Privacy Policy

Date of last update: 06/05/2026

The Brixio group (together “Brixio”, “we”, “us” or “our”) owns and operates the www.brixio.io website (the “Site”), which is hosted globally on the Cloudflare Workers edge network, and provides Cloudflare-based professional services (consulting, integration, deployment, managed services and support) to clients worldwide.

As a responsible operator, Brixio undertakes to protect the personal data collected and processed in connection with the use of the Site and of our services in compliance with:

• the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Member State implementing legislation, including the French Loi n° 78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties, as amended;
• the UK General Data Protection Regulation and the Data Protection Act 2018;
• the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“UAE PDPL”);
• the Kingdom of Saudi Arabia Personal Data Protection Law (“KSA PDPL”);
• the Singapore Personal Data Protection Act 2012 (“SG PDPA”);
• and any other applicable data protection laws and regulations (together, the “Data Protection Laws and Regulations”).

To exercise your data protection rights or submit a privacy request, use our DPO contact form.

1. What is the purpose of this Policy?

The purpose of this privacy policy (the “Policy”) is to inform visitors and users of the Site (the “Users”, “you” or “your”) of the methods by which Brixio processes their personal data (“Data”) in connection with the use of the Site, of the services made available on or through the Site, and of any commercial relationship that may arise from such use.

This Policy does not apply to:

• the processing of personal data carried out by our clients in the use of services we deliver to them, for which our clients act as data controllers and Brixio acts as a data processor on their behalf, in accordance with a Data Processing Agreement;
• third-party websites linked from the Site, which are governed by their own privacy policies.

Brixio reserves the right to modify this Policy when necessary (in particular in the event of legislative, regulatory, technical or organisational developments). The current version available on the Site indicates the date of the last update.

2. Who is responsible for processing your data?

The data controller is the entity that determines the purposes and means of the processing of personal data.

Brixio operates as a global group. The data controller responsible for your personal data depends on your country of residence:

2.1 Users residing in the European Economic Area (EEA), the United Kingdom or Switzerland

Brixio France SAS

• Société par actions simplifiée (SAS)
• Registered office: 91 rue du Faubourg Saint-Honoré, 75008 Paris, France
• RCS Paris: 944 457 688
• SIRET: 944 457 688 00017
• VAT: FR69944457688
• Contact: privacy@brixio.io

2.2 Users residing in the Middle East, the GCC, Saudi Arabia, Africa and the Americas

Brixio Technologies LLC

• Limited liability company incorporated in Dubai, United Arab Emirates
• Registered office: 2nd Floor, Dubai Supreme Court Complex, Umm Hurair 2, Dubai, United Arab Emirates
• Contact: privacy@brixio.io

2.3 Users residing in Singapore and the Asia-Pacific region

Brixio Technologies (Singapore) Pte. Ltd.

• Private company limited by shares incorporated in Singapore
• UEN: 202135558M
• Registered office: 68 Circular Road, #02-01, Singapore 049422
• Contact: privacy@brixio.io

2.4 Joint controllership for cross-border processing

For cross-border processing where personal data flows between Brixio France SAS, Brixio Technologies LLC and Brixio Technologies (Singapore) Pte. Ltd. (notably for the global delivery of services, intra-group coordination and the operation of the Site), these entities act as joint controllers within the meaning of Article 26 GDPR and equivalent provisions of other applicable Data Protection Laws and Regulations. The essence of their joint controllership arrangement is available upon request to privacy@brixio.io. Regardless of which entity acts as your primary point of contact, you may exercise your rights against any of them.

2.5 Other Brixio Group entities

The other Brixio Group entities - in particular Brixio Lux Holding Sàrl (Luxembourg) and any other holding entity, subsidiary or special purpose vehicle from time to time - do not, in their capacity as such, collect or process personal data of Users on the Site and are not data controllers under this Policy.

3. Have we appointed a Data Protection Officer?

Brixio has designated a Data Protection Officer (“DPO”) whom you may contact for any question relating to the processing of your personal data, the exercise of your rights, or any other matter covered by this Policy.

DPO contact:

• Online form: /contact-dpo/ (recommended)
• Email: dpo@brixio.io
• Postal address: For the attention of the Data Protection Officer, Brixio France SAS, 91 rue du Faubourg Saint-Honoré, 75008 Paris, France

For all general privacy queries, you may also contact us at privacy@brixio.io.

4. Who is this Policy for?

This Policy applies to the processing of personal data of the following categories of Users:

• Site Visitors: persons who browse the Site, including those who choose to provide an email address or other contact details to receive communications from Brixio, complete a contact form, subscribe to our newsletter, or otherwise interact with us via the Site.
• Prospects: professionals contacted by Brixio in the context of B2B sales and business development activities (including via outbound email, LinkedIn, events, and referrals).
• Clients and Client Contacts: representatives of entities that have entered into, or are negotiating, a commercial relationship with Brixio, including for the delivery of Cloudflare-based professional services and managed services.
• Candidates: persons who apply for a position at Brixio, whether spontaneously or in response to a job offer.
• Event Participants: persons who register for or attend events organised, sponsored or co-hosted by Brixio.
• Suppliers and Partner Contacts: representatives of our suppliers, subcontractors, technology partners and resellers.

This Policy does not apply to end users of services that Brixio delivers to its clients (for example, end users of websites or applications protected by Cloudflare on behalf of a Brixio client). In that context, our clients act as data controllers and Brixio acts as a data processor on their behalf. Such end users should refer to the privacy policy of the relevant client.

The Site and our services are not intended for, nor designed to attract, persons under the age of 16. Brixio does not knowingly collect personal data from minors (see Section 16).

5. What categories of personal data do we collect?

Brixio collects only the data necessary for the purposes identified in this Policy, namely:

• Identification data: first name, last name, professional title, name of company employing you, sector of activity.
• Contact details: professional email address, professional telephone number, professional postal address.
• Connection data: IP address, technical identifiers, browser type and version, operating system, pages visited, timestamps, referrer URL.
• Communication data: content of contact forms, email exchanges, newsletter subscriptions, responses to our marketing campaigns and surveys.
• Commercial data: information related to the contractual relationship with Brixio (proposals, contracts, purchase orders, invoices, support tickets, technical configuration data, intervention logs).
• Application data: for candidates, CV, cover letter, career history, qualifications, references, interview notes and any other information submitted as part of an application.
• Other data: any personal data communicated in the free-text fields of forms on the Site.

You are invited not to communicate, in free-text fields, any personal data which is sensitive within the meaning of the Data Protection Laws and Regulations (e.g. racial or ethnic origin, political, philosophical or religious opinions, trade union membership, health data, sex life or sexual orientation, criminal offences). Brixio is not authorised to process such data in the context of the Site and reserves the right to delete it as soon as possible.

Mandatory information is marked with an asterisk (*) on Site forms.

6. How do we obtain your data?

Brixio obtains your personal data:

• Directly from you: when you complete a form on the Site, exchange emails with us, subscribe to our newsletter, apply to a position, or interact with us at events;
• From your browsing on the Site: through cookies and similar tracking technologies (see Section 15);
• From third parties: from public professional sources (e.g. LinkedIn, corporate websites, business directories) for B2B prospecting purposes, from sales intelligence platforms, from professional referrals, or from your employer in the context of a commercial relationship.

Where data is collected indirectly, we inform the data subject within a reasonable period and at the latest at the time of the first communication, in accordance with Article 14 GDPR or any equivalent provision of applicable law.

7. For what purposes and on what legal bases do we process your data?

Brixio processes personal data for the purposes and on the legal bases set out in the table below:

The processing does not involve automated decision-making producing legal effects or similarly significantly affecting the data subject within the meaning of Article 22 GDPR.

Your data will not be further processed in a manner incompatible with the purposes described above.

8. To whom do we communicate your data?

Only authorised recipients receive and have access to your personal data, within the strict limits of their respective need:

• Authorised Brixio internal teams: sales, technical delivery, support, finance, HR, depending on the purpose of the processing.
• Other Brixio Group entities: for the purpose of intra-group coordination, technical delivery and support, in accordance with our intra-group services and transfer pricing arrangements.
• Our processors and service providers, listed below, governed by data processing agreements compliant with Article 28 GDPR (where applicable) or equivalent contractual safeguards.
• Administrative and judicial authorities: when required by law, regulation, or a binding order from a competent authority.
• Professional advisers: notably our lawyers, auditors, accountants and consultants, bound by confidentiality obligations.
• Acquirers or successors: in the event of a merger, sale, change of control or reorganisation of all or part of our business.

Our key processors are the following:

This list is non-exhaustive and may evolve. The complete and up-to-date list of our active processors is available upon request to privacy@brixio.io.

We do not sell your personal data, and we do not share your personal data with third parties for their own marketing purposes without your consent.

9. Do we transfer your data outside the EEA or your country of residence?

Brixio is a global group and may need to transfer your personal data across borders to deliver its services and to operate its business. In addition, the Site itself is hosted on the Cloudflare Workers global edge network: connection data such as IP addresses and request logs is processed at the Cloudflare point of presence closest to you, which may be located in any of the jurisdictions where Cloudflare operates.

9.1 Transfers from the EEA, the United Kingdom or Switzerland

Some of your data may be transferred outside the EEA, notably to the United Arab Emirates, the United States, Singapore or India, where our processors or other Brixio Group entities are located.

These transfers are governed by:

• Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented by additional safeguards where required;
• the EU-US Data Privacy Framework (DPF), for processors that have certified to it;
• UK Addendum to the EU SCCs or the UK International Data Transfer Agreement, for transfers from the United Kingdom;
• Adequacy decisions of the European Commission, where applicable;
• Transfer Impact Assessments (TIAs) documented for transfers presenting elevated risk.

9.2 Transfers from the United Arab Emirates

Cross-border transfers of personal data originating in the UAE are governed by the mechanisms set out in the UAE PDPL and its implementing regulations, including transfers to jurisdictions benefiting from an adequate level of protection as recognised by the UAE Data Office, transfers based on appropriate contractual safeguards, or transfers based on your consent.

9.3 Transfers from Saudi Arabia

Cross-border transfers of personal data originating in Saudi Arabia are governed by the mechanisms set out in the KSA PDPL and its implementing regulations, including authorisation by the Saudi Data and Artificial Intelligence Authority (SDAIA), appropriate contractual safeguards, or any other mechanism recognised by SDAIA.

9.4 Transfers from Singapore

Cross-border transfers of personal data originating in Singapore are governed by the mechanisms set out in the SG PDPA, including transfers to jurisdictions providing a comparable standard of protection, transfers based on legally enforceable obligations binding the recipient (such as binding contractual safeguards or binding corporate rules), or transfers based on your consent.

9.5 Transfers from other jurisdictions

For Users residing in other jurisdictions, Brixio applies a baseline level of protection equivalent to the GDPR and complies with any local cross-border transfer requirements applicable to you.

A copy of the safeguards in place for a specific transfer may be requested at privacy@brixio.io.

10. How long do we retain your data?

Brixio retains your personal data only for as long as is necessary for the purposes for which it was collected, in accordance with the table below:

Once these retention periods have been reached, your data is deleted from our systems or anonymised in such a way that you can no longer be identified.

11. How do we protect your data?

Brixio undertakes to maintain the security and confidentiality of your personal data and, in particular, to prevent it from being distorted, damaged, lost or accessed by unauthorised third parties.

Brixio implements appropriate technical and organisational measures to guarantee a level of security appropriate to the risks, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing. These measures include:

• encryption of communications in transit (TLS 1.2 or higher);
• encryption of sensitive data at rest;
• role-based access control (RBAC) and the principle of least privilege;
• multi-factor authentication for access to internal systems;
• access logging, audit trails and regular security reviews;
• ISO/IEC 27001:2022 certification of Brixio's information security management system;
• regular backups, environment separation and disaster recovery procedures;
• security awareness training for all employees and contractors;
• incident response procedures and notification protocols compliant with applicable data breach notification requirements (including Article 33 GDPR).

Our processors are required, by contract, to provide the necessary guarantees to ensure the protection of your data and to act only on documented instructions from Brixio.

12. What rights do you have?

12.1 Common rights

Regardless of your jurisdiction, you may at any time request to access, rectify or delete your personal data by contacting us at privacy@brixio.io. We will respond within a reasonable timeframe and in accordance with the data protection law applicable to you.

12.2 Rights under the GDPR (residents of the EEA, the UK and Switzerland)

Under the GDPR (and the UK GDPR, where applicable), you have the following rights:

• Right of access: obtain confirmation as to whether or not your personal data is being processed, access to that data, and further information about the processing (purposes, categories of data, recipients, retention periods, source of the data, existence of automated decision-making, and the right to lodge a complaint).
• Right to rectification: correct inaccurate personal data and complete incomplete data.
• Right to erasure (“right to be forgotten”): request the deletion of your data in cases provided by law.
• Right to restriction of processing: request the suspension of the processing of your data.
• Right to object: object to the processing of your data, in particular for direct marketing purposes (in which case Brixio will cease such processing without further justification).
• Right to data portability: receive the data you have provided to us in a structured, commonly used and machine-readable format, and transmit it to another controller.
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out prior to such withdrawal.
• Right not to be subject to automated decision-making producing legal effects or similarly significantly affecting you (Brixio does not engage in such automated decision-making).
• Right to lodge a complaint with a competent supervisory authority (see Section 14).

Please note that we may not always be able to fully comply with an erasure or other request, in particular where processing is necessary for the establishment, exercise or defence of legal claims, where we have a legal obligation to retain certain data, or where we need it for an existing contractual relationship. We will inform you in our response.

12.3 Rights under the UAE PDPL

Under the UAE Federal Decree-Law No. 45 of 2021, you benefit from the following rights:

• the right to request information about the processing of your data;
• the right to access your data;
• the right to request the transfer of your data to another controller;
• the right to correction, erasure and objection;
• the right to restrict processing;
• the right to withdraw consent;
• the right to lodge a complaint with the UAE Data Office.

12.4 Rights under the KSA PDPL

Under the Saudi Personal Data Protection Law, you benefit from the following rights:

• the right to be informed of the legal basis and the purpose of the processing;
• the right to access your data;
• the right to request correction, completion or update of your data;
• the right to request the destruction of your data when the purpose has been fulfilled;
• the right to withdraw consent;
• the right to lodge a complaint with SDAIA.

12.5 Rights under the SG PDPA

Under the Singapore Personal Data Protection Act 2012, you benefit from the following rights:

• the right to be informed of the purposes for which your data is collected, used or disclosed;
• the right to access your personal data and information about the ways it has been used or disclosed within the past year;
• the right to request correction of any error or omission in your personal data;
• the right to withdraw consent at any time, on giving reasonable notice;
• the right to data portability, where applicable under the SG PDPA;
• the right to lodge a complaint with the Personal Data Protection Commission of Singapore (PDPC).

12.6 Other jurisdictions

If you reside outside the EEA, the United Kingdom, Switzerland, the United Arab Emirates, Saudi Arabia or Singapore, please contact us at privacy@brixio.io for any request relating to your rights. We will apply a baseline level of protection equivalent to the GDPR to the extent possible, and we will take into account any local law applicable to you.

13. How can you exercise your rights?

To exercise your rights or to ask any question regarding the processing of your personal data by Brixio, you may contact our DPO:

• Online form: /contact-dpo/ (recommended);
• By email: dpo@brixio.io (or privacy@brixio.io for general queries);
• By post: For the attention of the Data Protection Officer, Brixio France SAS, 91 rue du Faubourg Saint-Honoré, 75008 Paris, France.

Please specify the scope of your request and provide details that enable us to identify you positively. If you fail to do so, we may request additional proof of identity at a later stage.

We will respond to your request as quickly as possible and at the latest within one (1) month of receipt. Depending on the complexity and number of requests, this period may be extended by a further two (2) months. If the deadline is extended, we will inform you within one month of receiving your request and explain the reasons for the delay.

14. How can you lodge a complaint?

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the relevant supervisory authority:

• France: Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France - https://www.cnil.fr.
• Luxembourg: Commission nationale pour la protection des données (CNPD), 15 Boulevard du Jazz, L-4370 Belvaux, Luxembourg - https://cnpd.public.lu.
• United Kingdom: Information Commissioner's Office (ICO) - https://ico.org.uk.
• Other EEA countries: the supervisory authority of your country of residence (list available at https://edpb.europa.eu).
• United Arab Emirates: UAE Data Office - https://u.ae.
• Saudi Arabia: Saudi Data and Artificial Intelligence Authority (SDAIA) - https://sdaia.gov.sa.
• Singapore: Personal Data Protection Commission (PDPC) - https://www.pdpc.gov.sg.
• Other jurisdictions: the competent supervisory authority in your country of residence.

15. Cookies and similar technologies

The Site uses cookies and similar technologies to ensure proper operation, measure audience and improve your experience. Non-strictly-necessary cookies are placed only with your consent, collected through the consent banner displayed on your first visit.

Categories of cookies used:

• Strictly necessary cookies: required for the Site to function (session management, language preferences, security). Placed without consent.
• Analytics cookies: anonymised audience measurement and visit statistics. Placed only with consent. Retained for a maximum of 13 months.
• Advertising cookies: advertising personalisation and campaign performance measurement (notably LinkedIn Ads and Meta Ads). Placed only with explicit consent.

You may change your choices at any time via the “Cookie settings” link at the bottom of each page of the Site.

Further information on the cookies we use is available in our Cookie Policy (https://brixio.io/cookie-policy/).

16. Minors

The Site and our services are not intended for, nor designed to attract, persons under 16 years of age. Brixio does not knowingly collect personal data concerning minors. If you become aware that a minor has provided us with personal data, please contact us at privacy@brixio.io so that we may delete such data without delay.

17. Changes to this Policy

We may amend this Policy from time to time to reflect legal, technical or organisational changes. Where the change is substantial, we will inform you via a notice on the Site or by email prior to the change taking effect. The “date of last update” is indicated at the top of this document.

18. Contact

For any question relating to this Policy or to the processing of your personal data:

• General privacy queries: privacy@brixio.io
• Data Protection Officer: dpo@brixio.io
• Brixio France SAS - EEA / UK / Switzerland: 91 rue du Faubourg Saint-Honoré, 75008 Paris, France
• Brixio Technologies LLC - Middle East / GCC / Africa / Americas: 2nd Floor, Dubai Supreme Court Complex, Umm Hurair 2, Dubai, United Arab Emirates
• Brixio Technologies (Singapore) Pte. Ltd. - Asia-Pacific: 68 Circular Road, #02-01, Singapore 049422