Privacy policy

Who we are

Stratovia Consulting LLC is a limited liability company registered in New Mexico, United States, with its registered office at 3831 Montgomery Blvd NE, Apt 433, Albuquerque, NM 87109. We are the controller of the personal information described in this policy.

Where we handle personal data on behalf of a client, in the course of running their marketing or analytics, we act as a processor rather than a controller. Those arrangements are governed by our data processing addendum, not by this policy.

What we collect

Category	Examples	Where it comes from
Identifiers	Name, work email address, telephone number if you give one	You, through the enquiry form or by writing to us
Professional information	Company name, website, role, the service you are interested in, budget range	You, through the enquiry form
Correspondence	The content of your message and any emails or call notes that follow	You, and our own records of the exchange
Technical data	IP address, browser and device type, referring page, pages viewed	Collected automatically by our hosting provider in server logs
Contract and billing records	Signed agreements, invoices, payment records	Generated if you become a client

We do not ask for and do not want special category data: health, race, religion, political opinion, biometric or genetic data, trade union membership, sexual orientation. Please do not send it to us.

Why we use it

Purpose	Legal basis under GDPR
Replying to your enquiry and discussing possible work	Steps taken at your request before entering a contract
Delivering services and managing the relationship	Performance of a contract
Keeping the website secure and available, and diagnosing faults	Our legitimate interest in running a functioning, secure site
Keeping accounting, tax and contractual records	Compliance with a legal obligation
Defending or bringing legal claims	Our legitimate interest in protecting the business

We do not run marketing email lists, and we do not add enquirers to a newsletter. If we ever do, it will be on the basis of consent you have actively given, and every message will carry a working unsubscribe link.

Cookies

This website does not set analytics or advertising cookies. The detail, including what would change if we add analytics later, is in the cookie policy.

We share personal information in four situations, and no others.

Service providers: The suppliers who help us run the business, such as hosting and email. Each is bound by contract to process personal information only on our instructions and to protect it. They are listed on our subprocessors page.
Professional advisers: Our accountants, insurers and lawyers, where they need the information to advise us.
Legal obligation: Where we are required to disclose by law, court order or a valid request from a public authority. Where we are permitted to tell you about such a request, we will.
Business transfer: If the business is sold or merged, information may transfer to the buyer. Any buyer would be bound by this policy until it gave you notice of a replacement.

Selling and targeted advertising

We do not sell personal information, and we have not done so in the preceding twelve months. We do not share personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes beyond those permitted without a right to limit. Because we do not sell or share, there is nothing for a “Do Not Sell or Share My Personal Information” link to switch off, and we honour the Global Privacy Control signal by default in the sense that there is no such processing to opt out of.

International transfers

We operate from the United States and our suppliers may process information there or elsewhere. Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies, and we assess whether additional safeguards are needed for the destination. A copy of the clauses we rely on is available on request.

How long we keep it

Record	Retention period
Enquiries that do not become work	24 months from the last contact, then deleted
Client correspondence and project records	The engagement, plus 6 years
Contracts, invoices and tax records	7 years, to meet accounting and tax requirements
Server logs	Retained by our hosting provider on a rolling short-term basis

When a retention period ends, records are deleted or anonymised. Where a legal claim is live or reasonably anticipated, we keep what is relevant to it until the matter is closed.

How we protect it

The website is served over HTTPS only. Access to our systems requires multi-factor authentication, and access to client data is limited to the people working on that engagement. We keep the number of systems holding personal information deliberately small. No system is perfectly secure, and we do not claim otherwise; if a breach affects your personal information and the law requires it, we will notify you and the relevant regulator within the applicable deadline.

Your rights

Depending on where you live, some or all of the following apply.

Access: A copy of the personal information we hold about you, and information about how we use it.
Correction: Correction of information that is inaccurate or incomplete.
Deletion: Deletion of information, where we have no overriding obligation or legitimate ground to keep it.
Portability: A copy in a structured, commonly used, machine-readable format, and transmission to another controller where technically feasible.
Objection and restriction: Objection to processing based on legitimate interests, and restriction of processing while a dispute about accuracy or grounds is resolved.
Withdrawal of consent: Withdrawal at any time, where we relied on consent. This does not affect processing already carried out.
Non-discrimination: We will not deny you service, charge you a different price or give you a lesser standard of service because you exercised a privacy right.
Appeal: If we decline a request, you may appeal by replying to our decision. We will respond to the appeal in writing with our reasoning, within the period the applicable state law allows.

How to exercise them

Email [email protected] with the words “privacy request” in the subject line, or write to the registered office above. Tell us what you want and enough detail for us to find your records.

We will verify your identity in proportion to the sensitivity of the request, usually by confirming details already in our records. We respond within 30 days, or sooner where the law requires it, and we will tell you if we need an extension and why. An authorised agent may act for you if they provide written proof of authority.

You also have the right to complain to a supervisory authority. In the European Economic Area that is the authority in your country of residence, work or the place of the alleged infringement; in the United Kingdom it is the Information Commissioner's Office. We would rather you came to us first so we can put it right.

Children

This is a business-to-business website. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, tell us and we will delete it.

Changes

We update this policy when our practices change or when the law requires it. The effective and last-updated dates at the top always reflect the current version. Where a change materially affects your rights, we will say so on this page and, where we hold your contact details and the law requires it, tell you directly.