Privacy Notice

Bureau Ingold Effective 21 August 2026 · Version 1.0

VVR ANT LLC d/b/a Bureau Ingold (the Practice), a Florida limited liability company, is responsible for the personal data described here.

Contact: hello@bureauingold.com

The short version

The Site sets no cookies. It carries no advertising and no tracking pixels. There is no form to fill in and no mailing list to join. Visitor numbers are counted, but no visitor is identified and nothing is stored on anyone's device.

The Practice collects personal data in two situations: when a page is served, because a server cannot deliver a page without an address to send it to, and when someone writes to it, because a letter contains whoever wrote it.

Nothing is sold, rented, or shared with anyone for their own purposes.

The rest of this notice sets out the detail.

1 · When a page is served

Serving a page requires the visitor's IP address, and the request itself carries the browser type, the operating system, the page requested, and the time.

This is handled by the Practice's hosting and infrastructure providers, listed in section 4. They keep short-term security and operational logs. The Practice does not receive those logs, does not build visitor profiles, and cannot identify individual visitors from them.

Typefaces are served from the Practice's own domain. No third party is contacted to display a page.

Measurement. The Site uses Cloudflare Web Analytics to count page views, referring sites, country of origin, and page loading speed. It sets no cookies, stores nothing on the visitor's device, and uses no persistent identifier. Uniqueness of a visit is derived at the edge from the request itself and immediately discarded. The Practice sees totals, never individuals, and cannot connect a visit to a person.

Legal basis, where the GDPR applies: legitimate interest in delivering and securing the Site (Article 6(1)(f)).

2 · When someone writes

An email to hello@ or any address at bureauingold.com contains the sender's address, name where given, and whatever the sender chose to put in it.

Email addresses at the domain are forwarded to an existing mailbox. Messages are read, answered where appropriate, and kept as correspondence.

Correspondence is used to answer the enquiry and, where it leads to work, to run the engagement. It is not added to any marketing list.

Legal basis, where the GDPR applies: steps taken at the request of the data subject before entering a contract (Article 6(1)(b)), or legitimate interest in responding to correspondence (Article 6(1)(f)).

3 · When someone becomes a client

Under an engagement, the Practice handles the client's business data and, unavoidably, personal data of the client's staff: names, work addresses, roles.

Where the Practice is given access to a client's analytics or advertising accounts, it may encounter personal data of the client's own customers. In that situation the client is the controller and the Practice is a processor: it acts on the client's instruction, uses the data only for the engagement, and returns or deletes it when the engagement ends. Terms governing that relationship are agreed before such access begins.

Legal basis, where the GDPR applies: performance of a contract (Article 6(1)(b)).

4 · Who processes data on the Practice's behalf

Each acts under its own terms and its own security obligations. None is permitted to use the data for its own purposes.

5 · Where data is held

The Practice is established in the United States, and data reaching it is held there.

Where personal data is transferred out of the European Economic Area or the United Kingdom to a provider listed in section 4, the transfer relies on the safeguards offered by that provider, which include the European Commission's Standard Contractual Clauses or certification under the EU–US Data Privacy Framework, as applicable to each.

Anyone who writes to the Practice directly is sending data to the United States by their own act. That is not a transfer made by the Practice, but it is worth stating plainly.

6 · How long data is kept

Correspondence that does not lead to work: up to two years, then deleted.

Correspondence and records relating to an engagement: seven years from the end of the engagement, which is the period required for tax and professional records in the United States.

Server and security logs held by the providers in section 4: for the period each of them sets, which is short and outside the Practice's control.

7 · What the Practice does not do

It does not sell personal data, and has never done so.

It does not share personal data with third parties for their own marketing.

It does not use automated decision-making or profiling.

It does not run advertising or retargeting, and does not track anyone across sites.

It does not knowingly collect data from anyone under 16. The Site is not directed at children.

8 · Rights

Anyone may ask the Practice what personal data it holds about them, ask for it to be corrected, or ask for it to be deleted. Requests go to hello@bureauingold.com and are answered within 30 days.

Where the GDPR or the UK GDPR applies, the following rights exist in addition: access, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest, and withdrawal of consent where processing rests on consent.

Where California law applies, residents of that state have the rights granted by the California Consumer Privacy Act, including the right to know, the right to delete, and the right to opt out of sale — the last of which is met by the fact that the Practice does not sell data. No one will be treated differently for exercising a right.

9 · Complaints

A complaint should be raised with the Practice first, at hello@bureauingold.com.

Anyone in the European Union or the United Kingdom who is not satisfied with the response may complain to the supervisory authority in their country of residence or place of work. Doing so does not require complaining to the Practice first.

10 · Changes

This notice may be revised. A revision takes effect when published, and the version in force is the one shown at the top of this page. Where a change materially affects how personal data is handled, it will be noted here.

Bureau Ingold hello@bureauingold.com