GDPR Compliance Statement

Last Updated: January 15, 2026

Our Commitment to GDPR

brave-leaf is committed to protecting the personal data of individuals in accordance with the General Data Protection Regulation (GDPR). This statement outlines our compliance practices and your rights under GDPR.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you submit consultation requests, you provide explicit consent for us to process your contact information
• Contractual Necessity: Processing is necessary to deliver the consulting services you request
• Legitimate Interests: We process data to improve our services and website functionality, provided this does not override your fundamental rights
• Legal Obligation: We retain certain records to comply with applicable business and tax regulations

Data Controller Information

brave-leaf acts as the data controller for personal information collected through our website and services. Our contact information for data protection inquiries is: [email protected]

Your GDPR Rights

Under GDPR, you have the following rights:

• Right of Access: You may request a copy of the personal data we hold about you
• Right to Rectification: You may request correction of inaccurate or incomplete data
• Right to Erasure: You may request deletion of your personal data, subject to legal retention requirements
• Right to Restriction: You may request that we limit how we use your data
• Right to Data Portability: You may request your data in a structured, machine-readable format
• Right to Object: You may object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected] with your request. We will respond within 30 days. You may be required to verify your identity before we process certain requests.

Data Transfers

We do not routinely transfer personal data outside the European Economic Area. If such transfers become necessary, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

Data Security Measures

We implement technical and organizational security measures including:

• Encryption of data in transit and at rest
• Access controls limiting data access to authorized personnel
• Regular security assessments and updates
• Incident response procedures for potential data breaches

Data Breach Notification

In the event of a data breach affecting your personal information, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay if the breach poses a high risk to your rights and freedoms.

Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware of such collection, we will delete the information promptly.

Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.

Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe our processing of your personal data violates GDPR. A list of supervisory authorities is available at: https://edpb.europa.eu/about-edpb/board/members_en

Contact for Data Protection Matters

For questions or concerns regarding GDPR compliance or data protection practices, contact us at: [email protected]