Privacy Policy

1. Information We Collect

1.1. Information You Provide

When you interact with the Site, you may provide us with personal information, including:

• Contact information (name, email address, phone number, company or organization, role)
• Inquiry details (information you submit through contact forms describing your portfolio, programs, or compliance needs)
• Application information (information submitted through the Annual Partner Program application form, including organization details, EIN, portfolio information, mission statements, and compliance history)
• Assessment responses (answers you provide through the HOTMA Readiness Score tool, Spot the Finding game, or other interactive tools)
• Newsletter and resource subscriptions (email address and topic preferences when you subscribe to our Insights or request notifications about new resources)
• Other information you choose to provide in correspondence with us

1.2. Information Collected Automatically

When you visit the Site, we may automatically collect:

• Device and browser information (browser type, operating system, device type)
• Usage information (pages visited, time spent on pages, clickstream data, referring URLs)
• IP address and approximate geographic location
• Cookie and similar technology data (see our Cookies Policy)

1.3. Information from Third Parties

We may receive information about you from third-party service providers, such as analytics providers, marketing platforms, or referral sources.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your inquiries and provide requested information
• To process and evaluate applications for the Annual Partner Program
• To generate and deliver assessment results from interactive tools
• To send you newsletters, insights, and resource updates you have subscribed to
• To communicate with you about our services, including marketing communications where permitted
• To improve the Site, our services, and our content
• To analyze usage patterns and trends
• To detect, prevent, and address technical issues, security risks, fraud, or abuse
• To comply with legal obligations
• To protect our rights, property, and safety, and the rights, property, and safety of others
• For other purposes for which we obtain your consent

3. Legal Bases for Processing (For Users in the EEA, UK, or Switzerland)

If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal information only when we have a valid legal basis to do so, including:

• Your consent (for marketing communications, optional cookies, and other consent-based uses)
• Performance of a contract (when processing your information to deliver services you have requested)
• Legitimate interests (when processing furthers our legitimate business interests in a way that does not override your rights)
• Legal obligations (when processing is required by law)

4. How We Share Your Information

We do not sell your personal information. We may share information in the following circumstances:

4.1. Service Providers

We may share information with trusted third-party service providers who help us operate the Site and our business, such as:

• Website hosting and infrastructure providers
• Analytics providers (such as Google Analytics)
• Email and mailing list providers
• Customer relationship management (CRM) tools
• Form processing and assessment delivery tools

These service providers are contractually obligated to handle your information in accordance with this Privacy Policy and applicable law.

4.2. Legal Requirements

We may disclose information if required to do so by law, regulation, legal process, or government request, or to protect the rights, property, or safety of Altus, our users, or others.

4.3. Business Transfers

If Altus is involved in a merger, acquisition, asset sale, or similar transaction, your information may be transferred as part of that transaction.

4.4. With Your Consent

We may share information for other purposes with your consent.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on the Site. For details, please see our Cookies Policy.

Google Ads receives permitted advertising measurement data: device and browser information, IP address, pages visited, ad-click identifiers, and a successful quote-request or contact-message event with a random submission identifier for deduplication. We use this to measure ads and optimize ad delivery; we do not send form contents, names, email addresses or phone numbers to Google for this measurement. No enhanced customer matching or offline conversion uploads are enabled.

Advertising tags and events are blocked until acceptance in consent-required or unknown regions. We apply the Canada-wide safeguard because our location lookup cannot distinguish Quebec. Elsewhere measurement respects rejection and Global Privacy Control. Use Cookie settings to withdraw at any time, without affecting your inquiry. We preserve consent evidence (random visitor identifier, choice, date, region, and the notice and choices shown) in your browser, and store an event-time snapshot with the inquiry. Learn more about Google’s use of advertising information.

6. Your Rights

Depending on your location and applicable law, you may have certain rights regarding your personal information.

6.1. For Users in the United States (Including California)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with the following rights:

• Right to know what personal information we have collected about you
• Right to delete personal information we have collected from you
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information (we do not sell personal information)
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising your privacy rights

Similar rights are available under other state laws including the Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, and Utah Consumer Privacy Act, among others.

6.2. For Users in the EEA, UK, or Switzerland

Under the General Data Protection Regulation (GDPR) and similar laws, you have the right to:

• Access your personal information
• Correct inaccurate personal information
• Delete your personal information ("right to be forgotten")
• Restrict processing of your personal information
• Object to processing of your personal information
• Data portability
• Withdraw consent at any time (for processing based on consent)
• Lodge a complaint with a supervisory authority

6.3. Exercising Your Rights

To exercise any of these rights, please contact us at info@altuscompliance.com. We will respond to your request within the timeframe required by applicable law.

6.4. Verification

We may require you to verify your identity before processing your request. We will not discriminate against you for exercising your privacy rights.

7. Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Contact form submissions: typically retained for up to 3 years after last contact
• Annual Partner Program applications: retained for the duration of the application cycle plus 2 years
• Newsletter subscribers: retained until you unsubscribe, then deleted within 90 days
• Assessment tool responses: retained in aggregate for up to 5 years for analysis purposes; individual records typically deleted within 1 year
• Analytics data: typically retained for up to 26 months

8. Data Security

We implement reasonable technical, administrative, and physical security measures to protect your personal information. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

9. Children's Privacy

The Site is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If we learn we have collected information from a child under 16, we will delete it promptly. Parents or guardians who believe their child has provided us with personal information may contact us at info@altuscompliance.com.

10. International Data Transfers

Altus is based in the United States. If you access the Site from outside the United States, your information will be transferred to, stored, and processed in the United States or other countries where our service providers operate. By using the Site, you consent to such transfers.

11. Third-Party Links

The Site may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to read the privacy policies of any third-party sites you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The most current version will be posted on the Site with the "Last updated" date. We encourage you to review this Privacy Policy periodically.