BRADcommerce Privacy Policy

1. Introduction

This Privacy Policy forms an integral part of the General Terms and Conditions of Service (the "Terms") governing the use of the BRADcommerce Service. It describes how UAB Invertus, operating the BRADcommerce Service (hereinafter “BRADcommerce,” “we,” “our,” or “us”), collects, uses, discloses, shares, transfers, and safeguards personal data relating to individuals who interact with our website, Services, Clients, Partners, and integrations available through bradcommerce.com and its subdomains.

We are committed to ensuring transparency, accountability, and the protection of personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Law on Legal Protection of Personal Data of the Republic of Lithuania, the ePrivacy Directive as implemented in applicable jurisdictions, and other applicable data protection, privacy, electronic communications, and cybersecurity laws.

This Privacy Policy should be read together with our General Terms and Conditions of Service, Data Processing Agreement (DPA) (including its Sub-processor List), Cookies Policy, any applicable Joint Controller Arrangement, and any other privacy-related notices published by BRADcommerce. These documents collectively explain how personal data is processed within the BRADcommerce ecosystem and describe the respective responsibilities of BRADcommerce, its Clients, and its Partners.

2. Who Is Responsible for Your Data

For personal data processed in connection with the operation of the BRADcommerce website, account registration, account administration, billing, customer support, marketing activities, and the direct contractual relationship with Clients, and other purposes described in Section 3.1, the data controller is:

UAB Invertus
Company Code: 300117946
Address: K. Donelaičio g. 62-522, LT-44248 Kaunas, Lithuania
Email: support@bradcommerce.com

Where BRADcommerce processes personal data on behalf of its Clients in connection with the provision of the Service, BRADcommerce acts as a data processor, and the relevant Client acts as the data controller. Such processing is governed by the applicable Data Processing Agreement (DPA) and described further in Sections 3 and 4 of this Privacy Policy.

2.1 Data Protection Officer

BRADcommerce has appointed a Data Protection Officer to oversee compliance with applicable data protection law. Data subjects, Clients, and End Visitors may contact the Data Protection Officer using the general contact details set out in Section 16.

3. Roles We Act In

BRADcommerce processes personal data in different capacities depending on the context in which the data is processed. The role we act in determines our responsibilities under applicable data protection laws.

3.1 BRADcommerce as a Data Controller

BRADcommerce acts as a data controller when processing personal data for its own business purposes, including:

• operating and managing the BRADcommerce website;
• registering and administering Client accounts;
• managing subscriptions, billing, payments, and contractual relationships;
• providing customer support and responding to inquiries;
• sending service-related communications and administrative notices;
• sending marketing communications where permitted by applicable law;
• maintaining platform security, fraud prevention, abuse detection, and service monitoring;
• improving, developing, and optimizing the Service on the basis of Service usage data and anonymized or aggregated data;
• generating, using, analyzing, commercializing, publishing, and distributing aggregated, anonymized, statistical, de-identified, and derived data, including data derived from Client Data, End Visitor Data, Partner Data, Partner Integrations, Service usage data, and third-party systems, for analytics, benchmarking, service improvement, product development, artificial intelligence enhancement, operational purposes, industry insights, and other lawful business purposes. Such data may only be used for these purposes where it has been processed using appropriate anonymization or aggregation techniques such that it does not identify, and cannot reasonably be used by BRADcommerce or any other party, by any means reasonably likely to be used, to re-identify any individual, Client, Partner, or End Visitor, and its use complies with applicable data protection laws.

This Privacy Policy applies to such processing activities.

3.2 BRADcommerce as a Data Processor

When Clients use the Service to collect, store, analyze, enrich, synchronize, or otherwise process personal data relating to their customers, website visitors, users, or other individuals (“End Visitors”), BRADcommerce generally acts as a data processor on behalf of the Client.

In such cases:

• the Client acts as the data controller and determines the purposes for which the Service is used, while BRADcommerce provides and operates the technical means of processing as described in the Service, the Terms, this Privacy Policy and the applicable Data Processing Agreement (DPA);
• BRADcommerce processes personal data on behalf of the Client in accordance with the applicable Data Processing Agreement (DPA), which governs the processing activities performed through the Service, together with the functionality of the Service and the processing activities initiated, configured, or authorized by the Client through the Service;
• the Client remains responsible for ensuring that the processing complies with applicable privacy, marketing, tracking, profiling, consumer protection, and data protection laws;
• The Client is solely responsible for obtaining all required notices, consents, permissions, lawful bases, and authorizations necessary for the collection, sharing, synchronization, enrichment, profiling, personalization, transfer, and processing of personal data through the Service and any Partner Integrations;
• End Visitors should refer to the Client’s own privacy notice for information about how their personal data is processed;
• Core Service functionality necessary to deliver the Service (such as basic analytics, dashboards, and data synchronization) forms part of BRADcommerce's standard Service offering and does not require a separate documented instruction beyond the Terms and the Data Processing Agreement (DPA). Processing activities that go beyond core Service delivery - including profiling, cross-platform data sharing with Partners, and the use of artificial intelligence features for personalization - shall only be carried out where expressly activated, configured, or otherwise instructed by the Client through the Service, and such activation shall constitute the Client's documented instruction for that processing activity within the meaning of Article 28(3)(a) GDPR.

3.3 BRADcommerce as a Joint Controller

For certain processing activities carried out through Partner Integrations, particularly the bidirectional exchange of interest profiles and behavioral data with Partners for cross-channel personalization purposes, BRADcommerce and the relevant Partner jointly determine the purposes and means of that processing and act as joint controllers under Article 26 GDPR.

3.4 Relationship Between Documents

Where BRADcommerce acts as a data processor, the processing of personal data is governed by the applicable Data Processing Agreement (DPA), which forms an integral part of the contractual relationship between BRADcommerce and the Client. In the event of any inconsistency between this Privacy Policy and the Data Processing Agreement (DPA) with respect to processor activities, the DPA shall prevail. In the event of any inconsistency between this Privacy Policy and the General Terms and Conditions of Service relating to privacy, data protection, or personal data processing matters, the document that more specifically governs the relevant processing activity shall prevail.

This Privacy Policy should be interpreted together with the General Terms and Conditions of Service, the Data Processing Agreement (DPA) (including its Sub-processor List), the Cookies Policy, and any applicable Joint Controller Arrangement.

4. What Personal Data We Collect

4.1 Categories of Individuals

We may process personal data from the following groups of individuals:

• Prospective Clients: individuals requesting information, quotes, or demos;
• Registered Users and Clients: users who create an account or access our Services;
• Business Partners and Service Providers: individuals engaged in business-related interactions on behalf of their organizations;
• Website Visitors: users who browse bradcommerce.com or interact with embedded features such as forms and cookies;
• Event Participants: attendees of webinars, workshops, or promotional events;
• End Visitors of our Clients' websites: individuals whose data is processed through the BRADcommerce platform on behalf of our Clients (processing governed by the Data Processing Agreement (DPA)).

4.2 Categories of Data

Depending on your relationship with us, we may process the following categories of personal data as a controller:

• Identification and Contact Data: name, job title, company, email address, phone number;
• Account and Access Data: usernames, passwords (stored in hashed form), authentication credentials, access logs;
• Billing and Payment Data: invoice information, payment methods (processed by Stripe), tax identifiers (e.g., VAT number);
• Technical and Usage Data: IP address, country, geographic region, city, browser type, browser version, operating system, device type, session logs, time zone, interaction behavior on our marketing website, Service usage data, account activity logs, authentication events, security events, error logs, API usage logs, and platform performance metrics;
• Communication Data: inquiries, feedback, support messages, and communication records;
• Marketing and Consent Data: event registration details, subscription preferences, marketing consents and consent records.

In some cases, we may also process pseudonymized or aggregated platform usage data to improve service performance, reliability, and security.

4.3 Data We Process as a Processor on Behalf of Clients

As part of delivering the BRADcommerce Service, we process personal data that our Clients upload, submit, or generate during use of the platform. This includes, but is not limited to:

• Behavioral event data of End Visitors (page views, searches, cart events, purchases, clicks);
• Technical and device metadata of End Visitors (IP-derived geographic region at country level, device type, browser type);
• Session and user identifiers used to link sessions (where consent has been obtained by the Client);
• Interest profiles inferred from End Visitor behavior (subject to the limitations described in Section 4.5);
• Data received from Partner Integrations (such as email engagement data, advertising platform data, ecommerce platform data, customer segmentation data, attribution data, campaign performance data, and other Partner-provided information) where the Client has authorized the integration;
• Order, transaction, and ecommerce activity data.

In these cases:

• The Client acts as the data controller and is responsible for the lawfulness of the processing;
• We act as a data processor and process such data in accordance with the applicable Data Processing Agreement (DPA), the functionality of the Service, and the processing activities initiated, configured, or authorized by the Client through the Service;
• We do not use such data for our own purposes (such as resale, independent profiling, or unrelated analytics) unless explicitly authorized in writing by the Client;
• This processing is governed in detail by the Data Processing Agreement (DPA).

We do not use personal data processed on behalf of Clients for our own independent purposes, except as expressly permitted by the applicable DPA, these Terms, or where the data has been aggregated, anonymized, de-identified, or otherwise rendered incapable of identifying any individual, Client, Partner, or End Visitor.

4.4 Profiling and Inferred Data

As part of the Service, the platform may generate interest profiles for End Visitors based on their behavior on the Client's website (such as search queries, page views, and purchases). These profiles are used to provide insights to the Client and, where the End Visitor has consented, to enable personalized communications and experiences across channels integrated with BRADcommerce.

Profiling is carried out only where the Client has established an appropriate lawful basis under applicable data protection laws and has authorized BRADcommerce to perform the relevant processing activities through the Service.

4.5 Special Category Data

The Service is not designed or intended to be used for the purpose of collecting, profiling, or inferring special category data within the meaning of Article 9 GDPR, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health information, sex life, sexual orientation, genetic data, or biometric data used for identification purposes.

To reduce the risk that inferred interest profiles reveal or are liable to disclose such information, BRADcommerce categorizes inferences derived from behavioral data at a level of generality designed not to reveal special category information. The resulting interest profiles are intentionally less granular than the underlying behavioral data from which they are derived.

Where BRADcommerce is notified of, or otherwise becomes aware of, special category data having been submitted, generated, inferred, or processed through the Service, BRADcommerce will take appropriate steps to restrict, delete, anonymize, suppress, or otherwise prevent further processing of such data, except to the extent applicable law requires otherwise. The approach described in the preceding paragraph constitutes BRADcommerce's primary safeguard against the processing of special category data; this paragraph applies to cases that come to BRADcommerce's attention and does not create an obligation to systematically monitor or scan data processed through the Service.

Clients remain solely responsible for ensuring that they do not submit or process special category data through the Service unless explicitly permitted by applicable law and supported by an appropriate legal basis.

4.6 Children's Data

Access to the Service as a registered User or Client is not intended for individuals under the age of 18. We do not knowingly register Users under 18. If we become aware that we have done so without valid consent, we will delete the relevant account data promptly.

End Visitors of a Client's website may include minors, depending on the Client's business and audience. The Client, as controller of its own End Visitors, is solely responsible for determining its obligations under applicable law regarding the processing of children's data (including Article 8 GDPR where relevant) and for implementing any required age-verification or parental-consent mechanisms on its own website.

5. Purposes and Legal Bases of Data Processing

We process personal data based on the lawful grounds outlined in the GDPR. The table below shows the main purposes and corresponding legal bases for processing in which we act as a controller.

BRADcommerce does not train or fine-tune general-purpose artificial intelligence models on Client Data or End Visitor Personal Data that identifies or could reasonably be used to re-identify an individual, eexcept where expressly agreed in writing with the Client and where an appropriate lawful basis for that specific use has been established in accordance with applicable data protection law.

Our legitimate interests in the processing activities described above include providing, maintaining, securing, supporting, improving, developing, and optimizing the Service; managing our business operations; protecting our Clients, Partners, users, and infrastructure from fraud, abuse, security incidents, and misuse; managing Partner relationships and integrations; promoting our products and services; and generating aggregated, anonymized, statistical, de-identified, and derived analytics, benchmarks, industry insights, product improvements, and artificial intelligence enhancements, provided that such processing does not identify and cannot reasonably be used to re-identify any individual.

Where BRADcommerce acts as a data processor on behalf of a Client, the applicable lawful basis for processing is determined by the Client as data controller. The Client remains responsible for ensuring that an appropriate lawful basis exists and continues to apply to the relevant processing activities throughout the use of the Service.

6. Sharing of Personal Data

We do not sell or rent your personal data. We share data strictly as necessary and only with parties that are bound to data protection obligations consistent with the GDPR.

6.1 Categories of Recipients

We may share personal data with the following categories of recipients:

• Authorized Sub-processors: External vendors supporting hosting, payment processing, communications, customer support, and related operational functions. These providers operate under Data Processing Agreements in accordance with Article 28 GDPR. A current list is maintained in Appendix A of the Data Processing Agreement (DPA).
• Partners (in the context of Partner Integrations): Where a Client has activated a Partner Integration, personal data, audience data, behavioral data, profile data, attribution data, engagement data, analytics data, or other information may be transferred, received, synchronized, enriched, aggregated, analyzed, or otherwise processed between BRADcommerce and the relevant Partner as authorized by the Client and permitted by applicable law. The Client remains responsible for ensuring that an appropriate lawful basis exists for such processing activities.
• Professional Advisors: Legal, financial, tax, or accounting advisors engaged to support our business operations.
• Public Authorities: Where legally required, such as in response to a lawful request or to comply with regulations.
• Artificial Intelligence and Technology Providers: Third-party providers that support artificial intelligence functionality, data analysis, machine learning, hosting, infrastructure, monitoring, or related Service features. Such providers process data only to the extent necessary to provide the relevant functionality and are subject to appropriate contractual and data protection safeguards.

BRADcommerce does not independently determine the purposes for which such personal data is collected, shared, synchronized, enriched, profiled, personalized, or otherwise processed through Partner Integrations unless expressly stated otherwise in this Privacy Policy, the applicable Joint Controller Arrangement, or applicable law.

6.2 Joint Controllership with Partners

For certain processing activities carried out through Partner Integrations - in particular, the bidirectional exchange of End Visitor interest profiles, behavioral signals, and attribution or engagement data between BRADcommerce and a Partner for the purpose of cross-channel personalization, audience activation, or campaign optimization - BRADcommerce and the relevant Partner jointly determine the purposes and means of that processing and act as joint controllers within the meaning of Article 26 GDPR. Before any such Partner Integration is activated, BRADcommerce and the relevant Partner will enter into a Joint Controller Arrangement setting out their respective responsibilities in accordance with Article 26 GDPR.

For such processing activities:

• the respective responsibilities of BRADcommerce and the relevant Partner are defined in the applicable Joint Controller Arrangement;
• data subjects may exercise their rights against either BRADcommerce or the relevant Partner, unless otherwise provided by applicable law;
• the essence of the applicable Joint Controller Arrangement is made available to data subjects where required by applicable law;
• BRADcommerce and the relevant Partner cooperate in fulfilling their respective obligations under applicable data protection laws.

Other processing activities carried out through Partner Integrations, which do not involve the bidirectional exchange of profile or behavioral data described above, are carried out by BRADcommerce as a data processor or independent controller, as applicable, and do not give rise to joint controllership.

The Client is not a party to any Joint Controller Arrangement between BRADcommerce and a Partner unless expressly agreed otherwise in writing. The Client remains solely responsible for ensuring that any processing activities initiated through the Service and any Partner Integrations are supported by an appropriate lawful basis and comply with applicable privacy, marketing, consumer protection, and data protection laws.

6.3 Data Received Through Partner Integrations and Third-Party Systems

As part of the Service, BRADcommerce may receive, access, synchronize, enrich, analyze, or otherwise process personal data originating from Partner Integrations, ecommerce platforms, analytics providers, advertising platforms, customer relationship management systems, marketing platforms, or other third-party systems connected by the Client.

Such data is processed only to the extent necessary to provide the functionality of the Service, perform the processing activities authorized by the Client, support Partner Integrations, generate analytics and insights, and otherwise operate the Service in accordance with the applicable Data Processing Agreement (DPA), the Terms, and applicable law.

Where BRADcommerce acts as a data processor, the relevant Client remains responsible for providing any required privacy notices, obtaining any required consents, establishing an appropriate lawful basis for processing, and complying with applicable transparency obligations towards End Visitors and other data subjects.

The categories of personal data received through Partner Integrations and third-party systems may include behavioral data, transaction data, engagement data, attribution data, audience data, profile data, technical metadata, ecommerce activity data, marketing interaction data, and other information made available through the relevant integration.

Such data is received and processed only because the relevant Client has activated, configured, connected, or otherwise authorized the relevant integration and related processing activities through the Service.

BRADcommerce does not independently verify the accuracy, completeness, legality, origin, or lawful collection of data received through Partner Integrations or third-party systems and may rely on the Client’s representations, warranties, and instructions regarding such matters.

7. Transfers Outside the European Economic Area (EEA)

BRADcommerce aims to host and process personal data primarily within the European Economic Area (EEA). Certain Sub-processors - which may include artificial intelligence providers, infrastructure providers, or other technology providers - may process personal data outside the EEA. The processing location of each Sub-processor, including whether it is located outside the EEA, is disclosed in the Sub-processor List maintained as Appendix A to the Data Processing Agreement (DPA), which BRADcommerce keeps up to date.

Where personal data is transferred outside the EEA, BRADcommerce implements appropriate safeguards in accordance with Chapter V of the GDPR, which may include:

• an adequacy decision adopted by the European Commission;
• Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented where necessary by additional technical, contractual, or organizational measures;
• other lawful transfer mechanisms recognized under applicable data protection laws;
• explicit consent where permitted and appropriate under applicable law.

Where a Client activates, configures, or authorizes a Partner Integration, the Client acknowledges that personal data may be transferred to, accessed from, or processed in jurisdictions outside the EEA depending on the infrastructure, locations, and processing activities of the relevant Partner.

Where BRADcommerce acts as a data processor, the Client remains responsible for determining whether the transfer is lawful, providing any required notices, obtaining any required consents, and ensuring that an appropriate lawful basis exists for the transfer, while BRADcommerce implements the transfer safeguards applicable to its role under the Data Processing Agreement (DPA) and applicable law.

Information regarding Sub-processors and their processing locations is made available through the Sub-processor List maintained as Appendix A to the applicable Data Processing Agreement (DPA).

8. Automated Decision-Making and Profiling

8.1 The Service may use artificial intelligence, machine learning, statistical modelling, predictive analytics, automated analysis, and similar technologies to generate insights, recommendations, forecasts, benchmarks, audience segments, interest profiles, alerts, and other outputs based on data processed through the Service. Such outputs are generated as part of the functionality of the Service and are intended to assist Clients in analyzing data, identifying trends, and supporting business decision-making.

8.2 BRADcommerce does not make solely automated decisions that produce legal effects or similarly significant effects on individuals within the meaning of Article 22 GDPR. The outputs generated by the Service are intended to support human review and decision-making by Clients. The Client remains solely responsible for evaluating, interpreting, validating, and acting upon any insights, recommendations, forecasts, profiles, segments, alerts, or other outputs generated through the Service.

BRADcommerce does not guarantee the accuracy, completeness, reliability, legality, suitability, or fitness for a particular purpose of any output generated through the Service. Clients remain solely responsible for independently assessing the appropriateness of any actions taken based on such outputs.

Where a Client configures the Service or any integration to trigger automated actions based on outputs generated by the Service without meaningful human review, the Client is solely responsible for ensuring compliance with Article 22 GDPR and other applicable automated decision-making requirements in respect of the relevant End Visitors.

8.3 Where profiling, segmentation, personalization, audience creation, behavioral analysis, or similar processing activities are performed through the Service, such processing shall be carried out only where the Client has established an appropriate lawful basis under applicable law and has authorized the relevant processing activities through the Service. End Visitors have the absolute right under Article 21(2) GDPR to object to profiling carried out for direct marketing purposes, including profiling to the extent it is related to such direct marketing. Where BRADcommerce acts as a data processor, such requests shall be handled in accordance with the applicable Data Processing Agreement (DPA) and under the instructions of the relevant Client. Where BRADcommerce acts as a joint controller under Section 6.2, such requests shall be handled in accordance with the applicable Joint Controller Arrangement.

8.4 BRADcommerce may use artificial intelligence technologies provided by BRADcommerce, its Sub-processors, Partners, or third-party technology providers to support the functionality of the Service. BRADcommerce will implement appropriate transparency, governance, risk-management, and compliance measures required by applicable law, including the EU AI Act where applicable.

9. Data Retention

BRADcommerce retains personal data only for as long as necessary to fulfill the purposes for which it was collected, to provide the Service, to comply with legal obligations, to resolve disputes, to enforce contractual rights, to maintain security, or to protect the legitimate interests of BRADcommerce and its Clients.

Unless a longer retention period is required or permitted by applicable law, personal data may be retained as follows:

• Active Client accounts: for the duration of the contractual relationship; following termination, Client Data remains available for export for up to ninety (90) days as set out in the Terms, after which it may be permanently deleted, save for such additional period as reasonably necessary to comply with legal obligations, resolve disputes, enforce agreements, maintain security, or protect legitimate interests;
• Trial accounts that do not convert to a paid subscription: for up to ninety (90) days following Trial expiration, unless the user activates a paid subscription or applicable law requires a different retention period;
• Billing, accounting, tax, and financial records: for up to ten (10) years or such longer period as required by applicable law;
• Marketing communications data: until consent is withdrawn, an objection is received, or for up to two (2) years following the last meaningful interaction, whichever occurs first;
• Cookie and tracking data: as described in the applicable Cookies Policy and consent management settings;
• Support requests, customer communications, and service records: for up to three (3) years following the last interaction, unless longer retention is necessary to establish, exercise, or defend legal claims;
• Data processed through Partner Integrations, third-party systems, and connected platforms: for the period determined by the applicable Client configuration, contractual arrangements, Service functionality, applicable retention settings, or legal requirements.

Where BRADcommerce acts as a data processor on behalf of a Client, retention periods are determined by the Client as data controller and governed by the applicable Data Processing Agreement (DPA). BRADcommerce may retain personal data for longer periods where required by applicable law, court order, regulatory requirement, audit obligation, legal hold, dispute resolution process, security investigation, fraud prevention activity, or other legitimate legal or compliance purpose.

Upon expiration of the applicable retention period, personal data will be deleted, anonymized, aggregated, or otherwise rendered incapable of identifying an individual, unless continued retention is required or permitted by applicable law.

Residual copies of personal data may remain in backups, archives, disaster recovery systems, logs, or security records for a limited period until overwritten, deleted, or anonymized in accordance with BRADcommerce’s internal retention and security procedures.

10. Your Rights as a Data Subject

Subject to applicable law, you may have the following rights in relation to your personal data:

• the right to obtain access to your personal data;
• the right to request rectification of inaccurate or incomplete personal data;
• the right to request erasure of personal data (“right to be forgotten”);
• the right to request restriction of processing;
• the right to data portability;
• the right to object to processing, including the right to object to direct marketing and profiling related to direct marketing under Article 21 GDPR;
• the right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before such withdrawal;
• rights relating to automated decision-making and profiling where applicable under law;
• the right to lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania (www.ada.lt) or another competent supervisory authority.

Where BRADcommerce acts as a data controller, requests relating to the exercise of data subject rights may be submitted to:

Email: support@bradcommerce.com

BRADcommerce may request additional information reasonably necessary to verify the identity of the requester and to assess the applicability of the requested right, and may decline to act on the request until such identity has been verified. BRADcommerce may refuse, limit, or defer requests where permitted by applicable law, including where requests are manifestly unfounded, excessive, repetitive, adversely affect the rights of others, conflict with legal obligations, or cannot reasonably be fulfilled.

BRADcommerce will respond to valid requests within the time periods required by applicable law, including GDPR. Where permitted by law, BRADcommerce may extend the response period where requests are complex or numerous.

Where BRADcommerce acts as a data processor on behalf of a Client, BRADcommerce generally does not determine how personal data is processed and is not responsible for responding independently to data subject rights requests relating to such processing. In such cases, the relevant Client acts as the data controller and remains responsible for handling the request. BRADcommerce may assist the Client in responding to such requests in accordance with the applicable Data Processing Agreement (DPA).

Where processing is carried out under a Joint Controller Arrangement, data subjects may exercise their rights against either BRADcommerce or the relevant Partner.

11. Security Measures

BRADcommerce implements appropriate technical, organizational, and administrative measures designed to protect the confidentiality, integrity, availability, and security of personal data processed through the Service, taking into account the nature, scope, context, and purposes of processing, as well as the risks to individuals and the state of the art, in accordance with applicable law.

Such measures may include, where appropriate:

• encryption of data in transit and, where applicable, at rest;
• access controls based on the principle of least privilege;
• multi-factor authentication for administrative access where supported;
• logging, monitoring, and auditing of relevant system activities;
• security testing, vulnerability management, and periodic security reviews;
• employee and contractor training relating to security, privacy, and data protection;
• data minimization, segregation, pseudonymization, and access restriction measures where appropriate;
• incident detection, response, recovery, and breach notification procedures.

BRADcommerce regularly reviews and updates its security measures to address evolving security threats, technological developments, legal requirements, and operational needs.

However, no security measure, system, network, software, service provider, transmission method, or storage mechanism can be guaranteed to be completely secure. Accordingly, BRADcommerce does not guarantee that unauthorized access, data breaches, cyberattacks, security incidents, service interruptions, data corruption, or other security-related events will never occur.

The Client remains responsible for maintaining appropriate security measures within its own systems, accounts, devices, integrations, users, credentials, and Partner relationships. Where BRADcommerce acts as a data processor, additional security obligations are governed by the applicable Data Processing Agreement (DPA).

12. Marketing Communications

BRADcommerce may send newsletters, product updates, event invitations, educational content, promotional materials, surveys, and other marketing or business communications relating to BRADcommerce, its Services, and related offerings.

Where required by applicable law, BRADcommerce will obtain consent before sending marketing communications. Where permitted by applicable law, BRADcommerce may send marketing communications about its own similar products or services on the basis of legitimate interests to existing Clients and to individuals who have proactively requested information, a demonstration, or a quote from BRADcommerce. BRADcommerce will obtain consent before sending marketing communications to any other business contact.

Marketing communications may be delivered directly by BRADcommerce or through authorized service providers acting on its behalf.

Recipients may unsubscribe, opt out, or object to receiving marketing communications at any time by using the unsubscribe mechanism included in the communication or by contacting BRADcommerce at support@bradcommerce.com.

BRADcommerce maintains records of consent obtained for marketing communications, including the date, method, and scope of consent given, in accordance with Article 7 GDPR.

Opting out of marketing communications does not affect the delivery of transactional, administrative, contractual, security-related, billing-related, support-related, legal, compliance, or other Service-related communications that are necessary for the provision, operation, administration, or security of the Service.

13. Cookies and Similar Technologies

BRADcommerce uses cookies, pixels, tags, software development kits (SDKs), local storage technologies, and other similar technologies on its website, client portals, and related online services for purposes including:

• enabling and maintaining core functionality of the website and Service;
• authentication, security, fraud prevention, and account administration;
• analyzing traffic, usage patterns, and performance;
• improving user experience and Service functionality;
• measuring the effectiveness of marketing, communications, and promotional activities;
• complying with legal and regulatory requirements.

Further information regarding the categories of cookies and similar technologies used by BRADcommerce, their purposes, retention periods, and available preference controls is provided in the applicable Cookies Policy.

Where required by applicable law, BRADcommerce obtains consent before placing or accessing non-essential cookies or similar technologies.

The use of cookies, tracking technologies, profiling technologies, analytics technologies, pixels, SDKs, or similar technologies on websites, applications, stores, or platforms operated by Clients remains the responsibility of the relevant Client. Clients are responsible for implementing appropriate consent management mechanisms, providing required transparency notices, obtaining any necessary consents, and ensuring compliance with applicable privacy, cookie, marketing, and electronic communications laws.

14. Third-Party Websites, Services, and Content

The BRADcommerce website, Service, documentation, communications, or Partner Integrations may contain links to, references to, integrations with, or content provided by third-party websites, platforms, applications, services, or resources.

BRADcommerce does not own, control, operate, monitor, endorse, or assume responsibility for any third-party websites, products, services, privacy practices, security measures, content, or business activities.

Accessing or interacting with any third-party website, service, platform, or resource is undertaken at your own risk and remains subject to the applicable terms, privacy policies, and practices of the relevant third party.

BRADcommerce encourages users to review the privacy notices, cookie policies, security practices, and terms of use of any third-party service before providing personal data or engaging with such service. This Section does not limit or reduce BRADcommerce's responsibilities as a joint controller under Section 6.2, where applicable.

15. Changes to this Privacy Policy

BRADcommerce may update, amend, replace, or otherwise modify this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, industry standards, security requirements, technology, Service functionality, business operations, Partner Integrations, Sub-processors, or data processing practices.

Updated versions of this Privacy Policy will be published on the BRADcommerce website and identified by an updated “Last Updated” date.

Non-material changes to this Privacy Policy, such as updates to contact details or clarifications that do not affect the rights of data subjects or the purposes or legal bases of processing, become effective upon publication.

Where a change is material - including a change that affects the rights of data subjects or the purposes, categories, or legal bases of processing - BRADcommerce will provide appropriate advance notice through the Service, the website, email, or other reasonable communication channel before the change takes effect. Where the processing in question relies on consent, BRADcommerce will seek renewed consent before relying on that consent for the changed processing; continued use of the Service does not, by itself, constitute consent to such changes.

This Privacy Policy should be read together with the General Terms and Conditions of Service, the Data Processing Agreement (DPA) (including its Sub-processor List), the Cookies Policy, and any applicable Joint Controller Arrangement.

16. Contact Information

If you have any questions, requests, concerns, or complaints relating to this Privacy Policy, the processing of personal data, the exercise of your data subject rights, the Service, or any privacy-related matter, you may contact BRADcommerce using the following details:

• UAB Invertus
• Email: support@bradcommerce.com
• Address: K. Donelaičio g. 62-522, LT-44248 Kaunas, Lithuania

The contact details above may also be used to reach BRADcommerce's Data Protection Officer, as described in Section 2.1.

BRADcommerce's identity verification requirements for data subject rights requests are set out in Section 10.