Last updated: 15 October 2026
This policy explains what personal data we collect through eubrandsupport.com, why, and what your rights are. We keep it short and only collect what we need.
Who is responsible for your data
EU Brand Support OÜ, Ahtri 12, 15551 Tallinn, Estonia (registry code 17605871) is the controller of your personal data. Contact us about anything in this policy at hello@eubrandsupport.com.
If you use our UK Responsible Person service, our UK company, Evolve Brands, also handles your data to provide that service.
What we collect and why
- When you buy or claim a template pack: your name, email address, billing address, company name and order details. We use this to deliver your downloads, send receipts, provide support and keep accounting records. Legal basis: contract; legal obligation (accounting).
- Payments: card and payment details are collected and processed directly by Stripe. We never see or store your full card number. We receive limited payment information from Stripe, such as the card type and last four digits. Legal basis: contract.
- When you send an enquiry (contact form, EUDR scope checker or email): your name, email, company, message and the answers you give. We use this to reply and, if you go ahead, to provide our services. Legal basis: steps before a contract; our legitimate interest in answering enquiries.
- Customer records: we keep buyer and enquiry details in our customer relationship system (Twenty CRM, hosted on our own server) so we can manage enquiries, orders and client work. Legal basis: contract; legitimate interests.
- Service clients: if you use our Responsible Person or EPR services, we hold your business contact details, product information and technical documentation, and may share them with market surveillance authorities, EPR registers and compliance schemes where the law or your service requires it. Legal basis: contract; legal obligation.
- Emails about our services: we may email business customers and enquirers about related services. You can unsubscribe at any time by replying or using the link in the email. Legal basis: legitimate interests.
- Website analytics: with your consent, we use Google Analytics to understand how visitors use the site (pages viewed, approximate location, device and browser). Legal basis: consent.
- Showing the right currency: we use your IP address to work out which country you are in, using a MaxMind GeoLite2 database stored on our own server. Your IP address is not sent to MaxMind. Legal basis: legitimate interests.
- Security: our server keeps standard logs, including IP addresses, to keep the site secure. Legal basis: legitimate interests.
Cookies
- Essential cookies make the basket, checkout, currency choice and account login work. They are always on.
- Payment cookies are set by Stripe at checkout to prevent fraud.
- Analytics cookies (Google Analytics, names starting
_ga) are only used if you agree.
When you first visit, a banner asks whether you accept analytics cookies. You can change your choice at any time using the “Manage consent” tab on the page. See our Cookie Policy for the full list. You can also delete or block cookies in your browser settings, but blocking essential cookies will stop the shop from working.
Who we share data with
We do not sell your data. We share it only with service providers who help us run the business, and only as much as they need:
- Stripe: payment processing and fraud prevention
- Google: website analytics (if you consent) and Search Console
- Our web hosting provider: hosting the website, email, CRM and backups
- Accountants and professional advisers: where needed for accounts, tax and legal compliance
- Authorities, registers and compliance schemes: where the law or our services require it
International transfers
Some providers, such as Stripe and Google, may process data outside the European Economic Area and the UK, including in the United States. Where they do, transfers are protected by the EU–US Data Privacy Framework (and its UK extension) or by standard contractual clauses.
How long we keep data
- Orders, invoices and payment records: 7 years, as required by Estonian accounting law.
- Enquiries and customer records: up to 2 years after our last contact, unless you become a client.
- Service client files: for the length of the service and as long afterwards as product safety law requires us to keep technical documentation available to authorities (usually 10 years after the product is placed on the market).
- Analytics data: up to 14 months.
Your rights
You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. You can also object at any time to marketing emails.
To use any of these rights, email hello@eubrandsupport.com. We reply within one month.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), to the data protection authority where you live, or, in the UK, to the Information Commissioner’s Office (ico.org.uk).
Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed.
Contact
EU Brand Support OÜ, Ahtri 12, 15551 Tallinn, Estonia · Registry code 17605871 · hello@eubrandsupport.com