Privacy Policy & Data Protection

AthyriumStudio ("the Agency", "we", "us", or "our") acts as the data controller for personal data processed through this website and associated engineering services. For any privacy inquiry, contact: • Trading Name: AthyriumStudio • Privacy Email: [email protected] • Operational Base: Bogotá D.C., Colombia (serving global clients). • Regulatory Framework: Drafted following General Legal open standards, EU General Data Protection Regulation (GDPR 2016/679), California Consumer Privacy Act (CCPA/CPRA), and applicable international privacy legislation.

We collect only adequate, relevant, and necessary data required to deliver boutique software engineering and project assessments: a) Voluntarily Provided Data: Name, business email, company/organization name, technical project scope, estimated budget range, and preferred contact channel. b) Technical & Telemetry Data: Anonymized IP addresses, browser types, operating system identifiers, timestamps, and page request telemetry processed strictly for defense-in-depth and intrusion prevention. c) Correspondence: Communications exchanged via technical enquiry forms or email under non-disclosure obligations. We never collect sensitive categories of personal data or data from individuals under 18 years of age.

All processing is grounded on valid lawful bases under international privacy laws: 1. Contract Performance & Pre-contractual Inquiries (Art. 6.1.b GDPR): Formulating architecture proposals, bilateral NDA execution, and custom software delivery. 2. Legitimate Security Interests (Art. 6.1.f GDPR): Hardening digital perimeters, defending against DDoS attacks, automated injection bots, and unauthorized penetration. 3. Consent (Art. 6.1.a GDPR): Voluntary submission of inquiries via our quote and contact forms. 4. Legal Compliance: Invoicing, tax record retention, and cooperation with binding judicial orders.

AthyriumStudio does not sell, rent, or trade personal data. We engage trustworthy cloud sub-processors bound by robust Data Processing Addendums (DPAs) with Standard Contractual Clauses (SCCs): • Cloudflare, Inc.: Global Anycast edge network, DDoS mitigation, and TLS 1.3 termination. • Cloud Database & Infrastructure Hosts: SOC 2 Type II and ISO 27001 certified cloud environments with isolated tenant storage. • Transactional Email Relay: Encrypted transit delivery of technical notifications with no persistent content caching. Any cross-border data transfer outside your local jurisdiction occurs under recognized adequacy mechanisms and end-to-end encryption.

We enforce Defense-in-Depth across every tier: • Robust Encryption: TLS 1.3 in transit with HSTS preload and AES-256 encryption at rest for sensitive configurations. • Zero Secret Exposure: Environment variables decoupled from source code; zero hardcoded secrets in client repositories. • Logical Partitioning: Database Row-Level Security (RLS) enforcing strict multi-tenant boundary checks. • Least Privilege Access: Access limited to senior engineering personnel protected by multi-factor authentication (MFA).

You possess comprehensive statutory rights regarding your personal information: • Access: Obtain confirmation and copies of your personal data held by us. • Rectification: Request correction of inaccurate or outdated details. • Erasure ("Right to Be Forgotten"): Request deletion of personal data when no longer legally required. • Restriction & Objection: Object to or restrict specific processing operations. • Data Portability: Receive data in an interoperable, structured machine-readable format. • Withdraw consent at any time without retroactive prejudice. Submit verification requests to [email protected]. We respond within statutory timelines without charging fees.

Personal data is retained only for the duration required to achieve contractual and legal statutory requirements (up to 5 years for tax and commercial records). We reserve the right to amend this Privacy Policy to reflect evolving industry practices and regulatory updates. The effective date at the top indicates current standing.