1. Data Controller Identity
For the purposes of applicable data protection legislation (including the UK General Data Protection Regulation and the Data Protection Act 2018), the data controller responsible for your personal information is:
Friendflickvaultbx Media & Heritage Ltd
48 Blackwood Crescent, Edinburgh, EH9 1TK, United Kingdom
Company Registration: SC14892014
Data Protection Officer Contact: [email protected]
2. Information We Collect
We adhere strictly to principles of data minimization. We only collect information that is strictly necessary for fulfilling our educational and communication objectives:
- Direct Contact Data: Name, institutional affiliation, email address, subject category, and message text voluntarily provided through our contact form.
- Technical Diagnostics: Anonymized server log records comprising masked IP addresses, browser agent headers, referring URLs, and timestamp data used solely to maintain infrastructure security and prevent malicious traffic.
- Preference Tokens: LocalStorage keys (such as cookie consent choices) stored client-side on your device.
3. Legal Bases for Processing
We process personal data only when substantiated by valid legal grounds under UK/EU data protection law:
| Data Category | Processing Purpose | Lawful Basis | Retention Period |
|---|---|---|---|
| Contact Form Details | Responding to research inquiries, editorial feedback, and site proposals | Legitimate Interests / Consent | 24 months from inquiry resolution |
| Server Diagnostic Logs | Firewall protection, DDoS prevention, rate limiting | Legitimate Interests (Security) | 90 days (rolling purge) |
| Consent Tokens | Recording cookie consent preferences | Legal Compliance | 12 months |
4. Third-Party Sharing and Disclosures
We do not sell, rent, monetize, or profile your personal data for commercial advertising. Information is shared only under specific operational conditions:
- Technical Service Providers: Encrypted hosting and content delivery network providers operating under binding data processing agreements.
- Statutory Compliance: When compelled by valid legal subpoenas, court orders, or statutory regulatory inquiries within the jurisdiction of the United Kingdom.
5. Your Statutory Rights
Under UK and EU data protection regulations, you possess enforceable rights regarding your personal information:
- Right of Access: Request a copy of any personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete records.
- Right to Erasure ("Right to be Forgotten"): Request deletion of your personal contact records where no legal obligation requires retention.
- Right to Restriction & Objection: Object to processing carried out under legitimate interest grounds.
- Right to Lodge a Complaint: You have the right to submit a complaint to the UK Information Commissioner's Office (ICO) at ico.org.uk.
6. Security Measures
We employ robust administrative, technological, and physical controls to safeguard stored information, including TLS 1.3 encryption in transit, strict access isolation, and regular security patching.
7. Policy Amendments
This policy may be revised periodically to incorporate technological updates or regulatory amendments. Any revisions will be published immediately on this URL with an updated effective date.