Privacy Policy

Gradient Technologies, LLC

Effective Date: 12/01/20219
Last Updated: 02/03/2025

1. Introduction

Gradient Technologies, LLC (“Gradient,” “we,” “us,” or “our”) is committed to protecting the privacy and confidentiality of all information entrusted to us. As a product development and engineering services company headquartered in Alpharetta, Georgia, we understand the critical importance of maintaining the highest standards of data protection and intellectual property security.

This Privacy Policy describes how we collect, use, protect, and handle information in connection with our product development, engineering services, and business operations. This policy applies to all information we collect through our services, website, communications, and business relationships.

Your trust is fundamental to our business. We recognize that our clients share their most valuable intellectual property and sensitive business information with us. This policy demonstrates our commitment to safeguarding that trust through transparent practices and robust security measures.

2. Information We Collect

We collect information in various ways depending on how you interact with our services. The information we collect falls into several categories:

2.1 Client and Project Information

In the course of providing our product development and engineering services, we collect and process various types of information that are essential to delivering high-quality results:

Technical and Intellectual Property Data:

• Product designs, schematics, and technical specifications: This includes all design documents, circuit diagrams, system architectures, component specifications, bill of materials (BOM), assembly drawings, and any proprietary design methodologies or processes that you share with us to enable product development.

   

• Firmware source code, algorithms, and software: We receive and work with proprietary software code, embedded firmware, algorithms, programming logic, software architectures, APIs, libraries, and any custom software solutions developed for your products.

   

• Manufacturing processes and methodologies: This encompasses production workflows, quality control procedures, assembly instructions, testing protocols, supplier specifications, manufacturing tolerances, and any proprietary manufacturing techniques or processes.

   

• Performance data, test results, and quality metrics: We collect and analyze data from product testing, performance benchmarks, stress testing results, environmental testing data, electromagnetic compatibility (EMC) testing, safety certification test results, and quality assurance metrics.

   

• Research and development data: This includes experimental data, research findings, prototype testing results, feasibility studies, market research, competitive analysis, and any proprietary research methodologies or discoveries.

   

• Prototyping and certification information: We handle data related to prototype development, iteration logs, certification requirements, regulatory compliance documentation, standards compliance testing, and certification body communications.

   

Business and Commercial Information:

• Sales data, revenue projections, and market analysis: This includes historical sales figures, revenue forecasts, market size estimates, target market demographics, sales channel information, pricing models, and competitive positioning data that you share to inform product development decisions.

   

• Customer demographics and usage patterns: We may receive information about your end customers, including user behavior data, demographic information, usage statistics, customer feedback, support ticket data, and market segment analysis to help optimize product design and functionality.

   

• Vendor relationships and supply chain data: This encompasses information about your suppliers, manufacturing partners, component vendors, pricing negotiations, supply agreements, vendor performance metrics, and supply chain logistics that impact product development and manufacturing decisions.

   

• Pricing strategies and cost structures: We receive information about product pricing models, cost breakdowns, margin requirements, manufacturing costs, component costs, and pricing strategies to ensure our development work aligns with your business objectives.

   

• Strategic plans and product roadmaps: This includes long-term product development plans, market entry strategies, product lifecycle management, feature prioritization, technology roadmaps, and strategic business decisions that guide our development efforts.

   

Device and Operational Data:

• Telemetry and usage data from products under development: We collect real-time data from prototypes and development units, including sensor readings, system performance metrics, operational parameters, error logs, and usage patterns during testing and development phases.

   

• Performance metrics and system logs: This includes system performance data, error reporting, diagnostic information, operational logs, maintenance records, and performance optimization data collected during development, testing, and deployment phases.

   

• Quality control data and failure analysis: We gather information about product defects, failure modes, root cause analysis, corrective action reports, quality metrics, reliability testing data, and improvement recommendations.

   

• Customer feedback and support information: We may receive end-user feedback, support requests, bug reports, feature requests, user experience data, and customer satisfaction metrics that inform product improvements and future development.

   

2.2 Website and Communication Information

When you visit our website or communicate with us, we collect certain information to facilitate our business relationship:

Contact and Communication Data:

• Contact information: This includes your name, job title, company name, business address, email address, phone number, and other contact details you provide when requesting information about our services or engaging in business communications.

   

• Website usage data and analytics: We collect information about how you interact with our website, including pages visited, time spent on pages, click patterns, referral sources, browser type and version, device type, operating system, IP address, and general geographic location. This helps us improve our website and understand how potential clients find and use our services.

   

• Communication records and correspondence: We maintain records of all business communications, including emails, phone calls, video conferences, text messages, and written correspondence. This includes the content of communications, timestamps, participants, and any attachments or documents shared during these interactions.

   

• Meeting notes and project documentation: We keep detailed records of meetings, project discussions, technical consultations, progress reports, and any documentation created or shared during the course of our business relationship.

   

Marketing and Business Development Information:

• Inquiry and proposal data: When you request information about our services or request a proposal, we collect details about your project requirements, timeline, budget considerations, technical specifications, and business objectives.

   

• Event and networking information: If we meet at trade shows, conferences, or networking events, we may collect business card information, conversation notes, and follow-up preferences.

   

2.3 Employee and Contractor Information

To maintain security and operational effectiveness, we collect information about our team members:

Personnel Data:

• Personal and professional information: This includes employee and contractor names, addresses, contact information, employment history, educational background, professional certifications, security clearance information (where applicable), and emergency contact details.

   

• Access credentials and security information: We maintain records of system access permissions, login credentials, security badges, facility access logs, and any security-related training or certifications required for handling sensitive client information.

   

• Training and certification records: This includes documentation of technical training, security awareness training, professional development, industry certifications, and any specialized training required for working with specific client projects or technologies.

   

• Performance and project assignment data: We track employee and contractor performance metrics, project assignments, skill assessments, and professional development goals to ensure appropriate staffing of client projects.

   

3. How We Use Information

We use the information we collect solely to provide superior service to our clients and maintain effective business operations. Our use of information is governed by strict confidentiality requirements and professional engineering ethics.

3.1 Service Delivery

Primary Service Functions:

• Provide contracted product development and engineering services: We use client information to design, develop, test, and manufacture products according to specifications and requirements. This includes using technical data to create prototypes, develop firmware and software, design circuits and PCBs, conduct engineering analysis, and deliver completed products that meet or exceed client expectations.

   

• Conduct research, development, testing, and certification activities: We utilize collected data to perform feasibility studies, conduct product research, execute testing protocols, analyze performance data, optimize designs, troubleshoot issues, and support regulatory certification processes including FCC, UL, CE marking, and industry-specific certifications.

   

• Communicate with clients regarding project status and deliverables: We use contact information and project data to provide regular updates, share progress reports, discuss technical challenges, coordinate milestone deliveries, and ensure transparent communication throughout the project lifecycle.

   

• Ensure quality control and performance optimization: We analyze performance data, test results, and feedback to continuously improve product quality, optimize performance parameters, identify and resolve issues, and implement best practices across all development activities.

   

• Maintain accurate project records and documentation: We use collected information to create comprehensive project documentation, maintain version control, track design changes, document testing procedures and results, and create deliverable documentation that clients can use for future reference and support.

   

Technical Development Activities:

• Design and engineering analysis: We use technical specifications and requirements to perform circuit analysis, mechanical design, thermal analysis, signal integrity analysis, power consumption optimization, and electromagnetic compatibility design.

   

• Prototyping and iteration: We utilize design data and feedback to create prototypes, conduct design iterations, implement improvements, and refine products based on testing results and client feedback.

   

• Manufacturing support: We use manufacturing data to optimize designs for production, create manufacturing documentation, support supplier selection, conduct design for manufacturing (DFM) analysis, and assist with production scaling and quality control implementation.

   

3.2 Business Operations

Administrative Functions:

• Process payments and maintain financial records: We use billing information and project data to generate invoices, track project costs, manage accounts receivable, process payments, and maintain financial records in accordance with accounting standards and tax requirements.

   

• Comply with legal and regulatory requirements: We use collected information to meet contractual obligations, comply with applicable laws and regulations, support regulatory filings, maintain required documentation, and ensure adherence to professional engineering standards and ethics.

   

• Improve our services and operational efficiency: We analyze project data, client feedback, and operational metrics to identify areas for improvement, optimize our processes, enhance service delivery, invest in new capabilities, and maintain competitive advantage in the market.

   

• Communicate with clients about our services: We use contact information to share updates about our capabilities, inform clients about relevant industry developments, provide technical insights, and maintain ongoing business relationships.

   

Quality Assurance and Risk Management:

• Risk assessment and mitigation: We use project information to identify potential risks, assess technical challenges, implement risk mitigation strategies, and ensure successful project outcomes.

   

• Continuous improvement: We analyze project outcomes, client satisfaction metrics, and operational data to implement process improvements, enhance service quality, and expand our technical capabilities.

   

• Knowledge management: We use project experience and technical data (in anonymized form when appropriate) to build our knowledge base, improve future project execution, and maintain our technical expertise.

   

3.3 Legal and Compliance

Legal Obligations:

• Fulfill contractual obligations and enforce agreements: We use collected information to ensure compliance with service agreements, non-disclosure agreements, intellectual property licenses, and other contractual commitments. This includes monitoring compliance with contract terms, managing deliverables, and addressing any contractual disputes or issues.

   

• Comply with applicable laws, regulations, and industry standards: We use information to ensure compliance with federal, state, and local laws, including export control regulations, environmental regulations, safety standards, and professional engineering codes of conduct. This also includes compliance with industry-specific regulations such as FDA requirements for medical devices or automotive safety standards.

   

• Respond to legal processes and protect our legal rights: In rare circumstances, we may use information to respond to subpoenas, court orders, or other legal processes, or to protect our legal rights in disputes, litigation, or regulatory investigations. Any such use would be limited to what is legally required and would be conducted in consultation with legal counsel.

   

• Maintain records as required by law: We use collected information to maintain business records, financial records, and project documentation as required by applicable laws, regulations, and professional standards. This includes maintaining records for specified retention periods and ensuring proper documentation for audit and compliance purposes.

   

Professional and Ethical Obligations:

• Professional engineering ethics: We use information in accordance with professional engineering codes of ethics, including obligations to protect public safety, maintain client confidentiality, and provide competent professional services.

   

• Intellectual property protection: We use collected information to respect and protect client intellectual property rights, avoid conflicts of interest, and ensure that proprietary information is used only for authorized purposes.

   

4. Information Sharing and Disclosure

Gradient Technologies maintains a strict policy against selling or commercially sharing client information. We recognize that our clients trust us with their most valuable assets, and we take this responsibility seriously.

4.1 No Sale or Commercial Sharing

Absolute Prohibition on Commercial Use:

Gradient Technologies does not, has never, and will never sell, rent, lease, or otherwise commercially share any client information, intellectual property, or data with third parties for commercial purposes. This prohibition includes:

• No data monetization: We do not generate revenue by selling access to client information, even in anonymized or aggregated form.
• No marketing list sales: We do not sell or share client contact information or business details for marketing purposes.
• No competitive intelligence sharing: We do not share client information with competitors or industry analysts for commercial advantage.
• No data brokerage: We do not participate in data brokerage activities or provide client information to data aggregation services.
• No advertising partnerships: We do not share client information with advertising networks or marketing service providers for commercial purposes.

Investment in Privacy Protection:

This commitment means we invest significantly in privacy protection measures because we rely entirely on service fees rather than data monetization for our revenue. Our business model is aligned with protecting client confidentiality rather than exploiting it.

4.2 Limited Disclosure Circumstances

We may disclose information only in the following strictly limited circumstances, and only to the minimum extent necessary:

With Client Consent:

• Explicit written authorization: When you provide specific, written consent for us to share certain information with designated third parties. Such authorization must clearly specify what information may be shared, with whom, for what purpose, and for what time period.

   

• Client-directed business purposes: When you specifically direct us to share information with your partners, suppliers, manufacturers, or other service providers to facilitate your business objectives. We will confirm such directions in writing and ensure appropriate confidentiality protections are in place.

   

• Collaborative projects: When working on projects that involve multiple parties (such as joint ventures or consortium projects), we may share relevant project information among authorized participants, but only with your explicit consent and under comprehensive confidentiality agreements.

   

Legal Requirements:

• Court orders and subpoenas: When required by valid legal process, including court orders, subpoenas, search warrants, or other lawful demands by government authorities. We will notify you of such requests unless prohibited by law, and we will challenge overly broad or inappropriate requests where legally permissible.

   

• Regulatory compliance: When disclosure is required by applicable laws or regulations, such as export control laws, safety regulations, or professional engineering codes of conduct. We limit such disclosures to the minimum required by law and maintain confidentiality to the greatest extent possible.

   

• Legal rights protection: To protect our legal rights, defend against legal claims, prevent fraud, or address other illegal activities. Such disclosure would be limited to information directly relevant to the legal issue and would be conducted in consultation with legal counsel.

   

• Public safety: In rare circumstances where failure to disclose information could result in imminent harm to public safety, we may disclose information necessary to prevent such harm, but only after careful consideration and consultation with legal counsel.

   

Service Providers:

• Authorized subcontractors: To qualified subcontractors or service providers who assist us in delivering services to you, but only when:

   

  • The subcontractor has signed confidentiality agreements with terms at least as restrictive as this privacy policy
  • The disclosure is necessary for the specific services being provided
  • Access is limited to the minimum information required
  • The subcontractor has demonstrated appropriate security measures and practices
  • You have been informed of our intent to use subcontractors (either in our service agreement or separately)
• Specialized service providers: For specific technical services such as specialized testing, certification, manufacturing, or regulatory compliance assistance, where disclosure of relevant technical information is necessary to complete the work. All such providers must meet our strict confidentiality and security requirements.

   

• Professional advisors: To our attorneys, accountants, auditors, insurance providers, and other professional advisors who need access to information to provide services to us, but only under appropriate professional confidentiality obligations.

   

Business Transfers:

• Merger or acquisition scenarios: In connection with a merger, acquisition, bankruptcy, or sale of all or substantially all of our assets, client information may be transferred as part of the business assets. However:

   

  • The acquiring party would be bound by the same confidentiality obligations contained in this privacy policy
  • We would provide notice to clients before such transfer occurs
  • Clients would have the right to request return or destruction of their information rather than transfer
  • Any such transfer would be conducted in a manner that maintains confidentiality throughout the process
• Due diligence protections: During any potential business transfer, we limit information sharing during due diligence processes through appropriate confidentiality agreements and data room restrictions.

   

Emergency Situations:

• Business continuity: In emergency situations that threaten business continuity (such as natural disasters or cyber incidents), we may need to share limited information with emergency service providers, backup facilities, or business continuity partners, but only to the extent necessary to protect and restore client information and services.

5. Data Security and Protection

We implement comprehensive, multi-layered security measures designed to protect all information entrusted to us. Our security approach follows industry best practices and is regularly updated to address evolving threats.

5.1 Security Measures

Technical Safeguards:

• Encryption of data in transit and at rest: We use industry-standard encryption protocols (AES-256 or equivalent) to protect data stored on our systems and advanced encryption (TLS 1.3 or equivalent) for all data transmissions. This includes encrypted backups, encrypted database storage, and encrypted communications channels for all client interactions.

   

• Secure network infrastructure and firewalls: Our network infrastructure includes enterprise-grade firewalls, intrusion detection and prevention systems (IDS/IPS), network segmentation to isolate sensitive systems, virtual private networks (VPNs) for remote access, and continuous network monitoring for suspicious activities.

   

• Access controls and authentication systems: We implement multi-factor authentication (MFA) for all system access, role-based access controls that limit access to information based on job responsibilities, regular access reviews and updates, strong password policies, and automated account lockout procedures for suspicious activities.

   

• Regular security updates and patches: We maintain current security patches on all systems, conduct regular vulnerability assessments and penetration testing, implement automated security monitoring and alerting systems, and maintain an incident response plan for security events.

   

• Secure backup and recovery systems: We maintain encrypted, geographically distributed backups of all client information, conduct regular backup integrity testing, implement disaster recovery procedures with defined recovery time objectives (RTO) and recovery point objectives (RPO), and maintain offline backups to protect against ransomware and other cyber threats.

   

Physical Security:

• Restricted access to facilities and equipment: Our facilities feature keycard access control systems, biometric authentication where appropriate, visitor management and escort procedures, security cameras and monitoring systems, and restricted access zones for sensitive operations and equipment.

   

• Secure storage of physical documents and media: We maintain locked filing cabinets and safes for physical documents, secure disposal procedures for sensitive materials, clean desk policies to prevent unauthorized access to information, and environmental controls to protect documents and equipment from damage.

   

• Environmental controls and monitoring: Our facilities include temperature and humidity controls to protect equipment and media, fire suppression systems designed for electronic equipment, power backup systems (UPS and generators), and environmental monitoring systems with automatic alerts for out-of-range conditions.

   

• Visitor access controls and escort procedures: All visitors must sign in and be escorted by authorized personnel, wear visitor badges at all times, are restricted to approved areas only, and are prohibited from accessing sensitive work areas or information systems.

   

Administrative Controls:

• Employee background checks and security training: All employees and contractors undergo comprehensive background checks appropriate to their access level, receive security awareness training upon hiring and annually thereafter, are required to sign detailed confidentiality and security agreements, and participate in ongoing security education and updates.

   

• Role-based access controls and need-to-know principles: Access to client information is strictly limited to employees and contractors who require such access to perform their assigned duties. We implement the principle of least privilege, ensuring that individuals have access only to the minimum information necessary for their roles.

   

• Regular security audits and assessments: We conduct annual security audits, quarterly access reviews, regular penetration testing by qualified third parties, continuous monitoring of security metrics and indicators, and annual reviews and updates of our security policies and procedures.

   

• Incident response procedures: We maintain a comprehensive incident response plan that includes procedures for detecting, responding to, and recovering from security incidents, notification procedures for clients and authorities when required, forensic investigation capabilities, and post-incident analysis and improvement processes.

   

• Document retention and destruction policies: We maintain clear policies regarding how long different types of information are retained, secure destruction procedures for information that has reached the end of its retention period, documentation of destruction activities, and regular reviews of retention schedules to ensure compliance with legal and contractual requirements.

   

5.2 Confidentiality Agreements

Comprehensive NDA Requirements:

All individuals who may have access to client information are required to sign comprehensive non-disclosure agreements (NDAs) and confidentiality agreements before beginning work. These agreements include:

• Specific confidentiality obligations: Clear definitions of what constitutes confidential information, explicit prohibitions on unauthorized use or disclosure, requirements to protect information with the same degree of care used for the individual’s own confidential information, and acknowledgment of the value and proprietary nature of client information.

   

• Duration and survival clauses: Confidentiality obligations that survive termination of employment or contracts, specific time periods for confidentiality obligations (typically perpetual for trade secrets), return or destruction requirements for confidential materials upon termination, and continuing obligations even after project completion.

   

• Enforcement provisions: Legal remedies available for breach of confidentiality, acknowledgment that monetary damages may be insufficient and that injunctive relief may be appropriate, jurisdiction and governing law provisions, and procedures for resolving disputes related to confidentiality obligations.

   

Third-Party Requirements:

Any third parties who may have access to client information (such as subcontractors, consultants, or service providers) must also execute appropriate confidentiality agreements with terms at least as restrictive as our own obligations to clients.

6. Data Retention and Disposal

We maintain clear policies regarding how long we retain different types of information and how we securely dispose of information when it is no longer needed.

6.1 Retention Periods

We retain information only as long as necessary to fulfill legitimate business purposes:

Project-Related Information:

• Active project duration: During active project phases, we retain all project-related information necessary to complete deliverables, provide support, and ensure quality outcomes.

   

• Post-completion retention: After project completion, we typically retain project information for a period of 3-7 years (depending on the type of project and contractual requirements) to provide ongoing support, address warranty obligations, and maintain business records as required by law.

   

• Long-term archive: Certain types of information may be retained longer for legitimate business purposes such as defending against potential claims, maintaining historical project records for reference, or complying with regulatory requirements specific to certain industries.

   

Contractual and Legal Requirements:

• Contract terms: Retention periods specified in service agreements, NDAs, or other contracts take precedence over general retention policies.

   

• Legal requirements: We comply with applicable laws regarding record retention, including tax regulations (typically 7 years for financial records), employment law requirements, and industry-specific regulations.

   

• Warranty and support obligations: Information necessary to fulfill warranty obligations or provide ongoing support services is retained for the duration of such obligations.

   

Business Records:

• Financial records: Maintained in accordance with accounting standards and tax law requirements, typically 7 years.

   

• Personnel records: Maintained in accordance with employment law requirements, typically 3-7 years after termination depending on the type of record.

   

• Legal and compliance records: Maintained as required by applicable laws and regulations, with some records maintained permanently.

   

6.2 Secure Disposal

When information reaches the end of its retention period or when clients request deletion, we ensure secure disposal through comprehensive procedures:

Electronic Data Disposal:

• Secure deletion standards: We use industry-standard secure deletion methods that meet or exceed DoD 5220.22-M standards, ensuring that deleted data cannot be recovered using standard data recovery tools.

   

• Multiple overwriting passes: For highly sensitive information, we use multiple-pass overwriting procedures that make data recovery virtually impossible even with advanced forensic techniques.

   

• Solid-state drive (SSD) procedures: For SSDs and other flash-based storage, we use manufacturer-recommended secure erase commands and, where necessary, physical destruction of storage media.

   

• Verification procedures: We verify successful deletion through testing and documentation, maintaining certificates of destruction where required.

   

Physical Media Destruction:

• Hard drive destruction: Physical destruction of hard drives using industrial shredding equipment that renders data recovery impossible.

   

• Document destruction: Secure shredding of paper documents using cross-cut shredders or professional document destruction services.

   

• Media degaussing: Use of degaussing equipment to destroy data on magnetic media before physical destruction.

   

• Optical media destruction: Physical destruction of CDs, DVDs, and other optical media through shredding or grinding.

   

Documentation and Certification:

• Destruction certificates: We provide certificates of destruction when required, documenting the date, method, and scope of information destruction.

   

• Chain of custody: We maintain detailed records of information handling from retention through destruction, ensuring accountability throughout the process.

   

• Audit trails: Comprehensive documentation of disposal activities for audit and compliance purposes.

   

Third-Party Disposal Services:

When using third-party disposal services, we ensure:

• The service provider is certified and reputable
• Appropriate confidentiality agreements are in place
• Destruction is witnessed or verified through certificates
• The service provider maintains appropriate insurance and indemnification

7. Client Rights and Controls

We believe that clients should have transparency and control over how their information is handled. We provide various mechanisms for clients to exercise their rights regarding their information.

7.1 Access and Correction

Information Access Rights:

Clients have the right to access information we hold about their projects and business relationships:

• Project information access: You may request access to all information we maintain related to your projects, including technical data, communications records, test results, and project documentation. We will provide such access in a reasonable timeframe, typically within 30 days of your request.

   

• Business relationship records: You may access information about our business relationship, including contract terms, invoicing records, communication logs, and service delivery documentation.

   

• Data processing information: You may request information about how we process your data, including what information we collect, how we use it, who has access to it, and how we protect it.

   

• Third-party sharing disclosure: We will provide information about any authorized sharing of your information with third parties, including the identity of recipients, the purpose of sharing, and the safeguards in place.

   

Correction Rights:

• Accuracy updates: If you identify inaccurate information in our records, we will promptly correct such information and update our systems accordingly.

   

• Completeness improvements: If our records are incomplete in ways that could affect our services or your interests, we will work with you to complete the information.

   

• Context clarification: If information in our records could be misleading without proper context, we will add appropriate clarification or additional information.

   

Request Procedures:

• Written requests: Access and correction requests should be submitted in writing to our Privacy Officer, including sufficient detail to identify the specific information of concern.

   

• Identity verification: We may require verification of your identity and authority to request access or corrections to protect against unauthorized requests.

   

• Response timeframes: We typically respond to access requests within 30 days and correction requests within 15 days, though complex requests may require additional time.

   

7.2 Data Portability

Upon request and subject to contractual terms and legal obligations, we will assist with data portability:

Data Formats and Transfer:

• Standard formats: We will provide your data in commonly used, machine-readable formats such as CSV, XML, JSON, PDF, or other formats appropriate to the type of information.

   

• Custom formats: Where feasible, we can provide data in specific formats you request to facilitate transfer to other systems or service providers.

   

• Complete datasets: We will provide complete datasets rather than partial or summary information, ensuring you receive all relevant information we maintain about your projects.

   

• Associated metadata: We include relevant metadata, documentation, and context information to ensure the portability of data is meaningful and useful.

   

Transfer Assistance:

• Direct transfer: We can transfer data directly to designated third parties (such as other service providers) upon your written authorization and after confirming appropriate confidentiality protections are in place.

   

• Migration support: We can provide reasonable assistance with data migration activities, including consultation on data formats, field mapping, and technical requirements.

   

• Verification procedures: We can assist with verification that transferred data is complete and accurate.

   

Limitations and Considerations:

• Contractual restrictions: Data portability is subject to any contractual restrictions or obligations, such as intellectual property licenses or confidentiality requirements.

   

• Third-party rights: We cannot transfer information that includes third-party intellectual property or confidential information unless appropriate permissions are obtained.

   

• Technical feasibility: Data portability is subject to technical feasibility and may require reasonable time and effort to complete complex transfers.

   

7.3 Deletion Requests

Clients may request deletion of their information, subject to certain limitations and considerations:

Scope of Deletion:

• Complete project deletion: You may request deletion of all information related to specific projects, including technical data, communications, test results, and associated documentation.

   

• Selective deletion: You may request deletion of specific types of information or specific documents, provided such deletion does not impair our ability to fulfill remaining obligations or comply with legal requirements.

   

• Account information: You may request deletion of contact information and business relationship records, subject to legal and contractual retention requirements.

   

Limitations on Deletion:

• Contractual obligations: We may need to retain certain information to fulfill ongoing contractual obligations, such as warranty support, maintenance services, or intellectual property licenses.

   

• Legal retention requirements: Some information must be retained to comply with applicable laws, such as financial records for tax purposes, employment records, or regulatory compliance documentation.

   

• Legitimate business interests: We may retain information necessary for defending against potential legal claims, resolving disputes, or maintaining business records required for operational purposes.

   

• Anonymized information: We may retain information in anonymized or aggregated form that cannot be linked to you or your projects for internal business analysis and improvement purposes.

   

Deletion Procedures:

• Request verification: We will verify deletion requests to ensure they come from authorized individuals and clearly specify the scope of requested deletion.

   

• Impact assessment: We will assess the impact of deletion requests on our ability to fulfill ongoing obligations and will discuss any limitations or alternatives with you.

   

• Secure deletion: When deletion is appropriate, we use the secure disposal procedures described in Section 6.2 to ensure information is permanently and irretrievably destroyed.

   

• Confirmation: We will provide written confirmation when deletion has been completed, including the scope of deleted information and any retained information with the reasons for retention.

   

Alternative Options:

• Data minimization: Instead of full deletion, you may request that we minimize the information we retain to only what is necessary for specific ongoing obligations.

   

• Access restrictions: We can implement additional access restrictions on your information while retaining it for legal or contractual purposes.

   

• Anonymization: Where appropriate, we can anonymize information to remove personally identifiable or business-identifiable elements while retaining data for legitimate business purposes.

   

8. International Data Transfers

In today’s global business environment, we may work with international clients or utilize international service providers. When such transfers occur, we ensure appropriate safeguards are in place:

8.1 Cross-Border Data Protection

Adequacy Determinations and Safeguards:

• Privacy framework compliance: When transferring data to countries with different privacy laws, we ensure compliance with applicable international privacy frameworks and adequacy determinations.

   

• Standard contractual clauses: We use standard contractual clauses or equivalent legal mechanisms to ensure that international transfers maintain appropriate protection levels.

   

• Binding corporate rules: Where applicable, we implement binding corporate rules or similar mechanisms to govern international data transfers within corporate groups.

   

• Certification programs: We may participate in recognized certification programs that facilitate secure international data transfers.

   

Transfer Limitations and Controls:

• Necessity requirement: International transfers are limited to what is necessary for service delivery, regulatory compliance, or legitimate business purposes.

   

• Client notification: We inform clients when international transfers may be necessary and obtain consent where required by applicable law.

   

• Data minimization: We transfer only the minimum amount of information necessary for the specific purpose and limit access to authorized personnel.

   

• Security in transit: All international transfers use encrypted communication channels and secure transmission protocols.

   

8.2 International Service Providers

Due Diligence and Safeguards:

• Privacy law compliance: International service providers must demonstrate compliance with privacy laws applicable to their jurisdiction and our business relationship.

   

• Contractual protections: All international service providers must execute comprehensive data protection agreements with terms at least as protective as this privacy policy.

   

• Security assessments: We conduct security assessments of international service providers to ensure they maintain appropriate technical and organizational safeguards.

   

• Ongoing monitoring: We monitor compliance by international service providers through regular reviews, audits, and performance assessments.

   

Client Rights and Protections:

• Transparency: We provide information about international transfers upon request, including the countries involved, the purposes of transfer, and the safeguards in place.

   

• Objection rights: Clients may object to international transfers where they have legitimate concerns about privacy protection, and we will work to find alternative solutions.

   

• Local jurisdiction options: Where feasible, we can arrange for services to be provided within specific jurisdictions to address client preferences or legal requirements.

   

9. Compliance and Certifications

Gradient Technologies maintains compliance with applicable laws and industry standards through comprehensive compliance programs and regular assessments:

9.1 Legal Compliance

Privacy Laws and Regulations:

• State privacy laws: We comply with applicable state privacy laws, including the California Consumer Privacy Act (CCPA), Virginia Consumer Data Protection Act (VCDPA), and other state privacy regulations as they develop and become applicable to our business.

   

• Federal regulations: We comply with federal laws and regulations applicable to our business, including export control regulations (ITAR, EAR), FTC privacy guidance, and sector-specific regulations.

   

• International privacy laws: When working with international clients or transferring data internationally, we comply with applicable international privacy laws, including GDPR requirements where applicable.

   

Industry-Specific Regulations:

• Medical device regulations: For projects involving medical devices, we comply with FDA regulations, HIPAA privacy requirements, and other healthcare-related privacy and security standards.

   

• Automotive standards: For automotive projects, we comply with industry-specific standards and regulations related to connected vehicle privacy and cybersecurity.

   

• Financial services regulations: When working with financial services clients, we comply with applicable financial privacy regulations and standards.

   

• Government and defense: For government or defense-related projects, we comply with applicable security and privacy requirements, including NIST standards and DoD cybersecurity requirements.

   

9.2 Professional Standards and Ethics

Engineering Professional Standards:

• Professional engineering codes of conduct: We adhere to professional engineering codes of ethics, including obligations to protect public safety, maintain client confidentiality, and provide competent professional services.

   

• Industry best practices: We follow recognized industry best practices for privacy, security, and data protection in engineering and product development.

   

• Continuous improvement: We regularly review and update our practices to incorporate new standards, technologies, and best practices as they develop.

   

Quality Management Systems:

• ISO compliance: We maintain compliance with relevant ISO standards for quality management, information security, and privacy management.

   

• Industry certifications: We pursue and maintain relevant industry certifications that demonstrate our commitment to quality and security.

   

• Regular audits: We conduct regular internal audits and engage third-party auditors to verify compliance with applicable standards and regulations.

   

9.3 Monitoring and Updates

Compliance Monitoring:

• Regular assessments: We conduct regular compliance assessments to ensure ongoing adherence to applicable laws, regulations, and standards.

   

• Legal updates: We monitor changes in privacy laws and regulations and update our practices accordingly.

   

• Industry developments: We stay informed about industry developments and best practices that may impact our privacy and security obligations.

   

Training and Awareness:

• Employee training: All employees receive regular training on privacy laws, regulations, and company policies.

   

• Updates and refreshers: We provide updates and refresher training when laws, regulations, or policies change.

   

• Specialized training: Employees working on projects subject to specific regulatory requirements receive specialized training relevant to those requirements.

   

10. Privacy Policy Updates

We recognize that privacy laws, business practices, and client needs evolve over time. We are committed to maintaining current and effective privacy protections through regular policy reviews and updates.

10.1 Changes to This Policy

Reasons for Updates:

• Legal and regulatory changes: Updates to comply with new or modified privacy laws, regulations, or legal requirements that affect our business or clients.

   

• Business practice evolution: Changes to reflect improvements in our privacy practices, new services we offer, or changes in how we collect, use, or protect information.

   

• Technology improvements: Updates to reflect new security technologies, data protection methods, or technical capabilities that enhance privacy protection.

   

• Client feedback and industry developments: Modifications based on client feedback, industry best practices, or guidance from professional organizations and regulatory bodies.

   

• Risk assessment outcomes: Changes based on privacy risk assessments, security audits, or incident response experiences that identify opportunities for improvement.

   

Types of Changes:

• Material changes: Significant modifications that substantially alter how we collect, use, share, or protect information, or that materially affect client rights or obligations.

   

• Administrative changes: Minor updates such as contact information changes, clarification of existing practices, or administrative improvements that do not materially affect privacy protections.

   

• Enhancement changes: Improvements that provide additional privacy protections or client rights beyond existing requirements.

   

10.2 Notification of Changes

Client Communication:

• Material change notification: For material changes to this privacy policy, we will provide written notice to clients at least 30 days before the changes take effect. This notification will be sent via email to the primary contact address we have on file, and may also include postal mail for significant changes.

   

• Change summary: Notifications will include a clear summary of the changes being made, the effective date of changes, and how the changes may affect our handling of client information.

   

• Full policy access: We will provide easy access to the complete updated policy and, upon request, a version showing changes from the previous policy version.

   

• Implementation timeline: We will provide reasonable time for clients to review changes and, where appropriate, discuss any concerns or questions before implementation.

   

Website and Public Notice:

• Website updates: Updated policies will be posted on our website with clear indication of the effective date and last revision date.

   

• Change log: We maintain a summary of policy changes and effective dates to provide transparency about policy evolution.

   

• Accessibility: Current and previous versions of our privacy policy are maintained in accessible formats and can be provided in alternative formats upon request.

   

Client Response Options:

• Review period: Clients will have at least 30 days to review material changes and discuss any concerns with our Privacy Officer.

   

• Objection process: Clients may object to material changes that they believe are inconsistent with their expectations or requirements. We will work in good faith to address such concerns.

   

• Contract modification: Where privacy policy changes materially affect existing contracts, we will discuss potential contract modifications or alternative arrangements with affected clients.

   

• Continuation of services: Continued use of our services after the effective date of policy changes constitutes acceptance of the updated policy, though we encourage active review and discussion of any concerns.

   

Stakeholder Communication:

• Employee notification: All employees and contractors will be notified of policy changes and provided with any necessary training on updated procedures.

   

• Vendor notification: Service providers and subcontractors will be notified of relevant policy changes and may be required to update their own practices or agreements to maintain consistency.

   

• Professional advisors: Our legal counsel and other professional advisors will be consulted on significant policy changes to ensure compliance and effectiveness.

   

11. Contact Information

We are committed to being accessible and responsive to questions, concerns, and requests regarding our privacy practices. We encourage open communication about privacy matters.

11.1 Primary Contact Information

Privacy Officer
Gradient Technologies, LLC
4625 Alexander Dr # 110
Alpharetta, GA 30022

Contact Methods:

• Primary Email: privacy@gradienttech.com
• Phone: (678) 444-2355
• Toll Free: (866) 993-1715
• Fax: (877) 631-4336
• General Contact: sales@gradienttech.com

Business Hours:
Monday – Friday: 8:00 AM – 6:00 PM EST
Saturday – Sunday: Closed

Emergency Contact:
For urgent privacy or security matters outside business hours, please email privacy@gradienttech.com with “URGENT” in the subject line, and we will respond as soon as possible.

11.2 Response Procedures

Initial Response:

• Acknowledgment: We will acknowledge receipt of your inquiry within 2 business days.
• Response timeframe: We will provide a substantive response to most inquiries within 10 business days.
• Complex matters: More complex matters may require up to 30 days for complete response, but we will provide status updates every 10 days during the investigation or resolution process.

Types of Inquiries We Handle:

• Privacy policy questions: Clarification about our privacy practices, data handling procedures, or policy terms.
• Data access requests: Requests to access information we maintain about you or your projects.
• Correction requests: Requests to correct inaccurate or incomplete information in our records.
• Deletion requests: Requests to delete information, subject to legal and contractual limitations.
• Data portability: Assistance with transferring your data to other service providers.
• Security concerns: Reports of potential security incidents or vulnerabilities.
• Complaints: Privacy-related complaints or concerns about our practices.
• General inquiries: Questions about our services, capabilities, or business practices.

Documentation and Follow-up:

• Written records: We maintain written records of all privacy-related inquiries and our responses.
• Follow-up: We follow up on inquiries to ensure satisfaction with our response and resolution.
• Continuous improvement: We use inquiries and feedback to identify opportunities for improving our privacy practices and policies.

11.3 Alternative Contact Methods

Postal Mail:
For clients who prefer postal communication, written inquiries may be sent to our business address. Please mark correspondence “Attention: Privacy Officer” for priority handling.

In-Person Meetings:
For complex matters or client preference, we can arrange in-person meetings at our Alpharetta facility or at client locations. Please contact our Privacy Officer to schedule such meetings.

Legal Representatives:
Clients represented by legal counsel may have their attorneys contact us directly regarding privacy matters. We will work cooperatively with client legal representatives while maintaining appropriate confidentiality protections.

12. Acknowledgment and Acceptance

This section establishes the legal framework for this privacy policy and its relationship to our business operations.

12.1 Policy Integration

Contract Integration:
This Privacy Policy is incorporated by reference into all service agreements, contracts, and business relationships with Gradient Technologies. It forms an integral part of our contractual obligations and should be read in conjunction with specific contract terms.

Precedence and Conflicts:

• Specific contract terms: Where specific contracts contain privacy or confidentiality terms that are more restrictive than this policy, the contract terms take precedence.
• Legal requirements: Where applicable laws require more stringent privacy protections than described in this policy, the legal requirements take precedence.
• Policy updates: As described in Section 10, policy updates may modify these terms, subject to appropriate notification and client response procedures.

Scope of Application:
This policy applies to:

• All information collected in connection with our services
• All business relationships and communications with clients
• All employees, contractors, and authorized personnel
• All facilities, systems, and operations of Gradient Technologies

12.2 Acknowledgment of Understanding

Client Acknowledgment:
By engaging our services, using our website, or providing information to us, you acknowledge that:

• Policy review: You have had the opportunity to read and understand this Privacy Policy.
• Terms acceptance: You agree to the terms and conditions described in this policy.
• Information accuracy: Information you provide to us is accurate and complete to the best of your knowledge.
• Authority confirmation: You have the authority to provide information and agree to these terms on behalf of your organization.
• Update awareness: You understand that this policy may be updated as described in Section 10 and agree to review updates when provided.

Ongoing Relationship:

• Continued acceptance: Continued use of our services constitutes ongoing acceptance of this policy and any updates made in accordance with Section 10.
• Active communication: We encourage active communication about privacy matters and welcome questions or concerns at any time.
• Mutual commitment: This policy represents our mutual commitment to maintaining the highest standards of privacy protection and data security.

12.3 Effective Date and Superseding Provisions

Effective Date:
This Privacy Policy is effective as of [Insert Date] and supersedes all previous versions of our privacy policy or privacy-related statements.

Transition Provisions:

• Existing relationships: For existing client relationships, this policy applies to all information and activities from the effective date forward.
• Historical information: Information collected before the effective date continues to be protected under the terms of previous policies until updated in accordance with this policy.
• Contract modifications: Existing contracts may be modified to incorporate updated privacy terms through amendments or renewals.

Legal Validity:

• Severability: If any provision of this policy is found to be invalid or unenforceable, the remaining provisions will continue in full force and effect.
• Governing law: This policy is governed by the laws of the State of Georgia and applicable federal laws.
• Dispute resolution: Disputes related to this policy will be resolved in accordance with dispute resolution procedures specified in relevant service agreements.

Conclusion

Our Commitment to Privacy Excellence

Gradient Technologies, LLC is committed to maintaining the highest standards of privacy protection and data security. We recognize that our clients trust us with their most valuable intellectual property and sensitive business information, and we take this responsibility seriously.

This Privacy Policy reflects our comprehensive approach to privacy protection, incorporating industry best practices, legal requirements, and our own high standards for client service. We are committed to:

• Transparency: Providing clear, comprehensive information about our privacy practices
• Security: Implementing robust technical, physical, and administrative safeguards
• Compliance: Meeting all applicable legal and regulatory requirements
• Continuous improvement: Regularly reviewing and enhancing our privacy protections
• Client service: Being responsive to client needs and concerns regarding privacy matters

Your Privacy is Our Priority

We understand that privacy is not just about compliance with laws and regulations—it’s about maintaining the trust that is essential to our business relationships. We are committed to earning and maintaining that trust through our actions, policies, and practices.

For questions, concerns, or additional information about our privacy practices, please contact our Privacy Officer at privacy@gradienttech.com or (678) 444-2355.