Privacy Policy

1. Overview

Compliance Consortium LLC ("Compliance Consortium," "we," "us," or "our") operates thecomplianceconsortium.com and develops two software products: UtilityComply, for electric utilities, and AccredGuard, for human services organizations.

This Privacy Policy explains what we collect through this website, how we use it, and the choices available to you. It serves as our notice at collection under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). It applies to this site only. Data you enter inside UtilityComply or AccredGuard is governed by the agreement covering that product, as described in section 11.

2. Notice at collection

At or before the point of collection, we tell you the categories of personal information we collect, the purposes for which we use it, whether we sell or share it, and how long we keep it. This section is that notice.

• Identifiers and contact details — name, email address, organization, and product interest, collected when you submit a form or email us.
• Commercial information — the content of your inquiry and the product you are asking about, collected when you contact us.
• Internet and network activity — pages viewed, referring URL, browser type, and device type, generated automatically by your visit.
• Approximate location — derived from IP address at the regional level, generated automatically by your visit.
• We use these categories to respond to your inquiry, provide and improve this website and our products, send information you request, and meet our legal obligations.
• We do not sell or share personal information, and we do not use or disclose it for cross-context behavioral advertising. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you. We do not knowingly collect or sell the personal information of consumers under 16 years of age.
• Retention periods are described in section 9.

3. Information we collect

We collect information you provide directly and limited technical information generated by your visit.

• Contact information you submit through our forms — name, email address, organization, product interest, and the content of your message.
• Correspondence you send us by email, including any attachments you choose to include.
• Usage and device data — pages viewed, referring URL, approximate location derived from IP address, browser type, and device type.
• Cookies and similar technologies used to keep the site functioning and to understand aggregate usage patterns.

We do not ask for and do not want sensitive personal information — such as government identifiers, health information, financial account numbers, precise geolocation, or credentials that would permit account access — submitted through this website's forms. If you send it to us anyway, we will use it only to respond to you and will not use it to infer characteristics about you.

4. How we use information

• Respond to your inquiry, schedule an assessment or consultation, and follow up on requests you initiate.
• Provide, operate, maintain, and improve this website and our products.
• Understand which content is useful so we can improve it.
• Send you information you have asked for, and — where permitted — updates about our products. You can opt out of marketing messages at any time.
• Comply with legal obligations, enforce our agreements, and protect the rights, property, and safety of our company, our clients, and others.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects.

5. Cookies and tracking

This site uses cookies and similar technologies that are necessary for it to function, and may use limited analytics to understand aggregate usage patterns. We do not use cookies for cross-context behavioral advertising, and we do not allow third parties to use cookies on this site to build advertising profiles of you.

Most browsers let you block or delete cookies. Blocking cookies may affect how parts of this site function.

6. Sharing

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We share information only with service providers who process it on our behalf under contract — for example, hosting, email delivery, and analytics providers — and only to the extent needed to perform those services. We may also disclose information where required by law, in response to valid legal process, or as part of a merger, acquisition, or sale of assets, in which case we will notify you as required by law.

7. Your California privacy rights

If you are a California resident, you have the following rights over the personal information we hold about you. These rights are not absolute — some are subject to exceptions, and we may need to verify your identity before acting on a request.

• Right to know and access — the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to delete — request deletion of personal information we collected from you, subject to legal retention obligations.
• Right to correct — request correction of inaccurate personal information we hold about you.
• Right to opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of, but the mechanism is available to you as described in section 8.
• Right to limit use of sensitive personal information — you may direct us to limit our use of sensitive personal information to what is necessary to perform the services. We do not collect sensitive personal information through this site.
• Right to non-discrimination — we will not deny you goods or services, charge different prices, or provide a different level of quality because you exercised any of these rights.
• Right to designate an authorized agent — you may use an agent to submit a request on your behalf. We may require written permission signed by you and may still contact you to verify your identity.

To exercise any of these rights, email us at Chris@thecomplianceconsortium.com. We will confirm receipt within 10 business days, respond within 45 calendar days, and tell you if we need an extension. If we deny a request, we will explain why and how you may appeal. You may also contact the California Privacy Protection Agency if you believe your rights have not been honored.

California Civil Code section 1798.83 ("Shine the Light") permits California residents to request information about disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing.

8. Your privacy choices

We do not sell your personal information and we do not share it for cross-context behavioral advertising, so there is no opt-out required for our current practices — and we will not begin selling or sharing it without updating this policy and offering a compliant opt-out first.

This is nevertheless where you exercise your choices. If you want to opt out of any future sale or sharing, request that we stop using your information for marketing, or submit a request under section 7, email Chris@thecomplianceconsortium.com with the subject line "Privacy Request" and tell us which right you are exercising. We honor opt-out preference signals sent by your browser or device, including Global Privacy Control (GPC), to the extent they relate to sale or sharing.

You may also unsubscribe from marketing email using the link in any message we send, or by replying to us directly.

9. Data retention

We retain inquiry and correspondence records for as long as needed to serve the relationship and to meet our legal, accounting, and reporting obligations. Technical and analytics data is retained in aggregate or for a limited period, after which it is deleted or de-identified.

10. Security

We protect information with encryption in transit and at rest, role-based access controls, and least-privilege administration. Our current controls and standards alignment are documented on our Security & Trust Center page.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we work to protect information in proportion to its sensitivity.

11. Data inside UtilityComply and AccredGuard

This policy covers the marketing website. Information you or your organization enters into UtilityComply or AccredGuard — including compliance evidence, obligation records, accreditation documentation, or program data — is governed by the applicable product agreement and, where relevant, by a Business Associate Agreement. Where our customers are the businesses that decide how and why that data is processed, we act as their service provider or business associate and direct privacy requests to them.

AccredGuard's HIPAA posture is aligned, not certified. We do not claim HIPAA certification. Whether a Business Associate Agreement is appropriate is determined case by case, based on the data your organization chooses to place in the platform and how it is configured.

12. Children

This site is intended for business and organizational use. It is not directed to children, and we do not knowingly collect personal information from children.

13. Changes to this policy

We may update this policy as our practices or the law change. When we do, we will revise the "Last updated" date above. If we make a material change — for example, if we begin collecting a new category of personal information or using it for a new purpose — we will post a notice on this page or contact you as required by law before that change takes effect.

14. Contact

Questions about this policy or about privacy at Compliance Consortium LLC can be sent to Chris@thecomplianceconsortium.com, or by mail to Compliance Consortium LLC, Sacramento, California.