Privacy Policy

1. Introduction

This Privacy Policy describes how Etoc IT, LLC (“Etoc IT,” “we,” “us,” or “our”) collects, uses, and shares personal information when you visit etocit.com (the “Site”) or interact with our services. We are committed to protecting your privacy and being transparent about our data practices.

2. Who We Are (Data Controller)

For purposes of the EU General Data Protection Regulation (GDPR), Etoc IT is the “Data Controller” for personal data collected via this Site.

3. Information We Collect

3.1 Information You Provide

When you fill out our contact form, schedule a consultation, or send us an email, we collect: your name, email address, phone number (if provided), business or company name (if provided), approximate number of employees or computers (if provided), and the content of your message.

3.2 Automatically Collected Information

Our hosting provider automatically collects: your IP address, browser type and version, operating system and device information, pages viewed and time on site, referring URL, and date/time of visit.

3.3 Cookies and Similar Technologies

Our Site uses a minimal set of cookies:

• Essential cookies from Cloudflare (our hosting provider) for basic site functionality and bot protection (e.g., __cf_bm, expires in ~30 minutes)
• Cookie consent preferences stored in your browser’s localStorage for up to 13 months

We do not use tracking cookies, analytics cookies, advertising cookies, or third-party marketing pixels.

4. How We Use Your Information

• Respond to your inquiries and contact requests
• Provide the IT consultation, quote, or services you’ve requested
• Send administrative communications (e.g., appointment confirmations)
• Maintain the security and performance of our Site
• Comply with legal, regulatory, and tax obligations

We do not use your information for automated decision-making or profiling.

5. Legal Basis for Processing (GDPR)

If you are located in the European Union, European Economic Area, or United Kingdom, we process your personal data on one of these legal bases:

• Consent — when you submit our contact form or schedule a call
• Performance of a contract — to provide services you’ve requested
• Legitimate interest — for site security, fraud prevention, and improving our services
• Legal obligation — for required business and tax records

6. Third-Party Services

We rely on the following trusted third-party service providers, each of whom may process limited data:

• Cloudflare, Inc. (US) — website hosting, content delivery, and DDoS protection
• Formspree.io (US) — processes submissions from our contact form
• Cal.com, Inc. (US) — appointment scheduling when you click our “Book a Call” link
• Proton AG (Switzerland) — hosts our business email inbox
• Google LLC — our Google Business Profile listing (external to this Site)
• Meta Platforms, Inc. — our Facebook business page (external to this Site)

We do not sell, rent, or trade your personal information to any third party.

7. Data Retention

• Contact form submissions are retained for up to 3 years after our last contact with you, or until you request deletion
• Session cookies expire when you close your browser
• Consent preferences stored in localStorage are kept for up to 13 months
• Server logs are typically rotated within 30 days by our hosting provider
• Client business records (active/former clients) are retained per our Master Services Agreement and applicable tax law

8. Your Rights

8.1 Rights Under GDPR (EU/EEA/UK Residents)

You have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure (“right to be forgotten”); restrict or object to our processing; request data portability; withdraw consent at any time; and lodge a complaint with your local supervisory authority.

8.2 Rights Under CCPA/CPRA (California Residents)

You have the right to: know what personal information we collect, use, and share; request deletion of your personal information; opt out of the sale or sharing of personal information (we do not sell); correct inaccurate information; and non-discrimination for exercising your rights.

8.3 How to Exercise Your Rights

Email us at rob@etocit.com with your request and enough detail to verify your identity. We will respond within 30 days (GDPR) or 45 days (CCPA), as applicable.

9. Data Security

We implement industry-standard technical and organizational safeguards, including HTTPS/TLS encryption, multi-factor authentication on administrative accounts, encrypted password management, and access controls limiting personal data to those who need it. No method of transmission over the Internet is 100% secure, but we take reasonable measures to protect your data.

10. Data Breach Notification

In the event of a personal data breach that poses a high risk to your rights and freedoms, we will notify you and the relevant supervisory authorities without undue delay and, where feasible, within 72 hours of becoming aware of the breach as required under GDPR Article 34.

11. Children’s Privacy

Our Site and services are not directed to children under the age of 13 (US) or 16 (EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

12. International Data Transfers

Etoc IT operates from the United States. If you access our Site from outside the US, your information will be transferred to, stored in, and processed in the United States, which may have different data protection laws than your country of residence. By using our Site, you consent to this transfer.

13. Do Not Track Signals

We do not currently respond to browser “Do Not Track” (DNT) signals because there is no consistent industry standard for compliance. However, we do not track your activity across other websites regardless of DNT settings.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The updated version will be posted on this page with a revised “Effective Date.” Continued use of our Site after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise any of your rights, contact us: