privacy policy
Privacy Policy, Data Protection Notice
Brand Activator Academy
This notice explains how personal data is processed in the Brand Activator Academy training platform (the "Platform"). It sets out what data we collect, why we use it, how long we keep it, who we share it with, and the rights you have under the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
1. Who we are (Controller)
The controller responsible for the processing of your personal data in the Brand Activator Academy platform is:
act.3 GmbH Käthe-Dassler-Straße 2, 91074 Herzogenaurach, Germany Website: https://www.weareact3.com
Throughout this notice, "we", "us", "the Company", and "Brand Activator Academy" refer to the controller named above.
2. Data protection contact
For any questions about this notice or about how we handle your personal data, or to exercise your rights, contact us at:
Data protection contact: data.protection@weareact3.com
3. What this platform is
Brand Activator Academy is an internal online training platform. We use it to onboard and train employed company personnel like Brand Activators, who represent brands at events, and to allow managers and executives to assign training courses and view completion reports. It is a workplace tool for our staff and personnel. It is not a public or consumer product, and it is not open to registration by the general public.
4. What personal data we process
We process only the personal data needed to run the training platform and keep training records. Specifically:
| Category | Examples |
|---|---|
| Identity data | Full name |
| Contact data | Work email address |
| Authentication data | Sign-in is by email and password. Your password is stored only as a secure cryptographic hash, we never store or see your plaintext password |
| Training records | Quiz attempts, scores, section/course completion status, progress |
| Course assignment data | Courses assigned to you |
| Invitation data | Records relating to your invitation to the platform |
| Usage/session data | Last-active timestamps; session information needed to keep you logged in |
We do not process:
- special categories of personal data (Art. 9 GDPR, e.g. health, ethnicity, religion, trade-union membership);
- health, financial, or payment/card data;
- marketing profiles, behavioural advertising data, or tracking-based profiling.
5. Why we process it and on what legal basis
We process your personal data for the following purposes and on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing you with access to the platform; authenticating your login; managing your account | Art. 6(1)(b) GDPR (performance of / steps in your employment or engagement relationship) and § 26(1) BDSG (processing for the purposes of the employment relationship) |
| Delivering mandatory training; recording quiz attempts, scores, completion and progress; assigning courses; producing completion reports for managers | § 26(1) BDSG and Art. 6(1)(b) GDPR (carrying out and documenting the training that forms part of your role) |
| Managing invitations and onboarding | § 26(1) BDSG and Art. 6(1)(b) GDPR |
| Keeping the platform secure, preventing misuse, and maintaining records of training for accountability | Art. 6(1)(f) GDPR, our legitimate interest in a secure, auditable training system, balanced against your interests |
| Complying with legal obligations (e.g. mandatory brand/safety/compliance training or record-keeping where required) | Art. 6(1)(c) GDPR (legal obligation), where applicable |
Training on this platform is mandatory as part of your role. Because it is a requirement of your engagement, not something you can freely decline without consequence, we do not rely on your consent (Art. 6(1)(a) GDPR) as the legal basis. This means you cannot "withdraw consent" to stop the core processing; instead, your rights are as set out in Section 9.
6. Who has access to your data
Within the Company, access is limited to those who need it for the purposes above, principally you (your own records), and the managers and executives responsible for assigning your training and reviewing completion reports, together with authorised administrators and IT/security staff.
7. Processors and sub-processors
We use the following service providers to operate the platform. Each processes personal data only on our documented instructions, under a data processing agreement (DPA) pursuant to Art. 28 GDPR:
| Provider | Role | Location | Safeguards |
|---|---|---|---|
| Vercel | Application hosting | Served from an EU region | Art. 28 DPA; for any transfer to the US: EU Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework |
| Supabase | Managed database and file storage | Frankfurt / EU region | Art. 28 DPA; SCCs and/or the EU-US Data Privacy Framework for any US transfer |
| Resend | Sending transactional invitation emails | EU region | Art. 28 DPA; SCCs and/or the EU-US Data Privacy Framework for any US transfer |
We do not sell your personal data and do not share it with third parties for their own marketing.
8. Storage location and international transfers
Your data is hosted in the EU (Frankfurt).
Some of our processors are US-headquartered companies. Even where data is stored in the EU, this can involve a transfer of personal data to, or access from, a country outside the EU/EEA. Where that happens, the transfer is safeguarded by EU Standard Contractual Clauses (Art. 46 GDPR) and/or certification under the EU-US Data Privacy Framework. We use only the data necessary for training administration, and no special-category, health, financial or payment data is processed on the platform.
You may request a copy of the relevant transfer safeguards using the contact details in Section 2.
9. Your rights
Subject to the conditions in the GDPR, you have the right to:
- Access (Art. 15), obtain confirmation of, and a copy of, the personal data we hold about you;
- Rectification (Art. 16), have inaccurate or incomplete data corrected;
- Erasure (Art. 17), have your data deleted, where the legal conditions are met (note that we may need to retain training records to meet our obligations, see Section 10);
- Restriction (Art. 18), have processing restricted in certain circumstances;
- Data portability (Art. 20), receive certain data you provided in a structured, commonly used, machine-readable format, where processing is based on Art. 6(1)(b) and carried out by automated means;
- Object (Art. 21), object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) (legitimate interests).
Because the platform involves no automated decision-making that produces legal or similarly significant effects, the specific safeguards of Art. 22 do not apply here (see Section 12).
How to exercise your rights: contact us using the details in Section 2. We will respond within the statutory time limit (generally one month, extendable under Art. 12(3) GDPR). Exercising these rights is free of charge in normal cases.
10. How long we keep your data
We keep your personal data, including your account data and training records (quiz attempts, scores, completion and progress), until one year after the later of (a) the last use of your account and (b) the end of your engagement with the Company. After that period, the data is deleted or anonymised.
Where we are under a legal obligation to retain certain records for a longer period, we will keep them only for as long as, and only to the extent that, the obligation requires.
11. How we protect your data
We apply appropriate technical and organisational measures (Art. 32 GDPR), including:
- Encryption in transit (TLS) for connections to the platform;
- Passwords stored only as secure cryptographic hashes, never in plaintext;
- Database access restricted to the server/application (no direct public database access);
- Hosting within the EU (Frankfurt);
- Login cookies set as
httpOnlyto reduce the risk of client-side theft; - Access limited to authorised personnel on a need-to-know basis.
12. No automated decision-making
We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. Completion status and scores are recorded and shown to you and your managers, but decisions about your role or engagement are taken by people, not by the platform.
13. Cookies
The platform uses strictly-necessary login cookies only, to keep you securely logged in:
| Cookie | Purpose | Type |
|---|---|---|
ba_session | Maintains the login session for Brand Activators | Strictly necessary, first-party, httpOnly cookie; expires 7 days after being set |
mgr_session | Maintains the login session for managers and executives | Strictly necessary, first-party, httpOnly cookie; expires 7 days after being set |
cookie_notice_ack | Remembers that you have seen the cookie notice | Strictly necessary, first-party preference cookie; stores no personal data; expires 6 months after being set |
These cookies are essential for the platform to function and to keep your login secure. Under § 25(2) TDDDG and the ePrivacy rules, strictly-necessary cookies of this kind do not require your consent, but we disclose them here for transparency. We do not use analytics, advertising, or third-party tracking cookies. Because only strictly-necessary cookies are used, we do not ask for your consent; for transparency, a short informational cookie notice is shown when you first enter the platform, linking to this notice.
14. Do you have to provide this data?
Providing the data described in Section 4 is necessary to use the platform and to complete the training that forms part of your role. If you do not provide it, we will not be able to give you access to the platform or record your mandatory training, which may affect your ability to carry out your role.
15. Your right to complain
If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with a data protection supervisory authority. You may contact the competent data protection supervisory authority in your country or in the Company's country, or the supervisory authority in your EU country of residence or workplace.
16. Changes to this notice
We may update this notice from time to time, for example, when we change service providers or add features. We will publish the current version on the platform and, where changes are material, notify affected users.
Last updated: 12 August 2026