Not a Beauty Brand → A Visual Studio

Legal

Privacy Policy

PRIVACY POLICY

BM Arena · www.bmarena.live

Effective Date: March 3, 2026


1. Introduction

BM Arena ("BM Arena," "we," "our," or "us") operates the website located at www.bmarena.live (the "Site"). We provide AI-powered visual production services for direct-to-consumer (DTC) beauty and skincare brands.

This Privacy Policy explains how we collect, use, disclose, and protect information about individuals who visit our Site or submit inquiries through our contact and booking forms. Please read this document carefully. By accessing or using the Site, you acknowledge that you have read and understood the practices described herein.

This Policy applies to individuals located in the United States, the United Kingdom, the European Union (including the European Economic Area), and Canada. Where legal requirements differ by jurisdiction, we describe those distinctions in the relevant sections below.


2. Information We Collect

2.1 Information You Provide Directly

When you submit an inquiry or booking request through our contact form, we collect the following categories of personal data:

  • Full name or business contact name
  • Email address
  • Brand name and any additional business details you choose to share
  • The content of your message or inquiry

    • We do not require you to create an account to use the Site or submit an inquiry. We collect only the information you voluntarily provide.

    2.2 Automatically Collected Data

    When you visit the Site, certain technical information is collected automatically through standard web technologies and third-party analytics services. This may include:

  • Internet Protocol (IP) address (which may be truncated or anonymised depending on your location and applicable settings)
  • Browser type, version, and language preferences
  • Device type and operating system
  • Referring URL and pages visited on the Site
  • Date, time, and duration of your visit
  • Interaction data, including clicks and scroll depth
  • Cookie identifiers and similar tracking technologies (see Section 5)

    • This information is collected in aggregate and pseudonymous form for analytics and Site performance purposes. It is not used to identify you personally without your consent.


    3. How We Use Your Information

    We use the information we collect for the following purposes:

  • To respond to inquiries and booking requests you submit through the Site
  • To assess project fit and communicate with prospective clients about our services
  • To understand how visitors use the Site so that we can improve its performance, content, and user experience
  • To diagnose technical issues and maintain the security and stability of the Site
  • To comply with applicable legal obligations and enforce our rights
  • To detect and prevent fraudulent, abusive, or unlawful activity

    • We do not sell your personal information. We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent.


    4. Legal Basis for Processing (EEA, UK, and Switzerland)

    If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data only where we have a lawful basis to do so under the General Data Protection Regulation (GDPR) and equivalent applicable law. The legal bases on which we rely are as follows:


  • Legitimate Interests (Article 6(1)(f) GDPR): Legitimate Interests (Article 6(1)(f) GDPR):
  • We process automatically collected analytics data to understand website usage and improve our Site. We have conducted a legitimate interests assessment and determined that this processing does not override the rights and freedoms of data subjects.

  • Performance of a Contract / Pre-Contractual Steps (Article 6(1)(b) GDPR): Performance of a Contract / Pre-Contractual Steps (Article 6(1)(b) GDPR):

    • When you submit a contact or booking form, we process your information to respond to your inquiry and take steps at your request prior to entering into a service agreement.


  • Consent (Article 6(1)(a) GDPR): Consent (Article 6(1)(a) GDPR):

    • Where we rely on consent (for example, for non-essential cookies), you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.


  • Compliance with a Legal Obligation (Article 6(1)(c) GDPR): Compliance with a Legal Obligation (Article 6(1)(c) GDPR):

    • We may process data where necessary to comply with applicable law or regulatory requirements.


    5. Cookies and Tracking Technologies

    We use cookies and similar technologies to operate and improve the Site, analyse user behaviour, and deliver relevant content.

    5.1 Types of Cookies We Use

  • Strictly Necessary Cookies: Strictly Necessary Cookies:

    • Required for the Site to function and cannot be disabled. They include session management and security cookies deployed through Cloudflare.


  • Analytics and Performance Cookies: Analytics and Performance Cookies:

    • Set by Google Analytics 4 (GA4) and managed via Google Tag Manager (GTM). These cookies collect information about how visitors use the Site, such as which pages are visited most often. The information is aggregated and anonymised where possible.

    5.2 Your Cookie Choices

    You may manage or disable non-essential cookies through your browser settings or a consent management tool if one is presented on the Site. Please be aware that disabling certain cookies may affect the functionality of the Site.

    For residents of the EEA and UK, we seek your consent before placing non-essential cookies in accordance with the ePrivacy Directive and applicable national law.


    6. Third-Party Services and Data Processors

    We engage the following third-party service providers who may process your data on our behalf or independently in accordance with their own privacy policies. We have entered into appropriate data processing agreements where required by applicable law.


    6.1 Google Analytics 4 (GA4) and Google Tag Manager (GTM)

    Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

    Purpose: GA4 is used to collect and analyse website usage data, including pages visited, session duration, and interaction events. GTM is a tag management system that controls when and how GA4 and other tracking scripts are deployed.

    Data Collected: IP addresses (subject to IP anonymisation), device and browser information, behavioural interaction data, and cookie identifiers.

    Data Transfers: Google may transfer data to servers located in the United States. For EEA and UK users, such transfers are subject to Standard Contractual Clauses or equivalent safeguards.

    Further Information: https://policies.google.com/privacy

    6.2 Formspree

    Provider: Formspree, Inc., a US-based form processing service.

    Purpose: Our contact and booking form submissions are processed through Formspree, which securely transmits form data to us via email notification.

    Data Collected: Name, email address, brand name, and message content submitted through the contact form.

    Data Transfers: Formspree processes data on servers in the United States. Transfers from the EEA and UK rely on appropriate safeguards as described in Formspree's privacy documentation.

    Further Information: https://formspree.io/legal/privacy-policy

    6.3 Cloudflare

    Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

    Purpose: Cloudflare provides content delivery network (CDN), DDoS protection, performance optimisation, and security services for the Site.

    Data Collected: Cloudflare may process IP addresses, HTTP request headers, and other network-level data to provide its security and delivery services.

    Further Information: https://www.cloudflare.com/privacypolicy/

    6.4 Website Hosting Infrastructure

    The Site is hosted on standard commercial hosting infrastructure. Our hosting provider may process server log data, including IP addresses, as part of routine hosting operations. Such data is processed in accordance with our hosting provider's data processing terms.

    We do not share personal data with any third party for their own independent marketing, advertising, or commercial purposes without your explicit consent.


    7. International Data Transfers

    BM Arena is operated from the United States. If you are accessing the Site from the European Economic Area, the United Kingdom, Canada, or any other jurisdiction with laws governing data collection and use that differ from those of the United States, please be aware that your information may be transferred to and processed in the United States or other countries.

    Where we transfer personal data originating from the EEA or UK to third countries, we ensure that appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs) approved by the European Commission or the UK Information Commissioner's Office (ICO), as applicable;
  • Binding Corporate Rules (BCRs), where applicable;
  • Any other transfer mechanism recognised as lawful under Chapter V of the GDPR or applicable UK data protection law.

    • For transfers of data from Canada, we comply with applicable requirements under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.


    8. Data Retention

    We retain personal data only for as long as necessary to fulfil the purposes set out in this Policy, unless a longer retention period is required by law.

  • Contact form submissions: Retained for up to 24 months from the date of submission, or for the duration of any ongoing business relationship, whichever is longer.
  • Analytics data: Aggregated or pseudonymous analytics data is retained in accordance with Google Analytics data retention settings, which we configure to the minimum period reasonably required for analytical purposes (generally 14 months).
  • Security and server logs: Retained for a period consistent with our security monitoring obligations, typically up to 12 months.

    • When data is no longer required, we take reasonable steps to securely delete or anonymise it.


    9. Data Security

    We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

  • Transmission of data over HTTPS (TLS encryption)
  • Use of reputable, security-certified third-party processors
  • Cloudflare's DDoS and security layer on all Site traffic
  • Access controls limiting personnel access to personal data on a need-to-know basis

    • No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and relevant supervisory authorities in accordance with applicable law.


    10. Your Privacy Rights

    10.1 Rights Under GDPR (EEA and UK Residents)

    If you are located in the European Economic Area or the United Kingdom, you have the following rights in relation to your personal data:

  • Right of Access: You may request a copy of the personal data we hold about you.
  • Right to Rectification: You may request that we correct inaccurate or incomplete personal data.
  • Right to Erasure ('Right to be Forgotten'): You may request deletion of your personal data in certain circumstances.
  • Right to Restriction of Processing: You may request that we limit how we use your data in certain circumstances.
  • Right to Data Portability: You may request that we provide your personal data in a structured, machine-readable format.
  • Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes.
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with your national supervisory authority, such as the Information Commissioner's Office (ICO) in the United Kingdom or your relevant EU Data Protection Authority.

    • 10.2 Rights Under CCPA/CPRA (California Residents)

    If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) grants you the following rights:

  • Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you, as well as how it is used and disclosed.
  • Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions.
  • Right to Correct: You may request correction of inaccurate personal information.
  • Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioural advertising as those terms are defined under California law.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

    • To exercise your CCPA rights, please contact us using the information in Section 13. We will verify your identity before processing a request and respond within the timeframe required by applicable law.

    10.3 Rights Under PIPEDA (Canadian Residents)

    If you are a resident of Canada, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, including the right to access personal information we hold about you and to request corrections where the information is inaccurate, incomplete, or not up to date. You may also withdraw consent to our collection, use, or disclosure of your personal information, subject to legal or contractual restrictions.


    11. Children's Privacy

    The Site and our services are directed exclusively to business professionals and are not intended for use by individuals under the age of 16 (or under the age of majority in their applicable jurisdiction, if higher).

    We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal data from a minor without appropriate parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child, please contact us immediately using the details in Section 13.


    12. Updates to This Privacy Policy

    We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes, we will update the Effective Date at the top of this document.

    We encourage you to review this Policy periodically. Your continued use of the Site following the posting of an updated Policy constitutes your acknowledgment of the changes. Where required by applicable law, we will provide more prominent notice of material changes or seek your consent.


    13. Contact Information

    If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us at:


    BM Arena

    Website: www.bmarena.live

    Email: [email protected]


    We will respond to all requests within the timeframe required by applicable data protection law (generally within 30 days, or 45 days for CCPA requests where required).


    For EEA or UK residents who are not satisfied with our response, you have the right to escalate your complaint to the relevant supervisory authority in your country of residence.



    Last Updated: March 3, 2026

    © 2026 BM Arena. All rights reserved.