Privacy Policy

This Privacy Policy explains what personal information we collect, why, who we share it with, how long we keep it, and what rights you have. It applies to visitors, users, members, buyers, prospects and applicants who interact with the Site, our Services, our Products, our emails, our advertisements, and our sales or recruitment activities.

"Personal information" (or "personal data") means information that identifies you or can reasonably be linked to you, such as your name, contact details, payment data, device identifiers and browsing activity.

Information you give us directly. When you book a consultation, create an account, join a Membership, place an order, contact support, post a review, apply for a role, or otherwise communicate with us, we may collect:

Information collected automatically. When you use the Site we and our vendors may collect:

Information from third parties. We may receive business contact and firmographic information about you or your company from enrichment providers and partners, and from publicly available business sources, to tailor our Services and verify business details. We do not purchase consumer behaviour lists.

Inferences. We may infer general preferences, likely interests and business stage from your interactions with the Site and our marketing. These inferences are used only to improve and personalise the Services and marketing, subject to your rights in §9 and §10.

We do not seek sensitive categories of personal information (such as health, biometric, precise geolocation, political or religious beliefs, or sexual orientation) through the Site. Please do not submit such information, or government identifiers, to us.

• Identifiers: full name, company name, job title, business email address, username.
• Contact details: email, telephone number, billing and postal address, country, preferred language.
• Booking and engagement data: selected consultation slot and timezone, goals submitted, notes, correspondence, the Order or Statement of Work, deliverables, invoices and support history.
• Order and transaction data: Products purchased, price, discounts applied, order date, order status, tax information. We do not collect or store full payment card numbers — payments are processed by our payment processors.
• Account and security data: password hash, authentication events, IP address and timestamp of login, account security flags.
• Recruitment data: CV, cover letter, employment and education history, and interview notes, where you apply to work with us.
• Marketing data: responses to campaigns, unsubscribe events, engagement, attribution data.
• User Content: anything you voluntarily submit, upload, or post (see §12 of the Terms).
• Other information: anything else you choose to provide.
• IP address, approximate geolocation derived from IP, network and service provider;
• device type, model, manufacturer, browser and version, operating system, screen resolution, language, touch capability;
• referring and exit URL, referring search terms, site interactions, pages and assets viewed, time spent, scroll depth, timestamps;
• advertising identifiers such as the Meta Pixel ID, LinkedIn Insight tag, TikTok and Google advertising tags, cookies and device identifiers;
• session replay and interaction heat-map data (clicks, keystrokes and cursor movement) collected by our session-replay vendor;
• email engagement data (opens, clicks, delivery status);
• diagnostic and security data, including IP address, device fingerprint, requests to the Site, and logs used to detect fraud, abuse and automated traffic.

Do Not Track. Our Site is not built to respond to legacy "Do Not Track" browser signals. However, we do honour Global Privacy Control (GPC) and other legally recognised opt-out signals as described in §11.

Where the GDPR or UK GDPR applies, we rely on the following bases:

• Performance of a contract — providing the Services, delivering Products, managing Memberships, processing payments and refunds, and taking steps at your request before entering a contract (e.g., processing a consultation request).
• Consent — non-essential cookies and similar technologies, direct marketing to EU/UK individuals, session-replay and behavioural analytics where consent cannot be relied upon as necessary, and any processing you have expressly consented to. You may withdraw consent at any time (§9).
• Legitimate interests — securing the Site, fraud and abuse prevention, service improvement, business administration, and B2B communications to business contacts, balanced against your interests and rights. Where we rely on legitimate interests, you may object (§9).
• Legal obligation — tax, accounting, records, regulatory, and lawful requests from authorities.
• Vital interests — only in the rare case where processing is necessary to protect someone's life.
• Public task — not relied upon.

We use cookies, local storage, pixels, tags, SDKs, web beacons and similar technologies. They are strictly necessary, optional (analytics and session replay), or advertising. Non-essential technologies are only set after you give consent where consent is required. We honour Global Privacy Control as a valid opt-out signal. You can change your choices at any time via "Cookie Preferences" in the footer, or by clearing site data. Full detail, including vendor names, purposes and durations, is in the Cookie Policy.

Payments are handled by our payment processors. Card details are entered on the processor's secure page and are processed under PCI DSS. We receive limited payment information (for example, the last four digits, card type, and billing country) for reconciliation, fraud prevention and accounting. Our processors may use your data for their own fraud prevention and regulatory obligations as set out in their policies.

We do not sell your personal information for money. However, we do share and disclose it in the following ways:

Vendors processing personal information on our behalf are bound by contract to process it only on our instructions and to protect it.

• Service providers / processors acting under contract on our instructions, including: hosting and CDN providers; payment processors (Stripe, PayPal, Adyen, Paddle, Shopify Payments, Lemon Squeezy); scheduling providers; email and marketing automation providers; customer support and CRM systems; analytics providers (including Google Analytics 4); session-replay and heat-map providers (Hotjar, Microsoft Clarity); advertising platforms (Meta, Google, LinkedIn, TikTok and their affiliates); analytics and business-enrichment providers; and professional advisers, accountants and insurers. Where we name specific vendors, this is not exhaustive of all processors used; a current list is available on request.
• Advertising platforms — "sale" and "sharing" (as those terms are used by CCPA/CPRA and similar US state laws). Certain cookies, pixels and SDKs placed by us or by our advertising vendors on the Site cause the disclosure of your personal information to those vendors, which they may use for cross-context behavioural advertising. Where you are a resident of a state with such laws, this constitutes a "sale," "sharing" or "targeted advertising," and you have the right to opt out — see §10 and §11. We do not knowingly sell the personal information of children under 16.
• Business-to-business communications. With business contacts who have provided us their work contact details, we may send relevant business communications, subject to your rights and any applicable suppression requirements. In the EU and UK this requires a lawful basis, normally consent or legitimate interests.
• Affiliates and group companies, for the purposes described in this Policy.
• Professional advisers and regulators: auditors, accountants, insurers, banks, professional advisers, and government, regulatory or law-enforcement bodies, where required by law, court order or to establish, exercise or defend legal claims.
• Corporate transactions: in connection with a merger, acquisition, financing, reorganisation or sale of assets, your personal information may be transferred. We will require the recipient to process it on terms consistent with this Policy and will notify you where required by law.
• At your direction: where you ask us to disclose information, or where you publish or submit content publicly.

Depending on where you live, you may have the right to:

Verification. To protect your information, we will verify your identity before fulfilling a request (for example, by confirming control of the email address on file or responding to a request from a business domain). We will only use information in a verifiable request to verify identity or authority, not for other purposes.

Authorised agents. In the United States, you may designate an authorised agent to make a request. We require proof of the agent's authority and may verify your identity directly.

Timing. We respond to verifiable requests within the period required by applicable law — ordinarily 30 days in California, one month under the GDPR (extendable by two further months for complex requests, with notice), and one month under the UK GDPR.

International users. If you are in the EU or UK and are not satisfied with our response, you may lodge a complaint with your local supervisory authority (for example, in Italy, the Garante per la protezione dei dati personali; in the UK, the Information Commissioner's Office).

Marketing opt-out. You can unsubscribe from marketing using the link in any marketing email, or by contacting compliance@impactsourcetechnologies.com. We will then stop sending direct marketing to you. We may still send service communications necessary to your purchase or account.

Retention and deletion. On withdrawal, objection or erasure we will stop the relevant processing and delete or de-identify the information, subject to records we must retain by law.

• Access — obtain a copy of the personal information we hold about you.
• Rectify — correct inaccurate or incomplete information.
• Erase — ask us to delete information, where we no longer need it.
• Restrict — ask us to pause processing.
• Portability — receive certain information in a structured, commonly used, machine-readable format.
• Object — object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Not be subject to solely automated decisions producing legal or similarly significant effects, and to obtain human intervention, express a point of view or contest a decision. We do not currently make decisions of this kind.

If you are a California resident, the CCPA/CPRA gives you the right to:

Other US states provide similar rights. To exercise a right, email compliance@impactsourcetechnologies.com with the subject "Privacy Request" and describe your request, state of residence and the email or order details associated with you. We do not sell or share for cross-context behavioural advertising unless you have opted in where required; note that where you have consented to advertising in another context, such behaviour may constitute a sale or sharing that you can opt out of at any time using the mechanism below.

• know what personal information we collect, use, disclose or sell;
• request deletion of your personal information (subject to exceptions, including where we need it to provide a service or for legal compliance);
• request correction of inaccurate information;
• opt out of the "sale" or "sharing" of your personal information, and of targeted advertising;
• limit the use of your sensitive personal information (we do not use sensitive personal information for inferring characteristics as defined by CPRA);
• receive equal levels of service and pricing regardless of whether you exercise your rights, and to receive non-discriminatory treatment for exercising them.

You can opt out of the sale/sharing of your personal information and of targeted advertising in any of these ways:

(a) Cookie preference centre — click "Cookie Preferences" in the Site footer and switch off advertising and analytics categories.

(b) Email — send an email to compliance@impactsourcetechnologies.com with the subject "Opt-Out" and the words "Sale/Sharing Opt-Out".

(c) Global Privacy Control (GPC). If your browser or extension sends a GPC signal, we treat it as a valid request to opt out of sale/sharing and of targeted advertising for your browser. You can enable GPC in your browser settings or with a privacy extension. Because we honour GPC, we do not need to recognise a legacy "Do Not Track" signal.

(d) Browser settings or ad platform controls — you can also limit interest-based advertising through Google, Meta, LinkedIn, TikTok and your device settings.

You may re-enable personalisation at any time via the cookie preference centre. We will confirm processing of your opt-out where required by law, and we will not penalise you for exercising any right. Opting out of advertising cookies does not remove you from our mailing lists; see §9 for marketing opt-out.

We keep personal information only as long as necessary for the purposes described, our legal and contractual obligations, and our legitimate interests, and we delete or de-identify it thereafter. Our indicative retention periods are:

We keep suppression records (for example, unsubscribed email addresses) only for as long as needed to honour your choice.

We and our vendors use automation to summarise and triage enquiries, match scheduling requests, detect spam and fraud, and personalise marketing. These tools support human review; we do not use solely automated decision-making to produce legal or similarly significant effects on you. We do not permit vendors to use your personal information to train their own general-purpose foundation models. Where we use your content to improve our own services, we do so on a de-identified or aggregated basis, and you may object or withdraw consent where that processing relies on consent.

We are a US company. Your personal information may be processed in the United States and in other countries, including the United Kingdom, the European Economic Area, and other locations where our vendors operate. Where personal information is transferred out of the EEA or UK, we rely on an adequacy decision where one exists, and otherwise on Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum, together with a transfer risk assessment and supplementary measures such as encryption and access controls. You may request a copy of the relevant safeguards from compliance@impactsourcetechnologies.com.

We maintain administrative, technical and physical safeguards designed to protect personal information, including encryption in transit (TLS) and at rest, role-based access controls, multi-factor authentication for privileged access, logging and monitoring, vendor security review, staff training, incident response procedures and periodic risk assessment. We require processors to provide comparable protection. No internet transmission or storage system is 100% secure, and we cannot guarantee absolute security. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware, and notify affected individuals and users where required by law.

The Site and Services are intended for adults aged 18 or older and are not directed to children. We do not knowingly collect personal information from anyone under 13, and we do not knowingly sell or share the personal information of anyone under 16. We do not knowingly collect information from children under 13 without verifiable parental consent. If you believe a child has provided us with personal information, contact compliance@impactsourcetechnologies.com and we will delete it.

The Site may contain links to, or embedded content from, third-party websites, plugins and applications (including social networks, scheduling widgets, video platforms, maps and advertising networks). These third parties collect information under their own policies. We are not responsible for their content, privacy practices or security. Where a third-party plugin is embedded, its vendor may collect information about your visit — including session-replay vendors, whose cookies are subject to your consent choice. You should review their policies before using them.

We may update this Policy. The "Last updated" date at the top identifies the current version. Where a change is material — for example a new purpose, a new category of data, a new recipient, a new country of processing, or a change in legal basis — we will provide at least thirty (30) days' notice by email or by a prominent notice on the Site before it takes effect, and we will request fresh consent where required. Continuing to use the Site after the effective date means you accept the updated Policy.

If you are in the EU, you may contact your national data protection authority. If you are in the UK, you may contact the Information Commissioner's Office (ico.org.uk).