Privacy Policy

1. Scope

This Privacy Policy explains how DigVel ("we", "us", "our") collects, uses, discloses, and protects information when you visit digvel.com, contact us, or engage us for cybersecurity consulting and software validation services (the "Services"). It applies to visitors, prospective clients, and clients of DigVel.

2. Information We Collect

We collect the following categories of information:

• Contact and business information you provide, such as name, work email, phone number, company name, and job title, when you reach out through our website (contact form, code security audit request, sample report request, software approval request) or engage our Services, together with the message or request details you write.
• Marketing preferences: whether you ticked the optional box to receive DigVel updates by email. This choice is stored with your contact record and is separate from your consent to the processing of your data for your inquiry.
• Campaign attribution: if you arrive through a link with utm_* tags (for example from an advertisement or newsletter), we keep those tags in your browser for the duration of the visit and send them to us only when you submit one of our forms, so we can tell which campaign your inquiry came from.
• Billing information processed on our behalf by our payment processor (see Sharing & Subprocessors); DigVel does not store full payment card numbers on its own systems.
• Engagement data, meaning the software, files, or system information Client submits for analysis under an active Statement of Work, handled under the confidentiality terms of our Terms of Service and, where applicable, a Data Processing Addendum.
• Usage data, such as pages visited, browser type, device information, and referral source, collected automatically through server logs and, if you accept them, the analytics cookies described in our Cookie Policy.

3. How We Use Information

We use the information we collect to:

• Respond to inquiries and provide the Services, including delivering reports and recommendations;
• Send you occasional updates about cybersecurity and compliance, only if you opted in through the optional newsletter box on our forms. You can withdraw at any time using the unsubscribe link in any message or by contacting us;
• Process payments and manage billing;
• Operate, maintain, and improve our website and Services;
• Communicate with you about your engagement, account, or updates to our Services;
• Comply with legal, regulatory, and contractual obligations, including recordkeeping tied to compliance-related deliverables;
• Detect, prevent, and investigate fraud, abuse, or security incidents.

4. Legal Bases for Processing

Where the GDPR or similar law applies, we process personal data under one or more of the following legal bases: performance of a contract with you (or your employer), our legitimate interests in operating and securing our business, compliance with a legal obligation, and, where applicable, your consent.

5. Cookies & Tracking

Our website uses strictly necessary browser storage required for it to function and, only if you accept them in the cookie banner, analytics cookies set through Google Tag Manager and Google Analytics. We do not use advertising cookies. You can change your choice at any time. See our Cookie Policy for the full list and how to manage it.

6. Sharing & Subprocessors

We do not sell personal information. We share information only with service providers who process it on our behalf under confidentiality and data-protection obligations (our subprocessors — see the current list on our Subprocessors page; this includes the email-marketing service that stores contact-form submissions and newsletter subscribers), when required by law or valid legal process, or in connection with a merger, acquisition, or sale of business assets (subject to continued protection under this Policy).

7. International Data Transfers

DigVel and its clients are currently based in the United States, and we do not presently engage clients based in the EU/UK. If that changes, we will adopt appropriate safeguards (such as Standard Contractual Clauses) for any personal data transferred internationally, as required by applicable law.

8. Data Retention

Engagement data — the software, files, or system information Client submits for analysis — is not retained after the engagement is completed; it is deleted once the final deliverable has been produced, unless a longer period is required by an active SOW or law. Final reports and deliverables are retained for 12 months from completion for recordkeeping purposes. Contact-form submissions and newsletter subscriptions are kept until you ask us to delete them or unsubscribe, and otherwise for as long as needed to handle your inquiry. Other personal information (e.g. contact and billing information) is retained for as long as necessary to provide the Services, comply with legal and contractual obligations, resolve disputes, and enforce our agreements.

9. Data Security

We implement administrative, technical, and physical safeguards designed to protect personal information and engagement data against unauthorized access, disclosure, alteration, or destruction, appropriate to the sensitivity of the information involved. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your Rights

Depending on your location, you may have the right to access, correct, delete, or export your personal information, restrict or object to certain processing, and withdraw consent where processing is based on consent. California residents have rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of the sale or sharing of personal information (we do not sell personal information). To exercise any of these rights, contact us using the details in Contact Us. We will respond within the timeframe required by applicable law.

11. Children's Privacy

Our Services are directed at businesses and are not intended for individuals under 16. We do not knowingly collect personal information from children.

12. Third-Party Links

Our website may link to third-party websites. We are not responsible for the privacy practices or content of those sites and encourage you to review their policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date and, where appropriate, additional notice.

14. Contact Us

For privacy-related questions or to exercise your rights, contact us at [email protected] or 728 Broadway, 322, Saugus, MA 01906. Privacy-specific inquiries can also be sent directly to [email protected].