Last updated: 3 November 2026
Brandflow is a newsletter about the advertising, media and marketing industries, written by Justin Billingsley and sent by email twice a week. This notice says what is collected when you subscribe or read, why, who handles it, and the choices you have. It is written for the reader, not the lawyer, and it is kept short because the processing is simple.
The controller is Justin Billingsley, an individual, of 34 Distillery Wharf, London W6 9BF, United Kingdom. Questions about your data go to [email protected]. There is no data protection officer; Brandflow is not large enough to need one.
Your email address, and your first name if you give it. Nothing else is asked for at sign-up.
Open and click events on the emails, recorded by the sending platform, together with the approximate location and device type inferred from your connection.
Comments and likes you leave on the website, which require you to be signed in with your subscriber email.
Replies you send to an edition, which arrive as ordinary email and are kept as ordinary email.
Website analytics: the pages visited, the referring site, the device and browser, and any campaign tag on the link you arrived from. This is aggregate traffic data held on the publishing platform.
Downloads from the Resources page. The files themselves are served from justinbillingsley.me, which keeps standard server logs.
Sending you the newsletter — your consent, given when you subscribe and confirmed by the email you click. You can withdraw it at any time by unsubscribing; the link is at the foot of every edition.
Open, click and website analytics — legitimate interests: knowing which editions and pages readers find useful, and keeping the list clean. This involves no profiling that produces decisions about you, and no automated decision-making with legal or similar effects.
Comments and replies — legitimate interests in running a readable comment thread and answering readers. Your comment appears under your name on the website; your reply is seen only by me.
Promotional content — editions occasionally mention my books, papers and advisory work. This is part of the newsletter, not a separate marketing list, and unsubscribing stops all of it.
You are not required to provide any of this. The only consequence of not giving an email address is that the newsletter cannot be sent to you; the open web archive at brandflow-marketing.com/archive needs no sign-up.
beehiiv Inc., New York, stores the subscriber list, sends the emails, hosts the website and records the analytics above. It acts as processor under its Data Processing Addendum, which incorporates the UK International Data Transfer Addendum to the EU Standard Contractual Clauses as the safeguard for the transfer of your data to the United States. Its own sub-processors are listed at subprocessors.beehiiv.com.
Cloudflare serves the downloadable files on justinbillingsley.me.
Your details are not sold, rented or shared with anyone else. If an edition is sponsored, the sponsor receives aggregate figures only — never your address.
If you read Brandflow through LinkedIn's newsletter feature rather than by email, LinkedIn is the controller of that relationship and its privacy policy applies. I see aggregate statistics only and cannot identify, contact or remove individual LinkedIn subscribers; that is one reason the email edition exists.
While you are subscribed. When you unsubscribe, your address is kept on a suppression list so you are not emailed again, and the rest of your record is deleted within twelve months, or sooner if you ask. Comments stay on the website until you delete them or ask me to. Replies are kept as long as the correspondence is useful and then deleted.
Under UK data protection law you can ask to see the data held about you, have it corrected or deleted, restrict or object to its use, receive a copy in a portable form, and withdraw consent at any time. Email [email protected]; requests are answered within one month. If you are unhappy with how your data has been handled you can complain to the Information Commissioner's Office at ico.org.uk, though I would rather hear from you first.
The website sets the cookies beehiiv needs to run the sign-up form, keep you signed in for comments and remember that you have already seen the subscribe prompt. The website also sets beehiiv's own first-party analytics cookie, which produces the aggregate traffic figures described above. No advertising or cross-site tracking cookies are set. The emails contain the sending platform's open-tracking image; your mail client's image-blocking setting disables it.
The date at the top changes with every revision. Anything that changes what is collected or why is announced in the newsletter itself, not buried here.