Privacy Policy & Regulatory Disclosures

Controller Identity & Studio Office. This website is owned and operated by Oakmerton, trading at oakmerton.com. The physical and legal correspondence address of the data controller is 300 East 17th Avenue, Denver, Colorado 80203, Denver, Colorado, United States. Telephone communications route to +1 (803) 555-5338 and electronic communications route directly to [email protected]. Oak Merton operates as a brand identity, strategy, and editorial copywriting studio registered under the laws of the State of Colorado.

Categories of Data Collected. We collect personal data strictly when you submit an inquiry through gifa6dd.php, engage with our client support chat via jaji961.php, or navigate our digital domain. The inquiry form captures your full name, telephone number, business email address, corporate location or physical address, engagement kind, project notes, delivery specification, and affirmative consent confirmation. With each transmission, our infrastructure records your Internet Protocol (IP) address, browser user-agent string, referring URL, timestamp of form render, and timestamp of transmission. The support chat retains message text and issues a random session token in localStorage. This site maintains no account registration, holds no passwords, and collects no credit card or financial instrument numbers; commercial invoicing is handled off-site via formal bank transfer.

Purposes of Data Processing. Personal information gathered by the studio is processed exclusively to evaluate prospective client engagements, deliver preliminary scope assessments, schedule brand consultations, maintain active project correspondence, archive proof of contractual consent, protect our digital infrastructure against brute-force intrusion, and measure the commercial efficiency of our search and digital advertising initiatives. We do not sell your personal information or compile consumer profiles for cross-context marketing.

Lawful Bases for Processing. Where European or international privacy frameworks apply, processing is anchored on three recognized lawful bases. First, contract performance: processing your contact parameters and project notes is necessary to assess and enter into a binding brand engagement agreement. Second, legitimate interests: maintaining access logs, blocking automated spam submissions, and ensuring server security. Third, consent: the placement of conversion tags and the retention of advertising click telemetry relies entirely on affirmative consent granted through our cookie preference banner.

Advertising Platforms & Click Identifiers. This studio actively runs paid marketing campaigns to direct commercial enterprises to our practice. Paid traffic routes to this website from Google Ads, Microsoft Advertising, and Meta Ads. When a visitor arrives via these networks, the advertising platform appends a unique click parameter to the destination URL: gclid for Google Ads, msclkid for Microsoft Advertising, and fbclid for Meta Ads. These identifiers allow our systems and the respective networks (including google ads and microsoft advertising) to verify that a visit originated from an authorized advertisement and to attribute subsequent inquiry form submissions without collecting or exposing underlying financial data.

Google Consent Mode v2 Architecture. We strictly enforce Google Consent Mode v2 on this website. By technical default prior to user interaction, the four platform consent parameters—specifically ad_storage, ad_user_data, ad_personalization, and analytics_storage—are held in a denied status. Only when a visitor grants affirmative consent via our consent interface are these values updated to granted. If a visitor declines cookies, chooses to withdraw permission, or transmits an automated opt-out signal, the consent mode parameters remain or are immediately restored to denied, preventing tracking cookies from being written to the client browser.

Authorized Processors & Service Providers. We transmit data only to verified third-party technical vendors under strict data processing covenants. Google Ireland Ltd / Google LLC processes Google Ads telemetry and consent signals. Microsoft Ireland Operations Ltd processes Microsoft Advertising click conversions, governed under the Microsoft privacy statement published at privacy.microsoft.com. Meta Platforms Ireland Ltd receives fbclid conversion pings for campaigns deployed on Meta. In addition, our secure cloud hosting provider hosts our web servers and inquiry repository, and our business email provider routes incoming notifications to [email protected].

Cross-Border Data Transfers. Because our primary studio infrastructure and physical office are situated in Denver, Colorado, United States, information submitted by individuals outside the United States is transferred to and processed within the United States. Where cross-border transfers involve European Economic Area (EEA), Swiss, or UK personal data, transfers are executed pursuant to Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring adequate legal safeguards matching European standards.

Defined Data Retention Periods. The studio enforces rigorous, predefined retention limits rather than indefinite storage. Inquiries submitted via gifa6dd.php and their corresponding studio email notifications are preserved for 24 months from receipt to support subsequent scope references and accounting audits. Support chat transcripts and local tokens are expunged after 12 months. Web server access logs, firewall telemetry, and IP transaction records are purged after 30 days. Records of affirmative or declined consent stored in browser storage under site_consent_v2 expire after 12 months.

Security Measures & Technical Controls. We implement defense-in-depth security standards to protect personal data from accidental loss, unauthorized alteration, or unlawful access. All traffic is encrypted in transit using Transport Layer Security (TLS 1.3). Inquiry databases are segregated, access-controlled via multi-factor authentication, and audited regularly. Form endpoints employ strict rate limiting, honeypot fields, and automated sanity filters to defeat injection attempts.

Statutory Rights Under the GDPR. For visitors accessing our studio from the European Union, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) grants comprehensive statutory entitlements. You maintain the right to access your personal data, rectify inaccuracies, request absolute erasure (“right to be forgotten”), restrict ongoing processing, obtain an exportable file of your records (data portability), object to processing grounded in legitimate interest, and withdraw consent at any time without compromising past lawful handling.

United States State Privacy Rights (CCPA / CPRA & CPA). Under the California Consumer Privacy Act as amended by the CPRA (CCPA), the Colorado Privacy Act (CPA), and comparable state statutes in Virginia, Utah, and Connecticut, residents hold defined consumer rights. You have the right to know what personal information is collected, disclosed, or shared; the right to delete personal information held by our studio; the right to correct inaccurate records; and the absolute right to opt out of the sale or sharing of personal data for cross-context behavioral advertising. Oak Merton does not sell personal information for monetary consideration.

Global Privacy Control (GPC) Compliance. Our website programmatically recognizes and respects the Global Privacy Control (GPC) signal transmitted via HTTP headers (Sec-GPC) or browser-level settings. If our infrastructure detects an active Global Privacy Control broadcast from your browser, we automatically treat that directive as an affirmative opt-out of cookie storage, targeting telemetry, and data sharing, applying the opt-out immediately without requiring secondary confirmation.

Protection of Minor Privacy. Oak Merton is an enterprise-facing commercial brand and strategy studio. Our website and consultation services are intended strictly for business principals, founders, and executives aged 18 and older. We do not knowingly solicit, collect, or store personal information from children under the age of 16. In the event we discover that an individual under 16 has submitted personal records through our contact desk, those records are permanently purged immediately.

Regulatory Inquiries & Supervisory Complaints. If you consider that our data processing infringes applicable statutory protections, you have the right to lodge a formal complaint with an appropriate supervisory authority. Colorado residents may contact the Colorado Office of the Attorney General. California residents may file with the California Privacy Protection Agency (CPPA). Residents within the European Economic Area may file with their local national Data Protection Authority (DPA).

Exercising Privacy Rights & Response Windows. To exercise your statutory entitlements regarding data inspection, correction, export, or deletion, transmit a written notice to [email protected] or submit a formal petition through our dedicated DSAR Portal. You may also direct postal requests to 300 East 17th Avenue, Denver, Colorado 80203. We will authenticate your identity to prevent unauthorized disclosure and deliver a written determination without charge within 14 days of receipt.

Policy Revisions & Publication Notice. We periodically review and update this Privacy Policy to reflect modifications in our operating procedures, advertising integrations, or legal obligations. When adjustments occur, the revised document is published immediately at this URL with an updated Effective Date. We encourage clients and site visitors to review this page periodically to remain informed of our current data stewardship protocols.

Direct Studio Human Contact. For questions, legal inquiries, or compliance notices regarding this privacy statement, you can reach an authorized human representative directly. Contact Anna Kozlova, Principal Consultant, Oak Merton Studio, 300 East 17th Avenue, Denver, Colorado 80203, United States. Telephone: +1 (803) 555-5338. Email: [email protected].