Privacy Policy

Effective Date: January 1, 2026 | Governing Regulation: GDPR (EU 2016/679) & CCPA

1. Data Controller Identity & Representative

This Privacy Policy applies to all services and web platforms operated under the domain brightbasketbrowsng.com. The data controller responsible for the processing of your personal information is:

BrightBasket Browsing Sp. z o.o.
KRS: 0000984218 | NIP: PL5252891044 | REGON: 389421098
ul. Mokotowska 49/12, 00-542 Warsaw, Poland
Data Protection Officer Contact: [email protected]

2. Categories of Personal Data Collected

We collect information directly from you when you interact with our kinetic grid portal, contact our desk, or browse our architectural dossiers:

Direct Communications: Full legal name, email address, postal address, company affiliation, and the contents of any inquiry transmitted via our contact portal.
Telemetry & Technical Metadata: Internet Protocol (IP) address, approximate geographic location based on IP, browser user-agent strings, device hardware specs, operating system versions, and referrers.
Kinetic Interaction Logs: Clickstream activity, destination tile enlargement events, grid layout reorganization triggers, filter selections, and time spent on specific historical dossiers.
Storage Tokens: LocalStorage keys preserving your cookie preferences (`cookieConsentPoland`) to ensure non-intrusive ongoing sessions.

3. Legal Bases for Processing Under GDPR (Article 6)

We process your personal information strictly under compliant legal bases:

Consent (Art. 6(1)(a)): Given explicitly when opting into analytical tracking cookies or subscribing to regional newsletter releases.
Contractual Performance (Art. 6(1)(b)): Necessary to respond to your direct requests for customized travel itineraries, guide bookings, or commercial travel partnerships.
Legitimate Interests (Art. 6(1)(f)): To safeguard platform integrity, detect automated abuse, balance kinetic grid load across European server nodes, and optimize editorial quality.
Legal Obligation (Art. 6(1)(c)): To maintain financial, corporate, and tax records in compliance with Polish commercial statutory requirements.

4. Third-Party Data Processors & Subprocessors

We enforce stringent Data Processing Agreements (DPAs) with vetted sub-processors adhering to European Standard Contractual Clauses (SCCs):

Cloud Infrastructure: EU-based cloud hosting providers ensuring ISO 27001 compliance and end-to-end data encryption at rest and in transit.
Content Delivery Networks (CDNs): Edge cache networks facilitating rapid delivery of high-definition imagery and typographic assets.
Analytics & Diagnostics: Privacy-preserving analytics engines operating with IP-anonymization flags enabled by default.

5. Data Subject Rights Under GDPR & CCPA

As a data subject, you hold statutory rights enforceable at any moment by contacting our desk at [email protected]:

Right of Access (Art. 15): Obtain confirmation as to whether your personal data is being processed, along with a complete copy of the recorded data.
Right to Rectification (Art. 16): Require the correction of inaccurate or incomplete personal records without undue delay.
Right to Erasure / "To Be Forgotten" (Art. 17): Request the permanent deletion of your data where processing is no longer required or consent is withdrawn.
Right to Restrict Processing (Art. 18): Temporarily suspend processing during data accuracy disputes.
Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, and machine-readable format.
Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing profiling.
California Consumer Privacy Act (CCPA) Provisions: We do NOT sell, lease, or monetize personal information to third-party data brokers.

6. Data Retention Protocols

Inquiry records submitted via the contact desk are retained for a maximum duration of 24 months from the date of final resolution, unless commercial contracting or statutory Polish tax retention requires archiving for up to 5 years. Analytical logs are aggregated, pseudonymized, and purged after 14 months.

7. Supervisory Authority

If you consider that our processing infringes data protection laws, you retain the right to lodge a formal complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).