Privacy Policy

Effective: January 2026

This Privacy Policy explains what personal data is collected when you use the website located at bramol.com (the "Website"), and how such personal data is processed by us.

BY USING THE WEBSITE, YOU CONFIRM THAT YOU HAVE READ, UNDERSTOOD, AND AGREED TO THIS PRIVACY POLICY, AND THAT YOU ARE AT LEAST 18 YEARS OF AGE (OR HAVE HAD YOUR PARENT OR GUARDIAN READ AND AGREE TO THIS POLICY ON YOUR BEHALF). If you do not agree, or are unable to make this confirmation, you must not use the Website. In such case, you must: (a) contact us and request deletion of any data already collected; and (b) leave the Website immediately.

1. Personal Data Controller

Bramol Limited, a company incorporated under the laws of the Republic of Cyprus, having its registered office at 26 Stavrou Street, Strovolos 2034, Nicosia, Cyprus, is the controller of your personal data collected through the Website.

2. Definitions

"GDPR" means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

"EEA" includes all current member states of the European Union and the European Free Trade Association. For the purposes of this Policy, the EEA shall also include the United Kingdom of Great Britain and Northern Ireland.

"Process" or "Processing," in respect of personal data, means any operation or set of operations performed on personal data, including collection, recording, storage, use, disclosure, or erasure.

3. Categories of Personal Data We Collect

3.1 Data You Provide Voluntarily

If you contact us via email or any contact form on the Website, you may provide your name and email address. We use this data solely to respond to your enquiries.

3.2 Data Collected Automatically

Referral data. We collect data about the referring application or URL that directed you to the Website (i.e., the app or webpage you were using when you navigated to our site).

Device and technical data. We collect data from your device, including: language settings, IP address, time zone, device type and model, operating system, Internet service provider, mobile carrier, and hardware identifiers.

Usage data. We record how you interact with the Website, including pages viewed, features and content accessed, session frequency, and duration of visits.

Cookies and similar technologies. We use cookies and comparable tracking technologies to recognise visitors, remember preferences, and improve the browsing experience. Further details are set out in Section 12 (Cookie Policy) below.

4. Purposes of Processing

4.1 To Provide and Operate the Website

We process personal data to enable the proper functioning of the Website and to identify and resolve technical issues. We use Amazon Web Services (AWS) for hosting and backend infrastructure. For further information, please refer to the AWS Privacy Policy.

4.2 To Provide Customer Support

We process personal data to respond to your requests, enquiries, and communications regarding the Website or our services.

4.3 To Communicate With You

We may use contact information you have provided to communicate with you regarding your use of the Website, including sending notices about updates to our Terms and this Privacy Policy.

4.4 To Enforce Our Terms and Prevent Fraud

We process personal data to enforce our Terms and Conditions of Use, to detect, investigate, and prevent fraudulent activity and abuse of the Website. As a result of such processing, we may share your information with law enforcement or other relevant authorities where required.

4.5 To Comply With Legal Obligations

We may process, use, or disclose your data when required to do so by applicable law, regulation, or lawful request from a competent authority.

5. Legal Bases for Processing (EEA Users)

This section applies exclusively to users located in the EEA. We process your personal data under the following legal bases:

Performance of a contract. We rely on this basis to provide the Website, customise your experience, provide customer support, and communicate with you regarding your use of the Website.

Legitimate interests. We rely on our legitimate interests to communicate with you regarding the Website, to enforce our Terms and prevent fraud, and to process advertising performance data (including data obtained via the Meta Marketing API and stored in Google BigQuery) for internal advertising analytics and campaign optimisation. Our legitimate interests in this respect are: protecting the legal rights of the Company, preventing and addressing fraudulent or unauthorised use of the Website, ensuring compliance with our Terms, and conducting internal business analytics to improve marketing efficiency.

Legal obligation. We rely on this basis where Processing is necessary to comply with a legal obligation to which the Company is subject.

6. Who We Share Your Personal Data With

We share information with third parties that assist us in operating, providing, and improving the Website. The types of third parties with whom we share personal data include:

6.1 Service Providers

We share personal data with third-party service providers engaged to perform functions on our behalf, including:

• Cloud infrastructure and hosting. We use Amazon Web Services (Amazon.com, Inc.) for hosting, data storage, and backend infrastructure supporting the Website.
• Analytics and data warehouse. We use Google BigQuery (Google LLC) to store and analyse advertising performance data obtained from the Meta advertising platform (Meta Platforms, Inc.). This includes campaign metrics such as spend, impressions, and ad delivery data, processed for internal marketing analytics and campaign optimisation purposes. This data does not include personal data of individual visitors to this Website.
• Communications services. We may use third-party communication tools to deliver notifications and correspondence.

All service providers are required to process personal data in accordance with our instructions and applicable data protection law.

6.2 Law Enforcement Agencies and Public Authorities

We may disclose personal data to law enforcement agencies, regulatory bodies, courts, and other public authorities where we are required to do so by applicable law, court order, or other legal process, or where disclosure is necessary to protect the rights, safety, or property of the Company, its users, or third parties.

6.3 Corporate Transactions

In the event of a merger, acquisition, restructuring, sale of assets, or other corporate transaction involving the Company, personal data may be transferred as part of that transaction. We will ensure that any successor entity is bound by obligations no less protective than those set out in this Privacy Policy.

7. Your Privacy Rights

Subject to applicable law, you have the following rights in relation to your personal data held by us:

• Access. You may request confirmation of whether we process personal data about you, and, if so, obtain a copy of that data.
• Rectification. You may request correction of inaccurate or incomplete personal data.
• Erasure. You may request deletion of your personal data where there is no compelling reason for its continued processing. We will honour such requests subject to any legal obligations requiring retention.
• Restriction. You may request that we restrict the processing of your personal data in certain circumstances.
• Objection. You may object to the processing of your personal data where we rely on legitimate interests as the legal basis for processing.

Additional rights for EEA-based users:

• Data portability. You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to request its transmission to another controller.
• Withdrawal of consent. Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right to lodge a complaint. You have the right to lodge a complaint with the competent data protection supervisory authority in the EU or EEA member state of your habitual residence, place of work, or place of the alleged infringement.

To exercise any of the above rights, please contact us using the contact information provided on our website.

8. Age Limitation

The Website is not directed to, and we do not knowingly collect personal data from, persons under 18 years of age. If you become aware that a person under the age of 18 has provided us with personal data without appropriate parental or guardian consent, please contact us immediately so that we may take steps to delete such data.

9. International Data Transfers

We operate internationally and may transfer personal data to countries or territories other than the country in which the data was originally collected. Where such transfers occur to countries that do not provide a level of data protection equivalent to that in your jurisdiction, we implement appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, adequacy decisions, or other legally recognised transfer mechanisms, to ensure that your personal data remains protected in accordance with this Privacy Policy and applicable law.

10. California Privacy Rights

If you are a California resident, California's "Shine the Light" law (California Civil Code § 1798.83) permits you to request, once per calendar year, information about the categories of personal information we disclosed to third parties for their direct marketing purposes during the preceding calendar year, and the names and addresses of those third parties.

To make such a request, please send an email to the contact address available on our website with the subject line "Request for California Privacy Information" and include your state of residence in the body of your message. We will provide the requested information to you at your email address in response, to the extent required by law.

California residents may also have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including rights to know, delete, correct, and opt out of the sale or sharing of personal information. To exercise any such rights, please contact us using the information on our website.

11. Data Retention

We retain personal data for as long as is reasonably necessary to fulfil the purposes described in this Privacy Policy, including providing the Website and its associated services. We will also retain and use your personal data to the extent necessary to comply with our legal obligations, resolve disputes, enforce our agreements, and meet applicable regulatory requirements. When personal data is no longer needed, we take reasonable steps to securely delete or anonymise it.

12. Cookie Policy

This section explains how we use cookies and similar tracking technologies on the Website, what they are, why we use them, and how you can control them.

12.1 What Are Cookies

A cookie is a small text file placed onto your device (computer, smartphone, tablet, or other electronic device) when you visit our Website. Cookies serve various purposes, such as storing your language preference, remembering your consent choices, or enabling core website functionality. Cookies set by us directly are called first-party cookies; cookies set by third-party providers on our behalf are called third-party cookies.

12.2 Types of Cookies

Session cookies expire automatically when you close your browser. They do not persist on your device and are used to link your actions during a single browsing session.

Persistent cookies remain on your device for a defined period or until you delete them manually. They enable the Website to recognise you on return visits and remember your preferences across sessions.

12.3 Similar Technologies

Web beacons (pixel tags). Small, transparent image files embedded in web pages or emails. They communicate with our servers when loaded, enabling us to collect technical information about your device and track certain interactions, such as whether an email has been opened.

HTML5 local storage. Browser-side storage that functions similarly to cookies but can hold greater volumes of data without requiring server communication. Used to remember your preferences and session state.

Fingerprinting. A technique that combines device configuration data (such as browser type, installed fonts, screen resolution, and time zone) to generate a unique device identifier for analytics and fraud prevention purposes.

Device identifiers. Numeric or alphanumeric identifiers unique to your device, used to recognise you across sessions for analytics and service improvement purposes.

12.4 Categories of Cookies We Use

The following table describes the categories of cookies currently in use on the Website:

12.5 Managing Your Cookie Preferences

Consent management tool. When you first visit the Website, you will be presented with a cookie banner allowing you to accept all cookies or limit your consent to strictly necessary cookies only. You may update your preference at any time by refreshing the page and responding to the banner, or by clearing your browser cookies and revisiting the Website.

Browser settings. Most browsers allow you to refuse, block, or delete cookies through their settings. The methods vary between browsers and versions; up-to-date instructions are available through your browser's help documentation or at aboutcookies.org. Please note that disabling all cookies may impair the functionality of this and other websites.

Opt-out of interest-based advertising. If applicable, you may opt out of interest-based advertising from participating companies via the following industry opt-out tools:

• Network Advertising Initiative
• Digital Advertising Alliance (US)
• European Digital Advertising Alliance

13. Do Not Track

Except as otherwise described in this Privacy Policy, the Website does not currently respond to "Do Not Track" browser signals. To determine whether any third-party services we use honour such signals, please consult their respective privacy policies.

14. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes, we will notify you by available means — which may include a prominent notice on the Website or communication to the email address associated with your account, where applicable — and will update the "Effective" date at the top of this Policy. Your continued use of the Website following the effective date of any amended Policy constitutes your acceptance of the changes.

15. Contact

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, including requests to exercise your privacy rights, please contact us using the contact information provided on our website.