Privacy Policy

BRANDBLOCK OÜ is the data controller for the personal data described here, and the only legal entity behind this studio. It is registered in Estonia under business registry code 17371485, VAT number EE102924013.

Registered office: Lõhmuse tee 3, 12113 Tallinn, Estonia.

The team works from three places: the Lift99 Telliskivi Hub at Telliskivi 60a/5, 10412 Tallinn; 30 Churchill Place, Canary Wharf, London E14 5RE, United Kingdom; and Via Albricci 7, 24067 Sarnico BG, Italy. These are working locations. Whichever one you deal with, the company you are contracting with, and the controller of your data, is BRANDBLOCK OÜ in Estonia.

For anything in this policy, write to info@brandblock.studio.

• What you send us. Your name, your email address, your company if you give it, and whatever you write. The form in the footer delivers this to our studio inbox as an email once you tick the consent box and press send. It goes nowhere else: no visitor database, no mailing list.
• The anti-spam check. The contact form is protected by Cloudflare Turnstile, which tells people from bots by reading technical signals such as your IP address and browser characteristics. It sets no cookies and stores nothing on your device.
• Job applications. If you write to our careers address, we receive whatever you send, which usually includes a CV or portfolio and the contact details on it.
• Technical logs. Our hosting provider records standard server logs, including IP address, browser and device type, pages requested and timestamps. These keep the site secure and available.
• Audience measurement. Aggregated, cookie-free statistics: page views, approximate country, device type and referring site. They are counts, not profiles. They do not identify you and they do not follow you to other websites.

We use personal data only for the purpose it was sent for, on these legal bases under the GDPR:

• To reply and to discuss possible work. Our legitimate interest in answering people who contact us, and where a project is being agreed, steps taken at your request before a contract.
• To consider applications. Our legitimate interest in hiring, and steps taken at your request before an employment contract.
• To keep the site secure and working. Our legitimate interest in running a reliable, protected website.

We do not sell personal data. We do not use it for advertising, automated decision making or profiling.

• Correspondence. For as long as the conversation is live, and up to 24 months afterwards so we can pick a thread back up.
• Applications. Up to 12 months, unless you ask us to delete them sooner or agree that we keep them on file for future roles.
• Technical logs. Short retention by our hosting provider, typically up to 30 days.
• Audience measurement. Aggregated counts only, with no personal data to delete.

Ask us to delete something earlier and we will, unless we are required to keep it (for example for accounting or legal claims).

A small number of providers process data on our instructions so the site and our correspondence work:

• Vercel. Hosting, content delivery and the cookie-free audience measurement.
• Sanity. The content system holding this site's words and images. It stores no visitor data.
• Vimeo. Hosting for the films embedded on the site, with tracking switched off. See the cookies policy.
• Resend. Delivers what you put in the contact form to our inbox as an email, and processes it for that purpose only.
• Cloudflare. Runs the Turnstile anti-spam check on the contact form, processing technical signals including your IP address.
• Google. Google Workspace runs our email, so the messages you send us are received and stored there.

Some of these are based outside the European Economic Area. Where that is the case, the transfer relies on an adequacy decision of the European Commission or on standard contractual clauses. We share personal data with no one else, unless the law requires it.

Under the GDPR you can ask us to give you a copy of your personal data, correct it, delete it, restrict how we use it, hand it to another provider, or object to our using it at all. Where we rely on consent, you can withdraw it at any time.

Write to info@brandblock.studio and we will answer within one month.

If you think we have got it wrong, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the supervisory authority where you live.

This site does not use cookies, and there is nothing to consent to. The detail, including what we use instead, is in the cookies policy.

When this policy changes, the date at the top changes with it. If a change materially affects how we handle your data, we will say so on the site rather than hope you notice.