Privacy Policy

1. Introduction

BPF Enterprise LLC ("BPF Enterprise," "we," "us," or "our") is a computer systems design and integration firm headquartered at 10700 N 85TH AVE, Peoria, Arizona 85345, United States. We provide systems architecture, integration, cloud, data, cybersecurity, and managed IT services to professional, scientific, and technical organizations.

This Privacy Policy describes how we collect, use, share, and protect personal information that we obtain through our website at https://www.bpfenterpr.shop (the "Site"), through our contact channels, and in the course of delivering our services. It applies to prospective clients, current clients, business contacts, website visitors, and any other individual whose personal information we process.

By accessing our Site or engaging with us, you acknowledge that we will process your personal information as described in this Policy. If you do not agree with the practices described here, you should not use our Site or submit information to us.

This Policy is intended to comply with applicable United States privacy laws, the General Data Protection Regulation (GDPR) of the European Union, the United Kingdom GDPR, the California Consumer Privacy Act (CCPA) as amended by the CPRA, and other applicable data protection laws. Where any part of this Policy conflicts with a mandatory legal requirement in your jurisdiction, that legal requirement prevails.

2. Information We Collect

We collect information that is necessary to respond to your inquiries, deliver our services, operate our Site, and comply with our legal obligations. The categories of information we may collect include:

2.1 Information You Provide Directly

• Contact information — your name, email address, phone number, company name, and job title when you submit a contact form, send us an email, or request a consultation.
• Project information — details about your current systems, business requirements, timelines, and goals that you share during discovery workshops or pre-sales discussions.
• Account information — credentials and access details required for us to deliver managed services or integrations on your behalf, stored in accordance with our security practices.
• Communications — the content of emails, messages, and meeting notes exchanged in the course of our relationship.

2.2 Information Collected Automatically

• Technical data — IP address, browser type and version, operating system, device identifiers, and referring page URLs.
• Usage data — pages visited, time spent on pages, click paths, and approximate geographic location derived from your IP address.
• Logs — server logs and application logs generated when you interact with our Site.

2.3 Information Collected from Other Sources

We may receive limited information about you from our partners, referral sources, or publicly available business directories. This is typically limited to professional contact information for business development purposes and is used only where we have a legitimate interest in contacting you about relevant services.

2.4 Sensitive Information

We do not knowingly collect sensitive personal information such as Social Security numbers, health information, biometric data, or information about racial or ethnic origin. If you inadvertently submit such information through our Site or in communications with us, we will delete it unless we are legally required to retain it. Please do not send us sensitive information unless we have explicitly requested it for a defined purpose.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

• Responding to inquiries — to answer questions, provide information about our services, and schedule consultations.
• Delivering services — to scope, design, build, integrate, and operate systems on behalf of our clients, including accessing client environments as authorized.
• Account management — to manage client accounts, maintain engagement records, and coordinate delivery across our team.
• Communications — to send service updates, contractual notices, and other communications relevant to an active engagement.
• Marketing — to share newsletters, case studies, and service announcements, only where you have opted in or where we have a legitimate interest and you have not objected.
• Site operation — to operate, monitor, secure, and improve our Site and the services it provides.
• Security and fraud prevention — to detect, prevent, and respond to security incidents, fraud, or unauthorized access.
• Legal compliance — to comply with applicable laws, regulations, and legal processes, and to protect our rights and the rights of others.

We do not sell your personal information to third parties. We do not use your personal information to make automated decisions that produce legal or similarly significant effects about you.

4. GDPR Legal Basis for Processing

For individuals in the European Economic Area, the United Kingdom, and Switzerland, we rely on the following legal bases under the GDPR when processing your personal information:

• Consent (Article 6(1)(a)) — when you submit a contact form, subscribe to communications, or otherwise explicitly agree to a specific processing activity. You may withdraw consent at any time.
• Contractual necessity (Article 6(1)(b)) — when processing is necessary to take steps before entering into a contract with you, or to perform a contract we have with you.
• Legitimate interests (Article 6(1)(f)) — for business development, Site security, and internal operations, where our interests are not overridden by your rights and freedoms.
• Legal obligation (Article 6(1)(c)) — where processing is necessary to comply with a legal obligation to which we are subject.

Where we rely on legitimate interests, we conduct a balancing test to ensure your reasonable expectations and fundamental rights are respected. You may request a copy of this balancing assessment by contacting us using the details in Section 14.

5. Information Sharing & Disclosure

We share personal information only as described in this Policy or where required by law. The categories of recipients with whom we may share information include:

• Service providers — vendors that host our Site, deliver email, provide analytics, or support our operations, under written agreements that require them to protect personal information consistent with this Policy.
• Cloud and infrastructure providers — where we operate systems on your behalf, your data may be processed by cloud providers such as AWS, Azure, or Google Cloud, subject to the terms of your engagement and the provider's own policies.
• Professional advisors — lawyers, accountants, and auditors who require access to information to provide professional services to us.
• Legal authorities — where disclosure is required by law, court order, or to protect our rights, property, or safety, or that of our clients or the public.
• Business transferees — in connection with a merger, acquisition, asset sale, or reorganization, we may transfer information to the successor entity, subject to confidentiality protections.

We require all service providers to commit to confidentiality and to process personal information only on our instructions and for the purposes we specify. We do not authorize any recipient to use your personal information for their own marketing purposes.

6. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this Policy, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Specific retention periods include:

• Website visitor data — technical and usage data is retained for up to 24 months, after which it is aggregated or deleted.
• Contact and inquiry data — retained for up to 36 months from your last interaction, unless you become a client, in which case it is retained as part of the client record.
• Client engagement records — retained for the duration of the engagement plus the period required by applicable law or the terms of our agreement, typically seven years.
• Marketing data — retained until you opt out or until we have had no meaningful contact with you for 24 months.
• Backup data — may persist in backups for up to 90 days after deletion from production systems, after which it is overwritten.

When retention periods expire, we either delete the information securely or anonymize it so that it can no longer be used to identify you. If you would like more information about retention for a specific category of data, please contact us.

7. Data Security

We take the security of personal information seriously and have implemented technical, organizational, and physical safeguards designed to protect it against unauthorized access, disclosure, alteration, and destruction. These safeguards include:

• Encryption of personal information in transit using TLS and at rest where stored in our systems.
• Role-based access controls and least-privilege principles, with access reviewed on a regular basis.
• Multi-factor authentication for all administrative and remote access to systems that process personal information.
• Network segmentation, firewalls, and intrusion detection across our environments.
• Regular vulnerability scanning and coordinated remediation of identified issues.
• Security awareness training for personnel with access to personal information.
• Incident response procedures designed to detect, contain, and notify affected parties in the event of a breach.

No method of transmission over the internet or electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. In the event of a personal data breach affecting individuals in the EU or UK, we will notify the competent supervisory authority and affected individuals as required by Articles 33 and 34 of the GDPR.

8. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access — to request a copy of the personal information we hold about you.
• Rectification — to request correction of inaccurate or incomplete information.
• Erasure — to request deletion of your personal information, subject to legal retention obligations.
• Restriction — to request that we limit processing of your information in certain circumstances.
• Portability — to receive a machine-readable copy of information you provided to us, where processing is based on consent or contract and is carried out by automated means.
• Objection — to object to processing based on legitimate interests or for direct marketing.
• Withdrawal of consent — to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
• Opt-out of sale or sharing — under the CCPA/CPRA, to opt out of the sale or sharing of personal information. We do not sell personal information.
• Limit use of sensitive personal information — under the CCPA/CPRA, to limit the use of sensitive personal information. We do not use sensitive personal information beyond what is permitted.

To exercise any of these rights, please contact us using the details in Section 14. We will respond within the timeframe required by applicable law, typically within 30 days. We may need to verify your identity before responding to a request and may extend the response period by an additional 60 days where necessary, in which case we will inform you of the extension.

If you are in the EU or UK, you have the right to lodge a complaint with your local supervisory authority. You can find contact details for EU supervisory authorities at the website of the European Data Protection Board, and for the UK at the Information Commissioner's Office.

9. Cookies & Tracking Technologies

Our Site uses cookies and similar tracking technologies to operate, secure, and understand how the Site is used. Cookies are small text files placed on your device when you visit a website. The categories of cookies we use include:

• Essential cookies — necessary for the Site to function correctly, such as remembering your navigation preferences. These cannot be disabled.
• Analytics cookies — help us understand how visitors interact with the Site so we can improve its content and structure.
• Preference cookies — remember choices you make such as language or region to provide a more personalized experience.

You can control cookies through your browser settings. Most browsers allow you to refuse cookies or alert you when cookies are being sent. Please note that some parts of the Site may not function properly if you disable essential cookies. We do not use cookies for cross-site advertising or behavioral profiling.

Where required by law, we will obtain your consent before placing non-essential cookies on your device. You can withdraw cookie consent at any time through your browser settings or by contacting us.

10. International Data Transfers

BPF Enterprise LLC is based in the United States. When we collect personal information from individuals outside the United States, that information may be transferred to and processed in the United States or in other countries where our service providers operate. We take steps to ensure that such transfers comply with applicable data protection laws.

For transfers out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement, or another valid transfer mechanism. Where we rely on Standard Contractual Clauses, we conduct a transfer impact assessment as required and implement supplementary measures where identified risks warrant them.

If you would like a copy of the relevant safeguards, or more information about the legal basis for a particular transfer, please contact us using the details in Section 14.

11. Third-Party Links

Our Site may contain links to third-party websites or services that we do not control. This includes links to cloud provider documentation, partner websites, and professional resources. We are not responsible for the privacy practices or content of these third-party sites.

When you follow a link to a third-party site, you are subject to that site's privacy policy rather than this one. We encourage you to review the privacy policy of any website you visit before providing personal information. We do not knowingly transfer personal information to third-party sites when you click a link from our Site.

If you become aware of a third-party link on our Site that leads to a resource with problematic privacy practices, please let us know so we can review and, where appropriate, remove the link.

12. Children's Privacy

Our Site and services are intended for business use and are not directed at children under the age of 16 (or the minimum age required for parental consent under applicable law). We do not knowingly collect personal information from children.

If you believe that we have inadvertently collected personal information from a child, please contact us immediately using the details in Section 14. We will take prompt steps to delete such information and to prevent further collection, subject to any legal obligation to retain it.

Parents and guardians who believe their child has provided information to us should also be aware that our services are designed for professional organizations and are not suitable for use by minors in any case.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will update the "Last Updated" date at the top of this Policy and, where appropriate, provide a more prominent notice on our Site or notify you directly.

We encourage you to review this Policy periodically to stay informed about how we collect, use, and protect your information. Your continued use of our Site or services after a change to this Policy constitutes your acceptance of the updated terms, to the extent permitted by applicable law.

Where required by law, we will obtain your consent to material changes that affect your rights. For significant changes that affect how we process information you have already provided, we will provide direct notice where we have your contact details.

14. Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or would like more information about how we handle personal information, please contact us using the details below:

• BPF Enterprise LLC
• Address: 10700 N 85TH AVE, Peoria, AZ 85345, United States
• Email: support@bpfenterpr.shop
• Phone: +1 985 585 1671

We are committed to resolving any privacy-related concerns promptly and in good faith. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.