Legal

Brite Legal Documentation

Welcome to Brite. To ensure compliance with the General Data Protection Regulation (GDPR) and the Telecommunications Act, we have divided our legal and operational guidelines into three separate, binding documents: the Terms and Conditions, the Privacy Policy, and the User Policy. By using our website and services, you agree to the provisions that apply to you.

Terms and Conditions

Article 1. Applicability and Business Use 1 .1 These General Terms and Conditions apply exclusively to all offers, agreements, and business services provided by Brite, as well as to the use of the Brite platform (Business-to-Business). Our services are designed exclusively for and aimed at communication with legal entities (such as private limited companies and public limited companies). 1.2 The Customer is expressly prohibited from using the functionalities of the Brite platform to make unsolicited commercial approaches to natural persons—including consumers, sole proprietorships, general partnerships (VOFs), and professional partnerships—without prior, explicit, and demonstrable consent.

Article 2. Data Processing Agreement and Subprocessors 2 .1 To the extent that the Customer processes personal data via Brite’s platform (including, but not limited to, uploading lead lists), the Customer acts as the data controller and Brite as the data processor within the meaning of the GDPR. A Data Processing Agreement, in accordance with Article 28 of the GDPR, forms an integral part of the agreement between Brite and the Customer. 2.2 Brite is entitled to use carefully selected sub-processors for the performance of its services, including Salesforce (for Web-to-Lead data and customer relationship management) and ScoreApp (for data processing and compliance assessments). If personal data is processed outside the European Economic Area (EEA), Brite guarantees that this will take place exclusively under appropriate legal safeguards, such as the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCCs) approved by the European Commission.

Article 3. Liability and Indemnification 3 .1 The Customer bears full and exclusive legal responsibility for the lawfulness, origin, and use of the processed data within its marketing campaigns. 3.2 The Customer unconditionally and fully indemnifies Brite against all third-party claims, claims, damages incurred, and administrative fines imposed by regulatory authorities (such as the Netherlands Authority for Consumers and Markets or the Dutch Data Protection Authority) that arise directly or indirectly from the sending of unsolicited electronic messages (spam), violations of the Telecommunications Act, or the absence of a properly documented assessment of legitimate interest (LIA).

‍

Privacy Policy

In this Privacy Policy, Brite explains in a transparent manner, in accordance with Articles 13 and 14 of the GDPR, how, for what purposes, and on what legal grounds we process your personal data.

1. Processing Activities, Purposes, and Legal Bases Brite bases all processing of personal data on one of the legal bases set forth in the GDPR:

  • Website Functionality and Log Files (Legitimate Interest): To ensure the security and proper functioning of the Brite website, we process technical data (such as IP addresses) in log files.
  • Cookies and Tracking (Consent): Analytical and marketing cookies (including Google Analytics and the LinkedIn Insight Tag) are placed on your device only after you have given your explicit consent (opt-in) via our cookie banner.
  • B2B Acquisition (Legitimate Interest / Consent): If Brite contacts employees of legal entities (BVs/NVs) unsolicited via email, this is done based on our legitimate interest. For this purpose, we always conduct a Legitimate Interest Assessment (LIA) in advance in accordance with the current EDPB guidelines (1/2024), carefully weighing the necessity of the processing and the reasonable expectations of the recipient. When contacting natural persons (including self-employed individuals and sole proprietors), Brite relies exclusively on prior explicit consent.

2. Tools and Data Sharing with Third Parties Brite shares personal data with external technology partners to optimize our services:

  • Salesforce: Information you enter via our contact form (Web-to-Lead) is immediately forwarded to and securely managed in our Salesforce CRM system.
  • ScoreApp: We use ScoreApp to facilitate online assessments and the associated data processing.
  • LinkedIn Insight Tag: Provided you have given your consent, we use this tool for retargeting and measuring conversions. Your data is shared with LinkedIn for this purpose. Important warning regarding AI: By default, LinkedIn may use collected profile data to train generative AI models. If you object to this, Brite recommends that you manually disable this feature in your LinkedIn account settings. Brite itself does not use high-risk AI applications without the required documentation and transparency.
  • Leadinfo: Brite uses Leadinfo’s B2B IP tracking software to identify business website visitors. This shows us only company names; no individuals or remote workers are identified, and the IP address is deleted immediately after identification.

‍

User Policy

This User Policy establishes the mandatory rules of conduct for Brite employees, customers, and licensees regarding direct marketing and lead generation through our platform.

1. The Dual Regime: Channels and DataWhendesigning and implementing a campaign, you are required to strictly and simultaneously comply with both the regulations governing communication channels (Art. 11.7 of the Telecommunications Act) and the regulations governing data lawfulness (GDPR).

2. Selection of Target Groups (Legal Form)

  • B2B Approach (Legal Entities): It is permitted to send unsolicited emails or make unsolicited phone calls to legal entities (such as private limited companies, public limited companies, and foundations) without prior consent, provided that the offer is business-related and you offer a clear opt-out option (right to object) immediately upon first contact.
  • Protected Business Owners (Individuals): It is strictly prohibited to cold-call or email individuals—including consumers, self-employed individuals, sole proprietorships, general partnerships, and professional partnerships. Explicit, prior consent (opt-in) is required at all times for this target group. Please note: As of July 1, 2026, the legal exception allowing contact with this group by telephone based on an existing customer relationship will be completely abolished.

3. Identity, Transparency, and Unsubscribing

  • You must never communicate under a fictitious name or use a hidden (anonymous) phone number.
  • Every commercial email must include a frictionless, one-click unsubscribe link (implemented via the List-Unsubscribe header in accordance with RFC 8058).
  • When a prospect opts out, you are not permitted to simply delete the data from your CRM. The contact information must be centrally recorded on a suppression list (opt-out list). This ensures that the person in question is not accidentally contacted again in the event of any new data imports.

4. Purchased Data and the Duty to Provide Information (Art. 14 GDPR) If you use data sets that have been purchased, rented, or obtained through web scraping, you must comply with the active duty to provide information. You are required to transparently inform the recipient, in the very first message, of the specific source from which the data was obtained. In the event of questions, requests for access, or complaints, you must be able to provide the data subject with the origin of the data within one business day.

5. Call Recordings (Voice Logging) Secretly (unnoticed) recording telephone calls is strictly prohibited. If you wish to record phone calls for training or quality assurance purposes, the prospect must be verbally informed of this immediately at the start of the call. A mere mention of call recording in the terms and conditions is legally insufficient.

‍