How CastleIQ collects, uses, and protects your information.

1. Introduction

CastleIQ ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, contact us for pricing consulting services, or interact with our organization.

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our website or services.

2. Information We Collect

2.1 Information You Provide Directly

We collect information that you voluntarily provide to us, including:

• Contact Information: Name, email address, phone number, company name, job title, and mailing address
• Communication Preferences: Your preferred method of contact and communication frequency
• Service Inquiry Details: Information about your pricing strategy needs, business type, company size, and revenue
• Payment Information: Billing address, payment method details (processed securely through third-party payment processors)
• Documents and Communications: Any materials, documents, or files you share with us during consulting engagements

2.2 Information Collected Automatically

When you visit our website, we automatically collect certain information about your device and browsing activity, including:

• Device Information: Device type, operating system, browser type and version
• Usage Data: Pages visited, time spent on pages, links clicked, referral sources
• IP Address: Your Internet Protocol (IP) address for security and analytics purposes
• Cookies and Tracking Technologies: Information collected through cookies, pixel tags, and similar tracking technologies

2.3 Third-Party Information

We may receive information about you from third parties, including:

• Business Partners: Companies you work with that may refer you to our services
• Service Providers: Information from payment processors, email service providers, and analytics platforms
• Publicly Available Sources: Information from public business directories and professional networks

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: Providing pricing consulting services and responding to your inquiries
• Communication: Sending you service-related updates, newsletters, and marketing materials (with your consent)
• Engagement Management: Managing your consulting engagement, including scheduling, reporting, and invoicing
• Business Analysis: Analyzing trends in pricing strategy to improve our service offerings
• Website Optimization: Improving website functionality, user experience, and performance
• Compliance and Legal Obligations: Meeting legal, regulatory, and contractual requirements
• Fraud Prevention: Detecting, investigating, and preventing fraudulent activities
• Research and Development: Understanding client needs and developing new services

4. Legal Basis for Processing (GDPR Compliance)

For users in the European Union and other jurisdictions with privacy regulations, we process personal data based on:

• Contractual Necessity: Processing is necessary to perform services you have requested
• Legitimate Interests: Processing for business purposes, including marketing and service improvement (balanced against your rights)
• Consent: Explicit consent for marketing communications and optional data processing
• Legal Obligation: Processing required to comply with applicable laws and regulations

You have the right to withdraw consent at any time by emailing [email protected].

5. How We Share Your Information

However, we may share your information with:

5.1 Service Providers

Third-party vendors who assist us in operating our website and delivering services, including:

• Cloud hosting providers
• Email and communication platforms
• Payment processors
• Analytics providers
• Customer relationship management (CRM) systems

All service providers are contractually obligated to maintain confidentiality and security of your information.

5.2 Business Partners

We may share information with business partners for joint marketing initiatives, referrals, or service collaboration, with your consent.

5.3 Legal Requirements

We may disclose information when required by law, court order, or government authority, or when we reasonably believe disclosure is necessary to:

• Comply with legal obligations
• Protect our rights and property
• Prevent fraud or illegal activities
• Ensure the safety of our clients and employees

5.4 Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will provide notice if such a change occurs.

6. Data Security

CastleIQ implements comprehensive technical, administrative, and physical security measures to protect your personal data from unauthorized access, alteration, disclosure, and destruction, including:

• Encryption: Secure transmission of data using SSL/TLS protocols
• Access Controls: Limiting employee access to personal data on a need-to-know basis
• Confidentiality Agreements: Requiring all employees to maintain strict confidentiality
• Regular Security Assessments: Periodic evaluation and updating of security practices
• Secure Data Storage: Protected servers and databases with appropriate access restrictions

Despite our security measures, no system is completely secure. We cannot guarantee absolute security of your information. You acknowledge the inherent risks of internet transmission.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law or for legitimate business purposes.

Typical retention periods:

• Service Engagement Data: Retained for the duration of engagement plus 3 years for legal and tax compliance
• Consulting Deliverables: Retained per your agreement or as required for regulatory compliance
• Marketing Communications: Retained until you unsubscribe or request deletion
• Website Analytics: Retained for 12–24 months unless extended for trend analysis

You may request deletion of your data at any time, subject to legal and contractual obligations.

8. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal data:

8.1 European Union and UK (GDPR / UK GDPR)

• Right of Access: Request a copy of your personal data we hold
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data ("Right to be Forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to processing for marketing or legitimate interests
• Right to Lodge Complaints: File a complaint with your Data Protection Authority

8.2 California (CCPA / CPRA)

• Right to Know: Know what personal information we collect, use, and share
• Right to Delete: Request deletion of personal information we have collected
• Right to Opt-Out: Opt out of the sale or sharing of personal information
• Right to Correct: Request correction of inaccurate information
• Right to Access: Request access to your personal information in a portable format

8.3 Virginia (VCDPA)

Virginia Consumer Data Protection Act (VCDPA) residents have specific rights if CastleIQ meets applicable thresholds (processing personal data of Virginia residents in a commercial context). These rights include:

• Right to Know: Request what personal data we collect and how it is used
• Right to Delete: Request deletion of personal data collected from you
• Right to Correct: Request correction of inaccurate personal data
• Right to Data Portability: Request your data in a portable, readily usable format
• Right to Opt-Out of Targeted Advertising: Opt out of processing for targeted advertising and profiling
• Right to Opt-Out of Sale of Personal Data: Opt out of the sale of personal data (note: CastleIQ does not sell personal data)

VCDPA rights apply to "consumers," defined as natural persons acting in an individual household context (not commercial or employment contexts). CastleIQ will assess requests for applicability under VCDPA definitions and requirements.

8.4 Other US States

Residents of other states with privacy laws (Colorado, Connecticut, Utah, etc.) have similar rights. Please contact us for specific information about your state's requirements.

8.5 Exercise Your Rights

To exercise any of these rights, please submit a request to: [email protected]

In your request, please specify:

• The right(s) you are exercising
• Your full name and email address
• Any relevant account or engagement information
• Specific data you are requesting

We will respond to verified requests within 30 days (or as required by applicable law) and provide information about how to verify your identity.

9. Cookies and Tracking Technologies

9.1 Types of Cookies We Use

• Essential Cookies: Required for website functionality and security
• Performance Cookies: Collect data about how you use our website to improve performance
• Analytics Cookies: Help us understand visitor behavior and website usage
• Marketing Cookies: Track your interests and interactions for targeted communications

9.2 Cookie Management

Most web browsers allow you to control cookies through settings. You can:

• Delete existing cookies
• Block all cookies
• Receive notifications when cookies are set

Note that disabling certain cookies may affect website functionality.

9.3 Do Not Track Signals

Some browsers include a "Do Not Track" feature. Currently, there is no industry standard for recognizing Do Not Track signals. CastleIQ does not currently respond to Do Not Track browser signals, but you may disable cookies and opt out of marketing communications as described above.

10. Third-Party Links and Services

Our website may contain links to third-party websites and services that are not operated by CastleIQ. This Privacy Policy does not apply to third-party websites, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites before providing personal information.

11. Children's Privacy

CastleIQ services are designed for business professionals and are not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected information from a child under 13, we will delete such information promptly.

12. International Data Transfers

CastleIQ operates in the United States. If you are located outside the United States, please be aware that your information will be transferred to and processed in the United States. By using our services, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

For users in the European Union, we use Standard Contractual Clauses and other lawful mechanisms to protect your data during international transfers in compliance with GDPR requirements.

13. Modifications to This Privacy Policy

CastleIQ reserves the right to modify this Privacy Policy at any time. Changes will be effective immediately upon posting to our website, and the "Effective Date" will be updated accordingly. Your continued use of our website or services following the posting of changes constitutes your acceptance of the revised Privacy Policy.

We encourage you to review this Privacy Policy periodically to remain informed about how we protect your information.

14. Contact Us

For questions, concerns, or requests regarding this Privacy Policy, your personal data, or our privacy practices, please contact:

Response Time: We typically respond to inquiries within 5–7 business days.

Data Protection Officer Inquiries: For GDPR-related questions, you may also reference the contact information above.

15. Additional Privacy Notices

15.1 California Privacy Rights (CCPA / CPRA)

California residents have specific rights regarding their personal information. For a detailed explanation of your California privacy rights, please see our California Privacy Rights Notice or contact us at [email protected].

15.2 State-Specific Privacy Laws

CastleIQ is organized under the laws of the Commonwealth of Virginia and operates in compliance with applicable state and federal privacy laws, including:

Virginia Consumer Data Protection Act (VCDPA): As a Virginia-based business, CastleIQ complies with VCDPA requirements. If you are a Virginia resident and the VCDPA applies to your data, you have rights to access, delete, correct, and port your personal data, and to opt out of targeted advertising and profiling. Requests should be submitted to [email protected].

Colorado Privacy Act (CPA): Colorado residents have rights to access, delete, correct, and port personal data, and to opt out of targeted advertising and profiling.

Connecticut Data Privacy Act (CTDPA): Connecticut residents have similar rights regarding access, deletion, correction, and data portability.

Utah Consumer Privacy Act (UCPA): Utah residents have rights to access and delete personal data.

California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA): California residents have extensive rights including the right to know, delete, correct, access, and opt out of the sale or sharing of personal data.

If your state has specific privacy law requirements or you have questions about your rights, please contact us at [email protected].