Regulatory Compliance & Transparency

Privacy Policy & GDPR Statement

Effective Date: January 1, 2026 • Last Revised: February 2026 • Version 3.2

Summary of Principles: Gridsvaultpilt Travel Media Ltd. ("Gridsvaultpilt", "we", "our", or "us") operates strictly on a principle of data minimization. We do not sell your personal information, deploy invasive cross-platform behavioral trackers, or monetize subscriber records to third-party ad exchanges.

1. Introduction and Data Controller

This Privacy Policy outlines how Gridsvaultpilt collects, processes, stores, and safeguards personal data when you access gridsvaultpilt.quest and its associated sub-pages, digital dispatches, residency reservation request systems, and field journals.

Under the EU General Data Protection Regulation (GDPR) Regulation (EU) 2016/679 and the UK GDPR (Data Protection Act 2018), the Data Controller responsible for your information is:

Gridsvaultpilt Travel Media Ltd.
Company Registration No.: 14892011
Registered Office: 44 Clarendon Cross, Notting Hill, London W11 4AP, United Kingdom
Italian Operations Branch: Via della Spiga 18, 53026 San Quirico d'Orcia (SI), Italy
Designated Data Protection Officer (DPO): [email protected]

2. Categories of Information We Collect

We only collect information that is strictly necessary to fulfill our editorial mission, deliver curated travel dispatches, and coordinate vetted residential bookings:

Voluntary Correspondence Data: Your name, email address, physical mailing address (if requesting printed quarterly journals), travel dates, and residency preferences submitted via our contact and inquiry forms.
Technical & Connectivity Metadata: Anonymized IP addresses, browser agent identifiers, device viewport dimensions, and referral URLs gathered strictly for security diagnostics and basic aggregated analytics.
Cookie & Local Storage Information: Minimal session state tokens and persistent user preferences (e.g., your consent state stored via localStorage) to prevent repetitive banner popups.

3. Legal Bases for Processing Under GDPR

We process personal data solely where an established legal basis under Article 6 of the GDPR applies:

Consent (Art. 6(1)(a)): You have provided affirmative consent when subscribing to our printed or digital Dispatches, or agreeing to analytical cookie telemetry.
Contractual Performance (Art. 6(1)(b)): Processing is necessary to facilitate residency reservations, coordinate farmstay logistics, or reply to direct inquiries initiated by you.
Legitimate Interests (Art. 6(1)(f)): Safeguarding our website infrastructure against automated spam, denial-of-service vectors, and malicious intrusion.
Legal Obligation (Art. 6(1)(c)): Fulfilling tax, corporate reporting, and audit requirements under UK and Italian statutory laws.

4. Third-Party Sub-Processors & Data Transfers

We partner with a limited set of vetted technical infrastructure providers who adhere strictly to GDPR standards and maintain Standard Contractual Clauses (SCCs) for cross-border data protection:

Web Hosting & CDN: European cloud infrastructure ensuring encrypted data at rest (AES-256) and TLS 1.3 in transit.
Transactional Email Dispatch: EU-based privacy-compliant SMTP routing services used exclusively to send requested field guides and confirmation receipts.
Mapping Coordinates: Anonymized waypoint map renderers that do not store persistent geolocation identifiers.

5. Your Rights Under GDPR & CCPA/CPRA

Depending on your geographic residency, you possess statutory rights regarding your personal information, including:

Right of Access (Art. 15 GDPR): The right to obtain a copy of all personal records we maintain regarding your identity.
Right to Rectification (Art. 16 GDPR): The right to correct inaccurate or incomplete information.
Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): The right to demand permanent deletion of your data from our active databases.
Right to Restrict Processing (Art. 18 GDPR) & Data Portability (Art. 20 GDPR): The right to receive your records in a structured, machine-readable JSON format.
Right to Opt-Out (CCPA/CPRA): We do not sell or share personal data for monetary or other valuable consideration. California residents may submit opt-out requests at any time.

6. Data Retention Period

Contact inquiries and residency coordination records are maintained for a maximum of twenty-four (24) months following the completion of your travel itinerary, after which they are either irreversibly anonymized or securely purged. Newsletter subscriptions persist until you click the one-click unsubscribe link provided in every dispatch.

7. Contact the Data Protection Officer

If you have questions, wish to exercise your statutory privacy rights, or wish to lodge a formal inquiry, contact our Data Protection Officer directly at [email protected] or write to Gridsvaultpilt Travel Media Ltd., 44 Clarendon Cross, Notting Hill, London W11 4AP, United Kingdom.