Privacy Policy & Data Protection Framework

1. Identity of the Data Controller

The data controller responsible for personal information processed under this policy is:

2. Scope and Categories of Data Collected

In accordance with data minimization principles, Choicegrdtogethrly collects only the personal information strictly necessary to provide informational resources, maintain server operational resilience, and respond to direct communications:

• Contact Inquiry Information: When you complete our contact form, we collect your submitted name, email address, thematic category, and message body text.
• Server Access Records: Web server hosting logs record your Internet Protocol (IP) address (pseudonymized where technically feasible), browser type and version, requesting domain, HTTP request status, timestamp, and referring URL.
• Client Preference Indicators: If you interact with our consent interface, we record your cookie selection token in your local browser storage.

3. Lawful Bases for Processing (UK GDPR / EU GDPR)

We process personal information under the following statutory legal grounds defined in Article 6 of the General Data Protection Regulation:

• Consent (Art. 6(1)(a)): Applicable where you voluntarily opt in to non-essential analytical cookies or express explicit consent for outbound responses.
• Contractual Performance (Art. 6(1)(b)): Applicable where data processing is required to address inquiries initiated prior to forming a formal research agreement.
• Legitimate Interests (Art. 6(1)(f)): Processing network access logs to prevent Distributed Denial of Service (DDoS) events, detect unauthorized vulnerability probes, and ensure network security.

4. Third-Party Data Processors & Infrastructure

Choicegrdtogethrly does not sell, rent, or trade your personal data to commercial data brokers or advertising exchanges. Where necessary, data is shared with strictly vetted technical infrastructure sub-processors:

• Cloud Hosting Providers: Operating secure data centre facilities within the United Kingdom and the European Economic Area (EEA).
• DNS & Content Delivery Networks: Distributing edge network caching to ensure fast, reliable uptime and mitigating distributed attacks.
• Statutory Authorities: Disclosed only when compelled by enforceable legal process, court orders, or applicable UK law enforcement directives.

5. International Data Transfers

Where technical routing necessitates data transit outside the United Kingdom or European Economic Area, transfers are governed by UK International Data Transfer Agreements (IDTAs) or European Commission Standard Contractual Clauses (SCCs), accompanied by rigorous transfer risk assessments to guarantee equivalent protection standards.

6. Retention Schedules

We maintain strict retention ceilings:

• General Inquiries: Retained for a maximum of twenty-four (24) months following resolution, after which communications are securely erased.
• Server Security Logs: Rotated and overwritten automatically on a thirty (30) day rolling schedule, unless flagged for ongoing security forensics.
• Consent Preference Markers: Stored locally on your client machine for up to twelve (12) months or until you clear your browser data.

7. Statutory Rights (GDPR & CCPA Protections)

Depending on your jurisdiction, you possess enforceable legal rights regarding your personal information:

• Right of Access: You may request a verified copy of all personal records held about you.
• Right to Rectification: You may challenge inaccurate, incomplete, or outdated personal information.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of records where processing is no longer justified by law.
• Right to Restrict or Object to Processing: You may object to processing grounded in legitimate interests or demand suspension while claims are audited.
• Right to Data Portability: You may request your data in a structured, machine-readable format.
• California Consumer Privacy Act (CCPA) Rights: California residents have the right to know what personal categories are collected, request deletion, and remain free from discrimination for exercising statutory privacy rights. Choicegrdtogethrly does not sell personal information.

To exercise these statutory rights, please transmit a formal request to our Data Protection Officer at [email protected]. We respond to verified requests within thirty (30) calendar days.

8. Supervisory Authority Inquiries

If you believe our processing of your personal data infringes applicable data protection statutes, you maintain the legal right to file a formal complaint with the UK Information Commissioner’s Office (ICO) via ico.org.uk, or with your local data protection supervisory body.