Privacy Notice

1. Scope of This Notice

This Privacy Notice describes how TinBOX LLC ("TinBOX," "we," "us," or "our") collects, uses, and discloses personal information as a controller, meaning where we determine the purpose and means of processing, in connection with our website, inquiries, and general business operations. This notice applies to personal information collected from:

• Visitors to this website and individuals who submit an inquiry or booking request;
• Current, former, and prospective clients and their personnel;
• Current, former, and prospective vendors, contractors, and business partners and their personnel; and
• Job applicants and, where applicable, TinBOX personnel.

Not in scope: where TinBOX processes personal information on behalf of a client as a processor or service provider, for example, personal data encountered while delivering a security assessment, privacy program build, or managed engagement, that processing is governed by the applicable client agreement and, where required, a separate data processing agreement, not this notice. In that relationship, the client determines the purpose and means of processing and is responsible for providing notice and obtaining any necessary consent from their own data subjects.

2. Information We Collect

We collect information you provide directly to us, including:

• Contact and inquiry information: name, work email, company name, and any message content submitted through our contact form or assessment booking request.
• Engagement information: information provided in the course of scoping or delivering an advisory retainer, project, or briefing engagement.
• Vendor and partner information: contact and business details for current or prospective vendors, contractors, and partners.
• Website usage information: pages visited, general device and browser information, and similar technical data collected automatically, see Cookies & Tracking Technologies.

We do not knowingly collect sensitive categories of personal information (such as health, biometric, or precise geolocation data) through this website, and we do not require you to provide such information to interact with us.

3. How We Use Information

• To respond to inquiries and schedule assessments or consultations
• To scope, deliver, and administer client engagements
• To evaluate and manage vendor and partner relationships
• To maintain our business records, including invoicing and past-performance documentation
• To improve this website and our service offerings
• To comply with legal, regulatory, and contractual obligations

We do not sell personal information, and we do not use personal information collected through this website for third-party advertising purposes.

4. Legal Basis for Processing

Where the GDPR or UK GDPR applies, we process personal information on the following legal bases:

• Contract: where processing is necessary to scope or deliver an engagement you've requested, or to manage a vendor relationship.
• Legitimate interests: to respond to inquiries, operate and improve our website, and maintain business records, balanced against your rights and interests.
• Consent: where we rely on your consent (for example, for optional marketing communications), which you may withdraw at any time without affecting the lawfulness of processing that occurred before withdrawal.
• Legal obligation: where processing is necessary to comply with applicable law.

5. Data Recipients & Disclosure

We do not sell or rent personal information, and we do not disclose it to third parties for their own marketing purposes. We may disclose personal information to:

• Service providers who perform functions on our behalf, for example, website hosting, scheduling, email delivery, and, where engaged, contracted specialists supporting client engagement delivery, bound by contractual confidentiality and data protection obligations.
• Professional advisors, such as our attorneys or accountants, where necessary to operate our business.
• Legal or regulatory authorities, where required by law, to comply with legal process, or to protect our legal rights.
• A successor entity in the event of a merger, acquisition, or asset sale, subject to standard confidentiality protections.

Any third-party service provider who processes personal information on our behalf is contractually required to use it only as instructed and to protect its confidentiality and security.

6. International Data Transfers

TinBOX is based in the United States. If you are located outside the United States, your information may be transferred to and processed in the United States, where privacy laws may differ from those of your home jurisdiction. Where required, we rely on appropriate safeguards for such transfers, including Standard Contractual Clauses, consistent with the transfer-mechanism work we perform for clients under our own privacy practice.

7. Data Accuracy

We take reasonable steps to keep the personal information we hold accurate and up to date, and to correct or delete information we identify as inaccurate. You may also request correction at any time, see How to Exercise Your Rights.

8. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this notice, including to maintain business and past-performance records, comply with legal obligations, resolve disputes, and enforce our agreements. Inquiry information from parties who do not become clients is retained for a limited period and then deleted or anonymized.

9. Your Rights

Depending on your location, you may have some or all of the rights below regarding your personal information. Many of these rights are subject to exceptions and limitations under applicable law, and not every right applies in every jurisdiction.

• Right of access, to know whether we process your personal information and to request a copy of it.
• Right to correction, to request that we correct or complete inaccurate or incomplete personal information.
• Right to deletion, to request that we delete your personal information, subject to legal retention obligations.
• Right to data portability, to request your personal information in a structured, commonly used, machine-readable format.
• Right to withdraw consent, where processing is based on consent, to withdraw it at any time.
• Right to restrict or object to processing, to request that we limit how we process your personal information, or to object to processing based on legitimate interests.
• Right to opt out of sale or sharing, we do not sell or share personal information as defined under California or other state privacy laws, so this right is not currently applicable, but you may still confirm this in writing.
• Right to non-discrimination, we will not discriminate against you for exercising any right described in this notice.
• Right to lodge a complaint, with your local data protection or supervisory authority, where applicable.

These rights reflect, among others, protections available under the GDPR and UK GDPR, the California Consumer Privacy Act as amended by the CPRA, and state privacy laws including Virginia's VCDPA and Colorado's CPA.

10. How to Exercise Your Rights

To exercise any of the rights above, please use our contact form and describe your request. To protect your information, we may need to verify your identity before fulfilling a request, for example, by confirming details you've previously provided to us. You may also designate an authorized agent to submit a request on your behalf, provided we can verify both your identity and the agent's authorization. We will respond within the time period required by applicable law, and if we're unable to fulfill a request, we will explain why.

11. Opt-Out Signals & Unsubscribe

Where applicable, we honor recognized browser-based opt-out preference signals, such as the Global Privacy Control. Recognition of such a signal applies only to the specific browser or device that sends it. If you receive marketing communications from us and would prefer not to, you may unsubscribe using the link in that communication or by contacting us through our contact form.

12. Cookies & Tracking Technologies

This website does not currently deploy analytics, advertising, or cross-site tracking cookies. The only cookie-like mechanism in use is a spam-prevention safeguard built into our contact form processor, which does not track visitors across sessions or sites. If we add analytics or similar tools in the future, this section will be updated to name the provider and link to its own privacy documentation before that tool goes live.

• Essential cookies: required for basic site functionality, including the contact form's spam-prevention safeguard. The site does not function properly without these.
• Analytics cookies: none currently in use.

We do not currently use cookies for advertising or cross-site tracking purposes.

13. Children's Privacy

This website is intended for business audiences and is not directed at children. We do not knowingly collect personal information from individuals under 13 years of age (or the relevant minimum age under applicable law). If you believe a child has provided us with personal information, please contact us so we can delete it.

14. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, consistent with the security practices we advise our clients to adopt. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

15. Changes to This Notice

We may update this notice from time to time to reflect changes to our practices, technology, or legal requirements. Material changes will be reflected by an updated "Last updated" date above. We encourage you to review this notice periodically.

16. Contact Us

For questions about this notice or to exercise your privacy rights, please use our contact form, select "Existing Client Support" if you're already a TinBOX client, or leave a message describing your privacy request otherwise. TinBOX does not maintain a public mailing address; all privacy inquiries are handled through the contact form.