Privacy Notice
Last updated: 31 October 2026
1. Who we are
1.1 This privacy notice is issued by Brandian Ltd, a company registered in England and Wales under company number 11588933, whose registered office is at Brandian, 124 City Road, London EC1V 2NX ("Brandian", "we", "us" and "our").
1.2 We are the controller of the personal data described in this notice, except where section 6 says otherwise. We are registered with the Information Commission's Office (ICO) and pay the data protection fee.
1.3 Questions about this notice, and requests under section 11, should be sent to legal@brandian.uk, by post to our registered office, or by telephone on 020 8040 9108 between 9am and 5pm, Monday to Friday.
2. What this notice covers
​2.1 This notice explains what personal data we collect, why we collect it, the legal basis on which we use it, who we share it with, how long we keep it, and the rights you have. It applies to personal data we collect through our website at brandian.uk, through our contact, booking and payment routes, in the course of providing our services, and when a client asks us to contact its customers or the leads it did not win.
2.2 Our services are supplied to businesses. Most of the personal data we hold is the business contact details of the people who work for them.
3. The personal data we collect, and why
3.1 The table below sets out, for each situation, the personal data we collect, what we use it for, and the legal basis on which we rely under Article 6 of the UK GDPR.
Situation | Personal data | Purpose | Legal basis |
|---|---|---|---|
You supply services to us | Your name, business contact details, contract and payment details | To manage the supply and pay you | Performance of the contract; our legal obligation to keep accounting records |
Your company becomes a client | The names, roles and business contact details of the people working with us on the engagement; the material your company sends us; the working files, notes, measurements and reports the work produces | To perform the engagement and administer the contract | Performance of the contract; our legitimate interest in managing the client relationship |
You buy a Brand Record or an Inspection through the website | Your name, work email address, company name and billing address. Your bank or card details are collected by our payment provider and are not seen or stored by us | To take payment, deliver the work and keep the accounting records the law requires | Performance of the contract; our legal obligation to keep accounting records |
You book a conversation with us | Your name, email address, your company's website, and your answers to the booking questions | To hold the meeting and prepare for it | Steps taken at your request before entering into a contract; our legitimate interest in preparing for the meeting |
You tick the box to receive our publications | Your name and email address | To send you our newsletter and notice of new publications | Your consent, which you may withdraw at any time using the link in each email |
You contact us through the form, by email or by telephone | Your name, work email address, your company's website if you give it, the option you select on the form, the content of your message, and a note of any call | To respond to your enquiry and to keep a record of the correspondence | Our legitimate interest in responding to business enquiries |
You open the booking window on the Contact page | The booking window shows TidyCal's own booking page. TidyCal's page loads TidyCal's providers (Stripe, Google Tag Manager and Google Analytics, Microsoft Clarity, Google Fonts, Chatbase, and a Cloudflare security check when it runs), each of which receives your IP address and browser information, and TidyCal's own analytics record how its page is used. That data goes to TidyCal and its providers under TidyCal's privacy notice; none of it comes to us. We receive the booking you make. | To let you book a conversation | TidyCal's own notice governs its page; we receive the booking under steps taken at your request before a contract |
You visit the website | Technical data sent by your browser: IP address, browser and device type, pages viewed, referring page, date and time. Essential cookies set by Wix, our hosting platform, and an error report to Sentry, Wix's error-logging service, if a page error occurs. The same technical data is received by the providers of the components that load as part of the page: the Trustpilot reviews widget, the jsDelivr library delivery, and, on the Contact page, Deftform. Brandian's own pages run no analytics. | To operate and secure the website and display it as designed | Our legitimate interest in running a secure website and in displaying our reviews rating |
3.2 We do not ask for, and do not knowingly collect, special category personal data (such as data about health, ethnicity or religious belief). Please do not send it to us.
3.3 We collect personal data from you directly, from the organisation you work for, from our payment and booking providers, and from public sources such as Companies House, LinkedIn and your company's website, where we are preparing to work with your company.
3.4 Where we rely on legitimate interests, we have assessed that the use is necessary for the interest stated, that it is what you would reasonably expect in the circumstances, and that it does not override your interests and rights. You may object to any use based on legitimate interests under section 11.
4. Who we share personal data with
4.1 We share personal data with the providers that supply the systems we run on and with the senior specialists who work under our direction on engagements. Each of them processes personal data only on our instructions and under a written contract. The providers are:
Provider | What it does |
|---|---|
Anthropic | Claude, an artificial intelligence tool we use for research, analysis and drafting, under terms that prohibit the provider from using our data for its own purposes; all work it produces is reviewed by us |
Google | Google Workspace calendar |
Notion | Publishes an engagement's measurement evidence, only where the client has agreed in writing |
Proposify and BreezeDoc | Proposals and the signing of contracts |
jsDelivr | Content delivery network that serves the three.js library used for the website's visual elements; receives your IP address when the file is requested |
Trustpilot | Provides the reviews widget; receives your IP address and the page address when the widget loads, and a record that the widget was displayed |
Stripe | Processes card payments when you buy through the website |
GoCardless | Collects bank payments and direct debits |
Emailit | Sends our automated emails and our publications |
Heffl | The client relationship system, the client portal and invoicing |
Zoho (Mail, Meeting, WorkDrive, Sheet, Calendar) | Correspondence, video calls, working files, scoring workbooks and the calendar |
TidyCal | Holds bookings and the answers to the booking questions; bookings are synchronised to a calendar in Google Workspace. Its booking page, shown in the booking window, runs TidyCal's own providers, listed in section 4.2 |
Make | Automates the passing of form and booking data between the systems below |
Simple Analytics | Loaded by Deftform on its forms; the provider states that it uses no cookies and collects no personal data |
Deftform | Runs the contact form, the intake forms and the surveys; its forms load Simple Analytics |
Usercentrics | Provides the consent banner and stores the record of your cookie choice |
Wix | Hosts the website and delivers its images, video and typefaces; loads Sentry, an error-logging service, which receives a report if a page error occurs |
4.2 Two of these providers bring in providers of their own, which we did not choose: Deftform loads Simple Analytics on its forms, and TidyCal's booking page, shown in the booking window on the Contact page, loads Stripe, Google Tag Manager and Google Analytics, Microsoft Clarity, Google Fonts, Chatbase and, when it runs, a Cloudflare security check. Those providers receive your IP address and browser information when the window opens, and TidyCal's analytics record how its page is used; that data goes to TidyCal and its providers under TidyCal's privacy notice and does not come to us. Our cookie notice states what each sets.
4.3 We also disclose personal data: a) to our accountant and professional advisers, to the extent necessary for them to advise us; b) to a regulator, court or law enforcement body where the law requires it; and c) to a buyer or prospective buyer of our business, under obligations of confidentiality, if we sell or transfer the business.
4.4 We do not sell personal data, and we do not pass it to any third party for that party's own marketing.
5. International transfers
5.1 Some of the providers listed in section 4 store personal data outside the United Kingdom, in the European Economic Area or the United States. Where they do, the transfer is made under the United Kingdom's adequacy regulations where they apply (which cover the European Economic Area, and providers in the United States certified under the UK Extension to the EU-US Data Privacy Framework), and otherwise under the International Data Transfer Agreement or the UK Addendum to the standard contractual clauses issued by the Information Commission. You may ask us at legal@brandian.uk for details of the safeguard that applies to a particular provider.
6. Where a client asks us to contact you
6.1 A Brand Record measures how a client's buyers see that client's brand. It includes a survey of the client's customers, and interviews or an exit survey among the leads the client did not win. If you are invited to take part, this section applies to you.
6.2 The client sends you the invitation from its own mailbox, in a form we supply. We are not the visible sender, and on the usual route we never receive the client's customer list. Your answers reach us through the survey tool. If you are invited to an interview, the client introduces you to us, and we receive your contact details only if you agree to take part. In some cases, at the client's request, we send the invitation on the client's behalf, in which case we hold the list of invitees for that purpose only.
6.3 In that work the client decides what happens to your personal data and we act on the client's instructions. The client is the controller and we are the processor. Your rights are exercised through the client, and we assist the client in responding. Ask the client whose brand is being measured for its own privacy notice.
6.4 Your answers go into the client's Brand Record in a form from which you cannot be identified. Once the Brand Record is filed, we remove names and contact details from the survey and interview data and delete the list of invitees and interviewees. The survey tool allows you to answer without identifying yourself.
6.5 The survey invitation states a donation to a charity named by the client for each completed response. We pay the donation. It is not conditional on what you answer.
7. How long we keep personal data
What | How long |
|---|---|
An enquiry that does not become an engagement | 24 months from our last contact with you |
A client's engagement file and its working material | The length of the relationship, then six years, being the limitation period for contract claims |
Invoices and accounting records | Six years from the end of the accounting period to which they relate, as HM Revenue & Customs requires |
The publications list | Until you unsubscribe or ask us to remove you |
Bookings and booking answers | 24 months from the booking |
Survey and interview data collected for a client | Names and contact details removed, and the invitee list deleted, once the Brand Record is filed |
Benchmark data | Indefinitely, in a form from which no person or company can be identified |
8. The benchmark
8.1 We compare each client's measurements against a pool of results from earlier work. Before a result enters the pool, every name, contact detail and client identifier is removed, and what remains is a set of scores against a sector. Data in that form is not personal data, which is why it is kept indefinitely.
9. How we protect personal data
9.1 We hold personal data only in the systems listed in section 4, each protected by individual credentials and multi-factor authentication where the system supports it. We limit access to the people whose work requires it, remove access when an engagement or a specialist's work ends, and keep client data separate from our marketing systems. No method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security.
10. Automated decision-making and children
10.1 We make no decision about you by automated means alone. A person reads every enquiry and every result.
10.2 The website and our services are not directed at anyone under the age of 18. We do not knowingly collect personal data about children, and we delete any we find.
11. Your rights
11.1 Under the UK GDPR you have the right to: a) access the personal data we hold about you and be given a copy; b) have inaccurate personal data corrected and incomplete data completed; c) have your personal data erased in certain circumstances; d) restrict our use of your personal data in certain circumstances; e) receive the personal data you gave us in a structured, commonly used, machine-readable form, and have it transmitted to another controller, where we rely on consent or contract and process it by automated means; f) object to processing based on our legitimate interests, and to direct marketing at any time; and g) withdraw consent at any time where consent is the legal basis, without affecting the lawfulness of processing before withdrawal.
11.2 To exercise any of these rights, email legal@brandian.uk or write to our registered office. We may ask you to verify your identity. We will respond within one month of receiving your request, extended by up to two further months where a request is complex or numerous, in which case we will tell you within the first month. We do not charge a fee unless a request is manifestly unfounded or excessive.
11.3 Where we act as processor for a client under section 6, please send your request to the client, whom we will assist.
12. Complaints
12.1 If you are unhappy with how we have handled your personal data, please complain to us first by email at legal@brandian.uk, through the form on the Contact page, by post or by telephone. We will acknowledge your complaint within thirty days of receiving it, look into it, and tell you the outcome without undue delay. This is the complaints procedure required by section 164A of the Data Protection Act 2018.
12.2 You also have the right to complain at any time to the Information Commission's Office (ICO), the United Kingdom's data protection regulator, at ico.org.uk.
13. Links to other websites
13.1 The website contains links to other websites. This notice does not apply to them, and we are not responsible for how they handle personal data.
14. Changes to this notice
14.1 We review this notice when our practices change and update the date at the top. Where a change materially affects you and we hold your contact details, we will tell you.