Privacy Policy & Data Protection Framework

1. Identity of the Data Controller

The entity responsible for processing personal data collected through this website is:

Brightsrankpntry Iberia Design SL
Corporate Identification Number (CIF): B-87941205
Registered Address: Carrer d'Aribau 168, 08036 Barcelona, Spain
Email Contact: [email protected]
Designated Data Protection Officer (DPO): [email protected]

2. Categories of Data Collected

We limit our collection of personal information strictly to what is necessary to deliver our editorial monographs, manage advisory inquiries, and ensure the security of our online infrastructure:

• Inquiry & Contact Information: When you complete our contact form, we collect your name, email address, phone number (if provided), professional role, and message content.
• Technical & Connectivity Metadata: Server access logs record truncated, anonymized IP addresses, browser user-agent strings, referral headers, operating system identifiers, and system timestamps.
• Consent Records: Cryptographic timestamps and preference states recorded when you configure cookie preferences via our consent manager.

3. Legal Bases and Purposes of Processing

Under Article 6 of the General Data Protection Regulation (EU 2016/679), all data processing activities rest upon defined legal grounds:

• Consent (Art. 6(1)(a)): We process optional analytics cookies and respond to unsolicited advisory inquiries solely based on your explicit, affirmative consent.
• Contractual & Pre-Contractual Measures (Art. 6(1)(b)): Processing necessary to prepare technical architectural lighting advisory consultations upon request.
• Legitimate Interests (Art. 6(1)(f)): Monitoring network integrity, preventing distributed denial of service (DDoS) threats, and optimizing server load balancing.
• Legal Obligations (Art. 6(1)(c)): Retaining transaction and communication records to satisfy Spanish commercial, tax, and regulatory compliance standards.

4. Third-Party Data Processors and Transfers

We do not sell, rent, or trade personal data to advertising brokers. Data is shared exclusively with vetted data processors operating under strict Data Processing Agreements (DPAs) pursuant to GDPR Article 28:

• Cloud Hosting Infrastructure: Secure servers located within the European Economic Area (EEA), providing high-availability storage and encrypted backups.
• Email Transmission Networks: Enterprise transactional mail gateways with TLS 1.3 encryption for delivering technical consultation notices.

Where technical processors operate outside the EEA, transfers are governed by European Commission Standard Contractual Clauses (SCCs) to guarantee an equivalent level of privacy protection.

5. Data Retention Periods

Personal data is retained only for the duration necessary to satisfy the purpose for which it was originally collected:

• Inquiry Records: Stored for 24 months following the resolution of your inquiry, unless continuing commercial interactions require longer retention.
• Server Security Logs: Automatically purged on a rolling 90-day cycle.
• Cookie Consent Choices: Stored within your local browser storage for 12 months, or until you clear your browser cookies.

6. Your Statutory Privacy Rights

As a data subject under GDPR and the Spanish Ley Orgánica 3/2018 (LOPDGDD), you possess the following enforceable rights:

• Right of Access (Art. 15): Request confirmation and copies of all personal data held concerning you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal records.
• Right to Erasure (Art. 17): Request deletion of your data when retention is no longer legally warranted ("Right to be Forgotten").
• Right to Restriction (Art. 18): Pause active processing while data accuracy or lawful grounds are contested.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to processing carried out under legitimate interest grounds.

To exercise any of these rights, contact our Data Protection Officer at [email protected] with appropriate identity verification. If you believe your data has been handled unlawfully, you have the statutory right to file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) at www.aepd.es.