Privacy Policy

1. Who is responsible

Brandarchway is the controller for the personal data described in this policy.

2. In short

• Advertising measurement is optional and requires your permission for targeting cookies. You can change that permission using Cookie settings.
• Where enabled and allowed, the Meta pixel and Meta Conversions API help us understand which Facebook and Instagram ads lead to requests. This website uses no analytics tools or other advertising tags.
• When you request a free marketing check, Google Ads audit or LinkedIn Ads audit, we store your request in our own CRM and send you a confirmation email.
• A request never subscribes you to our newsletter.
• After the Free Value form, you can open the material already available for your chosen topic. We keep your details in our CRM and email you when new lessons or the community become available. Joining does not create an account.
• You only receive The Archway Blueprint newsletter after you confirm your email address, and you can unsubscribe at any time.
• Your answers in the LinkedIn Ads workbook stay in your own browser. We do not receive them.

3. Requests for a free marketing check or ads audit

When you use the request form for a free marketing check, a free Google Ads audit or a free LinkedIn Ads audit, we receive:

• your name
• your work email address
• your company website
• your question, if you add one
• what you want to find out (spend less, more leads, both or Other), including your description if you choose Other
• which of the three requests you chose
• your choice to receive email about this request and the wording version, when provided

We use these details to look at your request, agree a time for the call by email and prepare for it. Your request is stored in Brandarchway Tasks, the CRM we built and run ourselves. It is hosted on Vercel and keeps its data in a Turso database.

We send two emails about your request through Resend: a confirmation to the address you entered, and one internal notification with your request to our own inbox. Further contact takes place by ordinary email.

The AI Marketing Setup form asks for your name, email address, company and where you want to start. We process that request through the same CRM and internal email route. The website shows whether the request was received; this form does not send an automatic receipt to you or subscribe you to the newsletter.

For marketing checks and ads audits, if advertising measurement is enabled and you allowed targeting cookies, we also tell Meta that a request was received. We send your email address only as a hash, never your name, company website or question. The Meta section below explains this.

A marketing check or ads audit takes place in a 45-minute online call, at a time we agree with you by email. The online meeting service we use for the call processes it under its own privacy policy.

Legal basis: taking steps at your request before a possible agreement (Article 6(1)(b) GDPR) and our legitimate interest in answering business enquiries (Article 6(1)(f) GDPR).

4. Requests through our ads on Facebook and Instagram

Some of our ads on Facebook and Instagram open a Meta lead form. When you send that form, Meta passes the details you entered to us, such as your name, email address, company and answers. The form shows which details it asks for before you send it.

We use those details to answer your request, agree a time for the review you asked for and prepare for it. We store requests we receive in Brandarchway Tasks, our own CRM.

Meta processes your use of its lead forms under its own privacy policy.

Legal basis: taking steps at your request before a possible agreement (Article 6(1)(b) GDPR) and our legitimate interest in answering business enquiries (Article 6(1)(f) GDPR).

5. The Archway Blueprint newsletter

You can subscribe to our newsletter, The Archway Blueprint, with the sign-up form in the website footer or the separate newsletter box on the early-access form. The newsletter is separate from the request forms: a request for a check or audit never adds you to it.

• Double opt-in. After you sign up, we send a confirmation email. The link opens a page where you confirm your subscription. Only then do we add you to our newsletter list.
• What we store once you confirm. Your first name and email address, and a record of your consent: when you signed up, on which page, which version of the consent wording you agreed to and when you confirmed. We store this in Resend Contacts.
• Unsubscribing. Every newsletter email contains an unsubscribe link. You can also reply to any edition or email info@brandarchway.com. After you unsubscribe, we mark your address as unsubscribed so you do not receive the newsletter again. We manually limit the retained record to what is needed to respect that choice and substantiate your earlier consent. You can ask us to remove your details; we assess separately whether limited evidence needs to be retained.

Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time. Withdrawing does not affect processing that took place before. Keeping limited unsubscribe and consent evidence serves our legitimate interest in respecting your choice and substantiating earlier subscriptions (Article 6(1)(f) GDPR).

6. Free Value reading path and workbook

The LinkedIn Ads reading path remembers your progress through the lessons, and the workbook saves your answers. Both are stored only in your own browser (local storage) on your device. They are not sent to Brandarchway. You can remove them by clearing the stored site data in your browser. Public checklists and worksheets can be opened directly. The Free Value form also gives you a link to the material already available for your chosen topic.

7. Free Value early access

When you complete the Free Value form, we receive your full name, email address, company name and selected topic.

We use these details to handle your request, record your chosen topic and email you when new lessons or the community become available. We store them in Brandarchway Tasks, our own CRM, under the source Free Value community. The CRM is hosted on Vercel and uses a Turso database. Resend sends your receipt and our internal notification.

After you submit the form, the website shows a link to the material already available for your chosen topic. New courses and the community are still in preparation. Joining does not create a community account, and we do not pass your details to Skool.

Joining never subscribes you to our newsletter. You only receive The Archway Blueprint if you tick the separate, unticked newsletter box and then confirm your email address.

After twelve months without contact about your chosen topic, we review your registration. If there is no active arrangement about access, we delete it. You can also ask us to remove your details earlier. This review and removal are carried out manually. Email info@brandarchway.com with an earlier removal request. We do not report early-access or newsletter sign-ups to Meta as request conversions.

Legal basis: your consent to receiving the access update (Article 6(1)(a) GDPR). You can withdraw it by email at any time.

8. Cookies and your consent

The CookieScript banner is not enabled on this version of the website. No optional advertising cookies are placed by this site's tracking code.

When the CookieScript banner is enabled, it remembers your choice in the necessary CookieScriptConsent cookie. The duration and cookie details are shown in the banner. You can reopen it with Cookie settings at the bottom of the page. If the banner is unavailable, that link takes you to this explanation.

The Meta pixel can use the targeting cookies _fbp and _fbc, the latter when a Facebook or Instagram click supplies an identifier. They are only used after permission for targeting cookies. You can withdraw permission through Cookie settings and remove stored cookies using your browser settings.

The fonts are served from our own website. The Leadinfo marks on the homepage and in the footer are partner badge images hosted here; they do not load Leadinfo tracking.

Legal basis: your consent for targeting cookies (Article 6(1)(a) GDPR and article 11.7a of the Dutch Telecommunications Act). The cookie that remembers your choice is necessary to respect that choice.

9. Meta pixel and Meta Conversions API

Meta advertising measurement is switched off on this version of the website. No page-view or request events are sent by this site's tracking code. The following explains how it works when enabled.

When enabled, both tools require your permission for targeting cookies. They help us measure which Facebook and Instagram ads lead to marketing-check or ads-audit requests and improve ad delivery.

Meta pixel. This script runs in your browser after consent. It reports page views and confirmed requests. Meta receives technical data such as the page address, referring page, time, IP address, browser and device information, its cookie identifiers, the request type and a random event identifier. Our event code does not send what you type in the form.

Conversions API. After a request is safely received, our server can send the same event with the same identifier, so Meta can recognise the browser and server reports as one request. It includes the type and time of the request, the page address without query parameters, your IP address, browser information, the Meta cookie values and a SHA-256 hash of your normalised email address. The hash is not your plain email address, but it is still personal data: Meta can match it against hashes of its users' addresses. We do not send your name, company website, question or Free Value answers.

Meta can link these events to Facebook and Instagram accounts. It reports advertising results to us and processes the data for its own purposes under its privacy policy.

For collecting and passing website event data to Meta, Brandarchway and Meta Platforms Ireland Limited are jointly responsible under Meta's Controller Addendum. Meta is responsible for its further use. You can exercise your rights with us or with Meta.

We do not keep a copy of the event payload. Our server records only the delivery status and request type in its technical logs, without the email address or event identifier.

Legal basis: your consent (Article 6(1)(a) GDPR). Without consent, the pixel is not loaded and our server sends no event to Meta. Withdrawing consent stops new events. You can also manage activity from other websites through Accounts Center in your Meta account.

10. Hosting and technical data

The website is hosted by Vercel. To deliver pages and keep the website secure, Vercel processes technical request data such as your IP address, browser type and the page you requested. Vercel keeps this data in technical logs for a limited period under its own policies.

To limit misuse, such as repeated submissions, the request, early-access and newsletter forms keep only one-way hashes of your IP address and of your email address in the web server's working memory. A hash is a coded value used to recognise repeated submissions, for example so that one inbox cannot receive a stream of confirmation emails. These hashes exist only in the web server's working memory, are used for a limit period of at most 24 hours, are never written to a database and are not added to your request. These abuse-prevention hashes are separate from any email hash sent to Meta with your consent.

Legal basis: our legitimate interest in a secure, working website (Article 6(1)(f) GDPR).

11. When you email us

If you email us, we use your message and contact details to answer you and to continue the conversation you started. We use Google Workspace for ordinary business email.

Legal basis: our legitimate interest in answering questions and business correspondence (Article 6(1)(f) GDPR).

12. Providers that process data for us

We never sell personal data. These providers process data on our behalf:

When advertising measurement is enabled and allowed, Meta Platforms Ireland Limited receives the event data described above. It is not our processor: we share responsibility for collecting and transferring that data, and Meta is responsible for its further use.

Beyond these parties, we only share personal data where the law requires it, or with professional advisers who are bound to confidentiality when their advice requires it.

13. Data outside the European Economic Area

Vercel, Turso and Resend are based in the United States. Personal data may be processed outside the European Economic Area. The providers' published data-protection information describes their processing and international transfers.

Resend states that it stores email content and delivery logs in the United States, including when email is sent from an EU region. Its Data Processing Addendum includes the EU Standard Contractual Clauses for these transfers. See Resend's data-protection information, Vercel's Data Processing Addendum, Turso's terms and information about its Data Processing Agreement and Google Workspace's Data Processing Addendum.

Where Meta receives data, it may transfer it from Ireland to Meta Platforms, Inc. in the United States under the safeguards described in its privacy policy and applicable data-transfer terms.

14. How long we keep data

• Enquiries that do not lead to an engagement: After twelve months without substantive contact, we review your enquiry. If there is no ongoing conversation, engagement or other specific reason to retain it, we delete the enquiry details from our CRM and the related correspondence. We keep data needed for a legal obligation or an ongoing dispute separately for as long as that reason applies. This review and removal are carried out manually.
• Newsletter: as long as you are subscribed. After you unsubscribe, we keep only the limited information needed to respect your unsubscribe choice and substantiate your earlier consent. We review and limit the contact record manually; we no longer use it to send newsletters.
• Sent emails: Resend keeps sending logs for a limited period under its own policies.
• Technical data: Vercel keeps technical logs for a limited period under its own policies.
• Hashes used to limit misuse: used for at most 24 hours, in the web server's working memory only, and cleared when the server restarts.
• Early access: After twelve months without contact about your chosen topic, we review your registration. If there is no active arrangement about access, we delete it. You can also ask us to remove your details earlier. This review and removal are carried out manually.
• Cookie choices and Meta cookies: for the duration shown in the cookie banner, unless you clear them earlier.
• Data sent to Meta: kept under Meta's privacy policy. We do not store a copy of the event payload.
• Workbook and reading progress: in your browser until you clear them.
• Clients: if you become a client, we keep contract and invoicing records for the seven years that Dutch tax law requires.

15. Security

The website and its forms use encrypted connections (HTTPS). Our providers secure their own systems. No method of transmission or storage is completely secure. If a data breach occurs that the law requires us to report, we will inform the Dutch Data Protection Authority and, where required, you.

16. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you
• have inaccurate or incomplete data corrected
• have your data deleted
• restrict processing, or object to it, including direct marketing at any time
• receive your data in a portable format
• withdraw your consent at any time. Use Cookie settings for optional advertising measurement, the unsubscribe link for the newsletter, or email us about early access

To use any of these rights, email info@brandarchway.com. We may ask you to confirm your identity. We respond within one month. If a request is complex, the law allows us to extend that period, and we will tell you if we need to.

We do not make decisions about you with legal or similarly significant effects based solely on automated processing.

17. Other websites

This website links to other websites, such as our LinkedIn page. Their own privacy policies apply there.

18. Complaints

If you have a concern, please contact us first at info@brandarchway.com so we can help. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in your own country.

19. Changes to this policy

We update this policy when the website or the way we process personal data changes. The date at the top shows when it was last updated.

20. Contact

For any question about this policy or your personal data, contact us: