By using our Service, you are accepting the practices described in our Privacy Policy. If you do not agree to the terms of this Privacy Policy, please do not use the Service. We reserve the right to modify or amend the terms of our Privacy Policy from time to time without notice. Your continued use of our Service following the posting of changes to these terms will mean you accept those changes. If we intend to apply the modifications or amendments to this Privacy Policy retroactively or to personal information already in our possession, we will provide you with notice of the modifications or amendments.

If you have any questions about this Privacy Policy or don’t see your concerns addressed here, you should contact us by email at "privacy @ enterprisegrc.com"

What Information About Me Is Collected and Stored?

We collect two basic types of information from you in conjunction with your use of the Service, personal information, and non-personal information. Personal information is information that you may supply to us, as described more fully below, i.e., when you obtain a subscription, complete a survey, register on the Service, upload content, participate in a community, or provide your e-mail address. Personal information is any information that can individually identify you and includes, among other things, your name, e-mail address, telephone number, postal address, credit card, billing, and contact information. Non-personal information includes information that does not personally identify you, but it may include tracking and usage information about your location, demographics, use of the Service, and the Internet.

Personal Information

As a general matter, you can browse the Service without submitting your personal information to us. However, there are a number of circumstances in which you may supply us or our agents with your personal information. The following lists the most common ways in which we may collect your personal information.

• Submission of content or other data and information on any part of the Service that permits it
• Service-related communications, e.g., account verification; technical notification
• Sign up to receive alerts or other information via email, text or instant message from "enterprisegrc.com"
• Submitting an application to work at "enterprisegrc.com"
• Uploading Content to the Service
• Registration for an event sponsored by "enterprisegrc.com"
• Registration for an account on the Service
• Profile information that You provide for Your user profile
• Commenting to "enterprisegrc.com" via blog entries
• Participation in surveys
• Request for sales calls, customer service, support requests or other assistance
• Participation in communities, commenting to blog entries and participation in other forums
• Any other place on the Service where you knowingly volunteer personal information
• Non-Personal Information

In addition, when you interact with the Service, we may collect certain information that does not identify you individually and our servers may automatically keep an activity log of your use of our Service (“Non-Personal Information”).

Generally, we collect and store the following categories of Non-Personal Information:

• Non-identifiable demographic data such as age, gender, and five-digit zip code as part of collecting personal information
• Device information about your computer, browser, mobile device, or other devices that you use to access the Service. This information may include IP address, geolocation information, unique device identifiers, browser type, browser language, and other transactional information.
• Analytics and usage information about your use of the Service.
• Additional “traffic data” and log files such as time of access, date of access, software crash reports, session identification number, access times, and referring website addresses.

Other information regarding your use of the Service.

• Collection of Your Source IP Address/Location Information
• We collect and store location information about you on the Service and associated with your account that you volunteer on the Service or enable through the Service or your device. We will not collect any location information that you do not volunteer or enable.
• We will delete any location information that you request is deleted. We do collect and store your device’s IP address and browser version which may disclose the location as represented by Google Analytics of your device at the time you access the Service. If your device is set to limit location tracking our services cannot override that setting.

Use of Cookies, Flash Cookies, Web Storage, and Web Beacons - Well to start with, we've removed everything Flash!

• We use a session “cookie”, which are small text files that are stored on your computer and allows you to maintain your login for up to 60 minutes, which is the duration limit for a session id. Cookies do not store your account name or password.
• Our Google Cloud reCaptcha and Analytics may use cookies in line with the following:
• We use cookies in conjunction with analysis of your use of our website and generate analytics regarding our Service
• If we ever decide to, we may use cookies in conjunction with sending you e-mail newsletters
• We use cookies to remind us of who you are and to find your account information in our database when you access a service, so you do not need to log in at every visit. This helps us to provide you with service tailored to your specific needs and interests. A cookie is created when you register for a service
• We use cookies to determine the browser the visitor uses so the site can be designed to work properly with the most common versions of different browsers
• Advertisers that place ads on the Sites may use cookies. Although we don't use them, sites you visit by referral could.
• We use cookies to estimate our audience size. Your browser is given a unique cookie that helps us determine whether yours is a repeat visit or a first visit
• You have the ability to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies. If you delete your cookies or if you set your web browser to decline cookies, some features of the Sites may not work or may not work as designed. For more information on cookies and how to disable them, you can consult the information provided by the Interactive Advertising Bureau at www.allaboutcookies.org.
• We do not use flash cookies, web storage, web beacons, or other technology that tracks your browsing history across multiple websites.

Still, take this to heart in how you provide information to any website.

• These technologies may be used to track user behavior and serve you more relevant advertising. This relevant advertising may appear on our Sites or other websites that you visit. This privacy policy does not cover the use of various technologies by advertisers, advertising networks, advertising servers, and analytics companies.
• These companies may also obtain information from services you use from other companies, including without limitation, other websites, mobile websites, mobile downloadable applications, and downloadable applications, and combine that information with information they obtain through these third-party technologies on our Services.
• You should be aware that no company has control over these third-party technologies or the information contained in them.
• You should be aware that if you choose to opt out through other sites, this does not opt you out of advertising. TO BE CLEAR, EnterpriseGRC does not issue any form of advertising. The choices made to accept cookies when you go to a promoted partner site are not within the boundary of this site.
• The ads will just not be targeted to you by any party from which you have opted out. No matter what our site may have now or in the future, You can also opt-out of future information collection from our Services by ceasing use of the Service or in the case of an application, uninstalling the application. (We are not an application, and we never install anything on your computer.)

How Do We Use Your Information?

• We don't. Really, your personal information is not a part of our business model, other than to entirely avoid accidentally storing any part of it we do not track individual users. We only monitor traffic as country of origin and metrics related to browser type and page visitation patterns.

Common site services can use your Personal and Non-Personal Information in the following ways:

General Uses

• To detect, investigate, and prevent activities that may violate our policies or be illegal
• To optimize or improve our products, services, and operations
• To personalize content and experiences on our Service, including providing you reports, recommendations, and feedback based on your preferences
• To communicate with you about changes to our policies
• To permit you to update, edit, and manage your content on our Service
• To upload your content to our Service as you request
• To communicate with you about your account or transactions with us (including service-related announcements) and send you information about features and enhancements on our Service
• To communicate with you about your comment to a blog post
• To disclose anonymized Personal Information to disclose statistics and analytics and other details regarding the use of our Service.
• To automatically update the Service on your device (not gonna happen, but legally the right exists)
• To perform statistical, demographic, and marketing analyses of users of the Service

Use of Your Location Information - Specifically, we may use your location information to:

• Detect, investigate, and prevent activities that may violate our policies or be illegal
• Personalize content on our Service, including providing you reports, recommendations, and feedback based on your preferences, (but really, we don't plan to.)

Who Do We Provide Your Information To?

• No one.
• We do not disclose information about your Personal Information collected online to any companies who are not part of "enterprisegrc". We have no parents or subsidiaries. In no event will we sell or rent your Personal Information as part of a customer list or similar transaction.

Business Partners and Third Parties

• If you are someone known to us, through direct exchanges, and where you as a company express desire to do extended work with us, we may share your Information about you with our business partners from time to time. We will not share telephone, email, or monitored activity. Any communication of this type is guided entirely by the NDA with both clients and partners. You may withdraw your consent to our sharing of your Personal Information with business partners and third parties at any time by following the opt-out process included at the bottom of email communications or selecting the button "Remove my information" on the user profile page. You may also use our GDPR compliance toolbar to systematically delete your profile from our systems, and you may contact us directly via "privacy" at "enterprisegrc" dot com.

Third-Party Agents

• We may elect in the future to have third-party agents, subsidiaries, affiliates, and partners that perform functions on our behalf, such as hosting, billing, push notifications, storage, bandwidth, content management tools, analytics, customer service, fraud protection, etc. These entities have access to the Personal Information needed to perform their functions and are contractually obligated to maintain the confidentiality and security of that Personal Information. Such partners would be and are restricted from using, selling, distributing, or altering this data in any way other than to provide the requested services to the Service.
• As of 2022, the only third-party operating on our behalf is our host provider, who is restricted to the elements that support our site and cannot access or make changes to their contents, and our security service for malware detection and firewall. This service is prominent on our site at all times. Website Security - Sucuri Verified Websites. 

Emergency Situations

• We may also use or disclose Personal Information (limited to the IP and browser details, page visits and records of any information posted to the site) if required to do so by law or in the good-faith belief that such action is necessary to (a) conform to applicable law or comply with legal process served on us or the Service; (b) protect and defend our rights or property, the Service or our users, and (c) act under emergency circumstances to protect the personal safety of us, our affiliates, agents, or the users of the Service or the public. This includes exchanging information with other companies and organizations for fraud protection.

"enterprisegrc dot com" E-mail and Text Communications

• Registration to our site does not constitute an opt-in for promotions via email, however, the following disclaimer applies to the use of our site for the purpose of publishing content to enterprisegrc.com.
• E-mail communications and text messages sent from Us or through Us are designed to make your experience more efficient. By participating in the Services, you specifically agree to accept and consent to e-mail communications and text messages initiated from us or through Us, which include, without limitation: message notification e-mails, e-mails, or text messages informing You about potential available Tutors or Tutees and e-mails informing You of single event promotions. We run and emails informing You of new and existing features We provide. For example, if you are a registered author, we might notify of new authoriing tools.
• Our practice is to use the email you post with your registration and we don't by practice use text messaging. If you provide an email that sends to your phone, standard text messaging charges applied by Your cell phone carrier will apply to text messages We send. If You change Your mobile phone service provider, the notification service may be deactivated for your phone number and you may need to use the registration form to update your preferred notification service. "enterprisegrc" reserves the right to cancel the notification service at any time. If you do not wish to receive any of our e-mail communications or text messages, please do not use the Services.  All that said, we would not intentionally add you to a mailing list. If you ask to be removed, you're gone, no questions asked. Our GDPR compliance toolbar should allow you to automatically remove your account. Should that fail or should you need assistance, contact us using "privacy" at "enterprisegrc" dot com.

What Steps Are Taken to Keep Personal Information Secure?

• We are concerned about ensuring the security of your Personal Information. We exercise great care in providing secure transmission of your information from your device to our servers. Personal Information collected by our Service is stored in secure operating environments that are not available to the public. Our security procedures mean that we may occasionally request proof of identity before we disclose your Personal Information to you. You would be required to know your email and pass a captcha/ReCaptcha. Please understand, however, that while we try our best to safeguard your Personal Information once we receive it, no transmission of data over the Internet or any other public network can be guaranteed to be 100% secure. Our site displays its SSL Certificate at all times. https://seal.starfieldtech.com/verifySeal?sealID=mkO58KHS8DJ8T3PMBUHCNXpaSO5RenrYlv3Jxt0GGG2W9QBmpdEhemzYG8X2 

How Can We Transfer Your Personal Information?  Note, we have no business reason to transfer or transact any customer information.  

• Your information collected through the Service may be stored and processed in the United States or any other country in which "enterprisegrc", its Clients, Affiliates or service providers maintain facilities. "enterprisegrc", its Clients, Affiliates, or service providers may transfer information that we collect about you, including personal information across borders and from your country or jurisdiction to other countries or jurisdictions around the world. If you are located in the United States or other regions with laws governing data collection and use that may differ from US law, please note that we may transfer information, including personal information, to a country and jurisdiction that does not have the same data protection laws as your jurisdiction. By registering for and using the Service you consent to the transfer of information to the US or to any other country in which "enterprisegrc", its Clients, Affiliates or service providers maintain facilities and the use and disclosure of information about you as described in this Privacy Policy.
• Currently, our site operates from California in the United States. We have no affiliates. Any information connected to our site via wrapper and menu is from within the USA and is limited to sites that meet our minimum-security standards.
• If you request your own data that information is downloaded as CSV to your local download folder. Our records will show the date and time that the information was deleted, and YOUR information will no longer exist in our systems. Once you delete your information it is entirely gone. Content may exist in our backups for a period of up to six months. Once our GDPR module has your request to delete your profile and data, that information will be programmatically restricted from any restore.
• Tracking and traffic logs are not Your property. The security of EnterpriseGRC remains the property of the company.

How Long Do We Keep Your Information?

• Following termination or deactivation of your account, "enterprisegrc", its Clients, Affiliates, or its service providers may retain information (including your profile information) and user Content for a commercially reasonable time for backup, archival, and/or audit purposes. Generally, our backups rotate at four weeks. If we had a catastrophic event that required external party restoration our site could restore as far back as six months in time. The nature of your request to have your data removed is sufficiently stored in legal records that we would not return data that had been issued a request for take-down. Any request to remove customer data is completed upon receipt. 
• Our platforms are configured to mask passwords provided to the system, however, if you feel your information is incorrectly managed, you may contact "security" at "enterprisegrc" dot "com". You can use the Contact forms to directly communicate to Privacy EnterpriseGRC.
• Upon creating your account, your password is emailed to you. We understand that your email might be exposed so we urge you to use our MFA options, either GoogleAuthenticator or Yubikey. We will not provde authoring access to users who are not enrolled in MFA. Simply, passwords alone don't meet with our security requirements. How you manage the security of your email is outside of EntepriseGRC Solution's control. Once your password has been issued we only have the option to force it to reset. You can request a password reset at Password Reset. In order to maintain GDPR compliance, we keep a record of your email and username. In the event of a necessary breach notification or a request to remove your information, these are necessary to perform those actions. If we learn that your email is not active, we will delete your account. If we know you personally, we may attempt to reach you via DM on LinkedIn or Twitter, but we offer no assurance that this is a requirement on our part. Accounts that are not associated to a valid email and user name will be deleted.

What Happens When I Link To or From Another Website?

• This Service contains many links to other websites operated by third parties, most notably "LinkedIn", "Twitter", various common social platforms, or the site of our partners. In general, we prefer to link to Government verfiied sites and we avoid sites we learn to use javascript and advertising other than the known efforts of our partners. Please be advised that the practices described in this Privacy Policy for "enterprisegrc" do not apply to information gathered through these other websites. We are not responsible for the actions and privacy policies of third parties and other websites. Due to national concerns over security, we have removed all IFRAMES that point to locations outside of our own service and will only serve MP4 videos or videos from known origins such as NIST.gov or other the Whitehouse sanctioned "dot.gov", or "EU" and other international government sites. We limit such links to sites determined as safe by CISA.Gov.
• In any situation where a video is set to run from a third-party location, such as "YouTube" we restrict the use of "Loop" video to avoid the display of unintended content. In general, the video displayed by enterprisegrc is located in our own system folders. We reserve the right to, from time to time, allow a known party to serve information from their verified YouTube account.

Governing Law

• This Service is published in the United States. We attempt to protect the Personal Information of all users of our Service, and we attempt to comply with local data protection and consumer rights laws to the extent they may apply to the "enterprisegrc" services, but our Service is located and purpose-built for United States citizens and our policies are directed at compliance with those laws. If you are uncertain whether this privacy policy conflicts with the applicable local privacy laws where you are located, you should not submit your Personal Information to us.

Assignment

• We reserve the right to change our ownership or corporate organization while providing the Service. We may also sell certain assets associated with the Service. As a result, please be aware that in such event we may transfer some or all of your information to a company acquiring all or part of our assets or to another company with which we have merged. Under such circumstances we would, to the extent possible, require the acquiring party to follow the practices described in this Privacy Policy, as it may be amended from time to time. Nevertheless, we cannot promise that an acquiring company or the merged company will have the same privacy practices or treat your information the same as described in this Privacy Policy.

Changes to This Policy

• As our Service continues to develop, we may add new services and features to our Service. In the event that these additions affect our Privacy Policy, this document will be updated appropriately. We will post those changes prominently so that you will always know what information we gather, how we might use that information and whether we will disclose it to anyone. We do, however, recommend that you read this Privacy Policy each time you use our Service in case you missed our notice of changes to the Privacy Policy. We will not, however, materially change our policies and practices to make them less protective of Personal Information we have previously collected from you without your express consent.

How Do I Opt-Out or Correct Information About Me?

• Should we choose to use one, any application used to communicate news, the service requires security features including "opt-in" and "opt-out". Our policy precludes the use of marketing lists to send mass emails.
• You may always opt-out of receiving future e-mail messages and newsletters from "enterprisegrc", however, please note we do not use such methods in our business. If you feel you are being targeted by our domain, please report it to "security @ enterprisegrc dot com." or use Privacy EnterpriseGRC to report it to us. The only way you would get communication from us is if you asked for it, either in person or through other messaging such as our LinkedIn, Twitter, Facebook, Email, or through our work with professional organizations such as ISACA, ISCC2, or the Cloud Security Alliance. You would have to "Opt-In". Our company no longer uses HubSpot or any other service to send marketing materials. Should this situation change, we will update our privacy policy.
• We provide you with the opportunity to opt-out of receiving communications from us by going into your profile settings and choosing the appropriate options. To opt-out, you can also send us a message at "privacy @ enterprisegrc dot com." Please note, however, that you generally cannot opt-out of system-generated service announcements, e.g. if the Service is temporarily suspended or if delivery of a product or service is delayed, or notification that you have modified your personal profile, or that you have posted or modified article content. If you don't want system communication, you can delete your registration with the service. Our website is largely public so that will not deny you as a public reader. 

Your California Privacy Rights

• California Civil Code Section 1798.83 permits customers of "enterprisegrc" who are California residents to request certain information regarding its disclosure of their personal information to third parties for their direct marketing purposes. To make such a request, please send an e-mail to "privacy @ enterprisegrc dot com." or use Privacy EnterpriseGRC contact form.
• Our Services respect your browser’s Do Not Track signals (or other well-established, commercially available mechanisms that provide you with the ability to exercise choice regarding the collection of Personal Information). If we receive a Do Not Track notice, we will stop using any Personal Information for online behavioral advertising purposes. (Again, it is not our practice to use behavioral advertising, but legally, this would be reasonable and within the rights of California Privacy Law.)

--- Facilitated Compliance Management (FCM)™, CRAP™, and EnterpriseGRC Solutions are our ™. Information provided by Contributing Authors and summarized from Government and Industry Standards remain the ©copyright of those authors and those standards. We routinely check with Google Console and with our contributing family to verify there are no outstanding requests to remove content. No part of this website is available for reproduction without the express permission of EnterpriseGRC Solutions, Inc.

In Conclusion, you should be concerned by the standards for web privacy in California. If you do not have a statement of permission to share information or if that information is not marked as public domain, don't share it. You may speak about us and point to us and our copyright, but you may not serve our information without our express consent. You should pay close attention to what you share and with whom you share it.

We certainly do.

Sincerely, 

Robin Basham

Owner, EnterpriseGRC Solutions