Privacy Policy, DevOptiv | IT Services and Consulting Company

DevOptiv Inc. ("DevOptiv," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, store, and protect information when you visit https://devoptiv.com and use our software development, cloud operations, and digital marketing services (collectively, the "Services").

This policy includes our SMS/text messaging practices in compliance with the Telephone Consumer Protection Act (TCPA), RingCentral's SMS/MMS Content Policies, the General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA)/California Privacy Rights Act (CPRA).

1. Who We Are

3. How We Collect Data

4. How We Use Your Data

6. Data Sharing & Subprocessors

6.1 Service Providers

6.2 Data Processing Agreements (GDPR Article 28)

All subprocessors (HubSpot, RingCentral, cloud providers) process data only on our documented instructions under Data Processing Agreements that include:

• Confidentiality obligations for personnel
• Security measures per Article 32
• Subprocessor authorization and notification requirements
• Assistance with data subject rights requests
• Return/deletion of data upon termination
• Audit rights and compliance cooperation

Standard Contractual Clauses (SCCs): We use EU Commission-approved SCCs (2021 versions) for international transfers to the US and Canada.

6.3 No Sale of Personal Information

We do not sell your personal information to third parties as defined under CCPA/CPRA.

We explicitly confirm that mobile opt-in data, including phone numbers collected via SMS consent forms or any other opt-in method, will NEVER be sold, shared, leased, or disclosed to third parties or affiliates for marketing or promotional purposes.

SMS opt-in consent is used solely for delivering messages from DevOptiv Inc. to the individual who has provided consent.

7. Cookies & Tracking

Control: Manage preferences via our cookie banner or browser settings. We honor Do Not Track signals for analytics.

8. Data Retention

Upon expiration, data is securely deleted or irreversibly anonymized.

9. Data Security & Breach Notification

9.1 Security Measures

• Encryption: AES-256 at rest, TLS 1.3 in transit
• Access Controls: Role-based access (RBAC), multi-factor authentication (MFA)
• Monitoring: 24/7 security operations center (SOC), intrusion detection
• Audits: Quarterly vulnerability assessments, annual penetration testing

9.2 Breach Notification

In the event of a personal data breach:

• Supervisory Authorities: Within 72 hours of discovery (GDPR Article 33)
• Affected Individuals: Without undue delay if high risk to rights/freedom
• Clients (B2B): Within 24 hours for breaches affecting client data
• Content: Nature of breach, data categories involved, likely consequences, measures taken, DPO contact

10. Your Privacy Rights

10.1 GDPR Rights (EEA/UK Residents)

• Access, rectify, or erase your personal data
• Restrict or object to processing
• Data portability (machine-readable format)
• Withdraw consent (without affecting prior lawful processing)
• Lodge complaint with supervisory authority (e.g., UK ICO)

10.2 CCPA/CPRA Rights (California Residents)

• Right to Know: Categories and specific pieces of personal information collected
• Right to Delete: Request deletion (subject to service provision/legal obligations)
• Right to Correct: Update inaccurate information
• Right to Opt-Out: Of "sale" or "sharing" (we do not sell data)
• Right to Limit: Use of sensitive personal information
• Right to Non-Discrimination: For exercising privacy rights

Authorized Agents: You may designate an agent to submit requests. We will verify their authority before processing.

Exercising Rights: Contact [email protected] or call +1 (657) 686-6729. We respond within 45 days (extendable with notice).

11. International Data Transfers

Your data may be processed in Canada, the United States, and other jurisdictions. When transferring from the EEA, UK, or Switzerland:

• We use Standard Contractual Clauses (SCCs) (2021 versions)
• HubSpot and AWS participate in the EU-US Data Privacy Framework
• We implement supplementary technical measures (encryption) where required

12. Children's Privacy

We do not knowingly collect data from individuals under 16. If discovered, we will delete such data immediately. Contact [email protected] to report.

13. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for their privacy practices. Please review their policies separately.

14. Policy Updates

We may update this policy to reflect legal, regulatory, or operational changes. Material changes affecting your rights will be notified via:

• Email to registered users (30 days notice)
• Prominent banner on Site (30 days notice)
• SMS notification to opted-in users (for SMS-related changes)

Continued use after changes constitutes acceptance.

15. Contact Us

Appendix A: SMS Campaign Registration (TCR/10DLC)

Required for RingCentral 10DLC Registration: