Last updated: September 10, 2025
This Privacy Policy forms an integral part of the General Terms and Conditions of Service governing the use of the BRADsearch solution. It describes how UAB Invertus, operating the BRADsearch solution (hereinafter "BRADsearch", "we", "our", or "us"), collects, uses, discloses, and safeguards the personal data of individuals who interact with our Services through the website bradsearch.com and its subdomains.
We are committed to ensuring transparency and accountability in compliance with the General Data Protection Regulation (GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, and other applicable data protection laws.
This Policy is complementary to our General Terms and Conditions of Service. Please review those documents for a full understanding of our data protection and Service responsibilities.
The data controller responsible for processing your data is:
We collect and process personal data in our capacity as a data controller for the purposes described in this Privacy Policy, and in certain cases as a data processor acting on behalf of our clients - details of which are governed by our Data Processing Agreement (DPA).
We collect and process personal data either:
In these cases, we act either as:
We do not use client-submitted personal data (such as merchant clients records or search queries) for our own purposes, unless explicitly instructed by the client in accordance with the DPA.
We may process personal data from the following groups of individuals:
Depending on your relationship with us, we may process the following categories of personal data:
In some cases, we may also process pseudonymized or aggregated platform usage data to improve service performance, reliability, and security.
As part of delivering the BRADsearch service, we may process personal data that our clients upload or generate during use of the BRADsearch (e.g., product catalog content, search and result logs, behavioral data, or client queries).
In these cases:
This processing is strictly governed by the terms of our Data Processing Agreement (DPA), which defines our obligations, security measures, and limitations.
Our services are not intended for individuals under the age of 18. We do not knowingly collect or process personal data from children. If we become aware that we have received such data without valid consent, we will delete it promptly.
We process personal data based on the lawful grounds outlined in the General Data Protection Regulation (GDPR). The table below shows the main purposes and corresponding legal bases:
| Purpose | Legal Basis |
|---|---|
| Handling contact requests and inquiries from prospective clients | Art. 6(1)(b) GDPR - Pre-contractual measures; Art. 6(1)(f) GDPR - Legitimate interest |
| Registering and managing client accounts | Art. 6(1)(b) GDPR - Contract performance |
| Providing and improving our Services | Art. 6(1)(b) and 6(1)(f) GDPR |
| Managing billing, invoicing, and payment operations | Art. 6(1)(b) and 6(1)(c) GDPR |
| Sending transactional or Service-related notifications | Art. 6(1)(f) GDPR - Legitimate interest |
| Conducting direct marketing (only if you have opted in) | Art. 6(1)(a) GDPR - Consent |
| Maintaining IT and platform security | Art. 6(1)(f) GDPR - Legitimate interest |
| Complying with legal obligations (e.g., tax, accounting, data retention) | Art. 6(1)(c) GDPR - Legal obligation |
We will never use your data for profiling or automated decisions without your consent.
We do not sell or rent your personal data. We share data strictly as necessary and only with parties that are bound to data protection obligations consistent with GDPR.
We may share your data with the following categories of recipients:
All third parties processing your personal data on our behalf are bound by GDPR-compliant Data Processing Agreements (DPAs), as required by Article 28 GDPR. In certain cases, when using integrations or analytics tools (e.g., with marketing platforms), BRADsearch and the third party may act as joint controllers under Article 26 GDPR. In such cases, we ensure that appropriate agreements and transparency obligations are in place.
For more details, check our Data Processing Agreement (DPA).
Your data may be transferred to countries outside the European Economic Area (EEA) where adequate safeguards are in place, only if:
We retain your personal data only for as long as necessary, including for the following purposes:
Additionally, where we act as a data processor on behalf of our business clients, such processing is governed by a dedicated Data Processing Agreement (DPA) in accordance with Article 28 of the GDPR.
You have the following rights under the GDPR:
To exercise these rights, contact us at legal@invertus.eu with proof of your identity.
We implement appropriate technical and organizational measures to ensure the confidentiality, integrity, and availability of your data, including:
We will send marketing emails or promotional messages only with your prior consent. You may unsubscribe at any time via the link in our emails or by contacting us.
We use cookies and similar tracking technologies to:
Please refer to our separate Cookies Policy for full details, including the types of cookies used, purposes, and how you can manage your preferences.
Our website may contain links to third-party websites. We are not responsible for their data practices. You are encouraged to review their privacy policies before providing personal data.
We may update this Privacy Policy to reflect legal, technical, or operational changes at any time. All updates will be published on this page and indicated with a revised "Last updated" date. If material changes affect your rights, we will notify you via email or by prominently displaying on our website.
For any questions or concerns regarding this Privacy Policy, please contact our support or: