Privacy Policy

We process personal data only where there is a lawful basis for doing so. Depending on the circumstances, processing may be based on:

• performance of a contract or steps taken at your request prior to entering into a contract;
• our legitimate interests in operating and securing the website, responding to professional inquiries and managing business communications;
• compliance with legal obligations; or
• your consent, particularly where non-essential cookies, analytics, embedded media or similar third-party technologies are used.

Where processing is based on consent, you may withdraw that consent at any time with effect for the future.

03 Website Hosting

Our website is hosted using services provided by Hostinger. Hostinger may process technical and operational information required to provide, maintain and secure the website. Depending on the technical configuration, this may include IP address, access date and time, requested URL, browser and device information, operating system, referrer information, HTTP status data and security logs.

Where the GDPR applies, processing necessary for reliable website operation, troubleshooting, abuse prevention and information security may be based on our legitimate interests under Article 6(1)(f) GDPR.

Further information: Hostinger Data Processing Addendum and Hostinger Privacy Policy.

04 Server Log Files

The hosting infrastructure may automatically generate server log files when the website is accessed. These logs may be used for:

• maintaining website functionality and performance;
• detecting and resolving technical faults;
• maintaining network and information security;
• preventing abuse or unauthorized access; and
• investigating security incidents.

We do not use ordinary server logs to create individual marketing profiles unless explicitly stated elsewhere in this Privacy Policy. Log data is retained only for as long as reasonably necessary for operational, security and legal purposes, subject to the hosting configuration and applicable legal requirements.

05 Contact Form

You may contact Smart Fusion International LLC using the contact form on this website. Depending on the form configuration, we may process:

• your name;
• company name;
• email address;
• topic of inquiry;
• target market;
• message content; and
• any additional information you voluntarily provide.

We process this information to review and respond to your request, communicate with you and, where applicable, prepare or perform a business relationship. Where an inquiry relates to a potential or existing contract, processing may be based on Article 6(1)(b) GDPR. For general professional inquiries, processing may also be based on our legitimate interest in responding to business communications under Article 6(1)(f) GDPR.

Spam protection

The contact form currently uses a honeypot / spam-trap mechanism to identify automated submissions. This mechanism does not require Google reCAPTCHA.

Form submissions

The website is currently configured so that form submissions are transmitted by email rather than intentionally retained as a separate Elementor submissions database. Technical processing by the website and hosting infrastructure may nevertheless occur as necessary to transmit and secure the request.

06 Email Communication

Email communication associated with the website is handled through info@substance-compliance.com using Hostinger email services. Incoming messages may additionally be forwarded to smartfusion.international@protonmail.com for internal communication and business administration.

Accordingly, information contained in an inquiry may be processed through both Hostinger’s email infrastructure and Proton Mail.

07 Proton Mail

We use Proton Mail, operated by Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland, for internal email communication and the handling of forwarded inquiries.

Further information: Proton Privacy Policy and Proton Data Processing Agreement.

Proton’s current Data Processing Agreement describes Proton AG as a processor where a company or organization uses Proton services to process personal data subject to applicable data-protection law.

08 Storage and Retention of Communications

We retain business inquiries and correspondence only for as long as reasonably necessary for the purposes for which they were collected. The relevant period may depend on whether a business relationship develops, contractual obligations, limitation periods, accounting or tax requirements, regulatory obligations and the need to establish, exercise or defend legal claims.

Unsuccessful, obsolete or irrelevant inquiries may be deleted earlier where there is no legitimate reason to retain them.

09 Cookies and Similar Technologies

This website may use cookies and similar technologies. Cookies are small data files stored on, or accessed from, a visitor’s device. They may be used for essential website functionality, security, preferences, analytics, embedded media and, where enabled, marketing or measurement.

Technologies that are strictly necessary for providing the website may be used without optional consent where permitted by applicable law. Non-essential technologies that require consent will be activated only after the required consent has been obtained through our consent-management solution.

Cookie inventory pending The final cookie table (provider, purpose, category and lifetime) will be added after the website’s final cookie scan and consent-tool configuration.

10 Consent Management

We intend to use a consent-management solution to manage technologies that require visitor consent. The consent system may record information such as consent status, selected categories, date and time of consent, technical consent identifiers, and subsequent withdrawal or modification of consent. Such information may be processed where necessary to demonstrate compliance with applicable privacy and electronic-communications requirements.

11 Google Analytics – Planned Use

This section applies once Google Analytics is activated on the website. We intend to use Google Analytics to understand how visitors interact with the website and to improve content, usability and performance. Depending on configuration, Google Analytics may process website interactions, pages visited, approximate geographic information, device and browser information, referral data, session information and pseudonymous identifiers.

Where consent is required, Google Analytics will be activated only after consent has been obtained and will be integrated with the website’s consent-management configuration.

Further information: Google Privacy Policy.

12 Google Maps – Planned Use

This section applies once Google Maps is embedded or otherwise integrated into the website. Google Maps may be used to display locations or geographic information. When map content is loaded, technical information such as IP address, device information and interaction data may be transmitted to Google. Where prior consent is required, map content will remain blocked until consent has been provided.

13 YouTube – Planned Use

This section applies once YouTube videos are embedded on the website. We may embed YouTube content, a service provided by Google. When embedded video content is activated, technical information about the visitor may be transmitted to Google/YouTube. Where legally required, embedded video content will not be loaded until the visitor has provided the necessary consent. Where appropriate, privacy-enhanced embedding options may be used.

14 LinkedIn

We may provide links to our LinkedIn profiles or content. Where LinkedIn is used only through a normal external link, data is generally transmitted to LinkedIn after you actively follow the link and leave our website.

We may later use LinkedIn plugins, tags, insight technologies or similar functionality. Where such technologies require consent, they will only be activated after the required consent has been obtained.

Further information: LinkedIn Privacy Policy.

15 Facebook / Meta

We may provide links to pages or profiles operated through Facebook or other Meta services. When you follow an external social-media link, you leave our website and the privacy practices of the relevant platform apply.

We may later use functionality such as embedded social content, Meta Pixel, conversion tracking or advertising measurement. Where such technologies store or access information on a visitor’s device or otherwise require consent, they will be activated only after the necessary consent has been provided.

Further information: Meta Privacy Policy.

16 WhatsApp

We may provide a link or button allowing visitors to contact Smart Fusion International LLC via WhatsApp. When you click such a link, you leave our website and establish a connection with WhatsApp or the relevant WhatsApp application. Subsequent processing within WhatsApp is governed by the applicable WhatsApp and Meta privacy terms.

Use of WhatsApp is voluntary. You may alternatively contact us at info@substance-compliance.com. If WhatsApp Business or additional website integrations are introduced, this Privacy Policy will be updated as necessary.

Further information: WhatsApp Privacy Policy.

17 External Links

Our website may contain links to third-party websites and services. A simple external link does not mean that we control the privacy practices of the linked provider. Once you leave our website, the privacy policies and terms of the third-party service apply.

18 International Data Transfers

Smart Fusion International LLC is established in the United States. Communications with us may therefore involve processing or access to personal data from outside the European Economic Area (EEA). Certain service providers used by us may also operate internationally.

Where the GDPR applies and personal data is transferred from the EEA to a third country, we rely on an appropriate transfer mechanism where required, such as an adequacy decision, applicable Standard Contractual Clauses, the EU-U.S. Data Privacy Framework for participating organizations, or another transfer mechanism permitted under Chapter V GDPR.

19 Social Media Presence

Smart Fusion International LLC may maintain business profiles on third-party platforms including LinkedIn, Facebook, WhatsApp, YouTube and other professional or social networks. When you interact directly with us through these platforms, Smart Fusion International LLC and the respective platform may each process information associated with your interaction according to their respective roles and privacy policies.

20 Security and Confidential Client Information

We implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful loss, alteration, unauthorized disclosure, access, destruction or misuse.

Given the sensitive nature of regulatory and compliance work, client engagements may involve confidential, proprietary or commercially sensitive information. Smart Fusion International LLC therefore applies appropriate confidentiality and security measures, including, where appropriate, confidentiality agreements, restricted access, secure communication channels and secure document transfer methods.

The specific safeguards applied may depend on the nature, sensitivity and scope of the information involved. However, no method of transmission over the internet or electronic storage can guarantee absolute security.

21 Your Data Protection Rights

Where the GDPR applies, you may have the right to:

• request access to personal data we process concerning you;
• request rectification of inaccurate or incomplete personal data;
• request erasure where the applicable legal requirements are met;
• request restriction of processing in certain circumstances;
• receive certain personal data in a structured, commonly used and machine-readable format where legally applicable;
• object to processing based on legitimate interests in circumstances provided by law; and
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, please contact info@substance-compliance.com. We may request reasonable information to verify your identity before responding.

22 Right to Lodge a Complaint

Where the GDPR applies, you have the right to lodge a complaint with a competent data-protection supervisory authority. You may generally contact the authority in the EU/EEA country where you normally reside, work, or believe an infringement has occurred.

Where an EU representative is appointed under Article 27 GDPR, the representative’s contact details will also be made available as an additional point of contact.

23 No Automated Decision-Making

We currently do not use this website to make decisions about individuals based solely on automated processing that produce legal effects or similarly significant effects. If this changes, this Privacy Policy will be updated accordingly.

24 Children

This website and our consulting services are directed to businesses and professionals and are not intended for children. We do not knowingly use the website to solicit personal information from children.

25 Changes to This Privacy Policy

We may update this Privacy Policy where our website functionality changes, new service providers are introduced, legal requirements change, or new processing activities are implemented. The current version will be made available on this website and will indicate the date of the latest update.

 

Contact

Smart Fusion International LLC
info@substance-compliance.com
substance-compliance.com