1. Introduction

Advantage Partners (“we,” “us,” or “our”) is a cybersecurity and compliance advisory firm committed to helping emerging technology companies achieve and maintain robust security programs. We take privacy seriously — both as a professional commitment and as a reflection of the trust our clients place in us.

This Privacy Policy explains how we collect, use, disclose, and safeguard personal information obtained through our website (advantage-partners.com), our services, and related business interactions. By engaging with our website or services, you acknowledge that you have read and understood this policy.

2. Scope and Applicability

This policy applies to:

• Visitors to our website at advantage-partners.com
• Prospective clients who submit inquiries or request service information
• Individuals who participate in promotions, events, or contests hosted through our website or other channels
• Authorized users who access client portals, accounts, or other authenticated areas of our systems
• Current and former clients receiving our Assurance, Advisory, or Penetration Testing services
• Business contacts, partners, vendors, and other third parties who interact with us

This policy does not apply to information processed solely on behalf of clients in our capacity as a service provider, which is governed by separate engagement agreements and applicable data processing terms.

3. Information We Collect

3.1 Information You Provide Directly

We collect personal information that you voluntarily provide to us, including:

• Contact details: name, email address, phone number, job title, and company name
• Service inquiry information submitted through our website contact form
• Communications you send to us by email, phone, or other channels
• Information provided during client onboarding, engagement scoping, or project delivery
• Professional credentials and background information relevant to partnerships or employment inquiries

3.2 Information Collected Automatically

When you visit our website, we and our service providers may automatically collect certain technical information, including:

• IP address and general geographic location
• Browser type, version, and operating system
• Device data
• Pages visited, time spent on pages, and referring URLs
• Login and usage data
• Date and time of website visits
• Cookies and similar tracking technologies (see Section 7 for more detail)

3.3 Information from Third Parties

We may receive information about you from third parties, such as:

• Business intelligence and professional networking platforms (e.g., LinkedIn)
• Referral partners within the technology and compliance ecosystem
• Publicly available sources relevant to our business development activities

4. How We Use Your Information

We use the personal information we collect for the following purposes:

Service Delivery: To scope, deliver, and manage our core service offerings, including communicating with you throughout the engagement.

Business Development: To respond to inquiries, provide proposals, and communicate about services that may be of interest to you or your organization.

Website Operations: To operate, maintain, and improve our website, analyze usage patterns, and ensure a functional user experience.

Communications: To send service updates, industry insights, news, and other information relevant to our service offerings. You may opt out of marketing communications at any time.

Compliance and Legal Obligations: To comply with applicable laws, regulations, professional standards, and legal process, and to protect our legal rights and interests.

Security and Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, unauthorized access, and other potentially illegal activities.

Relationship Management: To manage partner, vendor, and referral relationships, including fulfilling contractual obligations and maintaining accurate records.

Targeted Advertising: We may process your information to develop and display personalized content and advertising tailored to your interests, location, and more. For more information see our Cookie Notice.

Marketing Effectiveness: We may process your information to better understand how to provide marketing and promotional campaigns that are most relevant to you.

Vital Interests: We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.

Promotions and Prize Drawings: Including contests, sweepstakes, or event-based giveaways (such as tradeshow drawings).

5. Legal Basis for Processing (Where Applicable)

To the extent applicable under privacy laws such as the GDPR or other international frameworks, we process personal information under the following legal bases:

• Contractual necessity — processing required to perform services you have engaged us to provide
• Legitimate interests — processing necessary for our business operations, including business development and service improvement, where not overridden by your rights. For example, we may process your personal information to:
  • Send users information about special offers and discounts on our products and services
  • Develop and display personalized and relevant advertising content for our users
  • Analyze how our Services are used so we can improve them to engage and retain users
  • Support our marketing activities
  • Diagnose problems and/or prevent fraudulent activities
  • Improve user experience
  • Engage prospective clients, operate promotional activities, and fulfill prize distribution
• Consent — where you have provided explicit consent, such as for marketing communications
• Legal obligation — processing required to comply with applicable law or regulatory requirements

6. Disclosure of Personal Information

We do not sell personal information. We may share information with:

Service Providers: Third-party vendors and subprocessors who assist us in delivering our services and operating our business (e.g., cloud hosting providers, CRM platforms, compliance tools, and communication services). These parties are contractually required to maintain appropriate confidentiality and security standards.

Business Partners: We may share your information with our business partners to offer you certain products, services, or promotions.

Professional Advisors: Attorneys, accountants, and other professional advisors bound by duties of confidentiality.

Legal and Regulatory Authorities: When required by applicable law, court order, regulatory request, or to protect the rights and safety of Advantage Partners, our clients, or others.

Business Transfers: In connection with a merger, acquisition, or sale of all or substantially all of our assets, subject to standard confidentiality protections.

7. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance functionality and analyze usage. Types of cookies we use include:

• Strictly necessary cookies — required for basic website functionality
• Analytics cookies — to understand how visitors interact with our website (e.g., Google Analytics)
• Preference cookies — to remember your settings and improve your experience

You may control cookie preferences through your browser settings. Disabling certain cookies may affect website functionality. We do not currently respond to “Do Not Track” browser signals, though we continue to evaluate emerging standards in this area.

8. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, maintain our business records, comply with legal obligations, and resolve disputes. Retention periods vary depending on the nature of the information and applicable requirements:

• Client engagement records are retained in accordance with professional standards and applicable regulatory requirements, typically for a minimum of five (5) to seven (7) years following engagement completion
• Website analytics data is retained per the configuration of our analytics tools, generally not exceeding 26 months
• Marketing contact information is retained until you opt out or request deletion, or until the information becomes outdated

When personal information is no longer required, we take commercially reasonable steps to securely delete or anonymize it.

9. Data Security

As a cybersecurity and compliance firm, we hold ourselves to high standards for information security. We implement administrative, technical, and physical safeguards appropriate to the nature of the information we process, including:

• Encryption in transit and at rest for sensitive information
• Access controls and role-based permissions limiting data access to authorized personnel
• Endpoint security and device management practices
• Regular security assessments and risk evaluations
• Employee training on data handling and security practices

Advantage Partners maintains an information security management program consistent with industry best practices, including alignment with SOC 2 Trust Services Criteria and ISO/IEC 27001. No security measure is foolproof; however, we are committed to continuous improvement of our security posture.

10. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that inaccurate or incomplete information be corrected
• Deletion — request deletion of your personal information, subject to legal and contractual obligations
• Portability — receive your personal information in a structured, machine-readable format
• Restriction — request that we limit how we process your information in certain circumstances
• Objection — object to processing based on legitimate interests, including for direct marketing purposes
• Withdraw Consent — where processing is based on consent, withdraw it at any time without affecting prior processing
• Opt-Out — opt out of the sale or sharing of personal information or its use for targeted advertising, where applicable

To exercise any of these rights, please contact us using the information in Section 14. We will respond to verified requests within the timeframe required by applicable law. We may request information to verify your identity before processing a request.

11. California Residents (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). In addition to the rights described in Section 10, California residents may:

• Request to know the categories and specific pieces of personal information we have collected about you
• Request information about the categories of sources from which personal information is collected and the purposes for which it is used
• Opt out of the “sale” or “sharing” of personal information (we do not sell or share personal information as defined under the CCPA/CPRA)
• Request correction of inaccurate personal information
• Limit the use of sensitive personal information (to the extent we process such information)

We do not discriminate against individuals who exercise their CCPA/CPRA rights. To submit a verifiable consumer request, please contact us as described in Section 14.

12. International Data Transfers

Advantage Partners is based in the United States. If you are located outside the United States, please be aware that personal information we collect may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

For individuals in the European Economic Area (EEA), United Kingdom, or Switzerland, where applicable, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses (SCCs) or other legally recognized safeguards to govern cross-border data transfers.

13. Children’s Privacy

Our website and services are directed to business professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a minor, we will take steps to delete it promptly. If you believe we have inadvertently collected such information, please contact us immediately.

14. Contact Information

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have a concern about how we handle your information, please contact us:

We will endeavor to respond to all inquiries within a reasonable timeframe, and in any case within the period required by applicable law.

15. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, services, or applicable law. When we make material changes, we will update the effective date at the top of this document and, where appropriate, notify you by email or prominent notice on our website.

We encourage you to review this policy regularly to stay informed about how we protect your information. Your continued use of our website or services following any update constitutes acceptance of the revised policy.