Privacy policy
How we handle your information
This policy covers this website. It says what we collect, why, who else touches it, where it goes, how long we keep it, and what you can ask us to do. If anything here is unclear, write to compliance@pptcgroup.com and we will explain it.
The short version
- We set no cookies of our own. If you allow it, Meta and Pinterest advertising tags set theirs so we can measure our ads. Nothing loads until you say yes.
- Our analytics counts page visits without cookies and without identifying you, and you can switch it off below.
- The booking calendar belongs to Microsoft. Nothing is requested from them until you choose to load it.
- We do not sell your personal information. If you allow the advertising tags, what you do here is shared with Meta and Pinterest for advertising, and you can stop that at any time below.
- No decision about you is made by a machine.
- You can ask us for a copy of your information, or to correct or delete it, wherever you live.
Who we are, and who is accountable
PPTC Group LLC is the company responsible for your information, which the law variously calls the data controller, the business, or the organization accountable for it. We are a limited liability company registered in Texas, United States, on 29 September 2022.
The person accountable for our handling of personal information, and the person in charge of the protection of personal information for the purposes of Quebec's Law 25, is our Compliance Lead. Write to compliance@pptcgroup.com, or by post to PPTC Group LLC, 4352 S Capistrano Dr, Dallas, TX 75287, USA. For anything that is not a privacy question, use hello@pptcgroup.com.
We have internal policies covering how personal information is kept, who may see it, how long it is held, how it is destroyed, and how complaints are handled. Our Compliance Lead approves them and reviews them once a year. Everyone here sees only what their own work needs, and nobody working on client engagements has access to the website enquiry inbox. This page is the plain language account of those policies. Ask us and we will describe any of it in more detail.
What we collect
We collect only what the job needs. Nothing on this site asks for more than these.
| Where from | What |
|---|---|
| The message form on our Book a call page | Your name, your email address, your message, and a record that you ticked the box and when. There is no company field and no phone field. |
| Booking a call | Your name, your email address, the time you pick and anything you write in the notes. You give these to Microsoft Bookings, and the booking then appears in our Microsoft 365 calendar. |
| Our hosting provider's logs | Your IP address, your browser type, the pages requested and the time. IP addresses count as personal information, so we say so rather than calling logs anonymous. |
| Analytics | Counts of page visits, referring site, country, browser and device type, in aggregate. No cookies, no identifier, nothing that singles you out, and nothing that follows you to other sites. |
| Advertising tags, only if you allow them | The pages you visit here, whether you send a message or book a call, your browser and device, and the identifiers Meta and Pinterest keep in their own cookies. We do not send them your name, email address or phone number. |
| Spam protection | Cloudflare Turnstile checks the message form. It processes limited technical signals to tell a person from a bot. It does not profile you. |
Giving us any of this is voluntary. Nothing here is required by law or by a contract. But without a name and an email address we cannot answer you, and without the booking details Microsoft cannot hold a time for you.
Why we use it, and on what legal basis
The bases below are the ones the UK and EU GDPR ask us to state. Elsewhere the same table answers the simpler question of why we have your information at all.
| What | Why | Basis (UK and EU) |
|---|---|---|
| Message form | To read your message and reply to it | Our legitimate interest in answering a business enquiry addressed to us |
| Booking details | To hold the meeting you asked for | Steps taken at your request before any contract |
| Server logs | To serve the site, keep it up, and stop abuse | Our legitimate interest in a working, secure website |
| Analytics | To see which pages are read, in aggregate | Our legitimate interest in improving the site. You can switch it off |
| Advertising tags | To see which of our ads bring people here, and to show our ads to people who have visited | Your consent, which you can withdraw at any time with the switch below |
| Transactional email | To deliver our reply or your confirmation | Follows the purpose it serves |
The tick box on the message form is your acknowledgement that you have read this policy and are happy for us to reply. It is not consent to marketing: we do not run a marketing list, and we will not add you to one. If that ever changes, it will be a separate, unticked box that you choose, and you will be able to withdraw it as easily as you gave it.
Where your information goes
We are a United States company and your information is processed in the United States. Our delivery team works from the United States and India.
What reaches India, and what does not. Enquiries and bookings from this website are handled by our US-based team. Staff in India work on client engagements, and then only with data from which direct identifiers have been removed before it leaves the client's system: no names, no health information, no financial identifiers. That is a design, not a promise of good behavior, and it is described in how we protect information.
Information processed in another country may be accessible to the courts, law enforcement and national security authorities of that country, under its own laws.
Sending information somewhere else does not hand off the responsibility for it. Before personal information reaches a provider or a member of our team outside your country, we require in writing the same standard of protection we apply ourselves, and we stay answerable to you for what happens to it. If it is mishandled there, that is ours to answer for, not yours to chase.
Where information moves from the United Kingdom or the European Economic Area to our providers, we rely on the data protection terms those providers publish and which apply to our account, including the European Commission's Standard Contractual Clauses and, for UK data, the UK Addendum. Some of our providers are also certified under the EU-US Data Privacy Framework and its UK extension. We are not certified under that framework ourselves, and we do not rely on it. Ask at compliance@pptcgroup.com and we will tell you which safeguard applies to a given provider and how to get a copy.
For Quebec residents: your information may be communicated outside Quebec, as described above. Before we do that we assess the arrangement and rely on a written agreement with the provider.
How long we keep it
| What | How long |
|---|---|
| Message form enquiries and the email thread that follows | 24 months from our last contact with you, then deleted |
| Booking records in our calendar | 24 months from the meeting, then deleted |
| The record that you ticked the box, and its wording | 24 months, so we can show what you were told |
| Server logs | Held by Cloudflare under its own retention policy. We do not export or keep our own copy |
| Analytics | Aggregate counts only. There is no record of you to keep |
| Advertising tags | Held by Meta and Pinterest under their own policies. We keep no copy |
| Client working data, once you are a client | Only as long as the deliverable needs it, then purged on a schedule. We keep no archive of customer level records |
We keep what we hold accurate and up to date as far as the purpose needs, and you can correct it at any time. If the law requires us to keep something longer, for example a tax record, we keep that and nothing more.
How we protect it
Everything on this site is served over an encrypted connection. Access to the inbox and the calendar is limited to the people who need it, protected by multifactor authentication, and removed when someone no longer needs it. Credentials live in a vault, never in a browser. We choose providers that publish their security terms, and we do not take data we do not need. No website or company can promise perfect security, and we do not. How we protect information sets out the detail, including the design that keeps protected data out of our hands in client work.
If something goes wrong. If personal information is lost or exposed and there is a real risk of harm to you, we will tell you and the relevant authority without undue delay. In the UK and the EU that means the supervisory authority within 72 hours where the rules require it. In Canada that means the Office of the Privacy Commissioner, and in Quebec the Commission d'accès à l'information. In Texas it means notice without unreasonable delay and within 60 days. We keep a record of every incident, whether or not it was reportable, for at least five years, and we will give a regulator that record on request.
Automated decisions
We do not make automated decisions about you. No computer program on this site makes, or substantially helps make, any decision that affects your rights or your interests. There is no profiling and no scoring. We use automation in our client work, but it acts on business data under human direction, not on decisions about individuals. If that ever changes we will say so here before it starts.
If you become a client
This page is about the website. Client work is governed by the engagement agreement, and the short version of how we handle data there is that we do not take protected data at all. Our work needs accounting and operational data, not health records or personal identifiers, so restricted fields are left behind before anything leaves your system rather than stripped out afterwards.
In practice: an agreed field list rather than a full extract, sanitized files only in any cloud we run, no protected data in any AI tool we use, working data kept only as long as the deliverable needs it, and no archive of customer level records. Nothing is extracted until a named contact on your side approves the exclusion schedule in writing.
If you are a healthcare provider, an insurer or another covered entity, we will sign a business associate agreement before any work begins, and the design above is what makes it a formality rather than a leap of faith. We hold no HIPAA certification, because no such thing exists. Ask at compliance@pptcgroup.com for the full data handling protocol.
Your rights, wherever you are
Wherever you live, you can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it. Write to compliance@pptcgroup.com. We will ask you for enough information to be sure it is really you, and no more than that. There is no charge, and we will not treat you differently for asking.
We answer within 30 days, and within 45 days where a US state law sets that period. If a request is complicated we may take longer, and we will tell you why before the first deadline passes. If we refuse, you can appeal by replying to our decision, and we will give you a written answer with the reasons and tell you how to complain to a regulator.
United Kingdom and European Economic Area
You can ask for access, correction, deletion, restriction, or a portable copy, and you can object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time, and that does not affect anything done before you did. You can complain to your own national supervisory authority, or in the UK to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk. We would rather you gave us the chance to fix it first.
California
You can ask what we collect and why, ask for a copy, ask us to correct or delete it, and you will not be treated differently for exercising those rights. We do not sell personal information. With your consent, we share it with Meta and Pinterest for cross-context behavioral advertising. To opt out, use the advertising switch, which the "Do not sell or share my personal information" link at the foot of every page opens, or turn on Global Privacy Control in your browser, which we honor automatically. We do not use sensitive personal information to infer characteristics about you. You can use an authorized agent, and you can complain to the California Privacy Protection Agency or the Attorney General.
Other US states
Texas, Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island give their residents similar rights: know, access, correct, delete, a portable copy, and to opt out of targeted advertising, sale, and profiling with legal effects. We do not sell personal information or profile anyone with legal effect. The advertising tags are targeted advertising, and they only run if you allow them; the advertising switch above, or a Global Privacy Control signal, opts you out. Use the same address, and the appeal route above applies.
Canada
You can ask for access to your information and challenge its accuracy, and you can withdraw consent, subject to legal and contractual limits, with reasonable notice. If you are not satisfied with our answer you can complain to the Office of the Privacy Commissioner of Canada, priv.gc.ca, 1-800-282-1376. In Quebec you may also complain to the Commission d'accès à l'information, cai.gouv.qc.ca, and you may ask for the information you gave us in a structured, commonly used technological format. That right covers what you gave us, not conclusions we drew.
Alberta and British Columbia have their own private sector privacy laws and their own commissioners, and you can take a complaint to yours instead: oipc.ab.ca in Alberta, oipc.bc.ca in British Columbia. The rights above apply the same way whichever of them covers you.
Australia
We are a United States company, and this page is written to meet Australian Privacy Principle 1.4. We hold ourselves to the Australian Privacy Principles as our standard, whatever our size and wherever we sit, because a weaker standard for one country is not a standard.
You can ask for access and correction. If we decline, we will tell you why in writing and how to complain. You can complain to us first at compliance@pptcgroup.com, and then to the Office of the Australian Information Commissioner, oaic.gov.au. You can deal with us anonymously or under a pseudonym where it is lawful and practical, though we cannot answer an enquiry without a way to reach you.
Complaints
Tell us first: compliance@pptcgroup.com, with "Privacy complaint" in the subject line so it is not read as an enquiry.
What then happens: we acknowledge within five business days and tell you who is looking at it. The Compliance Lead investigates, and anyone whose work is being questioned does not review their own decision. You get a written answer within 30 days, with the reasons, and if we need longer we tell you why before that runs out. Where a complaint is justified we change what we do, and we say what we changed. Complaining costs nothing and we do not ask for more personal information than the complaint needs.
If you are still unhappy, the regulators listed above are your next step, and nothing here takes away your right to go to them directly instead of to us.
Children
This site and our services are meant for businesses, not children. We do not knowingly collect information from anyone under 16, and we have no reason to think children use this site. If you believe a child has sent us something, write to us and we will delete it.
Changes to this policy
We update this page when the site or our providers change. The effective date and the last updated date are at the foot of the page, and anything significant is described there rather than slipped in quietly. If you want to see what a previous version said, ask us and we will send it. Our terms of use cover the rest of your use of this site; where the two touch on personal information, this policy governs.
Effective 12 October 2026. Last updated 12 October 2026. Privacy requests: compliance@pptcgroup.com. PPTC Group LLC, 4352 S Capistrano Dr, Dallas, TX 75287, USA.