MultiBrand Privacy Policy
1. Controller and privacy contact
The controller is MultiBrand Ltd, 42 Knyaz Alexander I°, 4000 Plovdiv, Bulgaria, VAT BG200118659.
For privacy questions and requests, contact roberto@multibrand.net.
Business WhatsApp: +39 345 351 1710.
2. Scope and information we handle
This policy covers multibrand.net, professional enquiries by email, WhatsApp and WeChat, the GipiStyle AI-assisted WhatsApp service and our email newsletter. Our business concerns international wholesale opportunities in fashion, footwear and accessories.
Depending on how you contact us, we handle:
- your name, company, professional role, email address, telephone number and messaging identifiers;
- messages, relevant documents and the commercial requirements you provide, including brands, quantities, prices or budgets and destination markets;
- relevant conversation summaries used to maintain commercial context;
- message identifiers and dates, delivery/error records, requests for a person, automation pause/STOP status and records of notices and choices;
- newsletter registration and confirmation information, subscription status, delivery information, unsubscribe records and opening/click activity;
- website and security information, such as IP addresses, browser/device information and technical timestamps.
We generally receive this information from you. A colleague or business partner may introduce you or provide your professional details. Where information comes from another source, we provide the applicable information about that source and our processing within the required timeframe. Public availability of contact details does not itself authorise marketing.
Please do not send passwords, payment-card details, identity documents or sensitive personal information in an ordinary commercial message.
3. Purposes and legal bases
| Purpose | Legal basis and limits |
|---|---|
| Answer professional enquiries and manage commercial relationships | Legitimate interests in communicating with business contacts and operating our B2B activity, Article 6(1)(f) GDPR. |
| Take requested steps towards or perform a contract directly with you as an individual | Article 6(1)(b), only where you personally are the prospective/actual contracting party and the processing is necessary. A contract with your employer does not automatically establish this basis for your data. |
| Provide AI-assisted service, retain relevant conversation context and route enquiries to a person | Legitimate interests in providing and managing AI-assisted responses to professional enquiries, Article 6(1)(f). |
| Operate and protect the website, prevent abuse and duplicates, investigate delivery failures and honour service preferences | Article 6(1)(f), limited to what is proportionate for these purposes. |
| Send subscribed newsletters and commercial updates | Consent, Article 6(1)(a), together with applicable national electronic-marketing rules. No customer exception is assumed without a separate assessment. |
| Measure newsletter openings and clicks at recipient level | Consent where required by applicable rules; subscription does not automatically establish a separate tracking permission. |
| Keep records required by law or handle legal claims | Article 6(1)(c) for identified applicable obligations; Article 6(1)(f) where necessary for legal claims. |
Contacting us for information, including through the website's pre-filled WhatsApp message, does not itself subscribe you to marketing or establish marketing consent.
4. WhatsApp, Make and OpenAI
GipiStyle is MultiBrand's AI-assisted commercial assistant. WhatsApp Business services carry messages; Make coordinates the workflow and maintains service records; OpenAI API services process relevant text to generate replies, classify service requests and prepare summaries.
Relevant messages and commercial summaries may be sent to OpenAI. They may contain personal information supplied in the conversation. Summaries are not necessarily anonymous. Make may also hold message payloads, operational records and incomplete executions for troubleshooting and reliable delivery.
Replies may be sent automatically and are not necessarily checked by Roberto before delivery. GipiStyle is intended to support enquiries and gather requirements. Binding commercial decisions, confirmed orders and contractual commitments require human approval. The intended system does not make solely automated decisions with legal or similarly significant effects on individuals.
You can ask for Roberto or human assistance in the conversation. Automated replies can be paused for your contact while Roberto takes over; resumption applies to new messages rather than retrospectively answering a message received during the pause. Sending STOP stops automated WhatsApp replies. Alternatively, email roberto@multibrand.net to contact us outside the WhatsApp AI workflow. A human-assistance request made inside WhatsApp may itself be processed by the workflow before being routed.
STOP does not automatically erase existing records or unsubscribe you from a separate newsletter. You can make a broader objection or deletion request using the privacy contact above; we assess the scope of the request rather than requiring a particular command.
OpenAI states that API inputs/outputs are not used for model training by default unless the customer opts in. Storage and security/abuse-monitoring retention depend on the service, account controls and applicable exceptions. The workflow's response-storage setting is not a promise of zero retention.
5. Newsletter and Rapidmail
We use Rapidmail to manage and deliver B2B stock opportunities, current-season collections, pre-orders and related commercial updates.
The website's registration form requests a contact name, company name and business email. The configured process sends an email asking you to confirm the subscription. Registration/confirmation evidence may include IP addresses and timestamps. Newsletter registration is optional and separate from receiving an answer to an enquiry.
Our current Rapidmail configuration has personal opening and click tracking enabled. This can associate newsletter interactions with a recipient and support statistics and activity-based selection. Opening measurements may be affected by email-client privacy tools and are not necessarily proof that a person read a message.
You can unsubscribe using the newsletter's unsubscribe facility or contact roberto@multibrand.net. Withdrawal does not affect earlier lawful processing. A general request to stop marketing must be handled across relevant lists.
6. Providers and disclosures
Authorised MultiBrand personnel and relevant providers access information as needed for their functions:
| Provider/service | Function and relevant information |
|---|---|
| Aruba | Website hosting and business email, including correspondence and internal assistance notifications. |
| WhatsApp/Meta | Business messaging, message content and associated service identifiers/metadata. |
| Make | Workflow routing, contact memory, control records, notifications and execution/error data. |
| OpenAI | Relevant conversation content, commercial context, generated replies and summaries through API services. |
| Rapidmail | Subscription management, confirmation records, sending, delivery and personal opening/click statistics. The provider's public documentation identifies Positive Group Deutschland GmbH. |
| CaptchaFox / Scoria Labs GmbH | Protection of the newsletter form against bots and abuse. |
| Google Analytics | Former website audience measurement; disabled on 26 October 2026. Previously collected data may remain in the Analytics property; see section 7. |
| Messaging where you choose that channel; its operator also processes platform information under its own terms. |
Provider roles depend on the activity. Some act as processors for our service data and independently for their own platform/security purposes. Relevant information may also be disclosed to professional advisers or authorities where needed. Any sharing of identifiable contacts with a buyer, supplier, agent or international office must be necessary for the particular matter and covered by the relevant information and safeguards.
7. Website measurement and CAPTCHA
Google Analytics property G-GJ1QYNTRPW was disabled on the website on 26 October 2026. The Google tag, configuration and custom analytics events were removed from the six main language pages and their shared JavaScript. No GA4 requests were observed during the post-release page and interaction checks.
This change stops the checked website integration from collecting new events. It does not automatically erase previously collected Analytics data or cookies already stored in visitors' browsers. Historical Google Analytics retention and any later deletion remain to be reviewed. This policy does not describe the website as cookie-free: hosting and embedded-service technologies must still be described accurately.
CaptchaFox's published end-user notice describes IP address, browser/device type, operating system and timestamp processing to distinguish people from bots. The provider states that it does not use cookies or permanent browser storage for the widget, hosts in Europe and limits retention to the necessary bot-detection period, subject to legal obligations. Its notice does not specify a fixed number of days. The service is embedded through the newsletter form.
The website also uses session storage to remember whether its introductory animation has been shown. This is separate from audience measurement.
8. International processing
Our use of WhatsApp Business, Make and OpenAI may involve processing or access outside the European Economic Area (EEA), including in the United States. Selecting a European Make region does not establish that every provider, subprocessor or support access remains in the EEA.
The providers publish the following transfer provisions, whose scope depends on the applicable service agreement, contracting entity and processing role:
- OpenAI: its Data Processing Addendum, section 4.1, provides that transfers of EEA data by OpenAI Ireland to affiliates or third parties outside the EEA or Switzerland use agreements containing European Commission Standard Contractual Clauses (SCCs), or a European Commission adequacy decision. The DPA is incorporated into the service agreement within its stated scope; a separate signed document is not necessarily required.
- Make: its Data Processing Agreement, section 7, distinguishes EEA customers contracting with Celonis, Inc. from those contracting with an EEA Celonis entity. For the former it identifies the EU–US Data Privacy Framework as the primary mechanism and SCCs as a fallback if that framework is invalidated. For the latter it describes compliance with transfer requirements, including SCCs where applicable. Make also publishes controller-to-processor SCCs. These provisions form part of the relevant service agreement within their stated scope.
- WhatsApp: its Business Data Processing Terms apply where WhatsApp acts as a processor under the Business Terms. Where WhatsApp Ireland is the contracting entity, they incorporate the Business Data Transfer Addendum. That addendum identifies reliance on the EU–US Data Privacy Framework for transfers to WhatsApp LLC and Meta Platforms, Inc., while allowing recognised alternatives such as processor-to-processor SCCs. This does not describe every activity of Meta as processing on MultiBrand's behalf.
These are documented provisions published by the providers, not a statement that MultiBrand has separately signed each document or that every mechanism applies to every processing activity. The services used by MultiBrand are described above; the relevant transfer arrangement depends on the agreements governing those particular accounts and processing activities.
For information about a transfer affecting your personal data, or to request a copy of the applicable safeguards, please write to roberto@multibrand.net. Copies may be redacted where necessary to protect other people's personal data or confidential information, without preventing you from understanding the safeguards relevant to your rights.
9. Retention
Rapidmail newsletter statistics are configured for automatic cleanup after three years. Make execution logs are retained for seven days under the current Free plan. These settings do not apply to every copy of the same information or to persistent contact records.
For other records, the relevant retention criteria are the status and duration of the commercial enquiry or relationship, the need to maintain relevant conversation context, unresolved assistance or delivery issues, prevention of duplicate processing, evidence of subscription choices and objections, and applicable accounting, contractual and legal requirements. Different categories may therefore require different retention periods. The three-year newsletter statistics setting does not determine how long an active subscription or suppression record is kept.
No fixed automatic deletion period has been implemented for MultiBrand's persistent Make contact-memory records, notification queue or delivery-control records. STOP, pause and unsubscribe do not automatically erase existing records. You may request erasure or object using the contact details below; applicable legal exceptions and the need to honour an objection are assessed for the relevant records.
Provider-controlled security records, historical Analytics data and backups may have separate retention periods. Disabling Analytics does not itself delete historical data. This policy does not claim that proposed deletion schedules have already been implemented.
10. Your rights
Where the GDPR applies, subject to its conditions, you may request access, correction, erasure, restriction and applicable data portability. You may object to processing based on legitimate interests on grounds relating to your situation, and at any time to direct marketing and associated profiling. You may withdraw consent without affecting earlier lawful processing.
Contact roberto@multibrand.net. We may request proportionate identity-verification information. Requests are normally answered within one month; any permitted extension and its reason will be explained.
You may complain to the Bulgarian Commission for Personal Data Protection or another competent supervisory authority, including in the EU country of your habitual residence, work or the alleged infringement. You do not have to contact us first. Bulgarian authority information: https://cpdp.bg/en/lodging-complaints-and-alerts/.
Providing information is voluntary, but we need sufficient details to answer or perform a requested transaction. Newsletter subscription is not a condition for ordinary assistance. If our purposes change, the notice and any required information/consent must be updated before the new processing.
Published 27 October 2026.