Privacy policy
Your right to object. Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21(1)). You may object to direct marketing, including any profiling for it, at any time and without giving reasons (Art. 21(2)); we then stop at once. One email to contact@m246.org or one message on LinkedIn is enough.
1. Who is responsible
The controller is The Branding Brand EOOD (Да Брандинг Бранд ЕООД), trading as 24/6 and m246, UIC 207195302, g.k. Dianabad 26, 1172 Sofia, Bulgaria, represented by its managing director Gregor Lederer. Email contact@m246.org, telephone +49 152 5949 5693. Full details: imprint.
We have not appointed a data protection officer because none of the conditions of Art. 37 GDPR applies to us. All data protection questions and requests go to contact@m246.org and are handled by the managing director personally.
Where we process personal data on behalf of a customer (for example the meetings and tasks of a customer's team inside 24/6), the customer is the controller and we are its processor. That processing is governed by our data processing agreement, and requests about it should go to the customer first; we will forward any we receive.
2. Overview
| When | What we process | Legal basis | How long |
|---|---|---|---|
| You visit m246.org | IP address, time, page, browser in server logs | Art. 6(1)(f) | 14 days |
| You contact us | Name, contact details, your message | Art. 6(1)(b) or (f) | 24 months after last contact |
| We contact you on LinkedIn (B2B) | Professional profile data, our messages and replies | Art. 6(1)(f) | 24 months after last interaction, or until you object |
| You book or join a meeting with us | Booking details, calendar entry, meeting link, notes | Art. 6(1)(b) or (f) | 24 months after last contact |
| A meeting is recorded | Audio, transcript, speaker separation | Art. 6(1)(a), consent | Audio 30 days, transcript 24 months at most |
| Voice recognition | Voice profile | Explicit consent | Until you withdraw consent or the engagement ends |
| You take part in an interview | See the interview information | Art. 6(1)(a) | See there |
| You reserve a place or become a customer | Name, business, address, VAT number, payment method (held by Stripe), contract and invoices | Art. 6(1)(b) and (c) | Contract term, then up to 10 years for accounting records |
| We invite you to review us | Name, email, order reference | Art. 6(1)(f) | Until the invitation is sent, at most 30 days |
| Research and anonymised marketing examples | Pseudonymised data from the activities above | Art. 6(1)(f) with Art. 89 GDPR | Until the research is complete; only anonymised results are kept |
| You apply to work with us | Application documents, interview notes | Art. 6(1)(b), Art. 88 GDPR with national law | 6 months after the process ends |
3. In detail
3.1 Visiting our website
Our web server (netcup GmbH, data centre in Germany) logs every request: IP address, date and time, requested page, status code, data volume, referring page, browser and operating system. We use the logs only to deliver the website and to detect and stop attacks and errors. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f)). Logs are deleted automatically after 14 days.
The main pages of this website use no cookies, no analytics, no tracking pixels and no advertising tools, and they load no fonts or scripts from third parties. Some older campaign pages still under m246.org load web fonts from Google Fonts (Google Ireland Limited); when you open such a page, your browser sends your IP address to Google. We are replacing these with locally hosted fonts. Payment pages load Stripe (section 3.6), which may set cookies that are strictly necessary for secure payment and fraud prevention (§ 25(2) no. 2 TDDDG, Art. 4a of the Bulgarian Electronic Communications Act).
3.2 When you contact us
If you write to us by email, LinkedIn, WhatsApp, Slack or telephone, we process your name, contact details, the content of your message and our reply in order to answer you. If your message concerns a contract or its preparation, the legal basis is Art. 6(1)(b); otherwise it is our legitimate interest in answering enquiries (Art. 6(1)(f)). We delete the correspondence 24 months after the last contact unless a contract follows or we must keep it for tax or legal reasons.
3.3 Business outreach on LinkedIn
We contact founders, managing directors and team leads of companies that work in remote or distributed teams, to offer our services. If we contacted you this way, this section is our information to you under Art. 14 GDPR.
- Source: your public LinkedIn profile and LinkedIn Sales Navigator (LinkedIn Ireland Unlimited Company), and publicly available information about your company.
- Data: name, job title, employer, company size, industry and location, profile address, the content and dates of our messages and your replies, whether a meeting was booked.
- Purpose: to identify people for whom our service is relevant, to contact you once with a short personal message and, if there is no reply, at most two short follow-ups, and to keep a record of the conversation so we do not contact you twice or after you have declined.
- Profiling: we sort contacts by role, company, size and location to decide whom to write to first. This has no legal or similarly significant effect on you, and no decision about you is made by automated means alone.
- Legal basis: our legitimate interest in business-to-business direct marketing (Art. 6(1)(f) and Recital 47 GDPR). We write only to people in a professional role, only about a professional topic, and stop as soon as you say no.
- Storage: in our own database (Supabase, hosted in the EU) and our LinkedIn tools.
- Retention: 24 months after our last interaction. If you object, we delete your data and keep only an irreversible code (a SHA-256 hash) of your name, email address and profile address on a suppression list, so that our systems recognise you and never contact or record you again (Art. 6(1)(c) and (f), Art. 17(3)(b)). The list holds no readable personal data.
3.4 Meetings and calls
You can book a call with us through Cal.com (Cal.com, Inc., USA). Your booking creates an entry in our Google Workspace calendar (Google Ireland Limited) with your name, email address, the time and the video link. We hold calls on Google Meet or, at a customer's choice, Microsoft Teams or Zoom. Legal basis: preparing or performing a contract (Art. 6(1)(b)) or our legitimate interest in business communication (Art. 6(1)(f)). We delete booking data 24 months after the last contact.
Recording only with consent. We record or transcribe a meeting only if every participant has agreed beforehand (Art. 6(1)(a) GDPR). We ask in the booking form and again at the start of the call. If anyone says no, nothing is recorded. When we record, our note-taking participant joins the call visibly under the name "24-6 Notetaker".
- Where it is processed: audio is transcribed on our own server in Germany with open-source speech recognition. No external transcription service receives the audio.
- What results: a transcript, a separation of who spoke when, and short audio snippets used to check that separation.
- Voice recognition: to label speakers by name we can create a voice profile, only with your explicit consent.
- Notification: after a meeting we receive a short email through our provider Resend (Resend, Inc., USA) with its start time, length, the names of identified participants and how much each speaker spoke. The transcript itself is never emailed.
- Analysis: see section 3.7 on AI.
- Retention: audio recordings and snippets 30 days after the meeting; transcripts and notes for the duration of the engagement or project, at most 24 months; voice profiles as above. You can withdraw consent at any time; we then delete the recording, the transcript and anything derived from them, except where you agreed to anonymised use that can no longer be linked to you.
3.5 Interviews
We interview leaders of remote teams to develop and improve 24/6. These interviews are commercial product research by The Branding Brand EOOD. Full information and the consent we ask for: interview and meeting participation.
3.6 Reservations, customers, payments and invoices
When you reserve a place or sign up, we process your name, email address, business name, address, country and VAT number, and the contract and communication with you. Your card details go directly to Stripe (Stripe Payments Europe, Limited, Ireland) and never reach our servers; we see only the card brand, the last four digits and the expiry date. Legal basis: the contract with you (Art. 6(1)(b)), and our legal duties under Bulgarian accounting and tax law (Art. 6(1)(c)). Stripe also processes data as an independent controller to prevent fraud and to meet its own legal duties; see stripe.com/privacy. We keep accounting records and invoices for up to 10 years as Bulgarian law requires, and other contract data until the end of the limitation period, normally 5 years after the contract ends.
When you use 24/6, the content you and your team enter (tasks, messages, meeting notes, strategy documents) is processed on your behalf under our data processing agreement. Your account data (users, roles, login, billing) is processed by us as controller under Art. 6(1)(b).
3.7 Artificial intelligence
We use AI models to summarise and analyse notes, transcripts and documents, to draft text and to write software. We use them as follows:
- Models: open-source models that run on our own hardware or on a GPU server we rent from Scaleway SAS (France) and delete after use; Claude by Anthropic (Anthropic Ireland, Limited, processing in the USA); and Gemini within Google Workspace (Google Ireland Limited).
- No training: for every external model, the provider's use of our inputs and outputs for training its models is switched off.
- Customer and partner data: confidential information of a customer goes only into tools that customer has approved in writing.
- No automated decisions: AI output informs our work. It never decides anything about you that has legal or similarly significant effects (Art. 22 GDPR), and a person checks every result we pass on.
- Transparency: where 24/6 lets you interact with an AI system, the interface says so (Art. 50 of Regulation (EU) 2024/1689, the AI Act).
3.8 Reviews
After a project we may ask you to review us on Trustpilot (Trustpilot A/S, Denmark). For this we pass your name, email address and a reference number to Trustpilot, which sends you one invitation. Legal basis: our legitimate interest in customer feedback (Art. 6(1)(f)). You can object at any time; whether you write a review is up to you. Trustpilot's own processing: trustpilot.com/legal/privacy-policy.
3.9 Applications
If you apply to work with us, we process your application documents and our interview notes to decide on the application (Art. 6(1)(b) GDPR and Art. 88 GDPR with applicable national employment law). We delete them 6 months after the end of the process unless you agree to a longer period or you are hired.
3.10 Internal tools
To run our business we use Google Workspace (email, calendar, documents), Slack and WhatsApp (messaging), Notion (notes), Granola (meeting notes in calls we hold ourselves, only with the consent described in 3.4), GitHub (source code), Microsoft Azure (email automation) and a Telegram bot that files our own business documents. Personal data enters these tools only as far as needed for the purposes in this policy.
3.11 Scientific research
We study how remote teams coordinate their work. For this research, including academic theses and publications, we may use data from the activities in this policy (including meeting notes, interviews and records of how our services are used) in pseudonymised form. We keep research data separate and restricted, never use voice profiles or other special categories of data for it, and publish results only in anonymised or aggregated form that identifies no person and no organisation. In the same anonymised form we may use meeting content in our marketing, for example in LinkedIn posts. Legal basis: our legitimate interest in scientific research and in marketing (Art. 6(1)(f), Art. 89 GDPR); for data from a customer's workspace, also the customer's permission under the DPA. You can object at any time (Art. 21(1) and (6)); we then exclude your data from research not yet published.
4. Recipients
We do not sell personal data and do not share it for advertising. Recipients are:
- Processors bound by an agreement under Art. 28 GDPR. The current list with locations: sub-processors.
- Independent controllers where you use their service or the law requires it: LinkedIn, Stripe, Trustpilot, banks, our accountant and tax advisers (bound to professional secrecy), courts and authorities where we are legally obliged.
5. Transfers outside the EU
Some providers are in the USA or process data there. We transfer data to them only on the basis of an adequacy decision, in particular the EU-U.S. Data Privacy Framework for certified providers (Art. 45 GDPR), or of the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) together with the additional safeguards the provider offers. For people in the United Kingdom, the UK Extension to the Data Privacy Framework or the UK International Data Transfer Addendum applies. You can ask us for a copy of the safeguards at contact@m246.org.
6. How long we keep data
We delete personal data as soon as the purpose for which we hold it has ended, using the periods stated above. Where the law requires us to keep data longer (in particular accounting and tax records), we restrict it to that use. Backups rotate: we keep the most recent 30 of each kind and delete older ones. A backup is never restored into our live systems without first repeating every deletion made since it was taken.
7. Your rights
You have the right to:
- access your data and receive a copy (Art. 15);
- have incorrect data corrected (Art. 16);
- have your data erased (Art. 17);
- have processing restricted (Art. 18);
- receive data you provided in a common machine-readable format (Art. 20);
- object to processing based on legitimate interests and to direct marketing (Art. 21, see the box at the top);
- withdraw any consent at any time with effect for the future, as easily as you gave it (Art. 7(3));
- lodge a complaint with a supervisory authority (Art. 77), in particular the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg, or the authority where you live or work, for example the Hamburg Commissioner for Data Protection and Freedom of Information in Germany or, in the United Kingdom, the Information Commissioner's Office.
Write to contact@m246.org. We answer within one month (Art. 12(3)) and may ask you to confirm your identity first. Exercising your rights is free.
8. Do you have to give us your data?
No law obliges you to. Without the data marked as required in a form we cannot conclude or perform a contract with you, and without your consent we do not record you. You can always talk to us without being recorded.
9. Security
We protect personal data with the technical and organisational measures described in technical and organisational measures, including full-disk encryption, encrypted backups, encrypted connections and strict access limits.
10. Changes
We update this policy when our processing changes. The version and date are at the top. If a change affects a processing based on your consent, we ask again.