Privacy policy
Last updated — 30 July 2026
This document sets out the personal data processed when you visit ecombrandagency.com or send an enquiry through the contact form. It is written to be read, not to be relied on in an argument.
Working version prepared for launch. It should be reviewed and approved by legal counsel before being treated as final.
Data controller
- Controller
- SPOTIZY LLC (trading as Ecom Brand Agency)
- Registered office
- 2915 Ogletown Rd, Newark, DE 19713, USA
- Contact
- contact@ecombrandagency.com
- Point of contact
- Anthony T.
SPOTIZY LLC is established outside the European Union but offers services to companies within it. The General Data Protection Regulation (GDPR) therefore applies to the processing described below.
Data collected
Nothing is collected without your knowledge. Only two situations give rise to collection.
Contact form — the data you enter yourself: name, work email address, company name, website address, type of business, annual revenue range, the content of your message, and your optional newsletter subscription.
Audience measurement — only if you have consented: aggregate traffic statistics (pages viewed, country, device type, referring page). These are configured without cookies and do not identify you.
To protect the form against automated submissions, the sender’s IP address is held in memory for a short period, with no durable storage.
Purposes and lawful bases
- Responding to your enquiry
- Lawful basis: steps taken at your request prior to entering a contract (Article 6(1)(b) GDPR).
- Protecting the form from automated submissions
- Lawful basis: legitimate interest in keeping the service working (Article 6(1)(f)).
- Measuring site audience
- Lawful basis: your consent, given through the banner and withdrawable at any time (Article 6(1)(a)).
- Sending the analysis note
- Lawful basis: your consent, given via an unticked box and withdrawable in one click (Article 6(1)(a)).
Your data is never sold, rented, used for unsolicited outreach, or passed to a data broker.
Recipients and processors
The data is accessible only to the controller. It passes through the following technical providers, acting as processors:
- Vercel Inc. (USA) — site hosting and form execution.
- Resend (USA) — delivery of contact form emails and the acknowledgement message.
- The business email provider used to receive and store enquiries.
These transfers outside the European Union are covered by the European Commission’s standard contractual clauses, together with each provider’s own safeguards.
Retention periods
- Enquiry that did not lead to an engagement
- Three years from the last exchange.
- Enquiry that led to a contract
- Duration of the contract, then ten years for accounting and evidential purposes.
- Newsletter subscription
- Until you withdraw consent.
- Rate-limiting IP address
- A few minutes, in memory only.
- Cookie consent choice
- Six months.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent at any time where processing rests on it.
To exercise them, write to contact@ecombrandagency.com. You will receive a reply within one month. No identity check will be requested beyond what is strictly necessary to avoid disclosing your data to someone else.
If the response does not satisfy you, you may lodge a complaint with the supervisory authority in your country of residence — in France, the Commission nationale de l’informatique et des libertés (CNIL).
Security
The site is served exclusively over HTTPS. Form data is transmitted encrypted and is not written to a database: it is delivered by email and then held in the controller’s mailbox, which is protected by two-factor authentication.
No special category data within the meaning of Article 9 GDPR is requested. Please do not include any in the free-text field.
Changes
This policy may change to reflect developments in the site or the law. The last updated date appears at the top of the page. Any material change will be flagged on the site.