BPF Enterprise LLC ("BPF Enterprise," "we," "us," or "our") is a management services company headquartered at 10700 N 85TH AVE, PEORIA, Arizona 85345, United States. We provide administrative, business, executive, medical office, hospitality, industrial, and facilities management services, including contract-based operation of regulated facilities. Because our work spans environments that handle sensitive personal, operational, and regulated data, we approach privacy as a core operational discipline rather than a compliance afterthought.
This Privacy Policy describes how we collect, use, retain, safeguard, and disclose information in the course of operating our website at https://www.bpfenterpr.shop (the "Site") and delivering our management services (the "Services"). It applies to prospective clients, current clients, their personnel, visitors to our Site, and any individual whose information we process in the course of an engagement.
This policy is intended to be read together with any client-specific data processing agreement, business associate agreement, or facility operating contract that governs a particular engagement. Where a contract contains terms more specific than this policy, the contract controls for that engagement. This policy does not override contractual confidentiality obligations or regulatory requirements that apply to a specific sector.
We organize the information we handle into the following categories. Not every category is present in every engagement; the categories present depend on the Services being delivered and the sector involved.
Names, job titles, business addresses, business email addresses, telephone numbers, and similar identifiers provided by prospective and current clients, their staff, and individuals contacting us through the Site or by phone.
Records, schedules, correspondence, vendor information, workflow documentation, operational reports, and similar materials generated or handled in the course of managing a client function. This category is often governed by the client's own policies and applicable sector regulation.
Where we manage offices of dentists, physicians, surgeons, or other professionals, we may encounter protected health information as defined under U.S. health privacy law. Section 6 of this policy addresses how we approach such information.
Information related to the operation of facilities, including access control records, incident reports, maintenance logs, and — in regulated environments such as correctional facilities — records governed by contract terms and applicable law. Section 7 addresses this category.
Information collected automatically when you visit the Site, such as IP address, browser type, device characteristics, pages viewed, and referring URLs. Section 15 describes the technologies involved.
Records of correspondence, discovery calls, and inquiries, retained to respond to requests and maintain a record of our interactions with prospective and current clients.
We collect information through several channels, each with a clear purpose:
We do not purchase personal information from data brokers, and we do not collect information from publicly available sources for the purpose of building profiles about individuals.
We use the information we handle for the following purposes:
We process information for these purposes only where we have a lawful basis to do so, as described in Section 5.
Where applicable data protection law requires a legal basis for processing, we rely on the following bases as appropriate to the context:
For individuals subject to the EU/UK General Data Protection Regulation, we will document the specific basis relied upon for each processing activity where required. If you have questions about the basis for a particular processing activity, contact us using the details in Section 18.
When BPF Enterprise LLC manages offices of dentists, physicians, surgeons, or other professionals, the client practice typically remains the covered entity responsible for protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations. Our role is generally that of a business associate or management services provider acting on the practice's behalf under a written agreement.
Where we act as a business associate, we enter into a business associate agreement (BAA) that defines the permitted uses and disclosures of PHI, the safeguards we maintain, and the obligations that apply upon termination of the engagement. We do not use or disclose PHI for any purpose other than as permitted or required by the BAA and HIPAA.
We maintain administrative, physical, and technical safeguards appropriate to the sensitivity of PHI, including access controls, workforce training, and documented procedures for handling, storing, and transmitting health-related information. We do not de-identify, aggregate, or reuse PHI for our own marketing or analytics purposes. Breach notification obligations are addressed in the BAA and follow applicable HIPAA requirements.
If you are a patient of a practice we support and have questions about your health information, your primary point of contact remains the practice itself, as it is the covered entity responsible for your care and records.
For engagements involving government base facilities, military base support, or contract-based operation of correctional facilities, jails, or prisons, the information we handle is governed by the applicable contract, the client's policies, and the regulatory framework specific to that environment. This may include access control records, incident documentation, personnel rosters, and operational logs.
In these environments, our handling of information is constrained by the contract terms, which frequently impose requirements exceeding general data protection law — including restrictions on storage location, transmission methods, retention periods, and permitted recipients. We adhere to those requirements and do not repurpose regulated operational data for any use outside the scope of the engagement.
Where an engagement involves government-controlled information, we follow the handling, marking, and safeguarding requirements specified by the contracting authority. Questions about information handling in a specific facilities engagement should be directed to the contracting authority's designated point of contact and to us using the details in Section 18.
We do not sell personal information. We share information only in the following circumstances:
Any disclosure is limited to what is necessary for the purpose, and we seek to use the least intrusive means consistent with the obligation.
We engage third-party service providers to support functions such as web hosting, email delivery, document storage, scheduling tools, and certain administrative workflows. These providers process information on our behalf only to deliver the service we have engaged them for, and only under written agreements that require appropriate confidentiality and security measures.
For engagements involving PHI or regulated operational data, we limit the processors involved to those that meet the safeguards required by the applicable agreement (for example, a BAA for PHI) and the regulatory framework. We review processor arrangements periodically and require processors to notify us of security incidents affecting our information in a timely manner.
We do not authorize processors to use personal information for their own purposes, to sell it, or to share it with parties outside the scope of the service they provide to us.
We retain information only as long as necessary to fulfill the purposes described in this policy and to meet legal, regulatory, and contractual obligations. Retention periods vary by category:
When information is no longer needed, we render it unusable through secure deletion or destruction appropriate to the medium and the sensitivity of the information.
We maintain administrative, physical, and technical safeguards designed to protect information against unauthorized access, use, alteration, loss, and disclosure. These measures include:
No system can be guaranteed perfectly secure. In the event of a security incident affecting personal information, we will take steps to contain it, assess the impact, and notify affected individuals and regulators as required by applicable law and contract.
Subject to applicable law and the constraints of any engagement agreement, individuals may have the following rights regarding their personal information:
To exercise any of these rights, contact us using the details in Section 18. We will respond within the timeframe required by applicable law. Note that for information held on behalf of a client under an engagement, certain requests may need to be directed to the client as the controller of that information.
To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), applies to our handling of your personal information, this section provides additional disclosures for California residents.
We collect the categories of personal information described in Section 2 for the business and commercial purposes described in Section 4. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We retain personal information for the periods described in Section 10.
California residents may exercise the rights described in Section 12 by contacting us. We will verify your identity before responding to a request, and we will not discriminate against you for exercising your rights. Authorized agents may submit requests on behalf of a California resident with appropriate authorization.
Our Services are directed to organizations and professionals, not to individuals under the age of 18. We do not knowingly collect personal information from children through the Site. In the course of managing facilities or practices, any incidental handling of information relating to minors is governed by the applicable engagement agreement and sector regulation, not by this general policy.
If you believe we have inadvertently collected information from a child through the Site, please contact us using the details in Section 18 and we will take steps to delete it.
The Site uses minimal web technologies. Our hosting environment records standard server logs (IP address, browser type, pages viewed, and timestamps) for security, availability, and basic analytics. We do not use third-party advertising trackers or cross-site advertising networks on the Site.
We do not set persistent advertising cookies. Any essential technical cookies required for the Site to function are limited to what is necessary for security and availability. You can control cookies through your browser settings; disabling them may affect some functionality of the Site but will not affect your ability to contact us by email or phone.
The Site includes a Google site verification meta tag used solely to confirm domain ownership for search-console purposes. This does not result in the collection of personal information by BPF Enterprise.
BPF Enterprise LLC is based in the United States. Information we handle may be stored and processed in the United States or in other jurisdictions where our service providers operate. Where information is transferred across borders, we rely on appropriate safeguards such as standard contractual clauses, client agreements, or another lawful transfer mechanism where required by applicable law.
For engagements involving regulated operational data, cross-border transfers are subject to the restrictions in the applicable contract, which may prohibit or condition transfers beyond what general law requires.
We may update this Privacy Policy from time to time to reflect changes in our Services, applicable law, or our practices. When we make material changes, we will update the "Last reviewed" date at the top of this page and, where appropriate, provide a more prominent notice. We encourage you to review this policy periodically.
Changes that affect ongoing engagements are also addressed through the relevant client agreement, which controls over this policy for the specific engagement.
If you have questions about this Privacy Policy, wish to exercise any rights described above, or need to report a privacy concern, you can contact us as follows:
BPF Enterprise LLC
10700 N 85TH AVE
PEORIA, AZ 85345
United States
Email: support@bpfenterpr.shop
Phone: +1 985 585 1671
For engagement-specific privacy questions, please reference the engagement or client name in your communication so we can route it appropriately. We will acknowledge your request within a reasonable timeframe and respond substantively within the period required by applicable law.