LEGAL
Privacy Policy
Effective from: 4 September 2026 · Version: 2.0 · Supersedes: the notice dated 13 February 2024
1. Who we are
BriX Consulting, s.r.o., Veľký Lapáš 840, 951 04 Veľký Lapáš, Slovakia, IČO 54 016 444, registered with the Commercial Register of the District Court Nitra, section Sro, insert No. 55187/N ("BriX", "we", "us"), is the controller of the personal data described here, within the meaning of Article 4(7) GDPR. Our full registered identity is on our About page.
Contact for all privacy matters: info@brix.consulting
Data Protection Officer
We are not required to appoint a Data Protection Officer under Article 37 GDPR and have not appointed one. Privacy enquiries are handled at info@brix.consulting.
2. Which law applies to you
We are established in the Slovak Republic, so the EU General Data Protection Regulation (2016/679) governs everything here, together with Slovak Act No. 18/2018 Coll. on the protection of personal data and Slovak Act No. 452/2021 Coll. on electronic communications.
If you are in the United Kingdom, the UK GDPR also applies to us, because the behavioural measurement described in section 5 involves analysing how visitors use this site. Your rights are exactly the same as everyone else's, set out in section 9, and you may complain to the UK Information Commissioner's Office as well as to the Slovak authority — both are named in section 10.
We apply one standard to every visitor, wherever you are: the GDPR standard, which is the highest of those in play. We do not treat UK or EU visitors differently from anyone else, and we do not detect or record which country you are in beyond the approximate location that ordinary analytics derives from an IP address.
We do not target the United States and are not subject to the California Consumer Privacy Act or the consumer privacy statutes of Colorado, Connecticut, Utah or Virginia — we meet none of their applicability thresholds.
3. What this notice covers
brix.consulting and its subdomains. Not covered: ai-readiness.dev, operated by BriX Consulting, s.r.o. and covered by its own privacy notice; services delivered under a signed agreement, governed by that agreement's privacy terms; and third-party sites we link to.
4. What we collect, why, and on what legal basis
4.1 Everyone who visits
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| IP address, browser and device type, operating system, referring URL, pages requested, timestamps (server logs) | Delivering the site, security, abuse prevention, diagnosing faults | Legitimate interests, Art. 6(1)(f) | kept by our hosting provider for a short operational period; Netlify does not publish a fixed retention period |
| Your cookie choice, when you made it, and which version of the list you answered | Honouring your choice, and being able to demonstrate it | Legal obligation, Art. 6(1)(c) read with Art. 7(1) | 182 days on your device. We also keep the record of the choice — the reference, the moment, the categories and the version — on our hosting provider's storage in the United States for the same period, so that we can show a choice was made. That record contains no IP address and no device information. |
Before you answer the banner, nothing at all is stored on your device — not even the cookie that remembers your answer, which is written only once you choose.
4.2 If you allow analytics
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
Google Analytics 4 identifiers (_ga, _ga_7583RTM6BF), pages viewed, session and interaction events, approximate location derived from IP | Understanding which content is read and where visitors come from | Consent, Art. 6(1)(a) GDPR and § 109(8) of Act 452/2021 | Cookies up to 2 years; in GA4 event data 2 months, user data 14 months, reset on new activity |
Behavioural insight signals (brix_tense, brix_visit), and the derived class sent to our own server — see section 5 | Measuring how the site serves different reasons for visiting | Consent, Art. 6(1)(a) GDPR and § 109(8) of Act 452/2021 | Cookie at most 180 days, score halves every 30 days; the aggregate we keep carries no link back to your session |
4.3 If you press play on a video or podcast
Some pages carry a player from YouTube (Google), Vimeo or Acast. None of them loads on its own. You see a button naming what it will load, and nothing is requested from the provider until you press it. Pressing it is your consent, for that one player.
When you press it, the provider receives your IP address, the address of the page, and your device details; if you are signed in to their service, it can connect the visit to your account. YouTube and Vimeo also set their own cookies. Acast, as measured on 3 September 2026, sets no storage — but it still receives your IP address and which episode you asked for.
Legal basis: consent, Art. 6(1)(a) GDPR and § 109(8) of Act 452/2021, for YouTube and Vimeo, which store and read information on your device. For Acast, where nothing is stored or read, § 109(8) does not apply and the basis for transmitting your IP address is your explicit request to play the episode — Art. 6(1)(a), given by the same press.
We are a joint controller with each provider for the collection and transmission of your data at the moment the player loads (CJEU, Fashion ID, C-40/17). We are not a controller for what any of them does afterwards. The essential terms are in the Cookie Notice.
4.4 If you contact us or request an assessment
| Form | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact form | Name, work email, company, topic, your message | Replying to you and, if it goes further, discussing an engagement | Steps prior to a contract at your request, Art. 6(1)(b); legitimate interests, Art. 6(1)(f), in answering business enquiries | 24 months from last contact |
| AI-Readiness Assessment request | First and last name, email, company, role, message | Preparing and running the assessment conversation you asked for | Art. 6(1)(b) and Art. 6(1)(f) as above | 24 months from last contact |
Both are handled and stored by Netlify (section 6). Where a request becomes an engagement, the data moves into our contract records and is kept under Slovak accounting and tax law (Art. 6(1)(c)), generally 10 years.
4.5 If you subscribe to the newsletter
Double opt-in: you enter your email, Brevo sends you a confirmation link, and you join the list only when you click it. We keep a record of both steps.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address, confirmation timestamp and IP, opens and clicks | Sending one email per new episode; measuring whether it is read | Consent, Art. 6(1)(a) GDPR and § 116 of Act 452/2021 | Until you unsubscribe. The record proving consent is kept 3 years after that, under Art. 7(1) |
Every email carries a one-click unsubscribe link. Leaving is free and immediate.
5. The behavioural insight layer
We want to be direct about this, because it is the least obvious thing this site does.
What it is. If you allow analytics, this site records signals about how you move through it — which sections you read, how long you stay, in what order, when you return. From those it derives a score representing what we infer you came for, stored in a first-party cookie named brix_tense on your own device for at most 180 days, alongside the moment it was last touched, a name for the current sitting, and up to 64 short hashes that stop one behaviour being counted twice in that sitting. The hashes belong to the sitting and are dropped when it changes. The score halves every 30 days, so recent reading always outweighs old reading. brix_visit holds one number: when your visit's clock started.
Where it goes. The cookie stays on your device. The class derived from it — a single label such as "neutral" — together with the name of the signal that produced it — such as "read.citation_follow" — is sent to our own server, so that we can count how many visits and signals of each kind a page receives. It is not sent to Google, to any advertising network, or to any other third party. What we keep on our side is a count, carrying no identifier that would link it back to your session, your cookie or you.
Until 4 September 2026 this class was transmitted to Google Analytics as an event parameter, and until the same day the name of each signal was transmitted as the event name. Neither is any longer. Nothing derived from them was ever retained there — the parameters were never registered as custom dimensions and the raw export was switched off — but they should not have been sent, and the transmission has been stopped.
Why we do it. BriX builds behaviour-measurement systems for a living, and we use the same approach on our own site to see whether what we publish reaches people with different reasons for being here.
What it does not do. It does not change what you see. No page reads the score back to decide what to show you. Nothing about you is granted, refused, priced or ranked on this basis, and the score is never attached to your name or email — including when you later fill in a form.
Is this automated decision-making? It is profiling within the meaning of Article 4(4) GDPR. It does not produce legal effects concerning you or similarly significantly affect you, so Article 22 does not apply.
Your control. It runs only if you allow analytics. Use Cookie settings in the footer of any page to withdraw: the score and the visit cookie are deleted immediately. You may also object or ask for erasure under section 9.
6. Who receives your data
We do not sell personal data and we do not share it for advertising.
| Recipient | Role | Where | What it receives |
|---|---|---|---|
| Netlify, Inc. | Processor — hosting and form handling | United States | Server logs; all form submissions; the record of your cookie choice (reference, time, categories, version — no IP address, no device information) |
| Sendinblue SAS, trading as Brevo, 17 rue Salneuve, 75017 Paris, France | Processor — newsletter delivery | France, with sub-processors in the United States and India | Subscriber email, confirmation record, engagement data |
| Google Ireland Limited | Processor — Google Analytics (Data Processing Terms accepted 29 August 2021) | Ireland and United States | Analytics events, GA4 identifiers, IP-derived approximate location. Not the behavioural class or score. |
| Google Ireland Limited / Google LLC (YouTube), Vimeo, Inc., Acast AB (publ), Kungsgatan 28, 111 35 Stockholm, Sweden | Joint controllers with us at the moment a player loads; independent controllers thereafter | Ireland / United States / Sweden | IP address, page URL, device data, the episode or video requested, and account identity if you are signed in |
The behavioural class described in section 5 goes to no one outside BriX.
We may also disclose to professional advisers, auditors and public authorities where legally required, and to an acquirer in a merger or sale of the business.
7. Transfers outside the EEA and the UK
- United States — Netlify, Inc. and Google LLC are certified under the EU-U.S. Data Privacy Framework. The record of your cookie choice is held on Netlify's storage in the United States under that certification. Sendinblue SAS (Brevo) is not certified under the Data Privacy Framework; transfers to its United States sub-processors rely on the Commission's Standard Contractual Clauses with supplementary measures.
- India — no adequacy decision; Brevo's sub-processors there rely on Standard Contractual Clauses.
- Where UK data protection law applies, transfers rely on the UK International Data Transfer Addendum to the Standard Contractual Clauses, or on the UK Extension to the Data Privacy Framework where the recipient is certified under it.
Ask at info@brix.consulting for a copy of the safeguards.
8. How long we keep things
The periods are in the section 4 tables. Where none is stated we keep data only as long as the purpose needs, then delete or irreversibly anonymise it. Records required by Slovak accounting and tax law are kept for the statutory period, generally 10 years.
9. Your rights
You have the right to access your data and get a copy; rectify it; erase it where Article 17 applies; restrict processing where Article 18 applies; portability for data you gave us that we process on consent or contract; object to processing based on our legitimate interests on grounds relating to your situation, and to object to direct marketing at any time without giving reasons; and withdraw consent at any time.
Withdrawal is as easy as giving it: Cookie settings in the footer of every page for cookies, the unsubscribe link in any email for the newsletter. Withdrawal does not affect what was lawful before it.
Write to info@brix.consulting. We respond within one month, extendable by two further months for complex requests, in which case we tell you within the first month and say why. It is free; we may charge or refuse only where a request is manifestly unfounded or excessive, and we will explain why. We may need to verify your identity, will ask only for what is necessary, and delete anything given for verification once it is done.
10. Complaints
Tell us first. If you think we have handled your personal data badly, write to info@brix.consulting or use our contact form, marking it as a privacy complaint. We will acknowledge your complaint within 30 days and tell you what we are doing about it. We would rather fix something than have you find out from a regulator that we did not.
You do not have to come to us first, and nothing here limits your right to go straight to a supervisory authority:
Úrad na ochranu osobných údajov Slovenskej republiky Hraničná 12, 820 07 Bratislava 27, Slovakia · +421 2 32 31 32 14 · dataprotection.gov.sk
If you are in the United Kingdom: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · ico.org.uk
You may also complain to the supervisory authority of your own EU Member State of residence or place of work.
11. Cookies
See the Cookie Notice for the full list and how to change your choice.
12. Children
This site is addressed to businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. Write to info@brix.consulting and we will delete it.
13. Changes
We update this notice when what we do changes. Material changes appear here with a new version number and effective date, and — where the change affects consent-based processing — by asking again through the cookie banner.