GDPR Compliance

1. Our Role

BryteCast acts as a Data Controller for account and billing data, and as a Data Processor for content uploaded to your screens by you or your team.

2. Lawful Bases for Processing

• Contract — to deliver the services you sign up for.
• Legitimate interests — to secure, improve and support the platform.
• Legal obligation — to meet tax, accounting and regulatory duties.
• Consent — for optional cookies and marketing communications.

3. Your Rights Under GDPR

If you are located in the EU, EEA or UK, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Request erasure (the “right to be forgotten”)
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time
• Lodge a complaint with your supervisory authority

To exercise any of these rights, email hello@brytecast.com. We respond within 30 days.

4. Data We Process

• Account identifiers (name, email, workspace, role)
• Billing and subscription metadata
• Uploaded content and screen configuration
• Authentication, device and usage logs

5. International Data Transfers

Where personal data is transferred outside the UK or EEA, we rely on adequacy decisions or EU Standard Contractual Clauses (SCCs) with appropriate supplementary measures.

6. Sub-processors

We engage a small number of vetted sub-processors to operate BryteCast, including:

• Cloud infrastructure and database hosting
• Payment processing
• Transactional email delivery
• Product analytics and error monitoring

A current list is available on request.

7. Data Retention

We retain personal data only for as long as necessary. Closed accounts are archived for 6 months to allow reactivation, then permanently deleted.

8. Data Processing Agreement (DPA)

Business and Growth customers can request a signed Data Processing Agreement by emailing hello@brytecast.com.

9. Security

BryteCast uses encryption in transit (TLS 1.2+), encryption at rest, role-based access controls, and row-level security on all customer data.

10. Data Breach Notification

In the unlikely event of a personal data breach, we will notify affected customers and the relevant supervisory authority within 72 hours as required by GDPR.

11. Contact

For GDPR enquiries or to exercise your rights, contact hello@brytecast.com.