1. Regulatory Framework & Data Controller

This Privacy Protocol governs the processing of personal and telemetry data collected by Zenith Fiscal Research Group (“the Entity”, “we”, “us”, or “our”), operating the digital repository zenithfiscalpolicy.com. We operate in strict adherence to the UK General Data Protection Regulation (UK-GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

For the purposes of applicable data protection law, the nominated Data Controller is:

2. Scope of Telemetry & Technical Ingestion

In maintaining our institutional macroeconomic data matrices, we ingest technical telemetry through automated server logs and client-side scripts. This processing is strictly grounded in Article 6(1)(f) of the UK-GDPR (Legitimate Interests for Network Integrity):

• Network Signatures: Masked Internet Protocol (IP) addresses, Autonomous System Numbers (ASN), and packet headers utilized for distributed denial-of-service (DDoS) mitigation.
• Client Environments: User-Agent strings, browser rendering engines, screen resolutions, and operating system architectures for responsive DOM rendering.
• Interaction Metrics: Timestamped page latency, navigational paths through macroeconomic policy briefs, and scroll-depth telemetry.

3. Google AdSense, Certified CMP & IAB TCF Framework

This repository incorporates programmatic display advertising technologies governed by Google AdSense and Google Ad Manager. As a participant in programmatic ad networks, we enforce strict compliance with Google’s EU/UK User Consent Policy:

• Consent Management: We utilize an Interactive Advertising Bureau (IAB) Transparency and Consent Framework (TCF v2.2) certified Consent Management Platform (CMP). No non-essential ad targeting or personalized identifiers are deployed without prior, explicit, unambiguous consent.
• Third-Party Vendor Technology: Google and its certified ad technology partners deploy cookies and device identifiers to serve contextual or personalized advertisements based on mathematical models of previous browsing history across independent digital properties.
• User Agency & Revocation: Users can alter their programmatic ad consent string at any point via the persistent “Privacy Settings” link in our global footer, or directly via Google Ad Settings and AboutAds Choices.

4. International Data Transfers & Third-Party Processing

Because programmatic advertising and content delivery network (CDN) nodes operate distributed architectures, technical telemetry may be transferred to and processed within the United States or other jurisdictions outside the United Kingdom. All cross-border transmissions are executed pursuant to statutory safeguards under Section 17C of the Data Protection Act 2018 and UK International Data Transfer Agreements (IDTA), incorporating UK-approved Standard Contractual Clauses (SCCs) to ensure technical equivalency with domestic data protection standards.

5. Data Retention Lifecycle & Cryptographic Destruction

We apply rigid data minimization constraints. Technical server logs are retained for a maximum baseline duration of 90 days strictly for threat detection and algorithmic stability, after which telemetry logs are permanently purged or irreversibly anonymized. Analytical cookies managed via our Google Analytics infrastructure are set to a fixed retention cycle of 14 months, expiring automatically unless explicitly re-consented.

6. Statutory Subject Rights (DSAR Protocol)

Under Chapter 3 of the UK-GDPR, natural persons residing within the United Kingdom maintain enforceable legal rights concerning their data assets:

• Right of Access (Article 15): Right to obtain formal confirmation and cryptographic copies of personal data under processing.
• Right to Rectification (Article 16): Right to mandate correction of inaccurate fiscal or contact parameters.
• Right to Erasure (Article 17): Right to request irreversible deletion (“Right to be Forgotten”) where processing lacks statutory justification.
• Right to Restriction & Objection (Articles 18 & 21): Right to halt processing based on legitimate interests or direct marketing profiling.

Formal Data Subject Access Requests (DSAR) must be submitted directly to our Data Protection Office at [email protected]. Response latency is strictly capped at one statutory calendar month.