Privacy Policy

Effective Date: October 20, 2026

Policy Details

Please review the complete contractual provisions governing data retention, personal identifiable information safeguards, and our global compliance frameworks.

1. Scope and Application

This Privacy Policy articulates how Double Cup Tech collects, uses, and safeguards information obtained through our consulting engagements, digital advisory platforms, and software integrations. By engaging our advisory services or visiting our domain, you consent to the processing practices described herein.

2. Categories of Information Collected

We gather discrete categories of information necessary to scope architectural solutions, maintain contractual integrity, and deliver enterprise-grade advisory outcomes:

  • Identity & Contact Records: Legal names, corporate email addresses, executive designations, phone numbers, and company affiliation.
  • System Architecture Context: High-level infrastructure topologies, tech-stack registries, and project constraints disclosed under mutual NDA.
  • Telemetric Metadata: Internet protocol (IP) addresses, cryptographic session logs, browser characteristics, and page engagement patterns.
  • Commercial Invoicing Data: Payment processing tokens, transactional history, tax registration credentials, and corporate billing headquarters.

3. Data Collection Channels

Data collection occurs primarily through active submission during client onboarding, proposal drafting, and bilateral discovery sessions. Additionally, passive operational logging records connection latency, endpoint security authentications, and platform navigation metrics to guarantee infrastructure resilience.

4. Purpose and Processing Utility

We process collected records exclusively to: execute agreed contractual statements of work; validate cloud engineering benchmarks; comply with statutory auditing standards; safeguard confidential source code; and send mandatory technical notices regarding system changes or security remediation.

5. Legal Grounds for Processing

Under the General Data Protection Regulation (GDPR) and comparable international privacy statutes, our data governance rests upon defined legal bases:

  • Contractual Performance: Processing required to fulfill enterprise service-level agreements and statements of work.
  • Legitimate Interests: Defending proprietary architectures, preventing malicious intrusion, and refining advisory methodologies.
  • Legal Mandates: Retaining transaction records in compliance with tax, financial oversight, and corporate governance laws.
  • Explicit Consent: Opt-in confirmation collected prior to sending non-critical technical whitepapers or industry briefings.

6. Third-Party Sharing and Subprocessors

Double Cup Tech does not sell, lease, or monetize client data. Disclosures are strictly limited to vetted cloud hosting providers (e.g., AWS, GCP), certified payment gateways, external legal counsel, and regulatory bodies where compelled by lawful subpoena or formal judicial process.

7. International Data Transfers

Where data originated in the European Economic Area (EEA), United Kingdom, or Switzerland is transferred cross-border, transfers occur under European Commission Standard Contractual Clauses (SCCs), UK International Data Transfer Agreements, or verified adequacy findings to safeguard cross-jurisdictional privacy rights.

8. Retention Schedules and Archival

Client telemetry and engagement data are preserved solely for the duration of the active advisory agreement and up to seven (7) years post-termination to satisfy statutory tax obligations, defense against legal disputes, and regulatory reporting mandates, after which records are cryptographically wiped.

9. Individual Rights and Exercising Options

Subject to your local jurisdiction (including CCPA/CPRA and GDPR), you hold distinct non-discriminatory rights concerning your personal information:

  • Right to Disclosure & Access: Request itemized catalogs of specific personal categories collected over the prior 12 months.
  • Right to Rectification: Demand swift correction of erroneous, incomplete, or outdated business profiles.
  • Right to Erasure (Right to be Forgotten): Demand total expungement of records where retention exceptions do not apply.
  • Right to Portability: Receive standard, machine-readable exports of data directly supplied to our organization.

10. Cookies and Tracking Mechanisms

Our portal relies solely on strict operational session cookies necessary to maintain cryptographic authentication tokens and load-balancing parameters. We deliberately eschew invasive cross-context behavioral advertising trackers, data broker beacons, and consumer surveillance tags.

11. Security Architecture and Governance

We implement defense-in-depth protocols including TLS 1.3 transport encryption, AES-256 rest encryption, role-based access controls (RBAC), multi-factor hardware security authentication, and routine third-party penetration testing. Personnel access is constrained through strict principle of least privilege (PoLP).

12. Children's Privacy Protections

Our enterprise services and digital interfaces are strictly built for corporate executives and technology professionals aged 18 and older. We do not intentionally solicit, aggregate, or process information from minors. In the event child records are inadvertently gathered, they will be deleted immediately upon notification.

13. Revisions and Governance Inquiries

We reserve the prerogative to revise this policy periodically to accommodate evolving technological practices or regulatory standards. Material updates will be highlighted via notice on our website or direct transmission to designated client compliance officers. To exercise individual rights or resolve governance inquiries, please direct inquiries to [email protected].