Privacy policy
Your right to object. Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21(1)). You may object to direct marketing, including any profiling for it, at any time and without giving reasons (Art. 21(2)); we then stop at once. One email to contact@m246.org or one message on LinkedIn is enough.
1. Who is responsible
The controller is The Branding Brand EOOD (Да Брандинг Бранд ЕООД), trading as 24/6 and m246, UIC 207195302, g.k. Dianabad 26, 1172 Sofia, Bulgaria, represented by its managing director Gregor Lederer. Email contact@m246.org, telephone +49 152 5949 5693. Full details: imprint.
We have not appointed a data protection officer because none of the conditions of Art. 37 GDPR applies to us. All data protection questions and requests go to contact@m246.org and are handled by the managing director personally.
Where we process personal data on behalf of a customer (for example the meetings and tasks of a customer's team inside 24/6), the customer is the controller and we are its processor. That processing is governed by our data processing agreement, and requests about it should go to the customer first; we will forward any we receive.
2. Overview
| When | What we process | Legal basis | How long |
|---|---|---|---|
| You visit m246.org | IP address, time, page, browser in server logs | Art. 6(1)(f) | 14 days |
| You contact us | Name, contact details, your message | Art. 6(1)(b) or (f) | 24 months after last contact |
| We contact you on LinkedIn (B2B) | Professional profile data, our messages and replies | Art. 6(1)(f) | 24 months after last interaction, or until you object |
| You book or join a meeting with us | Booking details, calendar entry, meeting link, notes | Art. 6(1)(b) or (f) | 24 months after last contact |
| A meeting is recorded | Audio, transcript, speaker separation | Art. 6(1)(a), consent | Audio 30 days, transcript 24 months at most |
| Voice recognition | Voice profile | Explicit consent | Until you withdraw consent or the engagement ends |
| You take part in an interview | See the interview information | Art. 6(1)(a) | See there |
| You reserve a place or become a customer | Name, business, address, VAT number, payment method (held by Stripe), contract and invoices | Art. 6(1)(b) and (c) | Contract term, then up to 10 years for accounting records |
| We invite you to review us | Name, email, order reference | Art. 6(1)(f) | Until the invitation is sent, at most 30 days |
| Research and anonymised marketing examples | Pseudonymised data from the activities above | Art. 6(1)(f) with Art. 89 GDPR | Until the research is complete; only anonymised results are kept |
| You apply to work with us | Application documents, interview notes | Art. 6(1)(b), Art. 88 GDPR with national law | 6 months after the process ends |
3. In detail
3.1 Visiting our website
Our web server (netcup GmbH, data centre in Germany) logs every request: IP address, date and time, requested page, status code, data volume, referring page, browser and operating system. We use the logs only to deliver the website and to detect and stop attacks and errors. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f)). Logs are deleted automatically after 14 days.
Our home page m246.org and our landing pages count visits and button clicks without identifying anyone (section 3.1b) and measure how they are used only if you allow it (section 3.1a). Apart from that, the main pages of this website use no cookies, no analytics, no tracking pixels and no advertising tools, and they load no fonts or scripts from third parties. Some older campaign pages still under m246.org load web fonts from Google Fonts (Google Ireland Limited); when you open such a page, your browser sends your IP address to Google. Payment pages load Stripe (section 3.6), which may set cookies that are strictly necessary for secure payment and fraud prevention (§ 25(2) no. 2 TDDDG, Art. 4a of the Bulgarian Electronic Communications Act).
3.1a Statistics on our home page and landing pages, only with your consent
Our home page m246.org and our landing pages (for example m246.org/lp2.2) use the following two services only if you click Allow, to learn which parts of the page are useful:
- Mixpanel (Mixpanel, Inc., USA): which sections you see, how long each feature stays on screen, how far you scroll, which button you click and the campaign link you came from.
- Microsoft Clarity (Microsoft Corporation, USA): heatmaps and recordings of mouse movement, clicks and scrolling on the page.
Both store a random identifier on your device. We do not link this data to your name or email address and do not use it for advertising. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG, Art. 4a of the Bulgarian Electronic Communications Act). You can withdraw it at any time with "Privacy settings" at the bottom of the page; we then stop measuring. This data is deleted after at most 24 months.
3.1b Visit and click count, without consent
When you open our home page or a landing page, or click one of its buttons for booking a call, your browser tells our own server (netcup GmbH, Germany) that this happened. We keep the page, which button was clicked, the date and time, the campaign and source named in the link you came from, and the website that referred you. We keep no IP address and no identifier, and store nothing on your device. Legal basis: our legitimate interest in knowing how many people see our pages and how many of them want to book a call (Art. 6(1)(f)). We delete these counts after 24 months.
3.2 When you contact us
If you write to us by email, LinkedIn, WhatsApp, Slack or telephone, we process your name, contact details, the content of your message and our reply in order to answer you. If your message concerns a contract or its preparation, the legal basis is Art. 6(1)(b); otherwise it is our legitimate interest in answering enquiries (Art. 6(1)(f)). We delete the correspondence 24 months after the last contact unless a contract follows or we must keep it for tax or legal reasons.
3.3 Business outreach on LinkedIn
We contact founders, managing directors and team leads of companies that work in remote or distributed teams, to offer our services. If we contacted you this way, this section is our information to you under Art. 14 GDPR.
- Source: your public LinkedIn profile and LinkedIn Sales Navigator (LinkedIn Ireland Unlimited Company), and publicly available information about your company.
- Data: name, job title, employer, company size, industry and location, profile address, the content and dates of our messages and your replies, whether a meeting was booked.
- Purpose: to identify people for whom our service is relevant, to contact you once with a short personal message and, if there is no reply, at most two short follow-ups, and to keep a record of the conversation so we do not contact you twice or after you have declined.
- Profiling: we sort contacts by role, company, size and location to decide whom to write to first. This has no legal or similarly significant effect on you, and no decision about you is made by automated means alone.
- Legal basis: our legitimate interest in business-to-business direct marketing (Art. 6(1)(f) and Recital 47 GDPR). We write only to people in a professional role, only about a professional topic, and stop as soon as you say no.
- Storage: in our own database (Supabase, hosted in the EU) and our LinkedIn tools.
- Retention: 24 months after our last interaction. If you object, we delete your data and keep only an irreversible code (a SHA-256 hash) of your name, email address and profile address on a suppression list, so that our systems recognise you and never contact or record you again (Art. 6(1)(c) and (f), Art. 17(3)(b)). The list holds no readable personal data.
3.4 Meetings and calls
You can book a call with us through Cal.com (Cal.com, Inc., USA). Your booking creates an entry in our Google Workspace calendar (Google Ireland Limited) with your name, email address, the time and the video link. We hold calls on Google Meet or, at a customer's choice, Microsoft Teams or Zoom. Legal basis: preparing or performing a contract (Art. 6(1)(b)) or our legitimate interest in business communication (Art. 6(1)(f)). We delete booking data 24 months after the last contact.
Recording only with consent. We record or transcribe a meeting only if every participant has agreed beforehand (Art. 6(1)(a) GDPR). We ask in the booking form and again at the start of the call. If anyone says no, nothing is recorded. When we record, our note-taking participant joins the call visibly under the name "24-6 Notetaker".
- Where it is processed: audio is transcribed on our own server in Germany with open-source speech recognition.
- What results: a transcript, a separation of who spoke when, and short audio snippets used to check that separation.
- Voice recognition: to label speakers by name we can create a voice profile, only with your explicit consent.
- Notification: after a meeting we receive a short email through our provider Resend (Resend, Inc., USA) with its start time, length, the names of identified participants and how much each speaker spoke.
- Analysis: see section 3.7 on AI.
- Retention: audio recordings and snippets 30 days after the meeting; transcripts and notes for the duration of the engagement or project, at most 24 months; voice profiles as above. You can withdraw consent at any time; we then delete the recording, the transcript and anything derived from them, except where you agreed to anonymised use that can no longer be linked to you.
3.5 Interviews
We interview leaders of remote teams to develop and improve 24/6. These interviews are commercial product research by The Branding Brand EOOD. Full information and the consent we ask for: interview and meeting participation.
3.6 Reservations, customers, payments and invoices
When you reserve a place or sign up, we process your name, email address, business name, address, country and VAT number, and the contract and communication with you. Your card details go directly to Stripe (Stripe Payments Europe, Limited, Ireland). Legal basis: the contract with you (Art. 6(1)(b)), and our legal duties under Bulgarian accounting and tax law (Art. 6(1)(c)). Stripe also processes data as an independent controller to prevent fraud and to meet its own legal duties; see stripe.com/privacy. We keep accounting records and invoices for up to 10 years as Bulgarian law requires, and other contract data until the end of the limitation period, normally 5 years after the contract ends.
When you use 24/6, the content you and your team enter (tasks, messages, meeting notes, strategy documents) is processed on your behalf under our data processing agreement. Your account data (users, roles, login, billing) is processed by us as controller under Art. 6(1)(b).
3.7 Artificial intelligence
We use AI models to summarise and analyse notes, transcripts and documents, to draft text and to write software. We use them as follows:
- Models: open-source models that run on our own hardware or on a GPU server we rent from Scaleway SAS (France); Claude by Anthropic (Anthropic Ireland, Limited); and Gemini within Google Workspace (Google Ireland Limited).
- Customer and partner data: confidential information of a customer goes only into tools that customer has approved in writing.
- No automated decisions: AI output informs our work. It never decides anything about you that has legal or similarly significant effects (Art. 22 GDPR), and a person checks every result we pass on.
- Transparency: where 24/6 lets you interact with an AI system, the interface says so (Art. 50 of Regulation (EU) 2024/1689, the AI Act).
3.8 Reviews
After a project we may ask you to review us on Trustpilot (Trustpilot A/S, Denmark). For this we pass your name, email address and a reference number to Trustpilot, which sends you one invitation. Legal basis: our legitimate interest in customer feedback (Art. 6(1)(f)). You can object at any time; whether you write a review is up to you. Trustpilot's own processing: trustpilot.com/legal/privacy-policy.
3.9 Applications
If you apply to work with us, we process your application documents and our interview notes to decide on the application (Art. 6(1)(b) GDPR and Art. 88 GDPR with applicable national employment law). We delete them 6 months after the end of the process unless you agree to a longer period or you are hired.
3.10 Internal tools
To run our business we use Google Workspace (email, calendar, documents), Slack and WhatsApp (messaging), Notion (notes), Granola (meeting notes in calls we hold ourselves, only with the consent described in 3.4), GitHub (source code), Microsoft Azure (email automation) and a Telegram bot that files our own business documents. Personal data enters these tools only as far as needed for the purposes in this policy.
3.11 Scientific research
We study how remote teams coordinate their work. For this research, including academic theses and publications, we may use data from the activities in this policy (including meeting notes, interviews and records of how our services are used) in pseudonymised form. We keep research data separate and restricted, never use voice profiles or other special categories of data for it, and publish results only in anonymised or aggregated form that identifies no person and no organisation. In the same anonymised form we may use meeting content in our marketing, for example in LinkedIn posts. Legal basis: our legitimate interest in scientific research and in marketing (Art. 6(1)(f), Art. 89 GDPR); for data from a customer's workspace, also the customer's permission under the DPA. You can object at any time (Art. 21(1) and (6)); we then exclude your data from research not yet published.
3.12 Other providers
What this policy says about other providers' services is based on their own documentation at the date of this version. Processing that a provider carries out as an independent controller is governed by its own privacy policy.
4. Recipients
We do not sell personal data and do not share it for advertising. Recipients are:
- Processors bound by an agreement under Art. 28 GDPR. The current list with locations: sub-processors.
- Independent controllers where you use their service or the law requires it: LinkedIn, Stripe, Trustpilot, banks, our accountant and tax advisers (bound to professional secrecy), courts and authorities where we are legally obliged.
5. Transfers outside the EU
Some providers are in the USA or process data there. We transfer data to them only on the basis of an adequacy decision, in particular the EU-U.S. Data Privacy Framework for certified providers (Art. 45 GDPR), or of the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) together with the additional safeguards the provider offers. For people in the United Kingdom, the UK Extension to the Data Privacy Framework or the UK International Data Transfer Addendum applies. You can ask us for a copy of the safeguards at contact@m246.org.
6. How long we keep data
We delete personal data as soon as the purpose for which we hold it has ended, using the periods stated above. Where the law requires us to keep data longer (in particular accounting and tax records), we restrict it to that use. Backups rotate and older ones are deleted. Before a backup is restored, deletions made since it was taken are repeated.
7. Your rights
You have the right to:
- access your data and receive a copy (Art. 15);
- have incorrect data corrected (Art. 16);
- have your data erased (Art. 17);
- have processing restricted (Art. 18);
- receive data you provided in a common machine-readable format (Art. 20);
- object to processing based on legitimate interests and to direct marketing (Art. 21, see the box at the top);
- withdraw any consent at any time with effect for the future, as easily as you gave it (Art. 7(3));
- lodge a complaint with a supervisory authority (Art. 77), in particular the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg, or the authority where you live or work, for example the Hamburg Commissioner for Data Protection and Freedom of Information in Germany or, in the United Kingdom, the Information Commissioner's Office.
Write to contact@m246.org. We answer within one month (Art. 12(3)) and may ask you to confirm your identity first. Exercising your rights is free.
8. Do you have to give us your data?
No law obliges you to. Without the data marked as required in a form we cannot conclude or perform a contract with you, and without your consent we do not record you. You can always talk to us without being recorded.
9. Security
We protect personal data with the technical and organisational measures described in technical and organisational measures, including full-disk encryption, encrypted backups, encrypted connections and strict access limits.
10. Changes
We update this policy when our processing changes. The version and date are at the top. If a change affects a processing based on your consent, we ask again.