BruteCX logo

Legal Information

Privacy Policy

This page describes what limited data is processed through the website, which technologies are used, and how consent-dependent analytics are handled.

Legal wordingPrivacyConsent-aware analytics

  1. Scope and Purpose

    This Privacy Policy sets out the legal basis on which we process personal data obtained through the Website. We process personal data strictly in accordance with applicable laws, including the EU General Data Protection Regulation (GDPR) and applicable international data protection laws.

  2. Categories of Data Processed

    We do not request or collect personal data directly through forms or user accounts. However, the following categories of data are automatically processed:

    • IP address and related network metadata
    • Device identifiers, browser type, operating system and technical metadata
    • Server log files generated during standard web operations
    • Statistical and analytical data generated via Google Analytics (only after valid consent where required)
    • Consent preference records stored locally on the user's device to remember cookie choices

  3. Cookies and Tracking Technologies

    The Website uses strictly limited categories of cookies:

    • Theme Preference Cookie: a cookie used to remember the Website's current light or dark mode preference. Theme preference storage starts enabled by default so the interface can stay consistent between visits, and it may be disabled through the Website's preference controls or by using Reject All.
    • Preference Storage: a local storage record identified as cookieConsent_v1stores the user's cookie choices and timestamp so those choices can be respected on later visits.
    • Analytics Cookies: cookies set by Google Analytics. These are non-essential and are deployed only after explicit prior consent is given through the Website's cookie controls.

  4. Legal Basis for Processing (EU and EEA)

    Processing activities rely on the following legal bases:

    • Theme preference cookie: Article 6(1)(f) GDPR - legitimate interest in preserving the current interface theme while theme preference storage remains enabled.
    • Analytics Cookies: Article 6(1)(a) GDPR - consent.

  5. Google Analytics

    Google Analytics, provided by Google Ireland Ltd and Google LLC, is used solely for statistical and performance-related purposes. When activated by user consent, Google may process:

    • IP-derived network data
    • device and browser metadata
    • usage and interaction metrics

    Data may be transferred outside the European Economic Area, including to the United States. The specific transfer mechanism, safeguard documentation, and Google-side processing settings are determined outside this repository and should be verified against the live Google Analytics account and Google's current privacy documentation.

  6. Data Disclosure and Transfers

    We do not sell, lease, or otherwise transfer personal data to third parties. Data may be processed by Google only if Analytics is enabled by user consent.

  7. Data Retention

    Consent records stored on the user's device remain until the user changes preferences, clears site data, or a future application update replaces the storage key. If analytics is enabled, analytics data is retained for a limited period, typically between 2 and 14 months, and is then automatically deleted.

  8. User Rights (GDPR)

    Users located in the EU/EEA may exercise the following rights:

    • right of access
    • right to rectification
    • right to erasure
    • right to restriction of processing
    • right to data portability
    • right to object
    • right to withdraw consent at any time

    Requests must be submitted to the Operator using the contact information provided on the Website.

  9. Rights of Users in the United States (CCPA)

    For California residents:

    • California residents have the right to opt out of the sale or sharing of personal data.
    • We do not sell personal data.
    • The Website does not currently sell or share personal data for cross-context behavioral advertising, so no sale/share opt-out mechanism is currently required.
    • Users may request disclosure of collected categories of information.
    • Users may request deletion of collected information.
    • If this changes in the future, an appropriate opt-out method will be provided in the published privacy notices.
    • Users may exercise their rights without discrimination.

  10. Brazilian Users (LGPD)

    For users in Brazil, analytics processing is based on consent. Strictly necessary processing may rely on legitimate interest where applicable to operate the Website and preserve essential user-selected settings.

    Brazilian users may request confirmation of processing, access to personal data, correction of incomplete or inaccurate data, anonymization or deletion where applicable, information about sharing, portability where legally applicable, and withdrawal of consent at any time for analytics processing.

  11. Canadian Users (PIPEDA)

    Users from Canada may request access, correction, and information regarding the handling of their personal data under PIPEDA.

  12. Australian Users

    Processing of any personal information relating to Australian users complies with the Australian Privacy Principles (APPs).

  13. Policy Amendments

    We reserve the right to amend this Privacy Policy at any time. The applicable version shall be the version published on the Website at the time of use.