Privacy Policy

1) Controller

BRAINRISE ARCHITECTURE LTD
14 Agamemnonos Street, City Home 61
1041 Nicosia
Republic of Cyprus

Company Reg. No. HE475573 · VAT ID CY60176820Y

A formal Data Protection Officer within the meaning of Art. 37 GDPR is not required.

2) Scope

This Privacy Policy explains how personal data is processed when you use the website brainrise.ai and any channels made available through it (meeting booking via Microsoft Bookings, email correspondence).

Where services are delivered on the basis of a separate proposal, order form, or service agreement, additional data protection and processing terms agreed in that agreement apply.

3) Legal bases (Art. 6 GDPR)

We process personal data only where at least one of the following legal bases applies:

Art. 6(1)(a) GDPR — consent (e.g. optional information you actively submit, or optional website analytics, see Section 10);
Art. 6(1)(b) GDPR — contract or pre-contractual measures (e.g. handling your enquiry, preparing a proposal, initiating a service agreement);
Art. 6(1)(c) GDPR — legal obligations (e.g. accounting and retention duties);
Art. 6(1)(f) GDPR — legitimate interests (e.g. IT security, abuse prevention, B2B business communication).

4) Categories of data processed

Depending on the interaction, we may process:

identification data: first and last name, salutation, company, position, country;
contact data: email, phone, address;
communication content: messages, enquiries, uploads, meeting notes;
usage data: pages viewed, timestamps, referring URL, session ID;
technical data: truncated IP address, browser and device identifiers, language, operating system;
online identifiers (only with your consent): analytics cookie IDs set by Google Analytics;
booking data: selected time slot, time zone, meeting purpose;
application data (where applicable): CV, cover letter, references.

We ask you not to submit special categories of personal data (Art. 9 GDPR) or highly sensitive business information (source code, credentials, trade secrets) by email or in booking questions.

5) Purposes of processing

We process your data to:

respond to your enquiry and prepare a proposal;
coordinate and hold meetings booked via Microsoft Bookings;
keep the Website secure, available, and functional;
understand how the Website is used and improve its content, only if you consent to website analytics;
fulfil legal obligations (accounting, tax, compliance);
carry out legitimate B2B business communication (follow-ups, proposal clarification).

6) Retention periods

Data category	Retention period	Basis
Contact enquiries (email)	12 months from last contact	Art. 6(1)(b)/(f)
Proposal and pre-contract communication	Until conclusion of a service agreement, or 24 months thereafter	Art. 6(1)(b)
Meeting bookings	24 months	Art. 6(1)(b)/(f)
Server and security logs	30–90 days	Art. 6(1)(f)
Website analytics data (Google Analytics)	14 months, then deleted automatically by Google	Art. 6(1)(a)
Record of your consent choice	180 days	Art. 6(1)(c)/(f)
Invoices and accounting records	6–10 years	Art. 6(1)(c)
Application data	6 months after conclusion of the recruitment process, unless a contract is concluded	Art. 6(1)(b)/(f)

After the retention period, data is deleted or anonymised.

7) Website hosting and server logs

The Website is hosted by Replit, Inc. (USA) on Google Cloud infrastructure. The published website runs in Replit's Europe (EU) region. Replit acts as our processor under Art. 28 GDPR on the basis of its Data Processing Agreement, which includes the EU Standard Contractual Clauses for any transfer of data to the USA. When you access the Website, your browser automatically transmits technical data to the hosting infrastructure. This data (including truncated IP address, user agent, timestamp, requested URL) is processed in server logs to ensure availability, stability, and security (Art. 6(1)(f) GDPR).

Our hosting infrastructure also sets the technically necessary cookie GAESA, which is required to deliver the Website reliably and expires after 30 days. It does not require consent (Art. 6(1)(f) GDPR) and is not used for analytics or advertising. Your cookie choice is also stored in your browser so that the banner is not shown again on every visit.

8) Email communication

If you contact us by email, we process the information you provide in order to handle your enquiry and any related follow-up (Art. 6(1)(b), (f) GDPR). Email correspondence is received and stored in our Microsoft 365 environment (see Section 9 on Microsoft's role and legal safeguards).

9) Meeting bookings via Microsoft Bookings

To allow you to book discovery meetings, the Website links to Microsoft Bookings, which opens in a new tab. Microsoft Bookings is a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

When you use the booking functionality, we process the data you actively enter (name, email address, phone number if provided, company, your answers to the booking questions, time zone, and any additional details) on the legal basis of Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (efficient scheduling of business meetings).

Microsoft acts as our processor under Art. 28 GDPR on the basis of the Microsoft Data Protection Addendum and applicable Standard Contractual Clauses. Microsoft may process limited technical data in its own capacity for the operation of its cloud infrastructure; details are set out in the Microsoft Privacy Statement: https://privacy.microsoft.com/privacystatement.

10) Cookies, local storage and optional website analytics

Storing your choice

We store your privacy choice in your browser so that we do not have to ask you on every visit. This storage is strictly necessary (Art. 6(1)(f) GDPR). Your choice is kept for 180 days; after that, or if the purposes described here change, we ask you again. You can use the Website fully without agreeing to analytics.

Google Analytics 4 (only with your consent)

If you click "Accept", we use Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It helps us understand how the Website is used, for example which pages are visited and which websites visitors come from. We use these insights to improve the Website and do not use them for advertising. Google Analytics is not loaded before you consent. If you reject or make no choice, no data is sent to Google Analytics.

What is processed

Google Analytics processes connection data, browser and device information and usage data such as pages viewed, time of visit and engagement. It sets the cookies _ga and _ga_YE0DZ5J3DP. Our implementation sends page addresses without query strings or fragments and passes on external referrers only as the referring website's domain. Google Analytics also records when a page is scrolled to the end, when a link to another website is clicked, and when a file is downloaded. It does not send form contents. Google's standard session and engagement events may also be generated. Google signals and advertising features are disabled.

Storage periods

The analytics cookies expire 180 days after they are set; the expiry is not extended on later visits. Your browser may delete them earlier. Separately, Google deletes the collected event and user data after 14 months. Aggregated statistical reports that no longer relate to individual visitors may be kept longer.

Legal basis and Google's role

The legal basis is your consent (Art. 6(1)(a) GDPR and the national rules implementing Art. 5(3) of the ePrivacy Directive). Google acts as our processor under Art. 28 GDPR on the basis of Google's data processing terms. Data may also be processed by Google LLC in the United States; the safeguards are described in Section 12.

Changing or withdrawing your consent

You can change your choice or withdraw your consent at any time via "Cookie settings" in the footer of every page. Withdrawing is as easy as giving consent. It stops any further analytics collection and deletes the analytics cookies accessible to the Website. It does not affect the lawfulness of processing before the withdrawal, and data already collected is deleted at the end of the storage period stated above.

More information: Google Privacy Policy (https://policies.google.com/privacy) and How Google uses information from sites that use its services (https://policies.google.com/technologies/partner-sites). Your rights under Section 13 apply.

11) Recipients and processors

Recipients of your data are limited to:

internal BRAINRISE personnel involved in handling your request;
carefully selected processors under Art. 28 GDPR;
authorities, where legally required.

Your data is not shared with third parties for marketing purposes.

The processors currently used are:

Processor	Purpose	Location
Replit, Inc. (on Google Cloud infrastructure)	Website hosting, server logs	Europe (EU); transfers to the USA possible under Standard Contractual Clauses
Microsoft Ireland Operations Limited	Microsoft 365 (email) and Microsoft Bookings	Ireland (EU), with EU-based data residency where configurable
Google Ireland Limited	Website analytics (Google Analytics 4), only with your consent	Ireland (EU); transfers to Google LLC, USA, possible

Material changes to the sub-processor list will be communicated through an update to this Privacy Policy.

12) International data transfers

Where processors outside the European Economic Area (EEA) are used — in particular in the United States — transfers only take place with appropriate safeguards in place:

an adequacy decision of the European Commission (in particular the EU-U.S. Data Privacy Framework for certified U.S. providers);
Standard Contractual Clauses (Modules 2 / 3) of the European Commission (2021/914);
where appropriate, additional safeguards (encryption, pseudonymisation, restricted access controls).

A copy of the safeguards is available on request.

For Google Analytics, Google LLC (United States) is certified under the EU-U.S. Data Privacy Framework; in addition, the Standard Contractual Clauses included in Google's data processing terms apply.

13) Your rights

Under the GDPR, you have the following rights vis-à-vis BRAINRISE:

access (Art. 15) — which data we process about you;
rectification (Art. 16) — correction of inaccurate data;
erasure (Art. 17) — "right to be forgotten";
restriction (Art. 18) — restriction of processing;
data portability (Art. 20) — provision in a machine-readable format;
objection (Art. 21) — in particular against processing based on Art. 6(1)(f);
withdrawal of consent (Art. 7(3)) — at any time with effect for the future;
lodging a complaint with a supervisory authority (Art. 77).

To exercise your rights, an informal message to legal@brainrise.ltd is sufficient. We handle requests within one month (Art. 12(3) GDPR).

14) Competent supervisory authority

Office of the Commissioner for Personal Data Protection of the Republic of Cyprus 1 Iasonos Street, 1082 Nicosia, Republic of Cyprus Web: https://www.dataprotection.gov.cy/

You may also lodge a complaint with the supervisory authority of the EU Member State in which you reside.

15) Data security

We implement technical and organisational measures in accordance with Art. 32 GDPR, in particular:

TLS encryption for all Website connections;
access control on a least-privilege basis;
encrypted storage for sensitive data categories;
regular backups and restore tests;
data-processing agreements with all processors.

16) Automated decision-making

Automated decision-making with legal effect within the meaning of Art. 22 GDPR does not take place.

17) Changes to this Privacy Policy

We update this Policy when law, Website features, or services change. The current version is always available at this URL.

Last updated: September 2026

18) Contact

For any matter concerning this Policy or your personal data, please contact:

BRAINRISE ARCHITECTURE LTD
14 Agamemnonos Street, City Home 61
1041 Nicosia
Republic of Cyprus

Email: legal@brainrise.ltd