Enterprise Privacy Policy

1. Data Controller and Processor Framework

As Data Controller

For our own business operations:

• Website visitor analytics
• Marketing and communications
• Customer relationship management
• Business development activities

As Data Processor

For client assessment services:

• Candidate assessment data
• Evaluation results and reports
• Client-directed data processing
• Custom analytics and reporting

1.1 GDPR Article 28 Compliance

When acting as a data processor for enterprise clients, we operate under comprehensive Data Processing Agreements (DPAs) that include:

Processing Instructions: Only process personal data on documented client instructions
Confidentiality: All personnel bound by strict confidentiality obligations
Security Measures: Technical and organizational measures per Article 32
Sub-processor Management: Written agreements with approved sub-processors
International Transfers: Appropriate safeguards for cross-border data transfers
Data Subject Rights: Assistance with data subject requests and compliance
Breach Notification: Immediate notification of personal data breaches
Audit Rights: Client audit and inspection capabilities

2. Enterprise Data Classification and Handling

2.1 Data Classification Framework

Classification	Data Types	Security Controls	Retention
Restricted	Biometric data, health information, financial records	AES-256 encryption, zero-trust access	Legal minimum only
Confidential	Assessment results, candidate profiles, client data	Strong encryption, access logging	7 years (audit req.)
Internal	Operational metrics, anonymized data	Standard encryption, RBAC	3 years
Public	Marketing materials, public documentation	Standard web security	As needed

2.2 Personal Information Categories Collected

Direct Collection

Identity Data: Name, email address, phone number, job title
Professional Data: Company information, role requirements, hiring criteria
Assessment Data: Candidate responses, performance metrics, evaluation results
Communication Data: Messages, feedback, support interactions
Payment Data: Billing information, purchase orders, financial details

Automatic Collection

Technical Data: IP address, browser type, device information, OS version
Usage Data: Page views, click patterns, session duration, feature usage
Performance Data: Load times, error rates, system performance metrics
Security Data: Login attempts, access logs, security events
Geolocation Data: Country/region (not precise location)

3. Legal Basis and Processing Purposes

3.1 GDPR Legal Basis Framework

Consent (Article 6(1)(a))

• Newsletter subscriptions
• Marketing communications
• Non-essential cookies
• Optional data collection

Contract (Article 6(1)(b))

• Service delivery and support
• Assessment processing
• Payment processing
• Account management

Legitimate Interest (Article 6(1)(f))

• Website analytics and optimization
• Security monitoring and fraud prevention
• Service improvement and development
• Business analytics and reporting

Legal Obligation (Article 6(1)(c))

• Regulatory compliance and reporting
• Tax and financial record keeping
• Employment law compliance
• Data breach notifications

3.2 Processing Purpose Matrix

Processing Activity	Data Categories	Legal Basis	Retention Period
Assessment Services	Candidate data, results	Contract, Consent	7 years
Marketing Communications	Contact information	Consent	Until withdrawal
Website Analytics	Usage data, cookies	Legitimate Interest	26 months
Security Monitoring	Access logs, IP addresses	Legitimate Interest	12 months
Compliance Reporting	Audit trails, records	Legal Obligation	7 years

4. Third-Party Data Sharing and Sub-Processors

4.1 Approved Sub-Processor Registry

Enterprise Sub-Processor Management

All sub-processors undergo rigorous security and privacy assessments, maintain equivalent data protection standards, and are bound by comprehensive data processing agreements. Clients receive 30-day notice of sub-processor changes with objection rights.

Service Provider	Service Purpose	Data Location	Certifications
Supabase Inc.	Database hosting and user management	US (AWS)	SOC 2, ISO 27001
Resend Inc.	Email delivery and notifications	US	SOC 2, GDPR
Vercel Inc.	Website hosting and CDN	US, Global CDN	SOC 2, ISO 27001
Google LLC	Analytics and performance monitoring	US, Global	ISO 27001, SOC 2
Amazon Web Services	Cloud infrastructure and compute	US West 2	SOC 1/2/3, ISO 27001

4.2 Data Sharing Limitations and Controls

No Sale of Personal Data: We never sell, lease, or exchange personal information for monetary consideration
Purpose Limitation: Data shared only for specified, legitimate business purposes
Contractual Protections: All third parties bound by comprehensive data protection agreements
Access Controls: Minimum necessary access principles applied to all data sharing
Audit Rights: Regular audits of third-party data handling practices
Data Minimization: Only essential data shared with external parties

5. International Data Transfers and Safeguards

5.1 Transfer Mechanisms and Safeguards

Standard Contractual Clauses

EU Commission approved SCCs (2021/914) for all transfers to third countries

Adequacy Decisions

Transfers to countries with EU adequacy determinations where applicable

Additional Safeguards

Technical measures including encryption, access controls, and monitoring

5.2 Regional Data Localization

Region	Data Storage	Transfer Safeguards	Local Requirements
European Union	EU data centers available	SCCs, adequate protections	GDPR Article 44-49
United Kingdom	UK data centers available	UK GDPR, ICO guidelines	Data Protection Act 2018
Canada	Canadian data centers	Adequate protection level	PIPEDA compliance
Asia-Pacific	Regional options available	Country-specific agreements	Local privacy laws

6. Enterprise Security Framework

6.1 Technical Security Measures

Encryption and Cryptography

AES-256 encryption for data at rest
TLS 1.3 for data in transit
End-to-end encryption for sensitive communications
Hardware Security Modules (HSMs) for key management
Perfect Forward Secrecy implementation
Regular cryptographic key rotation

Access Controls and Authentication

Zero-trust architecture implementation
Multi-factor authentication (MFA) required
Role-based access control (RBAC)
Principle of least privilege
Just-in-time access provisioning
Regular access reviews and deprovisioning

Monitoring and Detection

24/7 security operations center (SOC)
Real-time threat detection and response
Behavioral analytics and anomaly detection
Comprehensive audit logging
Automated incident response workflows
Continuous vulnerability assessments

Infrastructure Security

Cloud security posture management
Network segmentation and microsegmentation
WAF and DDoS protection
Regular penetration testing
Secure software development lifecycle
Container and serverless security

6.2 Organizational Security Measures

Personnel Security: Background checks, security awareness training, confidentiality agreements
Physical Security: Secured facilities, biometric access controls, visitor management
Vendor Management: Third-party risk assessments, security questionnaires, contract requirements
Incident Response: Comprehensive incident response plan with defined escalation procedures
Business Continuity: Disaster recovery plan with RTO/RPO targets and regular testing
Compliance Monitoring: Regular audits, penetration testing, and compliance assessments

7. Data Subject Rights and Requests

7.1 GDPR Rights Framework

Access and Portability Rights

• Right to access personal data (Article 15)
• Right to data portability (Article 20)
• Machine-readable data export formats
• Comprehensive data subject reports

Correction and Deletion Rights

• Right to rectification (Article 16)
• Right to erasure/"right to be forgotten" (Article 17)
• Right to restrict processing (Article 18)
• Data accuracy maintenance procedures

Objection and Consent Rights

• Right to object to processing (Article 21)
• Right to withdraw consent (Article 7)
• Granular consent management
• Marketing communication preferences

Automated Processing Rights

• Protection against automated decision-making (Article 22)
• Right to human review of AI decisions
• Algorithm transparency and explanation
• Meaningful intervention capabilities

7.2 Request Processing Procedures

Streamlined Request Process

Submit data subject requests through our secure portal or email privacy@autonomyheroes.com. We respond within 30 days (72 hours for urgent requests) with comprehensive information and action taken.

Request Verification

Data Identification

Action Processing

Response Delivery

7.3 California Privacy Rights (CCPA/CPRA)

Right to Know: Categories and specific pieces of personal information collected
Right to Delete: Request deletion of personal information (subject to exceptions)
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out: Opt-out of sale or sharing of personal information
Right to Limit: Limit use and disclosure of sensitive personal information
Non-Discrimination: Protection against discriminatory treatment for exercising rights

8. Data Breach Notification and Incident Response

8.1 Incident Response Framework

24/7 Incident Response Capability

Our Security Operations Center (SOC) provides round-the-clock monitoring and incident response with automated detection systems and immediate escalation procedures for data protection incidents.

Detection and Assessment

• Automated threat detection systems
• Risk severity classification
• Immediate containment measures
• Impact assessment procedures

Notification Timeline

• Supervisory authorities: 72 hours
• Data subjects: Without undue delay
• Client notification: Within 24 hours
• Public disclosure: As required

Remediation Actions

• Immediate threat containment
• Forensic investigation
• System hardening and patching
• Process improvement implementation

8.2 Client Notification Procedures

Enterprise clients receive priority notification and dedicated support during security incidents:

Immediate Alert: SMS, email, and phone notification to designated contacts
Detailed Report: Comprehensive incident report with timeline and impact assessment
Regular Updates: Ongoing communication throughout incident response
Final Summary: Post-incident report with lessons learned and preventive measures
Support Resources: Dedicated incident response team and technical assistance

9. Data Retention and Secure Disposal

9.1 Enterprise Retention Schedule

Data Category	Retention Period	Legal Basis	Disposal Method
Assessment results and reports	7 years	Regulatory compliance	Cryptographic erasure
Candidate personal information	3 years or deletion request	Business necessity	DOD 5220.22-M standard
Financial and billing records	7 years	Tax law requirements	Secure shredding/erasure
Security logs and access records	12 months	Security monitoring	Automated deletion
Marketing communications	Until unsubscribe	Consent basis	Immediate deletion
Website analytics data	26 months	Legitimate interest	Platform deletion

9.2 Secure Data Disposal Procedures

Digital Data Destruction

NIST 800-88 compliant data sanitization
Cryptographic erasure for encrypted data
Multi-pass overwriting for magnetic media
Physical destruction of storage devices
Certificate of destruction provided
Chain of custody documentation

Legal Hold Procedures

Litigation hold notification system
Preservation of relevant data
Suspension of automated deletion
Legal review and approval process
Documentation of hold activities
Release procedures upon conclusion

10. Cookies and Tracking Technologies

10.1 Cookie Classification and Management

Essential Cookies

Required for basic website functionality:

• Authentication and session management
• Security features and fraud prevention
• Load balancing and performance
• Form submission and data integrity

Analytics Cookies

Help us understand usage patterns:

• Website traffic and user behavior
• Performance monitoring and optimization
• Feature usage analytics
• Error tracking and debugging

Functional Cookies

Enhance user experience:

• User preferences and settings
• Language and region selection
• Personalized content delivery
• Remember previous interactions

Marketing Cookies

Support targeted communications:

• Interest-based advertising
• Campaign effectiveness measurement
• Social media integration
• Cross-platform tracking (opt-in)

10.2 Consent Management and Controls

Granular Consent: Separate opt-in for each cookie category beyond essential
Cookie Banner: Clear information and easy consent/rejection mechanisms
Preference Center: Detailed cookie management and preference updates
Consent Records: Audit trail of consent decisions and timestamps
Withdrawal Options: Easy consent withdrawal through settings or email
Browser Controls: Respect for Do Not Track signals and Global Privacy Control

11. Children's Privacy Protection

Age Verification and Protection

Our services are designed for professional use by individuals 18 years or older. We do not knowingly collect personal information from children under 16 (or applicable local age of digital consent). If we become aware of such collection, we immediately delete the information and terminate access.

11.1 COPPA and Global Standards Compliance

Age Verification: Account creation requires age confirmation and business email
Parental Rights: Parents may request information about and deletion of child data
Educational Use: Special protections for any educational or research applications
International Standards: Compliance with GDPR Article 8 and global child protection laws
Monitoring: Regular audits to ensure no child data is inadvertently collected

12. Policy Updates and Change Management

12.1 Update Notification Framework

Material Changes

60-day advance notice via email and prominent website notification

Administrative Updates

30-day notice for operational changes and clarifications

Legal Requirements

Immediate updates for regulatory compliance with explanation

12.2 Version Control and Documentation

Version History: Complete changelog of policy modifications available
Effective Dates: Clear indication of when changes take effect
Archive Access: Previous policy versions maintained for reference
Change Summaries: Executive summaries of material modifications
Impact Assessments: Data protection impact assessments for significant changes

13. Privacy Office and Contact Information

Data Protection Office

Autonomy Heroes, LLC

2108 N ST, STE N

Sacramento, CA 95816

Data Protection Officer: dpo@autonomyheroes.com

Privacy Inquiries: privacy@autonomyheroes.com

GDPR Representative: gdpr@autonomyheroes.com

Supervisory Authorities

California

California Privacy Protection Agency

cppa.ca.gov

European Union

Local Data Protection Authority

edpb.europa.eu

United Kingdom

Information Commissioner's Office

ico.org.uk

24/7 Privacy Emergency Hotline

For urgent privacy incidents or data subject emergency requests:(650) 933-4532 ext. 911

Enterprise Privacy Framework