Skip to content

Privacy & Cookie Policy

Brixon Group Ltd · Last updated: 27 October 2026

1. Controller

This policy covers the Brixon AI website and related enquiries, services, applications and events. The controller is:

Brixon Group Ltd
Level 4, Centris Business Gateway, Triq Is-Salib Ta' L-Imriehel,
Birkirkara CBD 3020, Malta
Email: info@brixongroup.com

2. Website operation and security

To provide and secure the website, we process IP addresses, access and usage data, browser and device information and error data. We use Cloudflare, including Turnstile to protect against automated abuse. The basis is our legitimate interest in a secure, reliable website (Article 6(1)(f) GDPR).

We load fonts through Adobe Fonts for consistent presentation. Adobe receives your IP address and the domain visited. The basis is our legitimate interest in consistent, readable presentation (Article 6(1)(f) GDPR). Provider information:Cloudflare andAdobe Fonts.

3. Enquiries, downloads and applications

We process contact and company details and submitted content to handle enquiries, provide requested materials and communicate about business matters. Applications include application documents and employment preferences. Grant enquiries additionally involve project and financial details and calculation results.

The basis is Article 6(1)(b) GDPR for requested pre-contractual steps. General enquiries and contacts on behalf of an organisation rely on our legitimate interest in business communication (Article 6(1)(f) GDPR). Required details are marked; without them, we may be unable to process the request. We use Cloudflare, Attio and Brevo for storage, contact management and email delivery.

4. Appointments and meeting recordings

To arrange appointments and conduct online meetings, we process contact, booking and connection details and shared meeting content through Calendly and Microsoft Teams. The basis is Article 6(1)(b) GDPR or, for contacts on behalf of an organisation, our legitimate interest in business communication (Article 6(1)(f) GDPR).

With separate consent (Article 6(1)(a) GDPR), we use Fireflies.ai, provided by Fireflies.ai Corp., for audio and video recordings, transcripts and summaries for internal meeting documentation. Participant details and meeting content are processed. Provider information:Calendly,Microsoft andFireflies.ai.

5. Events and payments

For events, we process contact, company, registration and attendance details and optional information for preparing the content. This supports delivery of the event and related materials and participation-related communication under Article 6(1)(b) GDPR. For contacts on behalf of an organisation, the basis is our legitimate interest in event administration and communication (Article 6(1)(f) GDPR). Administration and communication use the services listed in section 3; promotional messages are covered by section 6.

To maintain data quality for certain registrations, OpenRouter and connected AI service providers process names, company websites and email domains (legitimate interest in accurate registration details, Article 6(1)(f) GDPR). This check does not make a final decision about your registration.

We process payment, billing and order data with Stripe to perform contracts (Article 6(1)(b) GDPR) and meet statutory accounting and tax obligations (Article 6(1)(c) GDPR). Stripe also acts as a controller for fraud prevention and legal compliance. Further information: Stripe.

6. Email marketing and contact management

We use contact details and information about interests for information, offers and invitations. Promotional emails rely on your consent (Article 6(1)(a) GDPR) or, where applicable law permits sending without consent, our legitimate interest in direct marketing (Article 6(1)(f) GDPR). Maintaining business relationships also relies on this legitimate interest. You can unsubscribe at any time using the unsubscribe link or by contacting us.

We use Brevo for delivery. Processing covers recipient details, message content, delivery information, preferences and necessary consent and opt-out records.

7. Website analytics and session replay

With your consent (Article 6(1)(a) GDPR), we use PostHog Cloud EU (Frankfurt) and Google Analytics 4 to analyse and improve the website. Processing covers usage and interaction data, technical identifiers, device and browser information, traffic sources and error data. This includes evaluating different versions of content.

PostHog enables replay of website activity to analyse usability problems. Form inputs are masked and selected sensitive content is blocked; sound and camera images are not recorded. Separately submitted details are covered by the other processing described in this policy. Provider information: PostHog andGoogle.

8. Advertising and measurement

With marketing consent (Article 6(1)(a) GDPR), we use Meta Pixel, LinkedIn Insight Tag and Google advertising services, including DoubleClick, for advertising measurement, audience creation and personalised advertising. Processing covers usage and event data, IP addresses, device information, online identifiers and campaign data. Providers may link this data to existing user accounts.

With your consent (Article 6(1)(a) GDPR), measurement may also involve linking contact, company, registration, booking and purchase data with website activity and customer records through PostHog and, with marketing consent, disclosing it to the advertising providers named above. LinkedIn additionally provides aggregated reports on professional visitor groups.

Provider information and advertising choices:Meta Platforms Ireland Limited,LinkedIn Ireland Unlimited Company andGoogle. Where joint controllership with Meta applies to the collection and transmission of event data, responsibilities are allocated in itsController Addendum. LinkedIn is covered by itsIndependent Controller Addendum. You can exercise your rights concerning our processing by contacting us.

9. Cookies and your choices

We use cookies and local browser storage for necessary functions and, with your consent, for analytics and advertising. Strictly necessary storage or access does not require consent. The following lifetimes apply:

  • Language: up to 365 days; workshop access: up to 60 days.
  • Privacy preferences: cookie up to 400 days; local storage without automatic expiry.
  • Analytics identifiers and Google Analytics cookies: up to 400 days; additional PostHog cookies: up to 365 days.
  • Meta advertising cookies: up to 90 days.
  • Campaign identifiers: used for up to 90 days, then removed on the next access; new campaign data can restart the period.
  • Grant calculator drafts: local storage without automatic expiry.

Lifetimes may be extended through renewed use. Further provider cookies are described in the linked provider notices andLinkedIn cookie table. Use Cookie Settings in the footer to change your consent or chooseReject all. You can also delete cookies and local data in your browser. Retention of data already transmitted is covered by section 11.

10. Recipients and international transfers

Recipients include the service providers used for the purposes described above and, where necessary, professional advisers and competent authorities. Providers act as processors or, particularly for payment and advertising services, as controllers for their own purposes. We do not provide contact details to external co-organisers or partners for their own marketing.

Providers and subprocessors may process data outside the EEA, particularly in the USA. Transfers rely on applicable adequacy decisions (Article 45 GDPR) or appropriate safeguards (Article 46 GDPR), particularly EU Standard Contractual Clauses with any necessary supplementary measures. The EU–US Data Privacy Framework applies only to recipients covered by a valid certification. For information about the applicable safeguards and a copy, contact info@brixongroup.com.

11. Retention

Our standard retention period for enquiries without a subsequent contract, applications and event registration and attendance data is one year, with reference to completion of the enquiry, recruitment process or event-related service. Meeting recordings and transcripts are retained for one year from recording.

Contract and billing data is retained for contract performance and statutory retention periods. Marketing data is used for the duration of the relevant permission; necessary evidence and suppression records may be kept longer to respect opt-outs and demonstrate lawful processing.

Analytics, session replay and advertising measurement data is retained to evaluate the website and relevant campaigns, taking account of the evaluation purpose, level of detail and whether aggregated data is sufficient. Security data is retained to investigate and resolve incidents. We then delete or anonymise it unless statutory obligations or a need to establish or defend legal claims require further retention.

12. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

You can object to processing based on legitimate interests on grounds relating to your particular situation. You can object to direct marketing and associated profiling at any time.

Contact info@brixongroup.com to exercise your rights. You can complain to a supervisory authority, particularly where you live or work or where the alleged infringement occurred. In Malta, this is theInformation and Data Protection Commissioner.

13. Contact and updates

For privacy questions, contact info@brixongroup.com. The date above identifies the current version of this policy.