Privacy Policy

Data controller

The controller of your personal data is the company that publishes this site, whose full identity appears in our legal notice:

• Company : BEYOND THE BRACKETS — SASU
• Registration : RCS Paris B 852 264 035 — SIRET 852 264 035 00035
• Registered office : 66 avenue des Champs-Élysées, 75008 Paris, France
• Legal representative and publication director : Loïc Guillebeau
• Data protection contact : contact@beyond-the-brackets.com

Given its size and the nature of its activities, Beyond The Brackets is not required to appoint a Data Protection Officer. Any question about your data is handled directly by management, at the address above.

Data we collect

We only collect the data required for the purposes described below. We never ask for special categories of data within the meaning of Article 9 GDPR.

Purposes, legal bases and retention periods

Each processing activity relies on a specific legal basis and a limited retention period. Once that period ends, the data is deleted or anonymised.

Recipients and processors

Your data is accessible to the Beyond The Brackets team, on a need-to-know basis, and to the technical providers below, who act as processors and are bound by contract under article 28 of the GDPR. We do not sell or rent your data. The one exception worth naming concerns advertising trackers: when you accept them, browsing identifiers are passed to Google, to OpenAI and to Meta, which California law calls "sharing" — the section for US residents sets that out in detail.

Card details never pass through our servers and are never stored by Beyond The Brackets: they are handled directly by Stripe, a PCI-DSS Level 1 certified provider.

Your data may also be shared with our advisers (accountant, lawyer) or with administrative and judicial authorities where the law requires it.

International transfers

Several of our processors are established in the United States, and Beyond The Brackets operates from Paris and New York. Every transfer outside the European Economic Area therefore relies on one of the safeguards in Chapter V of the GDPR: the recipient's certification under the EU-U.S. Data Privacy Framework where it exists, and otherwise the European Commission's standard contractual clauses of 4 June 2021. Those clauses are backed by technical measures — encryption in transit and at rest, minimising what is transmitted — and by a transfer impact assessment where the recipient is subject to surveillance legislation. For the United Kingdom, the UK International Data Transfer Addendum is added to the standard clauses; for Switzerland, the clauses are used in the version recognised by the FDPIC. A copy of these safeguards is available on request.

Your rights, depending on where you live

Data protection does not follow the same rules everywhere. Rather than applying the lowest common denominator, we grant every visitor the GDPR baseline — access, rectification, erasure, objection — and add the specific rights your local law provides. The purposes table above applies in every case.

United States residents (California and comparable states)

Beyond The Brackets does not currently meet the thresholds that make the California Consumer Privacy Act apply. We have nonetheless chosen to extend the rights below to all US residents, whether they live in California, Colorado, Connecticut, Virginia, Utah, Texas or elsewhere. What follows therefore describes a commitment, not an obligation we are under.

Categories of personal information collected in the last twelve months

Sensitive personal information

We collect no category of sensitive personal information within the meaning of the CPRA — no social security number, no health data, no biometrics, no contents of private communications, no sexual orientation, and no racial, ethnic or religious background. The right to limit the use of sensitive personal information therefore has nothing to apply to here.

Sale and sharing

We do not sell personal information and never have — including the personal information of anyone under sixteen. However, when you accept advertising cookies, our Google Ads tags, the OpenAI Ads pixel and the Meta pixel pass identifiers and browsing data to those partners: California law calls that "sharing" for cross-context behavioural advertising. We would rather say so than hide behind a bare "we do not sell your data".

Opting out of sale or sharing

Two ways, both free and immediate. Turn on the Global Privacy Control signal in your browser: we honour it automatically, with nothing for you to send us. Or use the "Manage cookies" control in the footer to switch the Advertising category off. No sign-up and no account are required.

Your rights

• Know which categories of information we collect, where they come from, why we process them and who we share them with.
• Obtain a copy of the specific pieces of information we hold about you.
• Ask us to correct inaccurate information.
• Ask us to delete your information, subject to the exceptions the law allows — our accounting obligations in particular.
• Opt out of the sharing of your information for cross-context behavioural advertising.
• Suffer no discrimination for exercising any of these rights: no different price, no degraded service, no refusal to answer.

How to exercise these rights

Write to contact@beyond-the-brackets.com stating the state you live in and what you are asking for. We acknowledge within ten business days and answer within forty-five days, extendable once by a further forty-five days if your request is complex — we would tell you if so. We must be able to verify your identity to a reasonable degree before releasing data: we do that by matching the information you give us against what we already hold, and we never ask for identity documents by email.

Authorised agent

You may appoint an authorised agent to act for you. We will ask the agent for written proof of authority and, unless there is a power of attorney, for direct confirmation from you.

California Shine the Light

Section 1798.83 of the California Civil Code lets you request the list of personal information disclosed to third parties for their direct marketing purposes. We disclose none for that purpose, so there is nothing to report — and we will confirm that to you in writing on request.

Data security

We implement technical and organisational measures proportionate to the risk:

• HTTPS/TLS encryption across the entire site.
• Passwords stored as irreversible hashes, never in plain text.
• Data access restricted to the people who need it, with individual authentication.
• Regular, encrypted database backups.
• Anti-spam protection and rate limiting on public forms.
• In the event of a data breach likely to result in a high risk to your rights, you would be informed without undue delay, in accordance with Article 34 GDPR.

Cookies and trackers

The site sets cookies that are strictly necessary for it to work, plus audience measurement and marketing cookies that require your prior consent. You can change your choice at any time.

Your rights

Under Articles 15 to 22 GDPR, you have the following rights over your personal data:

To exercise these rights, write to contact@beyond-the-brackets.com or by post to 66 avenue des Champs-Élysées, 75008 Paris, France. We reply within one month of receiving your request. Proof of identity may be requested where there is reasonable doubt about who you are.

If, after contacting us, you believe your rights have not been respected, you may refer the matter to the competent supervisory authority: the CNIL in France (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr), the Information Commissioner's Office in the United Kingdom, the FDPIC in Switzerland, the Office of the Privacy Commissioner in Canada, the ANPD in Brazil, or the authority in your country of residence. In the United States the route depends on your state: in California, the California Privacy Protection Agency and the State Attorney General.

Automated decision-making

The online simulator and diagnostic produce an indicative estimate based on your answers. These tools do not constitute automated decision-making producing legal effects concerning you within the meaning of Article 22 GDPR: every commercial proposal goes through a human conversation.

Minors

Our services are aimed at professionals and are not intended for minors. We do not knowingly collect data about anyone under fifteen in France — raised to sixteen in some EU member states — or under thirteen in the United States, where the Children's Online Privacy Protection Act applies. If you find that a minor has given us data, tell us: it will be deleted without delay and without condition.

Changes to this policy

This policy may be updated to reflect changes in our services or in the applicable regulations. The date of the latest update appears at the top of this page. If a material change affects your rights, we will notify you by email or through a notice on the site.

Contact us

A question about this policy or about how we handle your data?