Privacy Policy

## 1. Introduction and Scope Northwind Studio Global Ltd. ("Northwind Studio", "we", "us", or "our") is committed to protecting the privacy and personal data of our website visitors, clients, and partners. This Privacy Policy explains our practices regarding the collection, use, disclosure, and protection of personal data when you visit our website or engage our software engineering, cybersecurity, and digital growth services.

2. Data We Collect and Processing Purposes We adhere strictly to the principle of data minimization. We only collect personal information when voluntarily provided by you or necessary for legitimate business operations:

• **Inquiry & Proposal Intake:** When you submit a project inquiry, request a proposal, or book a consultation, we collect your name, work email address, company name, phone number, job role, project requirements, and estimated budget. This information is processed under the legal basis of taking steps at the request of the data subject prior to entering into a contract (GDPR Art. 6(1)(b)).
• **Newsletter Subscriptions:** When you subscribe to our technical insights or download whitepapers, we collect your email address under your explicit consent (GDPR Art. 6(1)(a)). You may unsubscribe at any time via the one-click link in every email.
• **Technical & Usage Telemetry:** We collect privacy-conscious, aggregated device telemetry (browser type, operating system, approximate country-level geographic region, referring URL) to ensure website security, prevent distributed denial-of-service (DDoS) abuse, and monitor Core Web Vitals performance. We do not track or fingerprint individual users across external websites.

3. Data Retention and Deletion We retain personal data only as long as necessary to fulfill the purposes for which it was collected, or as required by applicable commercial and tax regulations. Project inquiry records are retained for 24 months after the last active communication unless you request earlier deletion.

4. International Transfers and Subprocessors Your information is stored in secure, encrypted cloud facilities in the European Union (EU) and United States with strict SOC 2 Type II and ISO 27001 data center certifications. When transfers occur outside the European Economic Area (EEA), we execute Standard Contractual Clauses (SCCs) to ensure equivalent protection.

5. Your Data Subject Rights (GDPR & CCPA) Under applicable data privacy laws, you hold the following rights: - The right to access and receive a copy of your personal data. - The right to rectify inaccurate or incomplete data. - The right to erasure ("Right to be Forgotten"). - The right to restrict or object to the processing of your data. - The right to data portability in a structured, machine-readable format.

To exercise any of these rights, please contact our Data Protection Officer at [privacy@northwindstudio.com](mailto:privacy@northwindstudio.com). We respond to all verified requests within 30 days without charge.