Privacy Policy

1. Information We Collect

A. Information You Provide Directly

• Contact and inquiry data — name, email address, phone number, company name, and any message you submit via our contact forms or diagnostic booking tools.
• Client engagement data — financial information, business metrics, team structure, and operational details you share during a consulting engagement. This information is provided voluntarily and is used solely to deliver the Services.
• Assessment responses — answers you provide through third-party assessment tools we link to (e.g., Value Builder Score, PREScore, PC Score). Please review the privacy policies of those platforms independently.
• Communications — emails, messages, or other correspondence you send us.

B. Information Collected Automatically

• Usage data — IP address, browser type and version, pages visited, time and date of visit, time spent on pages, referring URLs, and other diagnostic data.
• Device data — device type, operating system, and unique device identifiers.
• Cookies and similar technologies — see Section 5 for details.

C. Information from Third Parties

We may receive information about you from third-party scheduling tools (e.g., Motion, Calendly), marketing platforms, or referral partners. We handle such information in accordance with this Policy.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve our Services;
• Respond to inquiries, schedule calls, and communicate with you about engagements;
• Deliver diagnostic results and consulting deliverables;
• Send transactional communications (confirmations, invoices, follow-ups);
• Send marketing communications where you have consented or where permitted by law (you may opt out at any time);
• Analyze Site usage to improve functionality and user experience;
• Comply with legal obligations and protect our legal rights;
• Prevent fraud and enforce our Terms of Service.

We do not sell your personal information to third parties for their own marketing purposes.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, our legal basis for collecting and using personal information depends on the specific data and context. We process your data under one or more of the following bases:

• Performance of a contract — processing necessary to deliver the Services you have engaged us for.
• Legitimate interests — processing for our legitimate business interests (e.g., improving our Services, communicating with prospective clients), provided those interests are not overridden by your rights.
• Consent — where you have given explicit consent (e.g., marketing emails). You may withdraw consent at any time.
• Legal obligation — processing required to comply with applicable law.

4. Sharing of Information

We may share your information with:

• Service providers — third-party vendors who assist us in operating our Site and delivering Services (e.g., scheduling software, CRM platforms, email service providers, payment processors, cloud storage). These parties are contractually bound to use your data only as directed by us.
• Professional advisors — attorneys, accountants, or auditors where necessary, under confidentiality obligations.
• Business transfers — in connection with a merger, acquisition, or sale of all or a portion of our assets. We will notify you before your information becomes subject to a different privacy policy.
• Law enforcement / legal process — where required by law, court order, or governmental authority, or to protect the rights and safety of our company, clients, or the public.

We do not sell, rent, or trade your personal information.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Site. Cookies are small data files stored on your device.

Types of cookies we use:

• Strictly necessary — required for the Site to function (e.g., session management). These cannot be disabled.
• Analytics — help us understand how visitors use the Site (e.g., page views, traffic sources). We may use tools such as Google Analytics or Fathom Analytics.
• Functional — remember your preferences to improve your experience.
• Marketing — used to deliver relevant advertisements or track campaign effectiveness. We will request your consent before placing marketing cookies.

You can control cookies through your browser settings. Disabling certain cookies may affect Site functionality. For more information, visit allaboutcookies.org.

6. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, including to comply with legal obligations, resolve disputes, and enforce agreements. When data is no longer needed, we securely delete or anonymize it.

Client engagement data is typically retained for a minimum of five (5) years following the conclusion of an engagement to satisfy professional and regulatory record-keeping requirements.

7. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — request correction of inaccurate or incomplete information.
• Deletion — request deletion of your personal information, subject to certain legal exceptions.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@smbstrategyconsultants.com. We will respond within the timeframe required by applicable law (generally 30 days). We may verify your identity before processing requests.

8. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know — the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete — request deletion of personal information we have collected, subject to exceptions.
• Right to Correct — request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing — we do not sell or share personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information — we do not use sensitive personal information for purposes beyond those permitted by the CPRA.
• Right to Non-Discrimination — we will not discriminate against you for exercising your privacy rights.

To submit a CCPA/CPRA request, contact us at hello@smbstrategyconsultants.com or call us during business hours. We will verify your identity and respond within 45 days (extendable by an additional 45 days where necessary).

9. Security

We implement industry-standard administrative, technical, and physical safeguards to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These include encrypted data transmission (TLS/HTTPS), access controls, and regular security reviews.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

10. Third-Party Links

Our Site may contain links to third-party websites, tools, or services (e.g., scheduling platforms, assessment tools, payment processors). We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

11. Children's Privacy

Our Site and Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. We will post the updated Policy on this page with a revised "Last updated" date. For material changes, we will provide more prominent notice (e.g., email notification to active clients). Your continued use of the Site after any changes constitutes acceptance of the updated Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

If you are in the EEA or UK and believe we have not addressed your concern adequately, you have the right to lodge a complaint with your local data protection authority.