How we collect, use and protect data at BrandsBeats. The Spanish version is binding; Portuguese and English versions are courtesy translations.
1. Data controller
BrandsBeats is an editorial directory of sustainable brands operated by Cofactory Startup Resort, S.L. (“the Controller”).
- Legal name: Cofactory Startup Resort, S.L.
- Tax ID (CIF): B87617148
- Registered office: Calle Irún, 23, Planta 1, 28008 Madrid, Spain
- Madrid Companies Register: Volume 34992, Folio 57, General Section, Sheet M-629295, 1st Inscription (21 July 2016)
- Contact:
[email protected]
2. Data we collect
- Browsing data: truncated IP, user-agent, language, page visited, referrer, timestamp. Processed via GA4 and Clarity only with your explicit consent.
- Contact data: when you email
[email protected]. - Form submissions: only what you voluntarily submit.
- Infrastructure provider logs. Not routinely accessed.
3. Legal basis
| Purpose | Basis | GDPR article |
|---|---|---|
| Brand inclusion in the catalog | Pre-contractual relationship | 6.1.b |
| Accounting and fiscal obligations | Legal obligation | 6.1.c |
| Analytics and future advertising | Consent | 6.1.a |
| Site operation and abuse prevention | Legitimate interest | 6.1.f |
You may withdraw consent anytime via the “Cookies” link in the footer.
4. Retention periods
- Aggregated analytics: up to 14 months.
- Email communications: 4 years.
- Indexed brand data: while the brand stays in the catalog.
- Accounting data: 6 years (Spanish Commerce Code).
5. Processors
| Provider | Purpose | Country | Basis / Safeguard |
|---|---|---|---|
| Vercel Inc. | Frontend hosting + serverless | USA (EU localisation) | Legitimate interest · DPF + SCC |
| Cloudinary Ltd. | Image CDN | Singapore / USA | Legitimate interest · SCC |
| Cloudflare Inc. | DNS + abuse protection | USA | Legitimate interest · DPF + SCC |
| Hetzner Online GmbH | Meilisearch (search) server | Germany | Legitimate interest |
| Google LLC (Analytics) | Aggregated analytics (GA4) | USA | Consent · DPF |
| Microsoft Corp. (Clarity) | Anonymised heatmaps & session replays | USA | Consent · DPF |
| Strato AG | Legacy WordPress + @brandsbeats.com email | Germany | Contract execution |
6. International transfers
Some providers process data in the USA, covered by the EU-US Data Privacy Framework or Standard Contractual Clauses. UK transfers use the IDTA or the adequacy decision.
7. Your rights
Access, rectification, erasure, objection, restriction, portability, and consent withdrawal.
Email [email protected] with proof of identity. Reply within 30 days.
You may file a complaint with the Spanish AEPD (www.aepd.es) or your local supervisory authority.
8. Security
HTTPS + HSTS enforced. We do not store passwords or payment data.
9. Minors
We do not knowingly collect data from users under 14.
10. Changes
This policy may be updated. The date at the top reflects the last revision. Material changes are announced on the home for at least 14 days.