Privacy Policy

We take care of your data.

INTRODUCTION AND DELINEATION OF THE ROLES OF CONTROLLER AND PROCESSOR

  1. This Privacy Policy sets out the rules for the processing and protection of personal data by the Provider in connection with the operation of the Platform and the provision of Services by electronic means (SaaS) via the domain getbrand.io (hereinafter referred to as: the “Platform”).

    The Privacy Policy concerns the personal data of:

    1. persons using the Platform and the Services (Users and persons visiting the Platform);

    2. persons who do not use the Platform and have not provided their data to the Provider directly, and whose personal data the Provider obtains from publicly available sources or from Identifiers entered by Users, stores in the database and cache of the Platform and presents in the results of Queries;

    3. persons contacting the Provider, including within the infringement notice procedure.

    With respect to the persons indicated in item 2, this Privacy Policy constitutes performance of the information obligation referred to in Article 14 GDPR, carried out by making the information publicly available (Article 14(5)(b) GDPR) – the details are set out in § 6.

  2. Capitalized terms used in this document (in particular: Platform, User, Identifier, Query, Domain Takeover, Account) have the normative meaning ascribed to them in the Terms (https://getbrand.io/terms-of-service), unless this Privacy Policy expressly provides otherwise.

  3. Delineation of legal roles within the meaning of the GDPR:

    1. The Provider as the Data Controller (Controller): with respect to: (i) the registration data of Users (Account), contact, subscription and billing data, (ii) personal data obtained from publicly available sources or extracted from an Identifier, stored in the database and cache of the Platform and presented in the results of Queries (§ 1(5), § 6), and (iii) data posted by verified Users within the Domain Takeover procedure – the entity determining the purposes and means of processing (the Controller within the meaning of Article 4(7) GDPR) is the Provider: Innodia sp. z o.o. with its registered office in Bydgoszcz (85-009), Poland, ul. Dworcowa 29/6, entered in the register of entrepreneurs of the National Court Register maintained by Sąd Rejenowy w Bydgoszczy, XIII Wydział Gospodarczy Krajowego Rejestru Sądowego under KRS number: 0001237194, NIP: 9671497788, REGON: 544572940 (hereinafter referred to as: the “Controller” or the “Provider”).

    2. The Provider as a Processor: With respect to the personal data of natural persons entered by the User into the Platform solely in the capacity of an Identifier (in particular electronic mail addresses or URL addresses) for the purpose of the automated execution of a Query via the application or the API interface – the Provider processes such data, which is of an incidental nature, solely on the documented instruction of the User and for the strict purpose of providing the Services, acting as a processor within the meaning of Article 4(8) GDPR. Within this legal relationship the User has the status of an independent controller and bears sole responsibility for having a valid legal basis (within the meaning of Article 6 GDPR) for entering such data into the Platform. The detailed rules, scope and limitations of that entrustment are set out in the Personal Data Processing Agreement (DPA), constituting Annex No. 1 to the Terms.

  4. In all matters relating to the protection of personal data, the Controller may be contacted by electronic means at the e-mail address: support@getbrand.io.

§ 1. CATEGORIES OF PERSONAL DATA PROCESSED

We collect and process only such data as is necessary for the provision of the Services in the B2B model, for securing the infrastructure and for communication.

  1. Data associated with the User Account:

    1. e-mail address (constituting the unique identifier of the Account);

    2. authentication and authorization data (including one-time login tokens and identifiers of external identity providers used in the authentication process);

    3. operational and subscription information concerning the Account (in particular the status of the subscription plan and technical billing identifiers provided by the external payment operator, as well as data on activity within the Platform, including statistics and the state of utilization of system limits).

  2. Data processed within the Domain Takeover procedure:

    1. The status of authorization and verification of the User’s rights to manage the resources assigned to a given domain;

    2. information, descriptions and visual materials posted voluntarily by a verified User in the brand profile – solely to the limited extent to which they allow the identification of a natural person (subject to the absolute prohibition, arising from the Terms, on making the personal data of third parties available in this mode).

  3. Communication, Support and DSA Notices:

    1. the sender’s e-mail address;

    2. data contained in the content of inquiries, complaint notices or notices of illegal content.

  4. Operational and analytical data:

    1. device IP address, type of internet browser, operating system, unique identifiers of terminal devices;

    2. telemetry data obtained from the presentation layer (frontend), covering in particular internet browser logs, subject to processing on the basis of the legitimate interest of the Controller solely for diagnostic purposes, the identification of system errors and the optimization of the Platform. The rules for recording the full content of Identifiers in system logs are set out in § 3(1)(5);

    3. data concerning activity within the Platform (the history of Queries executed, the degree of utilization of subscription limits);

    4. information obtained via cookies (in accordance with the regulations of § 8).

  5. Data of persons who are not Users (data obtained indirectly):

    In connection with the provision of the Services, the Controller processes the personal data of natural persons who are not Users of the Platform and who have not provided their data to the Controller directly. Such data comprises:

    1. internet domain names and the identifying and visual data of brands associated with those domains – to the extent to which they allow the identification of a natural person (e.g. domains containing a first name and surname or the designation of a sole proprietorship);

    2. brand information publicly published on the websites associated with a given domain.

    Sources of the data (Article 14(2)(f) GDPR): the data originates solely from (i) publicly available websites and internet resources, obtained in an automated manner, and (ii) Identifiers entered into the Platform by Users.

  6. Children’s data and special categories of personal data (sensitive data):

    1. The Platform and the Services are intended solely for adults conducting business or professional activity (B2B). The Controller does not knowingly process the personal data of children under 16 years of age.

    2. It is prohibited to enter into the Platform (in particular within API requests, Queries sent or the Domain Takeover procedure) personal data of the special categories referred to in Article 9 GDPR (so-called sensitive data, covering, among others, data concerning health, political opinions, religious beliefs, racial origin or biometric data).

  7. Data of newsletter subscribers:

    1. the e-mail address provided for the purpose of receiving the newsletter – processed on the basis of consent (Article 6(1)(a) GDPR), irrespective of holding an Account on the Platform.

  8. Voluntary nature of providing data. Providing the data referred to in paragraph 1 (Account data) is voluntary, but constitutes a condition for the conclusion and performance of the Agreement for the provision of the Services – failure to provide it makes it impossible to create an Account and to use the Services. Providing the data referred to in paragraph 2 (Domain Takeover) is voluntary and conditions solely the use of that functionality. Providing data for the purpose of receiving the newsletter is entirely voluntary.

§ 2. PURPOSES, LEGAL BASES AND MANNER OF DATA PROCESSING

Personal data is processed by the Controller in accordance with the GDPR on the basis of the following legal grounds:

  1. Article 6(1)(b) GDPR (Performance of a contract): for the purpose of providing the Services by electronic means (SaaS), including maintaining the Account, authorizing access to the API interface and carrying out the Domain Takeover procedure.

  2. Article 6(1)(f) GDPR (Legitimate interest):

    • for the purpose of handling inquiries directed to the technical support department and conducting correspondence;

    • for the purpose of ensuring the technical security of the Platform, detecting abuse (e.g. avoidance of subscription fees) and preventing cyberattacks;

    • for the purpose of establishing, pursuing or defending against claims (both on the part of Users and of third parties, including brand owners);

    • for the purpose of conducting direct marketing of its own services and auxiliary tools;

    • for the purpose of providing the Services consisting in the automated obtaining and making available to Users of publicly available information about brands associated with internet domains (§ 1(5)); the Controller has carried out a balancing test, and the data subject is entitled to object and to request erasure of the data (§ 6);

    • for the purpose of storing and presenting to the other users of the Platform the identifying data and materials (including logotypes) posted by verified Users within the Domain Takeover procedure – to the extent to which such materials contain the personal data of natural persons; the basis is the legitimate interest of the Controller and of the verified User consisting in the presentation of the brand associated with the domain.

  3. Article 6(1)(a) GDPR (Consent of the User): for the purpose of sending the newsletter and commercial information by electronic means and for the purpose of using analytical and statistical cookies (§ 8).

  4. Article 6(1)(c) GDPR (Legal obligation): for the purpose of fulfilling the obligations imposed by generally applicable provisions of law (e.g. tax and accounting provisions and moderation obligations arising from the EU Digital Services Act – DSA).

  5. No automated decision-making and profiling: The Controller does not take, with respect to data subjects, decisions based solely on automated processing, including profiling, which would produce legal effects concerning them or similarly significantly affect them. The rules for the use of cookies are set out in § 8.

§ 3. RETENTION (STORAGE PERIOD) OF DATA

  1. The personal data of Users will be stored for the period necessary to achieve the purposes set out in § 2:

    1. in the case of data processed for the purpose of performing the Agreement – for the term of the Agreement, and after its termination for the period necessary to establish, pursue or defend against any claims, however no longer than for the applicable limitation period thereof;

    2. in the case of data processed on the basis of a legitimate interest – until an effective objection is raised or until that interest ceases;

    3. in the case of data processed on the basis of consent (newsletter) – until it is withdrawn;

    4. in the case of data the storage of which arises from provisions of law (taxes, accounting) – for the periods specified, no longer than in those provisions (e.g. 5 years from the end of the tax year in which the documents were issued);

    5. in the case of the full content of Identifiers entrusted by Users (e.g. e-mail addresses or URL addresses), recorded in system logs and security logs in the course of executing Queries – for a period not exceeding thirty (30) days from the moment of their recording, upon the lapse of which they are subject to automatic and irreversible deletion;

    6. in the case of domain names and brand data referred to in § 1(5), stored in the database and cache of the Platform – for the period of provision of the Services, no longer than until an effective objection is raised, a request for erasure is submitted or the legitimate interest of the Controller ceases.

  2. The period of processing of personal data may be extended where their processing is necessary to establish or pursue any claims or to defend against claims, and thereafter only in the case and to the extent that generally applicable provisions of law so require. Upon the lapse of the processing period, the data is irreversibly deleted or subjected to an anonymization process.

§ 4. RECIPIENTS OF DATA AND INTERNATIONAL TRANSFERS

  1. For the proper functioning of the Platform, the Controller uses the services of external providers (processors), such as providers of cloud hosting, analytical systems and technical support tools. Those entities process data solely on the basis of written personal data processing agreements (DPA) and in accordance with the instructions of the Controller.

  2. The role of the Reseller (Paddle) as an independent controller: The User acknowledges and accepts that all transaction, payment and invoicing data (including payment card numbers, billing addresses and VAT ID / NIP / TAX ID numbers) is provided directly to the Reseller (Paddle.com Market Ltd. and affiliated entities). The Reseller is an independent controller of such personal data for the purposes of carrying out financial transactions and tax settlements, in accordance with its own privacy policy. The Controller (the Provider) obtains from the Reseller solely the operational information necessary to make available and properly provide the Service, comprising in particular the current subscription status and the technical billing parameters assigned to the User Account.

  3. Transfer of personal data outside the European Economic Area (EEA): The transfer of personal data outside the EEA takes place solely where it is necessary for the proper performance of the Services – in particular in connection with the use of providers of technical and cloud infrastructure and of monitoring and diagnostic tools, indicated in paragraph 1. The Controller ensures that such transfer takes place on the basis of mechanisms providing an adequate level of protection, referred to in Chapter V GDPR, in particular:

    1. a decision of the European Commission finding an adequate level of protection, including under the EU-U.S. Data Privacy Framework program;

    2. Standard Contractual Clauses (SCC) approved by the European Commission.

§ 5. RIGHTS OF DATA SUBJECTS

Every data subject – including Users and the persons referred to in § 1(5) – is entitled, to the extent and on the terms set out in the GDPR, to the following rights:

  1. Right of access to data (Article 15 GDPR): The data subject has the right to obtain from the Controller confirmation as to whether their personal data is being processed, and where that is the case, is entitled to obtain access to it and the following information:

    1. the purposes of the processing;

    2. the categories of personal data concerned;

    3. the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organizations;

    4. where possible, the envisaged period for which the personal data will be stored, and where that is not possible, the criteria used to determine that period;

    5. information on the right to request from the Controller rectification, erasure or restriction of the processing of personal data and to object to such processing;

    6. information on the right to lodge a complaint with a supervisory authority;

    7. where the personal data has not been collected from the data subject – any available information as to its source;

    8. information on automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR.

  2. Right to rectification of data (Article 16 GDPR): The data subject has the right to request from the Controller the immediate rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to request the completion of incomplete personal data, including by means of providing a supplementary statement.

  3. Right to erasure of data (“right to be forgotten”) (Article 17 GDPR): The data subject has the right to request from the Controller the immediate erasure of personal data concerning them, and the Controller has the obligation to erase the personal data without undue delay where one of the following circumstances applies:

    1. the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

    2. the data subject has withdrawn the consent on which the processing is based (in accordance with Article 6(1)(a) GDPR) and there is no other legal basis for the processing;

    3. the data subject objects pursuant to Article 21(1) GDPR to the processing and there are no overriding legitimate grounds for the processing, or objects pursuant to Article 21(2) GDPR to the processing for direct marketing purposes;

    4. the personal data has been unlawfully processed;

    5. the personal data must be erased for compliance with a legal obligation provided for in Union law or the law of a Member State to which the Controller is subject;

    6. the personal data has been collected in relation to the offer of information society services directly to a child (Article 8(1) GDPR).

    Exclusions from the right to erasure of data: This right does not apply to the extent that the processing is necessary for: compliance with a legal obligation which requires processing by law to which the Controller is subject, or for the establishment, pursuit or defense of claims.

  4. Right to restriction of processing (Article 18 GDPR): The data subject has the right to request from the Controller the restriction of processing solely to the storage of data in the following cases:

    1. where they contest the accuracy of the personal data – for a period enabling the Controller to verify its accuracy;

    2. where the processing is unlawful and the data subject opposes the erasure of the data, requesting instead the restriction of its use;

    3. where the Controller no longer needs the data for the purposes of the processing, but it is required by the data subject for the establishment, pursuit or defense of claims;

    4. where the data subject has objected pursuant to Article 21(1) GDPR to the processing – pending the verification of whether the legitimate grounds on the part of the Controller override the grounds of the User’s objection.

  5. Right to data portability (Article 20 GDPR): The data subject has the right to receive the personal data concerning them which they have provided to the Controller, in a structured, commonly used and machine-readable format, and has the right to transmit that data to another controller without hindrance from the Controller to whom that data was provided, where:

    1. the processing is carried out on the basis of consent (Article 6(1)(a) GDPR) or on the basis of a contract (Article 6(1)(b) GDPR); and

    2. the processing is carried out by automated means.

    In exercising this right, the User has the right to request that the personal data be transmitted by the Controller directly to another controller, where technically feasible. This right may not adversely affect the rights and freedoms of others.

  6. Right to object (Article 21 GDPR):

    1. The data subject has the right to object at any time – on grounds relating to their particular situation – to the processing of personal data concerning them based on Article 6(1)(e) or (f) GDPR (legitimate interest), including profiling. The Controller shall no longer process such personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, pursuit or defense of claims.

    2. Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time, unconditionally, to the processing of personal data concerning them for such marketing, including profiling, to the extent that the processing is related to such direct marketing. Where such an objection is raised, the data may no longer be processed for such purposes.

    3. An objection should be submitted to the address: support@getbrand.io. It is free of charge and does not require justification.

  7. Right to withdraw consent (Article 7(3) GDPR): The data subject has the right to withdraw the consent given to the processing of data (e.g. to the sending of the Newsletter) at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. It must be as easy to withdraw consent as to give it.

  8. Right to lodge a complaint with a supervisory authority: The data subject has the right to lodge a complaint with the competent data protection supervisory authority if they consider that the processing of their data infringes the GDPR. In Poland that authority is: the President of the Personal Data Protection Office (PUODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa (www.uodo.gov.pl).

§ 6. INFORMATION FOR PERSONS WHOSE DATA WAS OBTAINED INDIRECTLY (ARTICLE 14 GDPR)

  1. With respect to the data referred to in § 1(5), the Controller performs the information obligation by publicly making available this Privacy Policy, in accordance with Article 14(5)(b) GDPR.

  2. Individually informing every data subject would require a disproportionate effort – in particular due to: (i) the automated nature and scale of the processing covering a large number of internet domains, (ii) the absence on the part of the Controller of contact data enabling individual notification, and (iii) the fact that an attempt to obtain such contact data would require the processing of a broader scope of personal data than is necessary for the provision of the Services.

  3. Right to object and to erasure of data. Every person whose data is presented on the Platform may at any time:

    1. object to the processing (Article 21 GDPR) and request the erasure of the data (Article 17 GDPR) – to the e-mail address: support@getbrand.io;

    2. irrespective of the rights arising from the GDPR, make use of the rights of a contractual nature provided for in § 7 of the Terms, comprising a request for the permanent cessation of the collection and presentation of data associated with the indicated domain (opt-out), for its rectification or erasure. Those rights are exercised without undue delay, no later than within 7 days, and the indicated domain is placed on an exclusion list preventing the re-obtaining of data.

  4. Making use of the rights referred to in paragraph 3 is free of charge and does not require justification.

§ 7. SECURITY OF PERSONAL DATA

  1. The Controller applies advanced technical and organizational measures ensuring a high level of protection of the personal data processed, adequate to the risk, including securing the data against unauthorized access, loss, modification or destruction.

  2. The key data protection measures applied by the Controller comprise in particular:

    1. encryption of all data transmission using the SSL/TLS protocol (encrypted HTTPS connection);

    2. storage of personal data on secured servers, as a rule located within the territory of the European Economic Area; the transfer of data outside the EEA takes place on the terms set out in § 4(3);

    3. automatic performance of data backups;

    4. restrictive limitation of physical and logical access to database systems solely to the authorized personnel of the Controller and two-factor authentication (2FA).

  3. The security of personal data is a priority for us, however, due to the technical specificity of the internet, no method of electronic transmission guarantees absolute security. Users are advised to use their own, up-to-date antivirus tools and firewalls in order to protect their terminal devices.

§ 8. COOKIES AND TRACKING TECHNOLOGIES

  1. The Platform uses cookies (IT data, in particular text files, stored on the User’s terminal device) and related tracking technologies for the purpose of guaranteeing the integrity of the platform, authentication, ICT analysis and optimization of the Platform.

  2. The Controller applies the following categories of cookies within the Platform:

    1. Necessary (technical): conditioning the proper functioning of the Platform, enabling in particular secure authentication (by the passwordless method), maintenance of the User’s session and the security of IT systems. Their installation is technically and objectively necessary for the provision of the service by electronic means requested by the User.

    2. Analytical and statistical: applied for the purpose of monitoring ICT activity and analytics of Users’ interactions with the interface of the Platform (in particular using the analytical solutions of external providers), which conditions the optimization of its structure and functionality.

  3. The installation of the necessary cookies referred to in paragraph 2(1) does not require the consent of the User. Their application is conditioned solely by the necessity of providing the service by electronic means at the express request of the User, which satisfies the disposition of Article 399(3)(2) of the Polish Act of 12 July 2024 – Electronic Communications Law.

  4. The installation of analytical and statistical cookies takes place solely after the prior, informed and voluntary consent of the User has been given, in accordance with the requirements of Article 399(1)(2) of the Electronic Communications Law in conjunction with Article 6(1)(a) GDPR. That declaration is collected via a dedicated consent management mechanism (Consent Management Platform) made available upon initial access to the Platform. The User is entitled to withdraw the consent given at any time, without the obligation to indicate a justification, which is effected by reconfiguring the privacy preferences in the panel of the Platform or by deleting the files from the browser cache. The withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

§ 9. FINAL PROVISIONS AND INTERNATIONAL COMPLIANCE (INCLUDING CCPA AND CANADA)

  1. International compliance (including CCPA and Canada):
    To the extent that the laws of the United States of America (including the California Consumer Privacy Act – CCPA/CPRA) and the laws of Canada (including the federal PIPEDA act and Law 25 of the province of Quebec) apply to Users or to the Services provided (including to residents of the State of California and of Canada acting in the capacity of business representatives – B2B), the Controller declares that it exercises due diligence in order to ensure the compliance of data processing with those standards. Residents of the State of California are entitled to the rights to information on the categories of data collected, to access, erasure and rectification, and to the right to non-discrimination for exercising those rights. Residents of Canada are entitled to the rights of access and rectification on the terms of PIPEDA. Requests should be directed to the e-mail address indicated in the Introduction; they are handled free of charge within 30 days. The Controller declares that it does not sell, exchange or make available personal data to third parties for commercial or advertising purposes within the meaning of the relevant provisions.

  2. The Controller reserves the right to introduce changes to this Privacy Policy in order to adapt it to technological changes, new functionalities of the Platform and changes in personal data protection legislation.

  3. Users will be notified of changes to the Privacy Policy by the publication of a new version of the document on this subpage.

  4. The Privacy Policy was drawn up in the Polish language. The Polish version (https://getbrand.io/privacy-policy/pl) is the only binding version and constitutes the exclusive basis for interpretation. Any translations of the Privacy Policy into other languages are for information and reference purposes only. In the event of any discrepancy, contradiction or doubt as to interpretation between the Polish version and its translation, the Polish version shall prevail.

  5. The Privacy Policy in this wording shall be effective as of 2026-07-15.