ga cookies. Google Analytics 4 anonymizes IP addresses by default: it does not log or store them.
- Purpose
- understanding how the website is used so we can improve it.
- Legal basis
- your consent, Art. 6(1)(a) GDPR.
- Retention
- the _ga and _ga_<container-id> cookies last up to 2 years. Analytics data is kept in Google Analytics for no longer than 14 months.
- Withdrawing consent
- at any time, by clicking the “Cookies” button in the bottom-left corner of any page and choosing “Decline”. We then stop Google Analytics and delete its cookies on our domain. Withdrawal does not affect processing that took place before it.
Hosting and server logs
- Provider
- Netlify, Inc. (USA), which hosts this website.
- Data
- technical data such as your IP address, browser user agent, the requested URL and the time of the request.
- Purpose
- delivering the website and protecting it from attacks.
- Legal basis
- Art. 6(1)(f) GDPR (our legitimate interest in running a secure website).
- Retention
- for a limited period under Netlify’s log retention rules.
Error monitoring
- Provider
- Sentry (Functional Software, Inc., USA), if enabled.
- Data
- technical details of errors and page performance, such as the page address, browser and operating system, request headers such as the referring page, and the error message. We configure Sentry not to send cookies or form contents. Sentry does not set cookies.
- Retention
- error reports are deleted automatically after 90 days.
- Purpose
- finding and fixing technical problems.
- Legal basis
- Art. 6(1)(f) GDPR (our legitimate interest in a website that works correctly).
Giving us your data through a form is voluntary, but we cannot reply without your name, email address and message. The checkbox under each form confirms that you have read this policy. It is not the legal basis for processing your data.
3. Who receives your data
We share data only with the service providers needed to run this website:
- Resend, Inc. (USA): delivery of form messages to our mailbox.
- Google Ireland Limited (Google Workspace): hosting of our mailbox, where messages sent through the forms or to hello@brillq.today are stored.
- Netlify, Inc. (USA): website hosting.
- Google Ireland Limited and Google LLC (USA): reCAPTCHA when form protection is active, and Google Analytics only with your consent.
- Upstash, Inc. (USA): rate limiting, if configured.
- Functional Software, Inc. (Sentry, USA): error monitoring, if enabled.
These providers process data under their data processing terms. We may also disclose data when the law requires it.
4. Transfers outside the EEA
Google, Resend, Netlify, Upstash and Sentry are based in the USA or may process data there. Where the recipient is certified under the EU-U.S. Data Privacy Framework, transfers are based on the European Commission’s adequacy decision of 10 July 2023. Otherwise they are based on standard contractual clauses approved by the European Commission. You can ask us for a copy of these safeguards at hello@brillq.today.
5. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy of it,
- have inaccurate data corrected (rectification),
- have your data erased,
- restrict processing,
- data portability,
- object to processing based on our legitimate interest,
- withdraw your consent at any time, without affecting processing that took place before.
To exercise these rights, write to hello@brillq.today. We reply within one month.
You can also lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
6. Automated decision-making
We do not make decisions based solely on automated processing and we do not profile you.
7. Cookies
Which cookies we use, and how to change your choice, is explained in our Cookie Policy.
8. Changes to this policy
We update this policy when the website or the law changes. The date at the top of this page shows the current version. Questions? Write to us through the Contact tab or at hello@brillq.today.