Privacy Policy

BrandAura Studio ("BrandAura", "we", "us") is a logo and visual identity design practice operating under the laws of [Jurisdiction]. We act as the data controller for personal information processed through this website and through client engagements, unless a signed agreement states otherwise.

Information you provide. Name, work email address, company name, project scope selection and the contents of any brief, message or file you send us.

Engagement records. Contracts, correspondence, design feedback, invoices and payment confirmations relating to a commissioned project.

Technical information. Standard server log data such as IP address, browser type, referring page and timestamps, collected to keep the site secure and available.

We do not knowingly collect special-category data, and we ask that you do not submit it through our forms.

To respond to enquiries and prepare proposals; to deliver, invoice for and support commissioned design work; to maintain records required for tax and accounting; to secure and improve our website; and, where you have opted in, to send occasional studio updates.

Our lawful bases are performance of a contract, our legitimate interest in operating and securing the studio, compliance with legal obligations in [Jurisdiction], and consent where consent is required.

We use strictly necessary cookies to operate the site. Where analytics or preference cookies are enabled, they are used only in aggregate to understand page performance, and you may refuse or delete them through your browser settings without losing access to the site's core functionality.

We share personal information only with service providers who support our operations — hosting, email delivery, file transfer, accounting and payment processing — each bound by confidentiality obligations and permitted to process data solely on our instructions. We do not sell personal information. We may disclose information where required by law, court order or a competent authority in [Jurisdiction], or to establish or defend legal claims.

Our providers may process data outside [Jurisdiction]. Where that occurs we rely on recognised transfer mechanisms, such as standard contractual clauses or an adequacy decision, together with appropriate technical safeguards.

Enquiries that do not become projects are deleted within twenty-four months. Client engagement records, contracts and financial documents are retained for the period required by the accounting and limitation rules of [Jurisdiction], after which they are securely deleted or anonymised. Archived design source files are kept for reference unless you request their removal.

We apply access controls, encrypted transmission, device encryption and least-privilege file sharing. No system is perfectly secure; if a breach affecting your rights occurs, we will notify you and any applicable supervisory authority within the timeframes set by the law of [Jurisdiction].

Subject to the law of [Jurisdiction], you may request access to, correction of or deletion of your personal data; object to or restrict certain processing; request portability; and withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with the supervisory authority in [Jurisdiction].

Our services are directed to businesses and are not intended for children. We do not knowingly collect data from anyone below the age of majority in [Jurisdiction].

We may update this policy to reflect changes in our practices or in applicable law. The revision date at the top of this page always reflects the current version, and material changes will be communicated to active clients in writing.