Data handling practices, consent architecture, and statutory rights.

This policy takes effect on 2026-10-30 and governs all current web operations and direct inquiries.

This privacy policy establishes our active data processing standards as of October 30, 2026. Any prior policy iterations are superseded as of this date. Our practices reflect contemporary state and federal privacy mandates, advertising platform compliance guidelines, and international data transfer frameworks.

The legal entity responsible for your data is Willobrest Studio, operating in Denver, Colorado, United States.

The data controller for this website is Willobrest, trading at willobrest.com. The full registered physical postal address is 300 East 17th Avenue, Denver, Colorado 80203, Denver, Colorado, United States. Operating as an independent design and front-end engineering practice registered in Colorado since 2018, the studio exercises direct control over database storage, inquiry routing, and processing protocols.

We record only what you submit via forms or chat, plus automated diagnostic server records and advertising click identifiers.

We do not operate public user accounts, customer logins, or ecommerce shopping carts. No password, financial account, or credit card information is ever gathered or stored on this website. The specific data categories captured include:

Data is used solely to respond to project briefs, maintain server security, and measure advertising campaign performance upon consent.

Each captured data category serves an explicit operational purpose:

• Direct Inquiry Fulfillment: Contact details and project specifications are processed to evaluate technical feasibility, verify timeline availability, and deliver itemized cost estimates.
• Consultation Dispatch: Live chat communications are retained to answer scope questions, discuss typography and framework choices, and resolve technical queries.
• Infrastructure Security: Server logs and transmission timestamps are analyzed to protect against distributed denial-of-service attacks, detect brute-force bot submissions, and maintain hosting stability.
• Campaign Attribution: Advertising click identifiers (gclid, msclkid, fbclid) are read to evaluate which inbound advertising campaigns result in qualified commercial consultations.

We process data under the explicit legal bases of consent, pre-contractual necessity, and legitimate commercial interests.

Under applicable data protection frameworks, including European GDPR regulations and US state statutes, our processing activities rest upon distinct legal foundations:

This site receives paid traffic from Google Ads, Microsoft Advertising, and Meta Ads, reading specific click identifiers in real time.

willobrest.com is an active commercial destination for paid digital media campaigns. We receive traffic from Google Ads, Microsoft Advertising, and Meta Ads. When a visitor reaches our site via a paid advertisement, the respective platform appends a unique cryptographic query string to the destination URL:

• google ads: Attaches the gclid parameter to attribute advertising clicks, track landing page conversions, and evaluate campaign keyword relevance.
• microsoft advertising: Attaches the msclkid parameter to measure search ad conversions across the Bing network.
• meta ads: Attaches the fbclid parameter to correlate social discovery placements with consultation requests.

We explicitly state that neither Google, Microsoft, nor Meta has reviewed, approved, or verified the specific offerings or content of Willobrest Studio. All campaign tracking operates strictly subject to your consent preferences.

Consent Mode v2 holds all telemetry signals denied by default until you grant affirmative consent.

Our technical implementation adheres to Google Consent Mode v2 standards. By default, prior to any visitor interaction with the consent banner, the following four telemetry and advertising signals are held strictly in a denied state:

These parameters are upgraded to granted only if you click “Accept” on our consent interface. If you click “Decline”, revoke consent, or transmit a Global Privacy Control signal, all four parameters are immediately set back to denied.

We transfer data to trusted infrastructure providers, advertising networks, and mail delivery services under formal processing agreements.

Data collected through willobrest.com is shared with or processed by the following named entities:

• Google Ireland Ltd / Google LLC: Operates Google Ads measurement and analytics services. Subject to Google’s commercial data processing terms.
• Microsoft Ireland Operations Ltd: Operates Microsoft Advertising conversion services. For information on Microsoft’s data handling and processing commitments, review the Microsoft privacy statement at https://privacy.microsoft.com/privacystatement.
• Meta Platforms Ireland Ltd: Operates Meta Ads conversion attribution services for social advertising campaigns.
• Hosting Infrastructure Provider: Dedicated data center host providing Apache web server infrastructure, PHP runtime execution, and localized secure SQLite database storage within the United States.
• Mail Transport Network: Secure SMTP routing services delivering encrypted inquiry notifications from foze148.php directly to office@willobrest.com.

Data originating outside the United States is transferred to Denver, Colorado under Standard Contractual Clauses and recognised transfer mechanisms.

Willobrest Studio is based in the United States, and all primary server infrastructure is located within domestic US data centers. If you access willobrest.com from the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction outside the United States, your submission necessarily involves the cross-border transfer of personal information.

These international transfers are made pursuant to recognized lawful safeguards, including the European Commission’s Standard Contractual Clauses (SCCs), UK International Data Transfer Addendums, and commercial data privacy frameworks established between international regulators and our technology vendors.

We retain information only for documented operational periods rather than an indefinite duration.

We do not retain information longer than necessary to satisfy commercial communications and compliance obligations. Exact retention schedules are enforced as follows:

We implement end-to-end TLS encryption, strict server file permissions, and automated perimeter defenses.

We protect your personal data through rigorous administrative, technical, and physical safeguards. All communication between your browser and willobrest.com is encrypted in transit using Transport Layer Security (TLS 1.3). Inquiry form submissions to foze148.php are protected against bot attacks through hidden honeypots (department and weblink) and unix timestamp verification.

Server databases reside behind isolated filesystem boundaries inaccessible from direct web requests, protected by strict file permissions, restricted SSH key authorization, and rate-limiting perimeter firewalls.

Visitors from the European Union hold comprehensive gdpr rights regarding data access, rectification, and erasure.

If you are an individual located within the European Economic Area or the United Kingdom, the General Data Protection Regulation (gdpr) grants you specific legal entitlements:

• Right of Access: You may request a verified copy of all personal records held about you.
• Right to Rectification: You may require the correction of any inaccurate or incomplete personal information.
• Right to Erasure (Right to Be Forgotten): You may request the permanent deletion of your inquiry and chat history.
• Right to Restriction: You may request that we temporarily halt the active processing of your data while an objection is investigated.
• Right to Data Portability: You may request your data in a structured, commonly used, and machine-readable format (e.g. JSON or CSV).
• Right to Object: You may object at any time to processing based on legitimate commercial interests or direct marketing.
• Right to Withdraw Consent: Where processing is predicated on consent, you may revoke your agreement at any time without affecting the lawfulness of prior processing.

Residents of California and states with comprehensive privacy laws hold rights to know, delete, and opt out of data sharing under the ccpa.

This section provides mandatory disclosures for residents of California under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (ccpa), as well as residents of Colorado, Virginia, Connecticut, Utah, and other US states with active comprehensive privacy legislation:

We recognize and automatically honour the global privacy control header across all visits.

Our technical stack detects and respects the global privacy control (Sec-GPC) browser signal. If your browser or privacy extension broadcasts an active GPC header, willobrest.com automatically treats this as a valid, binding opt-out request for cross-context behavioral tracking and analytics storage.

When a GPC signal is received, all Consent Mode v2 parameters (ad_storage, ad_user_data, ad_personalization, and analytics_storage) are held in a denied state without displaying recurring prompt barriers.

Our services and website are intended exclusively for commercial entities and individuals aged 18 and older.

willobrest.com is not intended for or directed toward children under the age of 18, and we do not knowingly solicit or collect personal information from individuals under the age of 16. In the event that we discover a submission from a minor without verified parental consent, we will immediately purge the record from our primary databases.

You have the right to lodge a formal complaint with relevant state or federal regulatory authorities.

If you believe our data handling practices violate applicable privacy statutes, you may submit a complaint directly to relevant enforcement bodies:

• Colorado Residents: Office of the Colorado Attorney General, Consumer Protection Section, 1300 Broadway, 9th Floor, Denver, CO 80203.
• California Residents: California Privacy Protection Agency (CPPA) or the Office of the California Attorney General.
• European Residents: The supervisory data protection authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

Submit your privacy request to office@willobrest.com; we verify and answer all requests within 5 days.

To exercise your rights under GDPR, CCPA, or applicable state law (access, correction, export, or deletion), submit a written request via our designated channels:

Material policy updates are posted directly to this URL with a revised effective date header.

We periodically review our data handling practices to reflect technological enhancements, operational changes, and statutory developments. Any modifications to this privacy policy will be published immediately on this page with an updated “Effective Date” notation. For significant alterations that impact active client relationships, notifications will be transmitted via electronic mail.

Reach our studio principal directly for questions regarding privacy practices or technical compliance.

If you have questions, comments, or technical inquiries regarding this Privacy Policy or our engineering standards, contact the practice directly: