Privacy Policy — Williams InfoSec LLC

1) Who we are

Williams InfoSec LLC provides information security and cloud/security consulting services. We may work with clients in regulated or sensitive industries (including healthcare SaaS) and data-driven businesses (including analytics companies). In many engagements, we process information on behalf of our clients as a service provider.

2) Scope

This policy applies to:

• Our websites and web properties that link to this Privacy Policy (“Site”).
• Our business communications (email, phone, chat, forms) and marketing.
• Our consulting services and professional engagements (“Services”), including assessments, advisory, security program work, and implementation support.

This policy does not cover the privacy practices of our clients, or third-party sites/services linked from our Site.

3) Definitions

• Personal Information: Information that identifies, relates to, describes, or could reasonably be linked to an individual (directly or indirectly).
• Sensitive Personal Information: Categories that may require additional protections under applicable law (varies by jurisdiction).
• Client Data: Information provided by a client or processed on a client’s behalf during an engagement.

4) Information we collect

A) Information you provide to us

We may collect Personal Information you provide, such as:

• Contact details (name, email, phone, company, job title).
• Messages and inquiry content (e.g., details you include in a contact form or email).
• Contracting and billing information (business address, invoicing details). We do not intentionally collect full payment card numbers; payments are typically handled through third-party processors.
• Event, meeting, and scheduling details (meeting requests, availability, participant information).

B) Information we collect automatically (Site)

When you visit our Site, we may collect:

• Device and browser information (IP address, user agent, approximate location derived from IP).
• Site usage data (pages viewed, referring/exit pages, timestamps, interactions).
• Cookies or similar technologies (see “Cookies” below).

C) Information from third parties

We may receive Personal Information from:

• Referral partners or professional networks (to the extent they share business contact information).
• Service providers (e.g., scheduling, email, CRM) as permitted by their settings and your choices.
• Public sources (e.g., company websites, professional profiles) for business-to-business outreach.

D) Client Data and regulated data (including healthcare)

In the course of providing Services, we may access or process Client Data, which can include:

• Security logs, asset inventories, system configurations, and tickets.
• End-user identifiers (user IDs, email addresses) and administrative metadata.
• In some healthcare-related engagements, Client Data may include data regulated under laws such as HIPAA. When applicable, we handle such data per contract terms and required safeguards. We generally act as a service provider / processor with respect to Client Data.

5) How we use information

We use Personal Information to:

• Provide, operate, and improve our Site and Services.
• Respond to requests, inquiries, and proposals.
• Deliver consulting services, including assessments, documentation, implementation guidance, and support.
• Communicate about projects, updates, invoices, and administrative matters.
• Maintain security, prevent fraud, and protect our rights and the rights of others.
• Comply with legal obligations (tax, accounting, regulatory requirements).

We do not sell Personal Information.

6) Legal bases for processing (where applicable)

Where laws such as the GDPR apply, we process Personal Information under one or more of:

• Contract: to perform a contract or take steps at your request.
• Legitimate interests: to operate our business (e.g., securing systems, preventing fraud, improving services), balanced against your rights.
• Consent: where required (e.g., some marketing communications or non-essential cookies).
• Legal obligation: to comply with applicable law.

7) How we share information

We may share Personal Information with:

• Service providers that help us operate (e.g., hosting, analytics, email, calendar/scheduling, document management, invoicing). They are authorized to use Personal Information only as needed to provide services to us and are expected to protect it.
• Professional advisors (lawyers, accountants, auditors) as needed.
• Clients as part of delivering Services, including returning deliverables that may contain contact info or other Personal Information.
• Legal and safety: if required by law, subpoena, or to protect rights, safety, and security.

We do not share Personal Information for third-party direct marketing purposes without consent where required by law.

8) Cookies and analytics

Our Site may use cookies or similar technologies to:

• Remember preferences and improve performance.
• Measure traffic and usage patterns.

You can control cookies through your browser settings. Blocking cookies may affect Site functionality.

If we use third-party analytics tools, they may collect information such as IP address, device identifiers, and browsing events subject to their policies.

9) Data retention

We retain Personal Information only as long as reasonably necessary for:

• The purposes described in this policy.
• Our contractual, legal, and accounting obligations.
• Establishing, exercising, or defending legal claims.

For Client Data, retention is governed by client contracts and instructions. We may retain limited records (e.g., communications, invoices, and deliverables) for business and compliance needs.

10) Security

We implement administrative, technical, and physical safeguards appropriate to the nature of the information and the risks involved, such as:

• Access controls and least privilege.
• Encryption in transit where supported.
• Secure storage and backup practices.
• Vendor and tool selection aligned to security needs.

No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

11) Confidentiality and consulting engagements

Many engagements include confidentiality obligations. We treat Client Data and engagement materials as confidential per contract terms. We may also sign NDAs and, where applicable, Business Associate Agreements (BAAs) for healthcare-related clients.

12) International data transfers

We may process and store information in the United States and other jurisdictions where we or our service providers operate. Where required by law, we use appropriate safeguards for cross-border transfers.

13) Your choices and rights

Depending on where you live, you may have rights such as:

• Accessing, correcting, or deleting certain Personal Information.
• Objecting to or restricting certain processing.
• Withdrawing consent (where processing is based on consent).
• Opting out of marketing communications (unsubscribe links or contact us).
• Appealing a decision regarding a privacy request (where applicable).

To exercise rights, contact us using the information below. We may need to verify your identity and request details to process your request.

California notice (CPRA/CCPA) — if applicable

If California privacy law applies, you may have the right to know, delete, and correct Personal Information, and to opt out of “sale” or “sharing” (as defined by law). We do not sell Personal Information. If we use advertising cookies that constitute “sharing,” we will provide appropriate choices where required.

14) Children’s privacy

Our Site and Services are not directed to children under 13 (or under 16 where applicable). We do not knowingly collect Personal Information from children.

15) Third-party links

Our Site may contain links to third-party sites. Their privacy practices are governed by their own policies.

16) Changes to this Privacy Policy

We may update this policy from time to time. We will revise the “Effective date” above and post the updated policy on this page.

17) Contact us

For privacy questions or requests, contact:

Williams InfoSec LLC