Privacy Policy &
Data Sovereignty Governance

ThemeImpact (“the Agency”, “we”, “us”, or “our”) provides high-performance web engineering, design systems, and digital infrastructure advisory. This Governance Framework delineates our processing of personal data obtained via our corporate web interfaces (themeimpact.com), project estimation calculators, encrypted contact channels, and staging infrastructure.

We do not collect personal identification records indiscriminately. Processing is restricted entirely to:

• Direct Architectural Inquiries: Processing corporate email, engineering requirements, and timeline parameters explicitly submitted by prospective enterprise partners.
• Performance & DDoS Security: Inspecting anonymized network request packets to prevent automated abuse, Layer 7 volumetric attacks, and API injection vulnerabilities.
• Client Contractual Execution: Maintaining cryptographically audited access logs for production deployments, CI/CD pipeline triggers, and design review boards.

When interacting with our contact terminals, architectural survey boards, or performance audit calculators, the only fields stored are those deliberately transmitted by your user agent:

We do not purchase enrichment databases (e.g., Clearbit, ZoomInfo, Apollo) to perform covert profile building on visitors who simply read our engineering case studies.

ThemeImpact is served globally over a distributed serverless edge topology powered by Cloudflare Workers and enterprise edge gateways. When your browser requests resources:

These diagnostic logs are held in memory-volatile logstreams strictly for automatic threat filtering and bot neutralization. They are purged every 24 hours and are never merged with personal identifiers.

We employ purely essential HTML5 localStorage or sessionStorage keys strictly on your machine to save:

• theme_state: Persisting your system preference for dark mode interfaces.
• estimator_draft: Temporarily preserving entered project scope choices locally on your browser without cloud-side synchronization.

For contracted enterprise partners, client source code, design libraries, and proprietary algorithmic architectures are governed by bilateral, high-enforcement Non-Disclosure Agreements (NDAs).

Regardless of geographic origin, we extend GDPR-tier sovereign protections to all users globally. You maintain unambiguous command over your digital imprint:

ThemeImpact operates globally with core engineering hubs in Hanoi, Vietnam, and regional nodes across Frankfurt, Zurich, and Singapore. Data transfers are bound by the European Commission’s Standard Contractual Clauses (SCCs) (Module 1 and Module 2) supplemented by technical controls:

• End-to-end cryptographic transit security via TLS 1.3 with Perfect Forward Secrecy (PFS).
• At-rest encryption governed strictly by client-retained keys (BYOK) for enterprise-tier staging instances.
• Full certification alignment under the EU-U.S. Data Privacy Framework (DPF).

We mandate that all third-party cloud infrastructure vendors hold verifiable SOC 2 Type II, ISO/IEC 27001, and CSA STAR security accreditations. Our contracted sub-processors are limited to: