GET A QUOTE

Last updated: 27 October 2026

1. Introduction

This Privacy Policy describes how Brand Atelier ("we", "us") collects, uses, stores and protects the personal data of visitors and clients of our website www.brandatelier.studio. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Greek data protection law 4624/2019 and, where applicable, the German Telecommunications Digital Services Data Protection Act (TDDDG).

2. Data Controller

Brand Atelier Studio, owner Chrysovalantis Chartonas
M. Varnali 0, 56224 Evosmos, Thessaloniki, Greece
Email: hello@brandatelier.studio · Phone: +30 698 446 1065

We have not appointed a data protection officer, as we are not legally required to do so.

3. Hosting and server log files

Our website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you visit the website, Vercel processes technically necessary data (IP address, date and time, page visited, browser and operating system, referrer) to deliver the website and keep it secure. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Images and videos on the website are delivered through the content delivery network of Wix.com Ltd. (Israel); your IP address is transmitted to Wix in the process (Art. 6(1)(f) GDPR). Fonts are loaded locally from our server; no connection is made to Google Fonts.

4. Contact and enquiry forms

When you submit a form on our website (e.g. contact, website audit, campaign request, benchmark report), we process the details you enter – such as name, email address, phone number, company or property name, website address, project details, budget and your message. The data is transmitted via our server to Wix.com Ltd. (Israel) and stored in our customer relationship management system (CRM). The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR). An adequacy decision of the European Commission exists for Israel.

5. Contact by email, phone and WhatsApp

When you contact us by email or phone, we process your details to handle your enquiry (Art. 6(1)(b) or (f) GDPR). The WhatsApp button on our website is a simple link: WhatsApp (WhatsApp Ireland Ltd., Meta) opens only when you click it, and WhatsApp's privacy policy then applies. No data is sent to WhatsApp before that.

6. Data during a project engagement

If we work together, we process further data needed to deliver our services and issue invoices, such as VAT number, billing address and payment details (Art. 6(1)(b) and (c) GDPR).

7. AI customer engagement and conversational data

When we provide a custom AI Customer Engagement & Sales Agent, it may process messages that our client's customers send through the channels connected to it, such as website chat, email, Instagram Direct Messages and Facebook Messenger. This can include names, contact details, the content of the conversation and, where an integration provides it, booking, order or customer account information.

For this data, our client is the controller and we act as its processor (Art. 28 GDPR), under a data processing agreement concluded with each client.

  • Purpose: answering enquiries, supporting product discovery, reservations and sales conversations, and handing conversations over to the client's team where needed.
  • Legal basis: determined by the client as controller, usually Art. 6(1)(b) GDPR (communication before or under a contract) or Art. 6(1)(f) GDPR.
  • Storage: conversation data is stored in secured systems, within the EU/EEA where available or otherwise with the safeguards described in section 19, and only for the retention period agreed with the client.
  • Protection: role-based access, encrypted transmission, activity logging and, where agreed, human approval of responses before they are sent.
  • Transparency: customers are informed when they are communicating with an AI system.

8. Confidential business data and knowledge bases

Business data that clients connect to the Strategic Intelligence Platform, including ERP, CRM and PMS data, sales and performance metrics, internal documents and the content of RAG knowledge bases, is treated as strictly confidential. It is used only to provide the services agreed with that client and is never shared with other clients.

We never use client business data or knowledge base content to train public or general-purpose AI models. Where we use AI model providers to run the platform and the agents, we use their business or API services under terms that exclude the use of submitted data for training their models.

9. Third-party APIs and advertising integrations

With the client's authorisation, our services can connect to third-party systems and platforms, in particular:

  • Google Ads and Google Analytics (Google Ireland Limited)
  • Meta Ads, Facebook and Instagram, including the Messenger and Instagram messaging interfaces (Meta Platforms Ireland Ltd.)
  • the client's ERP, CRM, PMS, booking engine, e-commerce and content management systems, such as Soft1
  • AI model and cloud infrastructure providers that run the platform and the agents

Data is exchanged with these systems only to the extent the integration requires and the client's access rights permit. The providers process data under their own terms and privacy policies; where they act as our sub-processors, they are bound by Art. 28 GDPR. Transfers outside the European Economic Area follow section 19.

10. Connected social media accounts (TikTok, Instagram, Facebook, LinkedIn, Pinterest)

Clients of our platform (bi.brandatelier.studio) can connect their brand's own social media accounts so that we publish the posts of their content calendar. When a client connects a TikTok account through TikTok Login Kit, we receive an access token and the account's basic profile information (display name, avatar and open ID) and the posting options TikTok returns for that account.

We use them only to publish or schedule the posts the client has reviewed and approved (caption, video or pictures, privacy level), and to show the client the status and link of each post. We do not access followers, messages or other users' content, we do not sell this data and we do not use it for advertising or to train AI models.

Access tokens are kept on our servers only for as long as the account stays connected; they are deleted when the client disconnects the account, asks us to, or the engagement ends. A client can revoke our access at any time in the TikTok app (Settings and privacy > Security > Apps and websites / Manage app permissions) or by writing to hello@brandatelier.studio. The same applies to Instagram, Facebook, LinkedIn and Pinterest accounts connected for posting.

11. Cookies, consent and consent management

On your first visit, a cookie banner asks for your consent. You can choose "Accept all", "Reject all" or individual categories, and change or withdraw your choice at any time via "Cookie Settings" in the footer.

  • Strictly necessary: storing your cookie choice in your browser's local storage (for 12 months). Legal basis: Section 25(2) TDDDG, Art. 6(1)(c) and (f) GDPR.
  • Analytics (Google Analytics 4) and marketing (Google Ads, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Pinterest Tag): only with your consent. Legal basis: Section 25(1) TDDDG, Art. 6(1)(a) GDPR.

12. Google Tag Manager, Google Analytics 4 and Google Ads

We use services of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland):

  • Google Tag Manager manages the analytics and marketing tags. It does not set cookies itself.
  • Google Analytics 4 creates anonymous statistics about the use of the website (page views, time on page, device, approximate region) with your consent. IP addresses are truncated by Google.
  • Google Ads conversion tracking measures, with your consent, whether an enquiry follows a click on one of our ads.

We use Google Consent Mode. On our German- and Spanish-language pages (/de, /es), the Google services are not loaded without your consent. On the English-language pages, Google Tag Manager is loaded when the page opens; without your consent, the Google services set no cookies there and use no identifiers, but Google receives technical signals without cookies (e.g. that a page was viewed), which are used for statistical modelling.

Data may be transferred to the USA. Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Analytics data is retained for 14 months. More information: policies.google.com/privacy

13. Meta Pixel

With your consent, we use the Meta Pixel of Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland) to measure the effect of our ads on Facebook and Instagram and to build advertising audiences. Without your consent, no events are sent to Meta and no cookies are set. On our German- and Spanish-language pages the Meta script is loaded only after your consent; on the English-language pages it is loaded when the page opens (which technically transmits your IP address to Meta), but it stays disabled until you consent.

Data may be transferred to the USA. Meta is certified under the EU-US Data Privacy Framework. More information: www.facebook.com/privacy/policy

14. TikTok Pixel

With your consent, we use the TikTok Pixel of TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland) to measure the effect of our ads on TikTok and to build advertising audiences. The pixel records events such as page views and enquiries and may set cookies (e.g. _ttp). It is managed through Google Tag Manager and fires only after you have consented to marketing cookies; without your consent, no data is sent to TikTok. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

Data may be transferred to TikTok Inc. in the USA and to other companies of the TikTok group outside the European Economic Area. TikTok bases these transfers on the European Commission's Standard Contractual Clauses. More information: www.tiktok.com/legal/privacy-policy-eea

15. LinkedIn Insight Tag

With your consent, we use the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland) to measure conversions from our LinkedIn campaigns, to show our ads to visitors of our website on LinkedIn (retargeting) and to receive aggregated, anonymous reports on the professional characteristics of our visitors. LinkedIn may set cookies for this purpose (e.g. li_sugr, bcookie, lidc). The tag is managed through Google Tag Manager and fires only after you have consented to marketing cookies. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

Data may be transferred to LinkedIn Corporation in the USA, on the basis of the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. More information: www.linkedin.com/legal/privacy-policy

16. Pinterest Tag

With your consent, we use the Pinterest Tag of Pinterest Europe Ltd. (Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland) to measure the effect of our ads on Pinterest and to build advertising audiences. The tag records events such as page views and enquiries and may set cookies (e.g. _pin_unauth, _epik). It is managed through Google Tag Manager and fires only after you have consented to marketing cookies. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

Data may be transferred to Pinterest, Inc. in the USA, on the basis of the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. More information: policy.pinterest.com/privacy-policy

17. Purposes and legal bases at a glance

  • Answering your enquiry: Art. 6(1)(b) GDPR
  • Delivering our services: Art. 6(1)(b) GDPR
  • Invoicing and tax obligations: Art. 6(1)(c) GDPR
  • Secure operation of the website: Art. 6(1)(f) GDPR
  • Analytics and marketing: your consent, Art. 6(1)(a) GDPR, Section 25(1) TDDDG
  • Newsletters or marketing emails: only with your consent (Art. 6(1)(a) GDPR)
  • Showcasing completed projects in our portfolio: your consent or our legitimate interest, subject to any confidentiality agreement

We do not sell your personal data to third parties under any circumstances.

18. Recipients and processors

In addition to the providers named above, we use carefully selected service providers: email providers, cloud storage and project management tools, accounting software or our accountant, and payment processors where applicable. All processors are contractually bound to comply with the GDPR (Art. 28 GDPR). We also disclose data where we are required to by law or by the authorities, or where this is necessary to protect our rights.

19. Transfers to third countries

Some providers process data outside the European Economic Area. In such cases we rely on an adequacy decision of the European Commission (e.g. the EU-US Data Privacy Framework or the decision for Israel) or agree the European Commission's Standard Contractual Clauses.

20. How long we keep your data

  • Enquiries that do not lead to a project: up to 12 months
  • Active client data: for the duration of the engagement
  • Project files and communications after completion: up to 5 years
  • Invoices and accounting records: for the period required by Greek tax law (currently 5–10 years)
  • Marketing data based on consent: until you withdraw your consent

After these periods, the data is securely deleted or anonymised.

21. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR), e.g. via "Cookie Settings" in the footer.

Right to object (Art. 21 GDPR): where we process data based on our legitimate interest, you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons.

To exercise your rights, simply email hello@brandatelier.studio. We respond within one month.

22. Right to lodge a complaint

You can lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence or place of work. The authority responsible for us is the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens, www.dpa.gr.

23. Data security

We apply appropriate technical and organisational measures, including encrypted transmission (HTTPS), access controls and strong passwords, secure cloud storage with reputable providers and regular review of our security practices. No one can guarantee absolute security for data transmitted over the internet.

24. Children

Our website and services are not intended for individuals under 16. We do not knowingly collect data from children.

25. Changes

We update this Privacy Policy when our processing or the law changes. The version published here, with the date shown above, applies.