1. General Overview & Data Controller Identification
This Privacy Policy governs the processing of personal data collected through the digital publication, mapping archives, and subscription services operated by Spotbridgematrxx Global Media Ltd. (referred to herein as "Spotbridgematrxx", "we", "us", or "our"), a company registered in the United Kingdom under Company No. 14982104 with its principal office at 42 St. Magnus House, Lower Thames Street, London EC3R 6HD, United Kingdom.
We act as the Data Controller under Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR) and the UK Data Protection Act 2018. If you have questions regarding our data collection methods or wish to exercise statutory privacy rights, please reach our Data Protection Officer at [email protected].
2. Categories of Information Collected
In operating our European cultural destination platform, we collect information across three core categories:
- Information You Voluntarily Provide: When you submit field coordinates, subscribe to our research dispatches, or fill out communication forms on our contact portal, we collect your full name, email address, country of residence, and any qualitative notes you submit.
- Automated Telemetry & Technical Data: When browsing our digital platform, our servers log your Internet Protocol (IP) address, browser type and version, referring URL, time zone setting, operating system, and interaction telemetry (pages viewed, time spent per dossier).
- Geographical Search Parameters: Non-personally identifiable filters you select on our interactive Europe maps (e.g., regional preferences, terrain filters) are analyzed in aggregate to gauge cultural interest trends without profiling individual users.
3. Legal Bases for Data Processing
Under Article 6 of the GDPR, we process your personal data exclusively under the following established lawful grounds:
- Consent (Art. 6(1)(a)): When you opt-in to receive our weekly cultural dispatch newsletter or consent to analytical cookies via our persistent cookie banner.
- Contractual Performance (Art. 6(1)(b)): To deliver requested bespoke itineraries, field coordinates, or technical support inquiries initiated by you.
- Legitimate Interests (Art. 6(1)(f)): To maintain web application security, prevent distributed denial-of-service (DDoS) attacks, detect fraud, and optimize user experience across multiple device viewports.
- Legal Compliance (Art. 6(1)(c)): To satisfy statutory bookkeeping, tax reporting, and regulatory audit mandates within the United Kingdom and European Union.
4. Third-Party Data Processors & Sub-Contractors
We do not sell, rent, or trade your personal data to commercial marketing brokers. Data is shared strictly with vetted service infrastructure providers bound by contractual Data Processing Agreements (DPAs):
- Cloud Hosting & CDN: AWS / Cloudflare (providing resilient edge caching and network firewall security within EU/UK data centers).
- Transactional Email: Postmark / SendGrid (delivering system notifications and dispatch confirmations).
- Anonymized Analytics: Privacy-respecting cookieless or consent-governed analytics servers located inside the European Economic Area (EEA).
5. International Data Transfers
Whenever data is transferred outside the European Economic Area (EEA) or the United Kingdom, Spotbridgematrxx ensures adequate safeguards are enforced, including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA), guaranteeing equivalent data protections.
6. Data Retention Protocols
We retain personal information only for the duration strictly necessary to fulfill the purposes documented in this policy:
- General field inquiry messages: Retained for 24 months post-resolution, then permanently purged.
- Newsletter subscription records: Retained until you execute an unsubscribe request via our automated opt-out link.
- Server firewall security logs: Automatically rotated and deleted after 90 days.
7. Your Statutory Rights (GDPR & CCPA/CPRA)
Depending on your jurisdiction, you are entitled to exercise comprehensive data rights:
- Right of Access & Portability: Obtain a structured, machine-readable copy of your personal data held by us.
- Right to Rectification: Request correction of inaccurate or incomplete information.
- Right to Erasure ('Right to be Forgotten'): Request permanent deletion of your personal records where lawful processing justifications cease to exist.
- Right to Object & Restrict Processing: Restrict processing activities rooted in legitimate interest grounds.
- Right to Withdraw Consent: Revoke consent at any moment without affecting the lawfulness of processing executed prior to withdrawal.
To submit a verified data subject access request, contact [email protected]. We respond to all verified requests within 30 calendar days at zero charge.
8. Supervisory Authority Contact
If you believe our data processing violates applicable data protection regulations, you have the right to lodge a formal complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or your local EU National Data Protection Authority.