We collect only the personal information we need for the purposes described in this policy.

2.1 Information You Provide

• Contact and business details, such as name, email address, phone number, company, and job title, when you submit a form, request a consultation, subscribe to updates, register for an event, or contact us.
• The content of messages you send us.
• Information you submit through lead forms on LinkedIn or Meta advertisements, which the platform provides to us.

Please do not submit Controlled Unclassified Information (CUI), Federal Contract Information (FCI), or other sensitive or regulated information through Site forms.

2.2 Information Collected Automatically

When you visit the Site, we and our service providers collect information through cookies, pixels, tags, and similar technologies, including:

• IP address and approximate location derived from it (city, region, country).
• Device, browser, and operating system type.
• Referring website, pages viewed, time on page, links clicked, and the date and time of your visit.
• Campaign and advertising information, such as UTM parameters and ad click identifiers (for example, Google, LinkedIn, or Meta click IDs).
• Conversion events, such as form submissions, button clicks, and phone calls placed from the Site.

2.3 Information from Third Parties

We receive information from advertising and social media platforms, such as lead form submissions and reports about how our ads performed. LinkedIn provides us with aggregated, de-identified reports about Site visitors (for example, industry or job function) and does not identify individual visitors to us.

We use personal information to:

• Respond to inquiries, schedule consultations, and provide requested information or services.
• Operate, maintain, and secure the Site.
• Understand how visitors use the Site and improve its content and performance.
• Measure the effectiveness of our advertising and attribute inquiries to the campaigns that generated them.
• Show 38North ads to people who have visited the Site and to relevant professional audiences on advertising platforms (often called “retargeting” or “interest-based advertising”).
• Manage leads and business relationships in our customer relationship management (CRM) systems. When you submit a form, we may connect your prior and future Site activity to your contact record.
• Send marketing communications, which you can opt out of at any time.
• Comply with legal obligations and protect the rights, property, and safety of 38North, our clients, and others.

We use personal information only for the purposes for which it was collected or for compatible purposes, in line with applicable law.

Cookies are small text files stored on your device. Pixels and tags are small pieces of code that send information to us or to a third-party provider when a page loads or an action occurs. We use Google Tag Manager to deploy and manage the tags on the Site.

4.1 Technologies We Use

Third-party providers may use information collected through their tags under their own privacy policies, including to improve their services. Cookie names and lifespans are set by each provider and may change.

4.2 Managing Cookies and Advertising

• Browser settings: You can block or delete cookies in your browser. Some Site features may not work properly if you do.
• Provider tools: Use the opt-out links in the table above.
• Industry opt-outs: You can opt out of interest-based advertising from participating companies at optout.aboutads.info and optout.networkadvertising.org.

Opting out of interest-based advertising does not stop all ads. You may still see 38North ads that are not based on your Site activity.

4.3 Browser Signals

The Site does not currently respond to Global Privacy Control or “Do Not Track” browser signals. To opt out of targeted advertising, use the tools in Section 4.2 or contact us.

We do not sell personal information for money. We share personal information only as described below.

• Service providers: Companies that host and maintain the Site, provide analytics, CRM (such as HubSpot and Salesforce), and email, and our marketing agency, which manages our advertising and marketing platforms on our behalf. Service providers are bound by contract to use the information only to provide services to us and to protect it with appropriate security and confidentiality measures.
• Advertising and analytics platforms: Google, LinkedIn and Meta collect information directly through the tags described in Section 4.
• Legal and safety: When required by law, subpoena, or other legal process, or when needed to protect the rights, property, or safety of 38North, our clients, or others.
• Business transfers: In connection with a merger, acquisition, or sale of assets, subject to this policy.

Some state privacy laws treat allowing advertising partners to collect information through tags for targeted advertising as a “sale,” “sharing,” or “targeted advertising.” See Section 8 for how to opt out.

We use administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of personal information. We limit access to our marketing and CRM platforms to authorized personnel and service providers, require individual accounts and multi-factor authentication where available, and review third-party integrations before they are enabled. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We keep personal information only as long as needed for the purposes in this policy, including maintaining business relationships and meeting legal, regulatory, and contractual obligations. For example:

• Google Analytics event data is retained for 14 months.
• CRM contact records are kept while we have an active or potential business relationship, or until you ask us to delete them.

When information is no longer needed, we securely delete it, anonymize it, or dispose of it under our information security management procedures.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your information.
• Obtain a copy of your information in a portable format.
• Restrict or object to certain processing.
• Opt out of targeted advertising, and of any “sale” or “sharing” of personal information as defined by applicable law.
• Opt out of marketing communications.

How to make a request: Email info@38northsecurity.com with the subject line “Privacy Request.” We may need to verify your identity before acting on a request. An authorized agent may submit a request on your behalf with proof of authorization. If we decline your request, you may appeal by replying to our response, and we will review the decision.

Marketing emails: Use the unsubscribe link in any marketing email, or contact us. We will still send non-marketing messages related to an active business relationship.

We will not discriminate against you for exercising your privacy rights.

Children: The Site is not directed to individuals under 18, and we do not knowingly collect their personal information. If you believe we have collected information from a child, contact us and we will delete it.

If you are in the European Economic Area or the United Kingdom, we process personal information based on: your consent (which you may withdraw at any time); our legitimate interests in operating the Site, marketing our services, and developing business relationships; performance of a contract or steps taken at your request before entering a contract; and compliance with legal obligations. You may also lodge a complaint with your local data protection authority.

We maintain processes to identify and meet our privacy obligations under applicable law and our contracts, and we review our privacy practices periodically. Personal information is managed within our information security management system, which is aligned with ISO/IEC 27001:2022.

The Site is operated in the United States. Information we collect may be transferred to, stored, and processed in the United States or other countries where our service providers operate, which may have different data protection laws than your country.

We may update this policy from time to time. We will post the updated policy on this page with a new Effective Date. If we make material changes, we will provide additional notice where required by law.