Brightsvaultbundl Inquire
Regulatory Compliance

Privacy Policy & Data Protection Framework

Effective Date: 1 January 2026 Controller: Brightsvaultbundl Heritage Studio Lda. Jurisdiction: Regulation (EU) 2016/679 (GDPR) / Portugal CNPD

1. Overview and Identity of the Data Controller

This Privacy Policy sets out the data processing practices of Brightsvaultbundl Heritage Studio Lda. ("Brightsvaultbundl", "we", "us", or "our"), registered under company registration number PT 518 942 301, with its registered address at Rua do Alecrim 72, 1200-018 Lisboa, Portugal. We operate the digital research website brightsvaultbundl.sbs and are committed to protecting the privacy, security, and integrity of information relating to visitors, researchers, and correspondence partners.

2. Scope of Data Collection

We operate strictly under the principle of data minimization as enshrined in Article 5(1)(c) of the General Data Protection Regulation (GDPR). We collect and process personal data exclusively under the following circumstances:

  • Voluntary Correspondence Data: When you submit queries via our Contact Desk form or direct electronic mail, we collect your full name, email address, institutional affiliation, subject classification, and the substantive content of your message.
  • Technical and Telemetry Data: When you browse brightsvaultbundl.sbs, our web server logs record fundamental HTTP request data, including your truncated IP address (anonymized at the network edge), browser agent strings, referring URL, timestamp, and requested resources.
  • Client-Side Local Storage: To honor your cookie banner selections, we store a single key-value token (brightsvaultbundl_cookie_pref) directly within your browser's local storage. This value is never transmitted across third-party marketing domains.

3. Lawful Bases for Processing

We process personal data solely where a recognized lawful basis under Article 6 of the GDPR applies:

  1. Legitimate Interests (Art. 6(1)(f)): Processing network telemetry to detect malicious traffic patterns, preserve server stability, and maintain the integrity of our architectural archive.
  2. Performance of a Contract or Pre-Contractual Measures (Art. 6(1)(b)): Responding to specific research inquiries, monograph citation requests, or archival consultancy proposals submitted through our contact desk.
  3. Consent (Art. 6(1)(a)): Where optional performance or analytical cookies are actively accepted through our consent mechanism.

4. Third-Party Processors and International Transfers

Brightsvaultbundl does not sell, rent, or trade personal data to advertising brokers. We engage a limited number of vetted data processors who assist in our infrastructure operations:

  • Hosting and Cloud Infrastructure: Our static servers and content distribution points are hosted within ISO/IEC 27001-certified data centers located inside the European Economic Area (EEA).
  • Technical Maintenance Partners: Specialized server engineers bound by strict confidentiality and Data Processing Agreements (DPAs) in compliance with Article 28 of the GDPR.

If any technical routing necessitates transfer outside the EEA, such transfers are strictly executed under European Commission Standard Contractual Clauses (SCCs) to guarantee an equivalent standard of protection.

5. Data Retention Periods

We retain personal data only for the duration necessary to satisfy the purposes for which it was gathered:

  • Inquiry Correspondence: Contact desk submissions and related email exchanges are purged after 24 months from the resolution of the matter, unless longer retention is mandated by Portuguese commercial or legal documentation statutes.
  • Server Access Logs: Automatically erased or permanently anonymized on a rolling 30-day cycle.
  • Local Storage Cookie Preferences: Retained on your client browser for up to 12 months, or until you manually clear your browser cache.

6. Rights of Data Subjects Under GDPR and CCPA

Under the General Data Protection Regulation and relevant international data privacy laws (including California Consumer Privacy Act provisions where applicable), you are entitled to exercise the following rights without charge:

  • Right of Access (Art. 15): Request confirmation of whether we process your data and receive an accessible copy.
  • Right to Rectification (Art. 16): Demand correction of inaccurate or incomplete personal records.
  • Right to Erasure (Art. 17): Request permanent deletion ("Right to be Forgotten") where data is no longer necessary for initial processing purposes.
  • Right to Restriction of Processing (Art. 18): Restrict processing during ongoing disputes regarding accuracy or lawful basis.
  • Right to Data Portability (Art. 20): Receive your submitted personal records in a structured, commonly used, and machine-readable format.
  • Right to Object (Art. 21): Object to processing based on legitimate interests at any time.

7. Data Protection Officer and Supervisory Authority

For inquiries concerning our privacy standards, data handling records, or to exercise your statutory rights, please contact our designated Data Protection Officer:

Data Protection Officer
Brightsvaultbundl Heritage Studio Lda.
Rua do Alecrim 72, 1200-018 Lisboa, Portugal
Email: [email protected]

You also maintain the legal right to lodge a formal complaint with the Portuguese National Data Protection Commission (Comissão Nacional de Proteção de Dados – CNPD) at Av. D. Carlos I, 134 - 1.º, 1200-651 Lisboa, Portugal, or your national supervisory authority within the EU member state of your habitual residence.