Data Handling — The Emporium Agency

Our Commitment

As a cybersecurity advisory firm, responsible data handling is not merely a compliance obligation — it is a core operational standard. This document describes in precise terms how data submitted to The Emporium Agency LLC is collected, stored, processed, protected, and disposed of.

Data We Collect

Data Type	Source	Purpose	Retention
Name, email, organization	Contact form	Inquiry response and engagement facilitation	24 months or until engagement ends
Message content	Contact form, email	Understanding inquiry context	24 months or until engagement ends
IP address	Web server logs	Security and abuse prevention	90 days (rolling)
Browser and device type	Analytics	Site performance optimization	Aggregated, no individual retention
Page views and referrers	Analytics	Site improvement (anonymized)	13 months (aggregated)

Storage and Infrastructure

Our web infrastructure is hosted on Cloudflare Pages with enterprise-grade security controls applied at the network edge. Cloudflare acts as our CDN, WAF, and DDoS mitigation layer. Form submission data is transmitted exclusively over HTTPS (TLS 1.2+).

All data in transit is encrypted via TLS
Contact form submissions are processed with rate limiting and CAPTCHA protection
Business email is configured with SPF, DKIM, and DMARC authentication
No client data is stored in third-party CRM systems without explicit written consent

Third-Party Data Sharing

We do not sell or share personal data with third parties for any commercial purpose. Limited data sharing may occur only in the following circumstances:

With infrastructure providers (Cloudflare) who process data on our behalf under data processing agreements
When required by applicable law or valid legal process
With explicit written consent from the data subject

Client Engagement Data

For active advisory clients, data handling terms are defined in the executed Advisory Agreement or Statement of Work. Client-provided information, findings from assessments, and deliverables are handled under strict confidentiality obligations as specified therein.

Data Deletion Requests

You may request deletion of any personal data we hold about you at any time. Submit requests to contact@theemporiumagency.com with the subject line "Data Deletion Request." We will confirm receipt within 5 business days and complete deletion within 30 days, unless retention is required by law.

Security Incident Response

In the unlikely event of a data security incident affecting personal information we hold, we will notify affected individuals within 72 hours of confirmed breach identification, consistent with applicable notification requirements.

DATAHANDLING