Privacy Policy & Data Protection Protocol

1. Data Controller Identification

This privacy notice governs personal data processing by Brightspickledger Studio S.r.l., an Italian limited liability company with registered offices at Via Tortona 31, 20144 Milano (MI), Italy, registered with the Milan Chamber of Commerce under Company Registration Number IT-08942150961 (REA MI-2451092).

We operate the website brightspickledger.quest as an architectural monograph and informational ledger on Italian lighting design. Questions regarding data protection or compliance may be directed to our appointed Data Protection Officer via [email protected].

2. Categories of Information Collected

In accordance with the principle of data minimization, Brightspickledger collects only information necessary to deliver educational monographs, manage reader inquiries, and ensure server stability:

• Direct Inquiry Submissions: When you complete our contact form, we record your name, practice affiliation, professional email address, subject matter, and message content.
• Automated Telemetry & Server Logs: Internet Protocol (IP) addresses, browser user-agent tokens, referring URLs, timestamps, and page request responses are automatically retained in secure logs for cybersecurity monitoring and DDoS defense.
• Local Browser Storage: Preference parameters including your cookie choice status are stored locally on your device via localStorage to suppress redundant banners.

3. Legal Bases for Data Processing

We process personal information under the following legal frameworks established in Article 6 of the General Data Protection Regulation (GDPR):

• Consent (Art. 6(1)(a)): For non-essential analytics tracking or direct response to voluntary inquiries submitted via our communication portal.
• Contractual Performance (Art. 6(1)(b)): To execute preliminary steps prior to an editorial or architectural research engagement requested by the data subject.
• Legitimate Interests (Art. 6(1)(f)): To maintain network infrastructure security, investigate malicious traffic, and preserve server operational integrity.

4. Third-Party Subprocessors & Cross-Border Transfers

Brightspickledger does not sell, rent, or trade reader data to commercial data brokers. We utilize European-domiciled hosting infrastructure and security service providers bound by strict Data Processing Agreements (DPAs) conforming to European Commission Standard Contractual Clauses (SCCs). Should server routing require transit outside the European Economic Area (EEA), adequate protections under GDPR Chapter V are strictly maintained.

5. Statutory Data Subject Rights (GDPR & CCPA/CPRA)

Under European data protection law and comparable international statutes (including the California Consumer Privacy Act):

• Right of Access & Portability: You may request a machine-readable export of all personal data held concerning you.
• Right to Rectification & Erasure: You may demand correction of inaccurate records or permanent deletion ("right to be forgotten").
• Right to Restrict or Object: You possess the right to halt processing for analytical evaluation or based upon specific individual circumstances.
• Right to Non-Discrimination: We never deny service, vary content quality, or impose disparate treatment upon readers asserting privacy prerogatives.

To invoke any statutory right, transmit a formal request to [email protected]. Verification of identity will be required prior to releasing records.

6. Data Retention Protocols

Server access logs are systematically purged after ninety (90) days unless flagged for ongoing security incident investigations. Inquiries submitted through our curatorial desk are preserved for twenty-four (24) months to facilitate ongoing architectural correspondence, after which they are securely scrubbed from our active production databases.