Privacy Policy & Data Governance

1. Data Controller Identification

This website and digital service are operated by Brightsvaultbundle Observatory Ltd (Company Number 14892015), having its registered office at 72 Great Suffolk Street, London, SE1 0BL, United Kingdom. Under the UK Data Protection Act 2018 and the General Data Protection Regulation (GDPR), Brightsvaultbundle Observatory Ltd functions as the Data Controller in respect of any personal data submitted or collected via this portal.

For data protection inquiries, you may contact our designated Data Protection Officer (DPO) at [email protected] or write to our registered London address.

2. Categories of Information Collected

We process information under three distinct categories:

• Directly Provided Information: When you complete our contact inquiry form, register for technical observatory bulletins, or request documentation dossiers, we collect your name, business email address, organizational affiliation, and the direct text content of your communication.
• Automated Telemetry & Technical Identifiers: When browsing our model exhibits, our infrastructure logs standard network protocol metadata, including your IP address (anonymized at ingress), browser agent configuration, operating system type, referring URL, time spent per exhibit, and network latency figures.
• State & Local Storage Flags: We store your explicitly chosen cookie preferences in client-side localStorage to respect your opt-in selections across browsing sessions.

3. Legal Bases for Processing Under UK & EU GDPR

In adherence to Article 6 of the UK/EU GDPR, we rely on the following lawful bases for processing:

• Legitimate Interests (Art. 6(1)(f)): Maintaining server security, diagnosing network anomalies, preventing denial-of-service abuse, and evaluating user navigation efficiency across our DeepMind research catalog.
• Consent (Art. 6(1)(a)): Sending elective technical briefings and placing non-essential analytical cookies via our client cookie consent banner.
• Contractual Performance (Art. 6(1)(b)): Responding to formal technical inquiries and processing research consultation requests submitted by enterprise clients.

4. Third-Party Data Processors

We do not sell, rent, or trade your personal data to commercial broker networks. Data is shared exclusively with vetted data processors under binding Data Processing Agreements (DPAs) compliant with standard contractual clauses (SCCs):

• Hosting Infrastructure: Cloud hosting facilities located in the United Kingdom and European Economic Area (EEA), audited to ISO/IEC 27001 standards.
• Email Routing Services: Enterprise SMTP delivery infrastructure used exclusively to dispatch transactional responses and requested model whitepapers.

5. International Data Transfers

Where technical support or secondary infrastructure requires data transfer outside the United Kingdom or EEA, transfers are governed by UK International Data Transfer Agreements (IDTAs) or European Commission Standard Contractual Clauses, supplemented by technical encryption in transit (TLS 1.3) and at rest (AES-256).

6. Data Retention Schedules

We adhere to strict data minimization timelines:

• Technical Inquiries: Retained for twenty-four (24) months from the date of final correspondence to facilitate technical follow-up, after which records are purged or anonymized.
• Server Access Logs: Retained for ninety (90) days for forensic cybersecurity auditing and automatically overwritten.
• Cookie Preference Records: Stored locally on your device for up to twelve (12) months unless cleared manually by you.

7. Your Statutory Rights (GDPR & CCPA/CPRA)

Depending on your jurisdiction, you possess unambiguous legal rights regarding your personal information:

• Right of Access & Portability: Obtain confirmation of whether your data is processed and receive a structured, machine-readable export.
• Right to Rectification: Require immediate correction of inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request complete deletion of personal records where no overriding legal obligation exists.
• Right to Restrict or Object: Restrict processing or object entirely to processing conducted under legitimate interests.
• Right to Withdraw Consent: Revoke consent for non-essential cookies or communications at any time without detriment.
• California Consumer Privacy Act (CCPA/CPRA) Notice: We do not sell personal information or share personal data for cross-context behavioral advertising. California residents possess the right to know, delete, and correct their personal data free from discriminatory treatment.

8. Lodging a Regulatory Complaint

If you believe our data processing fails to comply with statutory standards, you have the right to lodge a formal complaint with the UK Information Commissioner's Office (ICO) via ico.org.uk, or your local EU Member State supervisory authority.