Privacy Policy

1. Data Controller and Contact Information

The legal entity responsible for the processing of your personal data on matemintpckbcn.xyz is:

Matemint Historic Estate Operations Ltd
Company Registration Number: #14892014
Registered Office: The Keep Chambers, 14 Sovereign Gate, Edinburgh, EH1 2PJ, United Kingdom
Designated Data Protection Contact: [email protected]

2. Information We Collect

Depending on how you interact with our website, we may collect and process the following categories of information:

• Voluntarily Submitted Contact Data: When you complete our consultation inquiry form or communicate with us by email, we collect your full name, email address, inquiry subject, and the narrative content of your message.
• Automatically Collected Technical Information: Whenever you browse our site, our servers log technical telemetry including your Internet Protocol (IP) address, approximate geographic region (country/city level), browser family and engine version, operating system, referring URL, pages visited, and dwell time.
• Cookie and Device Identifiers: Data collected via strictly necessary session cookies and optional aggregate analytical markers, subject to your explicit cookie preferences.

3. Legal Bases for Processing (UK GDPR / EU GDPR)

We only process your personal data where a clear legal basis exists under applicable data protection regulations:

• Legitimate Interests (Art. 6(1)(f) GDPR): To respond directly to your technical inquiries, maintain network and cybersecurity, prevent fraudulent activity, and optimize site readability.
• Consent (Art. 6(1)(a) GDPR): For any non-essential analytics tracking or functional storage mechanisms, which you may grant or revoke via our cookie management interface.
• Legal Obligation (Art. 6(1)(c) GDPR): To comply with applicable statutory accounting, tax, or legal disclosure requirements in the United Kingdom.

4. Third-Party Data Processors

We do not sell, rent, or trade your personal data to commercial brokers or third-party marketers. We may share bounded data elements with vetted infrastructure service providers who operate under strict Data Processing Agreements (DPAs):

• Hosting infrastructure and content delivery network providers based in the UK and European Economic Area (EEA).
• Direct transactional email dispatch routing providers assisting our customer correspondence.

5. International Data Transfers

Where personal data is routed through or processed by technical systems located outside the United Kingdom or the EEA, we ensure that adequate safeguards are enforced, such as the UK International Data Transfer Addendum, EU Standard Contractual Clauses (SCCs), or recognized adequacy regulations.

6. Data Retention Schedule

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected:

• General Inquiries: Stored for a maximum of 24 months following the last recorded communication, after which records are permanently deleted or anonymized.
• Server Diagnostic Logs: Retained for a maximum of 90 days for firewall telemetry and security threat mitigation, then automatically overwritten.
• Cookie Preferences: Stored in your local device browser storage for 12 months before requiring re-confirmation.

7. Data Security Measures

We implement rigorous technical and organizational controls to safeguard personal data against accidental loss, unauthorized access, alteration, or disclosure. All web traffic is strictly encrypted in transit using Transport Layer Security (TLS 1.3), and administrative access to internal communication mailboxes is protected by multi-factor authentication (MFA) and least-privilege role boundaries.

8. Your Statutory Rights

Under the UK Data Protection Act 2018 and the GDPR, you have extensive rights regarding your personal information:

• Right of Access: You may request a confirmation of whether we hold your personal data and obtain a copy of that data.
• Right to Rectification: You can require us to correct incomplete or inaccurate data.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where there is no compelling legal reason for continued processing.
• Right to Restrict or Object to Processing: You may challenge the lawful basis of our processing or object to processing carried out under legitimate interest grounds.
• Right to Data Portability: You may request your data in a structured, commonly used, and machine-readable format.

To exercise any of these statutory rights, please submit a written request to [email protected]. We will respond within one calendar month without charge. You also have the statutory right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. California Consumer Privacy Act (CCPA/CPRA) Disclosures

For residents of California, we confirm that we do not sell your personal data or share your personal information for cross-context behavioral advertising. You hold the right to know what personal information is collected, request deletion, and not receive discriminatory treatment for exercising your privacy rights.

10. Updates to This Policy

We may periodically update this policy to reflect operational changes, technical infrastructure adjustments, or statutory updates. Any revisions will be posted directly to this page with an amended "Last updated" date.