Privacy Policy

1. Principles and Scope of Data Processing

Meadowreel Shuffleit Aerospace Ltd ("the Company", "we", "our", or "us"), registered under company number 13982410 in England and Wales, operates the aerospace technical portal meadowreelshuffleit.bond. We are committed to processing all personal data lawfully, fairly, and transparently, adhering strictly to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (Regulation (EU) 2016/679).

This policy applies to individuals who navigate our public monographs, communicate with our editorial desk, or submit correspondence via electronic forms on this website.

2. Categories of Information Collected

We restrict data collection to information necessary for delivering analytical content and managing professional inquiries:

• Directly Provided Correspondent Data: When you complete our contact form, we collect your legal or professional name, electronic mail address, inquiry categorization, and the verbatim contents of your message.
• Automated Telemetry and Server Logs: When connecting to our web servers, standard diagnostic protocols automatically log your Internet Protocol (IP) address, user-agent string (identifying browser and operating system), access timestamps, referring URL headers, and HTTP request statuses.
• Preference Tokens: We retain local client-side storage tokens recording whether you have accepted, rejected, or modified cookie preferences.

3. Legal Bases for Processing Under UK GDPR

We rely on explicit lawful bases under Article 6(1) of the UK GDPR for every data handling operation:

• Legitimate Interests (Art. 6(1)(f)): Processing diagnostic server logs to protect network security, prevent distributed denial-of-service (DDoS) attempts, and maintain infrastructural uptime.
• Consent (Art. 6(1)(a)): Transmitting communications when you voluntarily provide contact data and explicitly opt in via checkbox consent.
• Legal Obligation (Art. 6(1)(c)): Retaining correspondence where required to comply with statutory accounting, regulatory inquiries, or judicial orders in the United Kingdom.

4. Third-Party Processors and International Transfers

We do not sell, license, or barter user records to data brokers or advertising exchanges. Personal data may be accessible only to vetted data processors acting strictly under binding data processing agreements (DPAs):

• Infrastructure Hosting Providers: Secure tier-3 cloud data center facilities located within the United Kingdom and European Economic Area (EEA) providing content delivery and firewall security.
• Technical Support Contractors: Systems administrators tasked with database integrity audits under non-disclosure obligations.

Where technical routing necessitates processing outside the UK or EEA, transfers occur under UK International Data Transfer Agreements (IDTA) or European Commission Standard Contractual Clauses (SCCs), ensuring equivalent levels of data subject protection.

5. Data Subject Rights (GDPR & CCPA)

Individuals whose personal data is processed by the Company retain enforceable statutory rights under applicable privacy regimes:

• Right of Access: You may request formal confirmation of whether your data is processed, alongside certified copies of stored records.
• Right to Rectification: You may require prompt correction of inaccurate or incomplete contact records.
• Right to Erasure ("Right to be Forgotten"): You may request immediate deletion of personal records where continued retention lacks a prevailing legal mandate.
• Right to Restriction and Objection: You may object to data processing grounded in legitimate interests or demand suspension of processing pending verification.
• Right to Data Portability: You may obtain structured, machine-readable exports of data supplied under consent.
• California Consumer Privacy Act (CCPA) Provisions: California residents retain statutory rights to notice of collected categories, non-discrimination for exercising statutory rights, and confirmation that we execute no data sales.

6. Data Retention and Destruction Schedules

We apply strict data minimization schedules. Contact form transmissions and associated email correspondence are retained for twenty-four (24) months from the date of final resolution to support historical reference, after which messages are permanently purged from active systems. Server diagnostic log files containing IP addresses are automatically overwritten on a rolling thirty (30) day retention cycle.

7. Data Protection Officer and Supervisory Authority Contact

To exercise your statutory data protection rights or lodge formal inquiries regarding privacy governance, contact our designated privacy desk:

If you believe our processing infringes data protection legislation, you retain the statutory right to lodge a formal complaint with the UK supervisory authority: The Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (ico.org.uk).