Privacy Policy
Personal Data Processing Information
1. Data Controller
KREDO Marketing
Flurstr. 74
Düsseldorf, Germany
VAT/ST-ID: DE 369065512
Managing Director: Alessandro De Vita
Privacy Contact:
Email: privacy@kredo-marketing.com
Website: kredo-marketing.com
2. Data Collected
Brand Grade collects the following personal data when you complete the assessment:
| Data Type | Examples | Purpose |
|---|---|---|
| Identification data | Name, Email, Company | Sending results, post-assessment contact |
| Company data | Industry, Target (B2B/B2C), Size | Customizing questions and insights |
| Assessment responses | Responses to 5 dimensions (DECODE, DEFINE, DESIGN, DEPLOY, DEVELOP) | Score calculation, AI insight generation |
| Technical data | Browser localStorage (temporary) | Technical functioning of the assessment |
3. Purpose and Legal Basis of Processing
3.1 Assessment Service Provision (Art. 6(1)(b) GDPR)
- Calculating your brand score across 5 dimensions
- Generating personalized insights via AI (Claude by Anthropic)
- Sending complete results via email
Legal basis: Contract performance (service requested by the user)
3.2 Post-Assessment Contact (Art. 6(1)(a) GDPR)
- Follow-up for in-depth results analysis
- Strategic call proposal (30 minutes)
- Support in implementing identified priorities
Legal basis: Explicit consent (checkbox during setup)
3.3 Marketing (Art. 6(1)(a) GDPR) - OPTIONAL
- Sending communications about KREDO Marketing services
- Newsletter on brand strategy and identity
- Event and workshop invitations
Legal basis: Separate explicit consent (optional checkbox)
4. Data Sharing with Third Parties
4.1 Google Forms (Google LLC)
Your data is sent to Google Forms for lead registration.
- Data shared: Name, Email, Company, Industry, Scores
- Purpose: Lead management and internal CRM
- Location: USA (protected by EU-US Adequacy Decision)
- Google Privacy Policy: policies.google.com/privacy
4.2 Anthropic (Claude AI)
Your responses are processed by Claude AI to generate personalized insights.
- Data shared: Assessment responses, company data (industry, target)
- Purpose: AI insight generation about your brand
- Location: USA
- Anthropic Privacy Policy: anthropic.com/privacy
- Note: Data is NOT used for AI model training
5. Retention Period
| Data Type | Retention Period | Reason |
|---|---|---|
| Contact data and results | 24 months from last contact | Follow-up and ongoing support |
| Marketing consent (if provided) | Until revoked or 24 months of inactivity | Marketing list management |
| Browser localStorage | Until assessment completion or browser closure | Technical functioning |
| Data in Google Forms | 24 months | CRM and relationship management |
Automatic deletion: After 24 months of inactivity (no interaction or response), your data is automatically deleted from our systems.
6. Your Rights (GDPR Arts. 15-22)
You have the following rights regarding your personal data:
- Right of access (Art. 15): Receive a copy of all data we have about you
- Right to rectification (Art. 16): Correct inaccurate or incomplete data
- Right to erasure (Art. 17): Request immediate deletion of your data
- Right to restriction (Art. 18): Restrict processing in certain circumstances
- Right to data portability (Art. 20): Receive your data in structured format (JSON)
- Right to object (Art. 21): Object to processing for marketing purposes
- Right to withdraw consent (Art. 7(3)): Revoke consent at any time
How to Exercise Your Rights
Send a request to: privacy@kredo-marketing.com
We will respond within 30 days of your request.
What to include in your request:
- Name and email used in the assessment
- Type of request (access, deletion, rectification, etc.)
- Optional ID document (for identity verification)
Right to Lodge a Complaint
If you believe the processing of your data violates GDPR, you can file a complaint with the competent supervisory authority:
- Germany (KREDO location): Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI) - bfdi.bund.de
- Italy (if Italian user): Garante per la Protezione dei Dati Personali - garanteprivacy.it
7. Data Security
KREDO Marketing implements adequate technical and organizational measures to protect your personal data:
Technical Measures
- TLS/SSL encryption for all communications (HTTPS)
- API keys protected via environment variables (no hardcoding)
- Data access limited to authorized personnel
- Regular encrypted backups
Organizational Measures
- Access policies based on "need-to-know" principle
- Staff training on GDPR and privacy
- Data Processing Agreements (DPA) with third-party providers
- Security incident response procedures (data breach)
8. Cookies and Tracking Technologies
Brand Grade does NOT use profiling or tracking cookies.
localStorage (Technically Necessary)
We exclusively use browser localStorage to:
- Temporarily save responses during the assessment
- Maintain navigation between the 5 dimensions
- Calculate the final score
Legal basis: GDPR Recital 30 - "Strictly necessary" for the functioning of the requested service.
Duration: Data in localStorage is automatically deleted when you close your browser or can be manually deleted from browser settings.
9. Privacy Policy Changes
This Privacy Policy may be updated to reflect regulatory or operational changes. In case of substantial changes, we will inform you via email (if we have your address).
Last update date: December 17, 2024
Version: 1.0
10. Questions and Contacts
For any questions about this Privacy Policy or the processing of your data:
Privacy Contacts
Email: privacy@kredo-marketing.com
Address: KREDO Marketing, Flurstr. 74, Düsseldorf, Germany
Website: kredo-marketing.com
We respond to all requests within 30 business days.