Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how CVA Advise, operating under CVA CONSULTING SERVICES L.L.C., collects, uses, stores, and protects information obtained from individuals and organizations who interact with our website at https://www.cvadvise.buzz, engage our computer systems design and IT consulting services, or otherwise communicate with us through electronic and written channels.

By accessing our website or using our services, you acknowledge that you have read and understood this Privacy Policy. We are committed to protecting the privacy of all individuals whose information we handle and to maintaining transparency about our data practices.

2. Information We Collect

2.1 Information You Provide Directly

When you contact us through our website contact form, send us an email, call our office, or engage our consulting services, we may collect the following categories of information:

• Contact and identification details: Full name, email address, phone number, company name, job title, and mailing address.
• Business information: Details about your organization, technology infrastructure, project requirements, budgets, timelines, and any other information you choose to share during pre-engagement discussions.
• Communication records: The content of messages, emails, phone calls, meeting notes, and any documents you share with us in the course of our service relationship.
• Service engagement data: Contract details, scope of work documentation, technical specifications, and system architecture information that forms part of our consulting deliverables.

2.2 Information Collected Automatically

When you visit our website, certain information is collected automatically through standard internet protocols and analytics tools:

• Technical data: Internet Protocol (IP) address, browser type and version, operating system, device type, screen resolution, and language preferences.
• Usage data: Pages visited, time spent on each page, referring website URLs, navigation patterns, clicked links, and downloaded files.
• Geolocation data: Approximate geographic location derived from your IP address at the city or regional level.
• Server log data: Timestamp of visits, HTTP status codes, data transfer volumes, and error logs generated during your browsing session.

2.3 Information from Third Parties

In certain circumstances we may receive information about you from third-party sources including business partners, technology vendors, publicly available databases, and professional networking platforms. This information is used solely for the purpose of understanding prospective client needs and verifying business credentials.

3. How We Use Information

We use the information we collect for the following business and operational purposes:

• Service delivery: To provide computer systems design, IT consulting, architecture planning, and related professional services as contracted with our clients.
• Communication: To respond to inquiries, provide project updates, send service-related notifications, and maintain ongoing client relationships.
• Business development: To prepare proposals, statements of work, and project estimates tailored to the specific needs of prospective clients.
• Website improvement: To analyze website usage patterns, optimize page performance, enhance user experience, and ensure technical compatibility across devices.
• Legal compliance: To comply with applicable laws, regulations, legal processes, and enforceable governmental requests.
• Security and fraud prevention: To detect, prevent, and address technical issues, unauthorized access, and potential security incidents.
• Billing and administration: To process invoices, manage accounts, maintain financial records, and fulfill contractual obligations.

4. Legal Basis for Processing

Our processing of personal information is grounded in the following legal bases, as applicable under data protection laws including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA):

• Contractual necessity: Processing is required to perform our obligations under a service agreement with you or to take pre-contractual steps at your request.
• Legitimate interests: Processing is necessary for our legitimate business interests, including improving our services, securing our systems, and developing our business, provided these interests do not override your fundamental rights.
• Consent: Where we rely on your consent for specific processing activities, you have the right to withdraw that consent at any time through the contact methods described in this policy.
• Legal obligation: Processing is necessary to comply with applicable laws, tax regulations, and regulatory requirements.

5. Information Sharing and Disclosure

We do not sell, rent, or trade personal information to third parties for their marketing purposes. We may share information in the following limited circumstances:

• Service providers: With trusted third-party vendors who assist us in operating our website, managing our business operations, and delivering services to clients. These providers are contractually bound to use information only as necessary to perform their functions and to maintain appropriate confidentiality and security.
• Professional advisors: With our legal counsel, accountants, auditors, and insurance providers as needed for legitimate business purposes.
• Business transfers: In connection with a merger, acquisition, reorganization, or sale of all or a portion of our assets, subject to appropriate confidentiality arrangements.
• Legal requirements: When required by law, court order, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

6. Data Retention and Deletion

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. The specific retention periods are determined by the following criteria:

• Active client relationships: Information is retained for the duration of the client engagement plus a period of seven years following project completion to address any post-project inquiries, warranty claims, and regulatory obligations.
• Prospective client inquiries: Contact information and communications from prospective clients who do not enter into a service agreement are retained for a maximum of two years from the last interaction.
• Website analytics data: Automatically collected usage data is retained for twenty-six months and is periodically aggregated and anonymized.
• Financial records: Transaction records, invoices, and payment information are retained in accordance with applicable tax laws, typically seven years.

Upon expiration of the applicable retention period, we securely delete or anonymize personal information using industry-standard data destruction methods. You may request earlier deletion of your information by contacting us as described in Section 14.

7. Data Security Measures

CVA Advise implements comprehensive technical, administrative, and physical security measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption: All data transmitted between your browser and our website is encrypted using Transport Layer Security (TLS) protocol. Sensitive information stored in our systems is encrypted at rest using AES-256 encryption.
• Access controls: Strict role-based access controls limit information access to authorized personnel who require it for legitimate business purposes. Multi-factor authentication is enforced for all administrative access.
• Network security: Enterprise-grade firewalls, intrusion detection and prevention systems (IDS/IPS), and continuous network monitoring protect our infrastructure perimeter.
• Security testing: Regular vulnerability assessments, penetration testing, and security audits are conducted by qualified security professionals.
• Employee training: All personnel receive mandatory data privacy and security training upon onboarding and at regular intervals thereafter.
• Incident response: A documented incident response plan ensures timely detection, containment, and remediation of security events, including notification procedures as required by applicable law.

While we employ robust security measures, no method of electronic storage or transmission over the internet is completely secure. We cannot guarantee absolute security of your information.

8. International Data Transfers

As a United States-based organization, our primary data processing occurs within the United States. However, we may engage service providers or maintain infrastructure located in other countries. When we transfer personal information across international borders, we implement appropriate safeguards in accordance with applicable data protection laws, including:

• Use of Standard Contractual Clauses (SCCs) approved by the European Commission for transfers of personal data from the European Economic Area.
• Verification that recipients in third countries maintain adequate levels of data protection as determined by relevant regulatory authorities.
• Implementation of supplementary technical and organizational measures where necessary to ensure a level of protection essentially equivalent to that provided in the originating jurisdiction.

9. Privacy for Children

Our website and services are directed at business professionals and organizations and are not intended for use by children under the age of sixteen. We do not knowingly collect, use, or disclose personal information from children under sixteen years of age.

If we become aware that we have inadvertently collected personal information from a child under sixteen without verifiable parental consent, we will take immediate steps to delete such information from our records. Parents and legal guardians who believe that their child has provided us with personal information should contact us using the information in Section 14 so that we may promptly remove the data.

The online safety and privacy of children are of paramount importance. We encourage parents and guardians to monitor the online activities of their children and to instruct them never to provide personal information through any website without parental permission.

10. Cookies and Tracking Technologies

10.1 What Are Cookies

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites function efficiently and to provide information to website operators. Other tracking technologies, including web beacons, pixels, and local storage objects, serve similar purposes.

10.2 Types of Cookies We Use

• Essential cookies: These cookies are necessary for the website to function properly. They enable core functionality such as security, network management, and accessibility. Our website cannot operate properly without these cookies.
• Analytics cookies: These cookies help us understand how visitors interact with our website by collecting and reporting information anonymously. We use this data to improve site structure, content, and performance.
• Functional cookies: These cookies allow the website to remember choices you make, such as your preferred language or region, and provide enhanced, more personalized features.

10.3 Managing Cookie Preferences

Most web browsers allow you to control cookies through their settings preferences. You can typically configure your browser to block all cookies, accept only first-party cookies, or delete cookies when you close your browser. Please note that disabling essential cookies may affect the functionality of our website and limit your ability to use certain features.

11. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right to access: You may request a copy of the personal information we hold about you and information about how we process it.
• Right to rectification: You may request that we correct inaccurate or incomplete personal information we hold about you.
• Right to erasure: You may request that we delete your personal information in certain circumstances, subject to legal retention obligations.
• Right to restrict processing: You may request that we limit the processing of your personal information in certain situations.
• Right to data portability: You may request a copy of your personal information in a structured, commonly used, and machine-readable format and have it transmitted to another controller where technically feasible.
• Right to object: You may object to processing of your personal information based on legitimate interests or for direct marketing purposes.
• Right to non-discrimination: You have the right not to receive discriminatory treatment for exercising any of your privacy rights.

12. Third-Party Services

Our website may contain links to third-party websites, platforms, and services that are not owned or controlled by CVA Advise. This Privacy Policy does not apply to those third-party properties. We encourage you to review the privacy policies of any third-party services you interact with before providing them with personal information.

We may use third-party service providers for functions including website hosting, analytics, email delivery, customer relationship management, and payment processing. These providers are carefully evaluated for their privacy and security practices and are bound by contractual obligations to protect information in accordance with this policy and applicable law.

We do not control and are not responsible for the privacy practices, content, or security of third-party websites that may be linked from our pages. The inclusion of a link does not imply endorsement of the linked site or its privacy practices.

13. Changes to This Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will take the following steps to notify you:

• Post the updated policy on this page with a revised effective date.
• Display a prominent notice on our website for a period of thirty days following significant changes.
• For clients with active engagements, provide direct notification via email of any material changes that affect the handling of their information.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of our website or services after any changes to this policy constitutes your acknowledgment of the updated terms.

14. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through any of the following channels:

We are committed to resolving any concerns about our handling of your personal information. If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with the data protection supervisory authority in your jurisdiction.