We hold very little about you, and this page says exactly what. If you joined the email list, we have your email address and the trade or surface type you picked. If you are a creator whose footage we feature, we have your handle and the message where you gave permission. There is no analytics on this site, no advertising pixel and no cookie banner, because there is nothing to consent to. We do not sell your data and we never will.
The data controller for BROUGHT BACK is:
Andre Blunt Korlátolt Felelősségű Társaság (Andre Blunt Kft)
Registered seat: 1085 Budapest, József körút 69. Fsz. 1. ajtó, Hungary
Company registration number: 01-09-451918
EU VAT number: HU32967656
Hungarian tax number: 32967656-2-42
Privacy contact: hello@broughtbackhq.com
Being the controller means we decide why and how your personal data is processed, and we answer for it. Andre Blunt Kft is established in Hungary, so the General Data Protection Regulation (GDPR) and Hungarian data protection law apply to everything described here. Because a meaningful share of our audience is in the United Kingdom, the UK GDPR applies to that part of what we do, and this policy is written to satisfy both.
We have not appointed a data protection officer. EU and Hungarian law do not require one at our scale. Privacy questions go to hello@broughtbackhq.com and reach us directly.
Three things:
It also covers the Meta app we use to publish to our own Instagram account and to read the comments and messages on it. That app is registered to Andre Blunt Kft, it connects to one account, ours, and it does not read anyone else's account or collect anything about you beyond what is described on this page.
Instagram and TikTok are not ours. They run their own platforms and decide their own handling of your data as controllers in their own right. When you are inside their apps, their policies apply to you as well as this one. Nothing we write here can change what they do. Read Instagram's privacy policy and TikTok's privacy policy if you want to know what that side looks like.
That is the whole list. We do not ask for your name, your phone number, your address or your company. We ask for the trade or surface type for one honest reason: so that what we send you matches the work you actually do, instead of sending everyone everything. You can leave it blank and still join.
We approach creators whose work we would like to feature. When we do, we keep a short record: your public handle, a link to the post we asked about, the date we asked, and whether you said yes, said no, or did not reply. If you say no or ask us not to contact you again, we keep the handle and that fact, and nothing else, precisely so that we do not approach you a second time.
Your comment and your handle are held by the platform and are visible to us there. We read comments, we reply to some, and we hide or delete abuse. We do not copy comments into any list of our own and we do not add commenters to the email list.
To deliver this site at all, our hosting provider necessarily processes technical data about your connection, such as your IP address and your browser user agent, in its own operational logs. We do not run any analytics over it, we do not build a profile from it, and we do not link it to anything else on this page.
Under the GDPR every use of your data needs a legal basis. Here is ours, purpose by purpose.
Send you the guide or planner you asked for, and the emails you signed up to receive
You asked for it. That is the whole reason we have your address.
Article 6(1)(a), your consent
Use the trade or surface type you gave us to decide which of our emails you get
So a homeowner is not sent a trade newsletter and a plasterer is not sent paving. You gave it for that purpose at signup.
Article 6(1)(a), your consent
Keep a record that you unsubscribed, so we cannot email you again by accident
Honouring an unsubscribe properly requires remembering it. The suppression record is what stops a later import putting you back on the list.
Article 6(1)(c), legal obligation, and Article 6(1)(f), legitimate interest
Approach a creator by direct message to ask permission to feature their work
It is how the page is made. We contact business accounts about work they published publicly, once, and we take no for an answer.
Article 6(1)(f), our legitimate interest in sourcing and licensing footage
Publish a clip with a credit to the creator's handle on the frame and in the caption
Because they said yes to exactly that, and a credit without a handle is not a credit. Consent is the basis, which is why it can be withdrawn at any time under section 6.
Article 6(1)(a), the creator's consent
Keep the message thread where permission was given
It is the only proof that we had the right to publish. Without it we cannot answer a rights complaint, and neither can the creator.
Article 6(1)(f), our legitimate interest in establishing, exercising and defending legal claims
Keep a note that someone declined or asked not to be contacted
So we do not approach them again. Deleting the record is what would cause the second message.
Article 6(1)(f), our legitimate interest in respecting a refusal
Read, reply to and moderate comments and messages on our posts
To answer people, and to remove abuse from under someone else's work.
Article 6(1)(f), our legitimate interest in running the account
Answer you when you write to us
To reply.
Article 6(1)(f), our legitimate interest in answering people who contact us
Keep the site up and protect it from abuse
Security and delivery.
Article 6(1)(f), our legitimate interest in a secure and working site
Where the basis is consent, you can withdraw it at any time and it costs you nothing. Every email we send carries an unsubscribe link, one click, no questions and no retention offer. Withdrawing consent does not make what we did before it unlawful.
Where the basis is legitimate interest, we have weighed our interest against your privacy and concluded it does not override your rights. The reasoning is short: the data stays inside this operation, it is not combined with anything bought from outside it, it is not used to target advertising at you, and in every case the amount held is the minimum that makes the purpose work. You can object to any of it under section 10, and we will stop unless we have compelling grounds we can explain to you in writing.
This site sets no cookies. There is no analytics, no Meta Pixel, no Google tag, no heatmap, no session recorder and no third party watching you here. Nothing on this page is loaded from an advertising network.
That is why you never see a cookie banner. We have nothing to ask you about, so we do not interrupt you to ask.
If that ever changes, this policy changes first, and a consent request appears before any non-essential cookie is set. We will not quietly add a tracker and update the small print afterwards.
This section is for the people whose work is on the page. It matters more than the rest of this document, so it is written plainly.
Every clip on our accounts that was filmed by someone else is there because that person was asked and said yes, in writing, before the clip was edited. That is not a policy we try to follow. Our build process refuses to produce a post whose source is not marked as permitted, with the permission exchange saved, so an unpermitted clip is not against the rules, it is unmakeable.
Ask, and it comes down. No reason needed, no argument, no waiting for a justification to be assessed. Write to hello@broughtbackhq.com or reply in the same message thread. We aim to remove it within 72 hours of seeing the request, and we will confirm when it is gone.
Because we treat the credit as running on your consent, a takedown request is a withdrawal of that consent, and we do not require anything more from you than the request itself.
If the person who commissioned the work, or the owner of the property in it, objects to a clip being published, tell us and we will take it down while it is sorted out rather than after.
We keep the permission exchange for a period after the post comes down, because it is the record that the post was lawful while it was up, and that record protects both of us if a complaint arrives later. Retention is in section 9. You can ask us to delete it too, and we will explain the trade off before we do.
We do not sell your personal data. We have never sold it and we will not. We share it with two providers, each of which is our processor, bound by a data processing agreement, and permitted to use your data only on our instructions.
Your email address and the trade or surface type you gave us are stored with Resend, and every email we send you is delivered through it. Resend processes your address and the content of the message in order to deliver it, and records whether a message was delivered, opened or bounced. Resend Inc. is a United States company.
This site is served from Vercel's platform. Vercel processes technical connection data, such as your IP address and user agent, in its operational logs in order to deliver the page and protect it from abuse. Vercel Inc. is a United States company.
Meta and TikTok are a different case. They are not our processors. They run the platforms our accounts sit on and they decide for themselves what they do with your data there, as controllers in their own right. When you message or comment on us, that message exists on their infrastructure under their terms as well as being visible to us. We hold our own copies only as described in section 3.
Nobody else. No advertising network, no data broker, no analytics vendor, no marketing agency, no AI training partner.
We may also disclose data where the law genuinely requires it, for example a valid order from a Hungarian court or authority. If that ever happens we will tell you, unless we are legally prohibited from doing so. If this operation is ever sold or transferred as part of the business, the data would move with it, and we would tell you before that happened and what it means for you.
Both of our processors are United States companies, so personal data reaches the United States. Specifically, your email address and signup preference sit with Resend, and technical connection data is processed by Vercel.
Where personal data goes to the United States, the transfer is covered by the safeguards in each provider's data processing agreement. In practice that means one or both of the following:
We rely on Standard Contractual Clauses as our primary safeguard rather than treating the Data Privacy Framework as sufficient on its own. That is a deliberate and conservative choice: an adequacy decision can be challenged and withdrawn, and a safeguard that could disappear is not one to build on alone.
If you want to know the specific safeguard a specific provider relies on, write to hello@broughtbackhq.com and we will tell you which one applies and send you what we have.
No accounting retention. Hungarian accounting law requires business records to be kept for eight years, but that only applies once there is a transaction. Nothing described on this page involves a payment in either direction, so nothing here sits under an accounting retention period.
Under the GDPR and the UK GDPR you have the right to:
Write to hello@broughtbackhq.com with the word "delete" and tell us which of these applies:
All of these are free. We answer within one month of receiving the request, as Article 12(3) requires. If a request is genuinely complex we may extend that by up to two further months, and if we do, we will tell you within the first month and say why. If a request is manifestly unfounded or excessive we may charge a reasonable fee or decline, and we will explain the reason if we ever do.
We may ask you to confirm you are who you say you are before we act, but only where there is a real doubt. We will not use an identity check as a delaying tactic, and we will not ask you for identity documents to prove ownership of an email address.
If you think we have mishandled your data, tell us first at hello@broughtbackhq.com. We would rather fix it than have you find out from an authority that we could have.
You also have the right to complain to a data protection supervisory authority. Ours is the Hungarian one:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
National Authority for Data Protection and Freedom of Information
Address: H-1055 Budapest, Falk Miksa utca 9-11, Hungary
Post: 1363 Budapest, Pf. 9
Phone: +36 (1) 391-1400
Email: ugyfelszolgalat@naih.hu
Web: www.naih.hu
If you are in the United Kingdom, you can complain to the Information Commissioner's Office instead:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Phone: 0303 123 1113
Web: ico.org.uk
If you live or work in another EU or EEA country, you can complain to the supervisory authority there. You do not have to come to Hungary to do it. You also have the right to an effective judicial remedy.
This is a page about trade work, made for adults doing it and adults paying for it. You must be at least 16 to join the email list or to give us permission to feature your footage. We do not knowingly collect data from anyone under 16. If we find out that we have, we delete it, and if it is a featured clip, we take the post down.
We keep this straightforward and we do not overstate it.
Traffic between your browser and this site runs over HTTPS. The email list lives in Resend and is reachable only by the small number of people who run this operation. Permission screenshots are stored privately and are never published, linked or shared. Access to the accounts is limited to the people who need it. Our providers hold their own security certifications, which you can read about at the links in section 7.
No system is perfectly secure, and anyone who says otherwise is selling something. If a breach ever affects your personal data and creates a real risk to you, we will tell you, and we will notify NAIH within the 72 hours the GDPR requires.
If we change how we handle your data, we update this page and change the effective date at the top.
For a change that materially affects you, we will give you at least 30 days' notice by email, if we have your address, before it takes effect. Two specific changes would count, and we name them here so they cannot be slipped past you later: adding any tracking or advertising technology to this site, and using the email list to promote any product other than this one. Neither is happening today. If either is ever proposed, this policy is updated and you are told before it starts, not after.
Ask us anything about this policy. A real answer is easier for everyone than a guess.