01. Data Controller & Atelier Identity
This Global Privacy Policy applies to all digital interactions, photographic commissions, fine art print acquisitions, and private client proofing conducted through Broken Jaw Frames, the independent fine art and documentary atelier directed by Debashish Bhuyan (hereinafter referred to as "we", "our", or "the Data Controller/Fiduciary"), operating out of Golaghat, Assam, India.
02. Categories of Personal Information Collected
Depending on your interaction with our studio, we collect only the following limited categories of personal information:
- Commission & Production Inquiries: Name, professional or business email address, production location requirements, estimated budget brackets, and creative briefs transmitted voluntarily via our inquiry form.
- Fine Art Print Acquisitions: Collector name, physical delivery address, contact telephone (for insured courier dispatch), and bespoke framing specifications.
- VIP Client Proofing Vault: Private access keys and one-way cryptographic SHA-256 salted hash digests used solely to authenticate authorized client access to confidential campaign proofs.
- Functional Device Preferences: Ephemeral user interface preferences (Darkroom Nocturne vs. Museum Alabaster theme, Web Audio shutter audio state) stored strictly within your local browser storage (
localStorage).
03. Lawful Grounds for Processing (Global Standards)
Under international data protection laws, we process personal data exclusively under recognized lawful bases:
- Consent (GDPR Art. 6(1)(a), DPDP Act Sec. 6, CCPA): Where you have granted explicit consent by submitting a project inquiry or subscribing to fine art monograph notifications.
- Contractual Performance (GDPR Art. 6(1)(b)): Where processing is necessary to prepare commission estimates, execute production agreements, or fulfill print acquisitions.
- Legitimate Interests (GDPR Art. 6(1)(f)): To secure our digital infrastructure against brute-force attacks, protect intellectual property from automated scraping, and ensure server integrity.
04. Universal Data Subject & Consumer Rights
Regardless of your geographic location, we provide comprehensive statutory rights:
Right to Access & Portability
Request an electronic copy of the personal information we hold about you and details of any processing activities.
Right to Rectification & Correction
Request prompt correction of inaccurate, incomplete, or outdated personal details.
Right to Erasure ("Right to be Forgotten")
Demand complete, irreversible deletion of your personal data from all studio records when retention is no longer legally mandated.
Right to Restriction & Objection
Object to or request limitation of processing based on legitimate interests or change of circumstances.
Do Not Sell / Share (CCPA/CPRA)
We do not sell or share personal data. California residents enjoy absolute protection against commercial disclosure.
Right to Nominate (DPDP Act Sec. 14)
Designate an authorized representative or nominee to exercise your digital data rights in event of death or incapacity.
05. International Data Transfers & Technical Safeguards
Our digital infrastructure utilizes globally distributed edge networks (Vercel Edge Network) adhering to SOC 2 Type II compliance and ISO 27001 standards. Cross-border transfers between our primary studio in Assam and international edge endpoints are protected by Standard Contractual Clauses (SCCs) and end-to-end TLS 1.3 cryptographic transport security.
06. Data Retention & Cryptographic Security
Personal data is retained only for the duration necessary to conclude active commissions or satisfy statutory commercial accounting requirements in India. Client proofing PINs are stored exclusively as irreversible SHA-256 digests with cryptographically random salts—the plaintext PIN is never stored or transmitted.
07. Data Protection Liaison & Exercising Your Rights
To submit a formal request for data access, correction, erasure, or nominee designation, contact our designated Data Protection Liaison:
Atelier Data Protection Liaison
08. Supervisory Authorities
If you believe your privacy rights have been infringed, you retain the statutory right to lodge a complaint with your competent supervisory authority:
- European Union: Your national Data Protection Authority (DPA) under GDPR Art. 77.
- United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk.
- United States: California Privacy Protection Agency (CPPA) or your State Attorney General.
- India: Data Protection Board of India (DPBI) under Section 27 of the DPDP Act 2023.