1. Who we are
BrandFools is an independent creative studio operated from Cyprus by Georgios Kleitou and Charis Petrou. We jointly decide how enquiries and other BrandFools business correspondence are handled, and we are jointly responsible for that processing.
You can contact either of us through our shared privacy contact, support@brandfools.com. We both take responsibility for handling data-protection requests made through this address. You can exercise your rights against either of us.
2. Information we receive
When you use our contact form, we receive your name, email address, selected service or services, and message. You may also provide an optional phone number and one PDF, JPG or PNG reference file of up to 10 MB. If you email us directly or message us on Instagram or Facebook, we receive the information you choose to share there, including your account name and correspondence.
To operate and protect the website, our hosting and security services also process technical information such as IP addresses, timestamps, device and browser details, and spam-verification signals. Our contact server uses a hashed identifier derived from the request IP address and recent request times to limit abusive submissions.
3. Why we use information, and our legal basis
We use correspondence to read your brief, answer questions, discuss services, prepare quotations and, where you ask us to, take steps towards a potential agreement. Where applicable, this is necessary to take steps at your request before entering into a contract (GDPR Article 6(1)(b)). We also rely on our legitimate interests in handling ordinary business enquiries, managing communications, operating the website and preventing spam or misuse (Article 6(1)(f)), subject to your rights and interests.
The contact form requires a name, email address, at least one service selection and a message so that we can respond. Providing a phone number or attachment is voluntary. We do not add you to newsletters or advertising lists because you contacted us.
4. Where your messages go
SiteGround hosts our website and the support@brandfools.com mailbox. Website enquiries are delivered only to our support@brandfools.com mailbox hosted by SiteGround. Our automatic acknowledgement is sent to the email address you provide. We and our service providers therefore store or process enquiry emails even though we do not maintain a separate customer database.
If you contact us on Instagram or Facebook, Meta's services also handle that conversation under their own privacy terms. These platforms are additional channels for communicating with us, not part of the website contact form.
5. AI-assisted creative work
We may use AI-assisted tools to brainstorm, prepare proposals or develop creative work, and may use relevant parts of a client brief or supplied references when necessary for a requested project. Such providers may include OpenAI/ChatGPT, Higgsfield or other creative tools, depending on the project. We aim to share only what is needed, avoid including unnecessary names, contact details and sensitive information, and check the applicable provider terms and safeguards before sharing client materials. If a brief contains confidential or sensitive information, please tell us before sending it so we can agree on how to handle it.
We do not use AI to make solely automated decisions about individuals that produce legal or similarly significant effects.
6. Files, security and spam prevention
Optional files are checked by our server and attached to the enquiry email. We do not intentionally save a permanent standalone copy of uploaded files on the website, but copies may remain in our email mailboxes and provider backups. Please do not submit medical records, passwords, banking details or other sensitive personal information through the general enquiry form.
We use Cloudflare Turnstile on the contact page to help block automated spam. It processes technical/browser signals for verification, while the actual message is handled by our form server. Read Cloudflare's Turnstile Privacy Addendum. We also maintain short-lived, access-restricted hashed-IP rate-limit files for spam protection. These records are no longer needed after the 15-minute enforcement window; we use a daily server cleanup to remove files older than 48 hours, normally within a further 24 hours.
7. Analytics, cookies and tracking
We do not use Google Analytics, advertising pixels, remarketing scripts, newsletters or marketing analytics cookies on this website. SiteGround and Cloudflare may still use technical information and essential browser storage as needed for hosting, delivering pages and protecting the form. Turnstile pre-clearance is disabled.
8. How long we keep information
Enquiries that do not become projects: we review and delete the related correspondence and attachments from our actively controlled SiteGround mailbox 12 months after the last meaningful conversation, unless a legitimate reason or legal obligation requires longer retention. We also review our Instagram and Facebook business conversations and delete copies we control when they are no longer needed, subject to those platforms' capabilities.
Client projects: if we work together, we may need to retain relevant contracts, project records or accounting documentation for longer where necessary for the project, legal obligations or legal claims. Hosting logs, email infrastructure backups and security records maintained by our providers follow their own retention arrangements, which can differ from our mailbox deletion schedule.
9. Service providers and international processing
The services we use can include SiteGround (hosting and email), Cloudflare (Turnstile), Meta (Instagram and Facebook messaging), and relevant AI/creative platforms when requested work calls for them. Access within BrandFools is limited to Georgios Kleitou and Charis Petrou, although providers may process information to operate their services. We do not sell enquiry information.
Some providers operate internationally and may process information outside the European Economic Area. Where international transfers are relevant, protections depend on the particular provider, destination and applicable terms; these may include an adequacy decision or contractual safeguards such as EU standard contractual clauses. Contact support@brandfools.com to ask for information about the safeguards relevant to your enquiry.
10. Your rights
Depending on the circumstances, you may ask to access, correct or erase your personal information, restrict its use, object to processing based on legitimate interests, or request data portability where the legal conditions apply. Please contact support@brandfools.com. We will respond without undue delay and generally within one month, subject to the GDPR's permitted extensions and exceptions. We may need to verify your identity first.
You can also complain to a relevant supervisory authority, including the Office of the Commissioner for Personal Data Protection in Cyprus.
11. Changes to this policy
We may update this page when our website, communication channels, providers or data practices change. We'll show the latest update date above.