We do not sell personal information and we do not "share" personal information for cross-context behavioral advertising.
16.3 Sensitive Personal Information
PrivacyStudios does not intentionally collect sensitive categories in our normal operations. If a project or legal requirement ever necessitates limited processing, we will only use or disclose such information for the narrow, permitted purposes in the statute.
16.4 Your California Rights
- Know / Access (categories and specific pieces).
- Correct inaccuracies.
- Delete personal information (subject to lawful exceptions).
- Portability (copy in a portable format).
- Opt-out of sale or sharing (not applicable: see above).
- Limit use/disclosure of sensitive personal information (not applicable as described).
- Appeal a denied request (see Section 14.3).
16.5 How to Exercise Your Rights
Submit a request via our on-site Data Privacy Request form or email [email protected]. We take reasonable steps to verify the request.
16.6 Response Timing and Fees
We generally respond within 45 days of receiving a verifiable request. If we need more time (up to an additional 45 days), we will let you know. We do not charge a fee unless a request is excessive or repetitive as defined by law.
16.7 Non-Discrimination
We will not deny goods or services, charge different prices, or provide a different level of service because you exercised your CCPA/CPRA rights.
16.8 Financial Incentives
We do not offer financial incentive programs tied to the sale or sharing of personal information.
16.9 "Sharing," GPC, and Do-Not-Track
- Sharing (ads): We do not engage in cross-context behavioral advertising: no "sharing" to opt out of at this time.
- Global Privacy Control (GPC): We treat a valid GPC signal as an opt-out request where applicable.
- Do-Not-Track: Our site does not currently respond to DNT signals.
Section 17
GDPR Notice (EU/EEA)
17.1 Controller
For Website operations and communications described in this Policy, PrivacyStudios acts as the controller. For client projects where we act on instructions, we are a processor and the client's privacy terms apply.
17.2 Purposes, Legal Bases, and Retention
| Purpose | Personal Data | Legal Basis | Retention |
|---|
| Respond to inquiries | Identifiers, contact, message content, organization, role | Legitimate interests (Art. 6(1)(f)) | As needed to address request; archived if required by law |
| Email subscriptions & newsletters | Email, preferences, interaction data | Consent (Art. 6(1)(a)) or legitimate interests (Art. 6(1)(f)) | Duration of subscription; unsubscribe any time |
| Events and webinars | Registration details, access logs, session questions, recordings | Contract (Art. 6(1)(b)); legitimate interests | Event lifecycle and limited post-event period |
| Site operation, analytics, security | Technical/usage data, cookies | Legitimate interests (Art. 6(1)(f)); consent for non-essential cookies | Cookie/log durations; de-identified data may be retained longer |
| Contracting | Contact, company info, proposal history, billing contacts | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) | Contract term plus statutory limitation periods |
| Compliance, legal claims, fraud prevention | Identifiers, transactional records, logs | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) | As required by law and for duration of claims/defense |
17.3 Recipients
- Service providers/contractors acting on our instructions.
- Professional advisors under confidentiality.
- Affiliates within PrivacyStudios, only as needed.
- Authorities when required by law or to protect rights and security.
17.4 International Transfers
When personal data is transferred outside the EEA/UK, we implement appropriate safeguards such as the European Commission's Standard Contractual Clauses. Contact [email protected] for details.
17.5 Security and Confidentiality
We maintain administrative, technical, and organizational measures to protect personal data. Access is limited to personnel and providers who need it under binding obligations.
17.6 Cookies and Consent Management
Non-essential cookies are used only with your consent, which you can withdraw at any time via your browser or our on-site controls. Withdrawing consent does not affect processing carried out before withdrawal.
17.7 Your GDPR Rights
Subject to conditions in Articles 12–23 GDPR, you have the right to access, rectify, erase, restrict, object, obtain portability for certain data, and withdraw consent where relied upon.
17.8 Supervisory Authority
You have the right to lodge a complaint with your local supervisory authority (e.g., the CNIL in France, the DPC in Ireland, or the ICO in the UK). We invite you to contact our DPO first at [email protected] so we can address your concerns quickly.
Section 18
SaaS & Tools Operated by PrivacyStudios
- When clients upload data to our tools and cloud storage, we act as a processor and follow the client's instructions under a data processing agreement.
- When we collect limited usage data (e.g., login events, IP, activity) to secure and improve our services, we act as a controller.
- We apply industry-standard safeguards (e.g., encryption in transit/at rest) and retain data only as needed or required by law. Upon termination, data is deleted or de-identified per contract.
Section 19
Country/Region-Specific Addenda
Supplemental information for residents of U.S. states with comprehensive privacy laws. If any term below conflicts with the general sections, this addendum controls for residents of that state.
Applicability
These provisions apply to residents of: Virginia (VCDPA), Colorado (ColoPA), Connecticut (CTDPA), Utah (UCPA), Delaware (DPDPA), Oregon (OCPA), Texas (TDPSA), Iowa (Iowa CDPA), Indiana (Indiana CDPA), Tennessee (TIPA), Montana (MCDPA), Kentucky (KCDPA), Nebraska (NDPA).
Key Rights and Protections
- Access and Confirmation: request confirmation of processing and access to data.
- Correction: correct inaccurate personal data.
- Deletion: request deletion, subject to legal exceptions.
- Portability: receive data in a portable format where technically feasible.
- Opt-Out: targeted advertising, sale (if applicable), and profiling for decisions with legal/similar effects.
- Appeal: if we deny a rights request, you may appeal within the state-specific timelines (see Section 14.3).
Summary of State Enforcement and Timelines
Virginia (VCDPA)
45-day response; appeal rights within 60 days.
Colorado (ColoPA)
Mandatory appeals and universal opt-out signals.
Connecticut (CTDPA)
Similar to Colorado; enhanced protections under 16.
Utah (UCPA)
Applies to larger entities; fewer rights (no correction/appeal).
Delaware, Oregon, Texas, etc.
Strong opt-out and sensitive-data limits.
PrivacyStudios applies a unified compliance framework designed to meet or exceed the strongest of these state standards across U.S. operations.
Section 20
Definitions
Controller
Decides why/how personal data is processed.
Processor
Processes personal data for a controller under contract.
Personal data
Information relating to an identified or identifiable person.
Sell / Share (CCPA/CPRA)
Meanings set by California law.
SCCs
EU-approved Standard Contractual Clauses for international transfers.
De-identified / Aggregated data
Data that cannot reasonably be linked to an individual.