Northfieldly
Studio Active • Denver Start an Inquiry

Privacy Policy & Data Notice

Governing Law: Colorado, United States • Effective Date: 2026-11-08

Effective Date and Document Scope

This Privacy Policy and Statutory Data Notice takes effect on 2026-11-08. It governs data handling practices across northfieldly.com, direct correspondence with our Cherokee Street studio desk, customer intake processing, and technical telemetry collected during site interactions.

Data Controller & Operating Identity

The data controller responsible for personal information processed through this website is Northfieldly, trading at northfieldly.com.

Studio and legal correspondence address: 1371 Cherokee Street, Denver, Colorado 80204, Denver, Colorado, United States. Telephone inquiries are received at +1 (247) 555-2780 and digital communications at [email protected]. The studio operates as an independent design practice directed by Ivan Petrov since 2021.

Categories of Data Collected

We collect personal and technical information strictly necessary for commercial website proposals and inquiry evaluation:

  • Inquiry Details: Name, telephone number, email address, physical practice address, project scope format, requested specifications, and freeform project notes submitted via lahe26c.php.
  • Technical and Server Telemetry: Internet Protocol (IP) address, browser user-agent string, operating system version, HTTP referrer URL, and automated submission timestamps recording when the form was rendered and when it was dispatched.
  • Studio Chat Logs: Conversation message text, timestamp records, and local session tokens issued by sozuc1e.php to enable uninterrupted browser dialogues.
  • Advertising & Storage Identifiers: Advertising network click identifiers attached to inbound links (gclid, msclkid, fbclid) and local browser storage preferences stored under site_consent_v2.

This site operates no user registration system, creates no customer accounts, requires no passwords, and collects no credit card or banking details. Financial transactions for contracted projects take place under separate formal commercial agreements.

Purposes of Data Processing

Data collected by Northfieldly is utilized exclusively for legitimate business operations:

  • Evaluating project requirements and formulating fixed-rate commercial contracts ($5,000–$20,000 USD).
  • Conducting phone or email follow-ups regarding Cherokee Street consultation scheduling and scope feasibility.
  • Measuring advertising campaign effectiveness on search and social channels without profiling individual consumers.
  • Diagnosing technical server anomalies, mitigating automated submission abuse, and maintaining defensive security perimeters.

Legal Bases for Processing

In compliance with statutory standards, each category of data processing is grounded in a specific legal basis:

  • Contractual Necessity: Processing project notes, names, and contact coordinates to formulate commercial proposals and deliver contracted web design milestones under written agreements.
  • Consent: Activating advertising measurement tags and analytical tracking scripts only after the visitor provides explicit opt-in confirmation via the consent banner.
  • Legitimate Interests: Preserving server logs, monitoring submission timestamps, and mitigating automated network spam to ensure the security and uninterrupted availability of northfieldly.com.

Advertising Platforms & Click Identifiers

Northfieldly actively conducts paid customer acquisition. Google Ads, Microsoft Advertising, and Meta Ads send traffic to this domain. Inbound campaign links append unique alphanumeric query parameters to verify genuine business visits:

  • Google Ads: Appends the gclid parameter to inbound URLs for conversion attribution.
  • Microsoft Advertising: Appends the msclkid parameter to measure campaign effectiveness on Bing.
  • Meta Ads: Appends the fbclid parameter when visitors navigate from Meta platforms.

These parameters are read by our measurement configurations strictly in accordance with visitor consent states. Neither Northfieldly nor our platform vendors engage in invasive behavioural profiling or sensitive category targeting.

Consent Mode v2 Architecture

Our technical implementation deploys Google Consent Mode v2 to ensure privacy preferences are enforced by default. Before any visitor action is taken on our banner, the four foundational tracking signals remain held strictly denied:

  • ad_storage: denied
  • ad_user_data: denied
  • ad_personalization: denied
  • analytics_storage: denied

Only when a visitor clicks “Allow” on our consent interface are these states updated to granted. If the visitor selects “Decline” or alters their settings through our footer controls, all four parameters are immediately reset to denied, preventing tracking cookies or advertising pixels from recording persistent local data.

Third-Party Data Processors

We transmit data only to verified third-party infrastructure providers that comply with strict data protection covenants:

  • Google Ireland Ltd / Google LLC: Operates Google Ads measurement and analytics scripts under strict contractual safeguards.
  • Microsoft Ireland Operations Ltd: Operates Microsoft Advertising conversion logging. Microsoft’s privacy commitments and data handling policies are accessible at privacy.microsoft.com.
  • Meta Platforms Ireland Ltd: Operates Meta Ads conversion measurement where active.
  • Production Hosting & Mail Infrastructure: Our dedicated server host stores the submission database and delivers automated inquiry notifications to Ivan Petrov’s inbox over encrypted TLS connections.

Cross-Border Data Transfers

Northfieldly operates from Denver, Colorado in the United States. Communications dispatched through our inquiry form and server interactions originate within or are transferred to the United States. Where inquiries originate from the European Economic Area or the United Kingdom, transfers are conducted under standard contractual clauses (SCCs) approved by the European Commission, maintaining an adequate level of data protection equivalent to European standards.

Data Retention Schedules

We do not retain information indefinitely. Personal data is maintained strictly for defined operational timeframes:

  • Inquiry Records & Emails: Retained for exactly 24 months from receipt to support contract scope records and warranty continuity.
  • Support Chat Transcripts: Retained for 12 months from the last message before automatic database purge.
  • Web Server & Access Logs: Retained for 30 days for network security monitoring and rotated automatically.
  • Consent Preference Records: Retained in local browser storage for 6 months under site_consent_v2.

Data Security Measures

Our infrastructure employs administrative, physical, and technical safeguards to prevent unauthorized access, alteration, or interception. All network transmissions are encrypted with modern TLS 1.3 cryptographic suites. Access to production inquiry databases is limited strictly to Ivan Petrov via hardware-authenticated credentials. Regular security updates and firewall policies protect our server endpoints against injection and brute-force intrusion.

European Data Subject Rights (GDPR)

If you access northfieldly.com from the European Economic Area, Switzerland, or the United Kingdom, you hold statutory rights under the General Data Protection Regulation (GDPR):

  • Right of Access: Request confirmation and copies of personal data processed by the studio.
  • Right to Rectification: Request correction of inaccurate or incomplete contact records.
  • Right to Erasure: Request permanent deletion of personal data where retention grounds have elapsed.
  • Right to Restriction: Request restriction of processing during factual disputes.
  • Right to Data Portability: Obtain a structured, machine-readable export of submitted inquiry data.
  • Right to Object: Object to processing based on legitimate commercial interests.
  • Right to Withdraw Consent: Revoke consent at any time without affecting past processing legality.

United States State Privacy Rights (CCPA & Colorado)

Residents of Colorado, California (under the CCPA and CPRA), and other US jurisdictions with comprehensive privacy statutes possess specific protections regarding their personal data:

  • Right to Know and Access: Confirm whether we process personal data and request categories of information collected.
  • Right to Correct: Rectify factual inaccuracies in business records.
  • Right to Delete: Request deletion of personal records, subject to legal record-keeping exemptions.
  • Sale and Sharing Prohibition: Northfieldly does not sell personal information or share consumer data for cross-context behavioral advertising. We have not sold or shared consumer data in the preceding 12 months.
  • Non-Discrimination: We do not alter service fees, timelines, or contractual commitments for clients who exercise statutory privacy rights.

Global Privacy Control (GPC)

We recognize and honor Global Privacy Control signals transmitted by visitor web browsers. When northfieldly.com detects the Sec-GPC HTTP request header, our consent framework automatically treats the visit as an opt-out from optional analytics and advertising tracking, setting Consent Mode v2 flags to denied without prompting the visitor with additional dialogs.

Protection of Children

Our services are directed exclusively to business operators, professional practices, and commercial entities. Northfieldly does not knowingly solicit or collect personal information from individuals under 16 years of age. If we learn that personal data of a minor has been submitted without verified parental authorization, we immediately purge the data from our active storage systems.

Regulatory Inquiries & Complaints

Visitors have the statutory right to file a formal complaint with relevant regulatory bodies:

  • Colorado Residents: Office of the Colorado Attorney General, Consumer Protection Section, 1300 Broadway, 10th Floor, Denver, CO 80203.
  • California Residents: California Privacy Protection Agency (CPPA) or the California Attorney General’s Office.
  • European Visitors: The relevant supervisory data protection authority in their country of residence.

Policy Revisions & Updates

Northfieldly reviews and updates this policy whenever operational tools, advertising tags, or statutory requirements evolve. Any modifications become effective upon publication at northfieldly.com/privacy/privacy.html with an amended effective date. Significant structural changes affecting processing bases will be summarized in our site footer legal announcements.

Contact Information for Privacy Matters

For questions regarding this policy, our Consent Mode v2 implementation, or our studio security practices, reach our direct operating desk:

Northfieldly Web Design Studio
Attention: Ivan Petrov, Principal Designer
1371 Cherokee Street, Denver, Colorado 80204, United States
Telephone: +1 (247) 555-2780
Email: [email protected]

Official business registry and privacy compliance documentation binder in the studio archives.
Studio legal registry binder Cherokee Street Archive, Denver