GDPR Compliance & European Data Subject Rights
Statutory disclosures, legal bases for processing, and data subject rights under the General Data Protection Regulation (Regulation (EU) 2016/679) and the UK Data Protection Act 2018 for kettletownestate.com.
1. Data Controller Identification & Civic Scope
For the purposes of Regulation (EU) 2016/679 (General Data Protection Regulation) and the UK GDPR, the Data Controller for this website is:
Entity: The Kettletown Pre-Development Consortium (Citizen-Led Civic Initiative)
Location: Southbury, Connecticut, United States
Data Governance Contact: kettletownestate@gmail.com
Website: https://kettletownestate.com
The website operates strictly as an educational and civic feasibility study for the adaptive reuse of the 228-acre former corporate headquarters at 150 Kettletown Road in Southbury, CT. We do not engage in e-commerce, commercial transactions, or paid advertising.
2. Lawful Bases for Processing (Article 6 GDPR)
We only process personal data when a lawful basis under Article 6 of the GDPR applies:
Article 6(1)(f) — Legitimate Interests
We process aggregate telemetry and server logs to ensure network security, maintain edge uptime, protect against cyber attacks or DDoS events, and gauge community interest in specific civic master plan documents. Our legitimate interest is balanced against visitor privacy through strict first-party telemetry and immediate IP address masking.
Article 6(1)(a) — Consent
When you voluntarily submit your name, email, or municipal residence via our civic feedback form, preference surveys (e.g., vehicle storage, culinary, STEM), or briefing inquiries, processing is based on your explicit consent. You may withdraw consent at any time by requesting deletion of your submission.
3. European Data Subject Rights (Articles 15–22 GDPR)
Visitors residing in the European Economic Area (EEA), European Union, or United Kingdom possess comprehensive statutory rights regarding their personal data:
Right of Access (Art. 15)
Request confirmation of whether we hold personal data concerning you and obtain a copy of that data.
Right to Rectification (Art. 16)
Request prompt correction of any inaccurate or incomplete personal information previously submitted.
Right to Erasure (Art. 17)
Request permanent deletion of your form submissions, commentary, and email records ("Right to be Forgotten").
Right to Restriction (Art. 18)
Request temporary restriction of processing while accuracy or legitimacy is verified.
Right to Portability (Art. 20)
Receive personal data provided to us in a structured, commonly used, and machine-readable format (JSON or CSV).
Right to Object (Art. 21)
Object at any time to processing based on legitimate interests. We will cease processing absent compelling grounds.
4. International Data Transfers & Technical Safeguards
Because kettletownestate.com is hosted via the Netlify Edge CDN with infrastructure located in the United States and globally distributed edge points of presence, data transfers outside the European Economic Area may occur.
- Data Minimization: By stripping IP octets at the network perimeter and collecting minimal telemetry, personal identifiers do not cross international borders.
- Standard Contractual Clauses: Where personal data is handled by our CDN service providers, transfers rely on EU Standard Contractual Clauses (SCCs) and robust technical safeguards (TLS 1.3 encryption in transit).
- First-Party Architecture: Telemetry communicates directly with our dedicated Matomo analytics instance, preventing exposure to commercial data aggregators.
5. Exercising Your Rights & Supervisory Complaints
To exercise any GDPR data subject right, email our civic data governance desk at kettletownestate@gmail.com with the subject line "GDPR Data Subject Request".
Response Timeline: We respond to all verified requests within thirty (30) calendar days.
Zero Fees: Requests are processed completely free of charge.
Supervisory Authority Complaints: You retain the right to lodge a complaint with an EU/EEA national Data Protection Authority (such as the Irish DPC, French CNIL, or German BfDI) or the UK Information Commissioner's Office (ICO, ico.org.uk).
- First-party Matomo analytics
- Anonymized IP addresses
- Zero automated profiling
- 30-day response SLA
- Free data subject requests
Compare GDPR protections directly alongside CCPA, Connecticut CTDPA, and WCAG accessibility standards inside our tabbed modal.
