Privacy Policy.

1. Data controller

This Privacy Policy describes how LR Brand Value Strategies Ltd ("BV Strategies", "we", "us") collects, uses, and safeguards personal data in connection with the website bv-strategies.site and the consulting and tooling services we operate.

• Registered office: 121 Prodromou, Hadjikyriakion Building, 4th Floor, Office 402, Strovolos 2064 — Nicosia, Cyprus
• Registration number: HE 464113 (Cyprus Registrar of Companies)
• VAT: CY 60089520D
• Contact for data requests: lukas@bv-strategies.site

2. Data we collect

We collect the following categories of personal data:

• Contact data you provide when reaching out by email or through the contact form (name, email address, message content).
• Server log data (IP address, user agent, request timestamps) automatically collected by our hosting provider for security and operational purposes.
• Amazon Selling Partner data processed under engagement contracts with our clients, or — where applicable — under our own Amazon Selling Partner account. Access is strictly limited to the services described in §3.

3. How we use data

We process personal data to:

• Respond to inquiries and operate the engagement lifecycle (proposals, contracts, advisory delivery).
• Provide marketplace strategy, catalogue, and performance-diagnostic services to clients.
• Operate internal tooling — including catalogue audit, suppression-risk detection, and performance analytics — against client Amazon Selling Partner accounts under contract, or against our own Selling Partner account for operational improvement.
• Comply with legal, tax, accounting, and statutory obligations under Cypriot and EU law.

4. Legal bases (GDPR)

We rely on the following legal bases under Regulation (EU) 2016/679 (GDPR):

• Contract performance (Art. 6(1)(b)) — to deliver the services we agreed to provide.
• Legitimate interest (Art. 6(1)(f)) — to respond to inquiries, secure our systems, and improve our services.
• Legal obligation (Art. 6(1)(c)) — tax, accounting, and statutory record-keeping.
• Consent (Art. 6(1)(a)) — where explicitly requested for any optional processing.

5. Amazon Selling Partner API

Where we access Amazon Selling Partner data through the Selling Partner API, we do so strictly under written authorization from the data owner (the seller of record), in accordance with Amazon's Data Protection Policy and Acceptable Use Policy.

Personal data obtained via the SP-API is used solely to deliver the contracted services, is retained no longer than necessary for that purpose, is not sold, and is not used for any unauthorized purpose. Access is logged and restricted to authorized personnel. We do not transmit such data to third parties except as required to perform the engagement or by law.

6. Sub-processors

We rely on the following service providers, each bound by appropriate data-processing terms:

• Cloudflare, Inc. — website hosting (Pages), DNS, and email routing.
• Google LLC — email delivery (forwarded inbox).
• Amazon.com, Inc. and its affiliates — Selling Partner API for client engagements and our own selling account.

7. International transfers

Some of our sub-processors are established outside the European Economic Area (notably in the United States). Where applicable, transfers are governed by Standard Contractual Clauses or equivalent safeguards adopted by the European Commission.

8. Retention

We retain personal data only as long as necessary for the purposes above and as required by Cypriot statutory law (typically up to seven years for accounting records). Inquiry correspondence is retained for up to 24 months after last contact. Amazon SP-API data is retained only for the duration of the engagement and is deleted upon termination, subject to any statutory record-keeping requirement.

9. Your rights

Under the GDPR and, where applicable, the California Consumer Privacy Act (CCPA), you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to withdraw consent at any time without affecting the lawfulness of prior processing. You may lodge a complaint with the Cyprus Office of the Commissioner for Personal Data Protection or another competent supervisory authority.

To exercise these rights, contact us at lukas@bv-strategies.site.

10. Cookies and analytics

This website does not currently set tracking cookies or use third-party analytics. If we introduce them, we will update this policy and, where required, request prior consent via a cookie banner.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by direct notice to active clients.

12. Contact

For any privacy-related question, write to lukas@bv-strategies.site or to the registered office above.