Flatirons Solutions, Inc. (“Flatirons” the “Company”, “we”, “us” and the possessive “our”), a Delaware corporation with its headquarters at 5755 Central Avenue, Suite A, Boulder, Colorado 80301, together with its affiliates is committed to protecting your Personal Information, which is information that alone, or with other information, identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person (“Personal Information”). The term “Personal Information” is interpreted broadly to include the definition of “Personal Information” as used in the California Consumer Privacy Act (“CCPA”) and the definition of “personal data” as used in the General Data Protection Regulation in effect in the European Union (“GDPR”). Flatirons processes Personal Information in accordance with the principles of transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability called for by the EU-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, and the implementing principles for each of those frameworks (collectively, “DPF Principles”).

We have created this Privacy Policy (this “Privacy Policy”) to describe how we collect, use, store, and disclose Personal Information, including any Personal Information that we collect from the website on which this Privacy Policy is posted (“Website”). This Privacy Policy is incorporated into and made a part of the Terms of Service (the “TOS”) Agreement among us and the various customers and other visitors to our Website (collectively, “Visitors” or “you”). Capitalized terms used but not otherwise defined in this Privacy Policy have the meanings given to them in the TOS. Flatirons is a “Service Provider” for its customers, and as such, the TOS describes the business purposes for which Flatirons collects and processes Personal Information (such purposes, the “Services”). To allow Flatirons to provide the Services, and for Visitors to use the Website, Flatirons must collect and be permitted to disseminate certain information as further described in the TOS and this Privacy Policy.

When we determine the purposes and means of processing (e.g., Website, marketing, recruiting), we act as a ‘controller’ (EU/UK) and a ‘business’ (U.S. state laws). When we process personal information on behalf of our customers under a written agreement, we act as a ‘processor’/‘service provider’/‘contractor’ and follow our customers’ instructions.

Please read this Privacy Policy carefully. By accessing or using this Website or otherwise providing us with Personal Information, you acknowledge, accept the terms of, and consent to our privacy practices as outlined in this Privacy Policy. If you do not want to agree to our privacy practices contained in this Privacy Policy, do not use the Website, or provide any Personal Information to us. We reserve the right, at any time, to modify, update, or revise this Privacy Policy. We will post those revisions to our Website, and your continued use of the Website will constitute your consent to the modifications. You should review this Privacy Policy periodically to keep up to date on the most current versions. If you have any questions or concerns, please contact us at [email protected].

If you are a California resident, additional information applicable to California residents is below in the Section titled, “Your California Privacy Rights.”

If you are a resident of the European Union, additional information applicable to European residents is below in the Section titled, “EU and UK Residents.”

I. Information We Collect.

The Personal Information we may request from you includes:

II. Sensitive Information.

Some of the information may be considered “special” or “sensitive” in certain jurisdictions, for example, your racial or ethnic origins, sexual orientation, and religious beliefs. We do not intentionally collect or process sensitive personal information unless permitted or required by law, or where necessary for a specific disclosed purpose.

III. How We Collect Your Information.

We collect information from you in a variety of ways, depending on how you interact with the Services, the choices you make, and the products and features you use, including, but not limited to:

We may also take the Personal Information we receive from individuals responding to our surveys, remove any personally identifying information, such as names and phone numbers, to create anonymous profiles (“Profiles”), and combine (or aggregate) it with the other Profiles. These combined Profiles may contain information about the gender, age, education, employment, industry sector, or other demographic information of our customers, which we use to improve the quality of our services to you and to develop new services and products. These combined Profiles may be shared with third parties.

If you seek to apply for employment with us via the Website, you will be redirected to our third-party Applicant Tracking System (ATS), Pinpoint, and your application process will be governed by Pinpoint’s privacy policy posted at: https://flatironssolutions.pinpointhq.com/privacy-policy
Any application data you share with Pinpoint may be shared with us to consider your application. We may also use AI-enabled features available within Pinpoint to assist our recruitment team in reviewing and summarizing job applications, matching relevant skills, and summarizing interview feedback; however, all hiring decisions are made by our recruitment team and are not based solely on automated processing.

When you browse our Website, we also automatically collect and aggregate other information about you using cookies, web beacons, tracking pixels, and related tracking technologies, browser analytics tools, server logs, and similar technologies. These tracking technologies may be implemented and placed by us or by third-party vendors on our behalf, and they allow us to collect information by automated means. For example, information about how many web pages you have used, what hyperlinks you clicked, access times, and number of visits may be collected. We may also collect geo-location information through your IP address and mobile devices. This information may be aggregated or de-identified in some cases and is used for internal analysis and reporting purposes.

We use Google Analytics to collect and process information about your use of the Website. Google sets cookies on your browser or device, and then your web browser will automatically send information to Google. Google uses this information to provide us with reports that we use to better understand and measure how users interact with our Website.

To learn more about how Google uses data, visit Google’s Privacy Policy and Google’s page on “How Google uses data when you use our partners’ sites or apps.” You may download the Google Analytics Opt-out Browser Add-on for each web browser you use, but this does not prevent the use of other analytics tools. To learn more about Google Analytics cookies, visit Google Analytics Cookie Usage on Websites.

IV. Cookie Policy.

Cookies are small data files stored on your hard drive by the Website. Cookies do many different jobs, like letting you navigate between pages efficiently, remembering your preferences, and generally improving the user experience.

1. Cookies our Website Uses. We use session cookies, performance cookies, functionality cookies, and targeting cookies.

2. Managing cookies. Many website browsers automatically accept cookies, but you can change your browser settings. However, if you choose to disable cookies from our Website, you may not be able to use certain features of the site. You can visit www.aboutcookies.org to learn about how to delete and control cookies using the major browser types. We also may collect information by periodically conducting business and individual customer surveys. These surveys help us to improve the types of products and services we offer and how we provide them to you.
3. Do Not Track. Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this time, there is no uniform industry or legal standard for recognizing or honoring DNT signals, so we do not respond to them. We will honor Global Privacy Control (GPC) signals where required by applicable law.
4. Server Logs and Web Beacons. Web server logs are activity records created when Visitors visit web pages, such as search terms, device information, browser information, IP address, access times, and pages viewed. Web Beacons are electronic files that allow us to recognize and count Visitors and can be used to determine response rates to our communications. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports and hardware settings).
5. Device Information. We may also use sensors to collect information about your devices, such as location, hardware and software, operating system, device memory, advertising identifiers, application identifiers, browser type, language, time zone; and other sensor device information. We may ask for permission to collect images and other information from your device’s camera.
6. Location Data. We collect location data such as information about your device’s location. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.

V. Children and Minors.

Our Website is not intended for children under 18 years of age. No one under age 18 may provide any personal information to or on the Website. We do not knowingly collect personal information from children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or the equivalent age as specified by law in your jurisdiction or that you are the parent or guardian of such a minor and consent to such minor’s use of the Services. If we learn we have collected or received personal information from a child under 18 or the equivalent age as specified by law in your jurisdiction without verification of parental consent, we will take reasonable measures to delete that information. If you believe we might have any information from or about a child under 18 or the equivalent age as specified by law in your jurisdiction, please contact us at [email protected]. California residents under 16 may have additional rights regarding the collection and sale of their personal information.

VI. The purposes for which we collect your Personal Information.

We take your privacy seriously and only use your Personal Information in lawful ways to process your Personal Information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law. The lawful reasons for collecting and processing your information are: (1) because you have entered into a contract for us to supply goods and services to you; (2) we have a legitimate interest in using your information (for example, to provide and improve our services, customer support and show you advertisements we think will be of interest to you,) but we only rely on this legitimate interest reason when we think our use of your information doesn’t significantly impact your privacy rights or there is a compelling reason to do so; and (3) to comply with applicable law. You can review, change, and update your Personal Information at any time. In addition, we collect your Personal Information to:

Additional Information if you are located in the EU, UK, or Canada.
If you are located in the EU or UK, the following information also applies to you.
The GDPR and UK GDPR require us to explain the valid legal bases we rely on in order to process your Personal Information, which includes:

If you are located in Canada, the following information also applies to you.

Consent. We may process your Personal Information if you have given us specific permission (i.e., express consent) for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

VII. Customer Contact.

When you provide us with your email and other contact information, you authorize us to contact you in accordance with this Privacy Policy and the TOS. We may use the information we collect to contact you by email to provide you with news and updates related to our or our partners’ products and services, invitations to events hosted by other industry organizations or us, notices of new promotions, and information on other similar events. We may also contact you by email to respond to your comments and questions, notify you of changes to your account, or send you information regarding our services, including confirmations, invoices, technical notices, updates, security alerts, support and administrative messages. You may opt out of receiving marketing emails from us by following the directions in the marketing email you receive.

VIII. Disclosure To Third Parties.

We will not sell your Personal Information. We may share your Personal Information with any of our affiliates and subsidiaries who must comply with this Privacy Policy. We may also share your Personal Information with third parties that provide services for us, with vendors to help us host and manage the Website, support and maintain our software, and deliver products for us, with customers who access the Website and other third parties such as the following:

IX. Retention.

We will keep Personal Information only for the period necessary to fulfil the purposes described in this Privacy Policy and for which the information was collected, unless a longer retention period is permitted or required by applicable law or the DPF Principles. For example, we reserve the right to maintain information on customers who have violated our Privacy Policy, the TOS, or any other license and services agreement between our company and a customer, or for the purposes of reasonably serving customer relations, compliance and legal considerations, auditing, security, and fraud prevention.

When we have no ongoing legitimate business need to process your Personal Information, we will either delete or anonymize such information, or, if this is not possible (for example, because your Personal Information has been stored in backup archives), then we will securely store your Personal Information and isolate it from any further processing until deletion is possible.

X. Accessing and Correcting Your Information.

You can review and change your Personal Information by logging into the Website and visiting your account profile page. You may also send us an email at [email protected] to request access to, correct, delete, or withdraw consent for our processing of any personal information that you have provided to us. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect. Residents of certain states may have additional personal information rights and choices.

XI. Social Media.

We are active on social media, including Facebook, Twitter, Vimeo, and LinkedIn (“Social Media”). Anything you post on Social Media is public information and will not be treated confidentially, but information we obtain from public sources must still comply with certain DPF Principles. We may post (or re-post) on the Website and our Social Media pages any comments or content that you post on our Social Media pages. Your use of Social Media is governed by the privacy policies and terms of the providers that own and operate those websites and not by this Privacy Policy. We encourage you to review those policies and terms.

XII. International Data Transfers-EU-US Data Privacy Framework (DPF), UK Extension of the US DPF, and Swiss-US DPF.

If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored by, and processed by us in our facilities and in the facilities of the third parties (including cloud service providers) with whom we may share your Personal Information in the United States, France, Denmark, Norway, India, and other countries. If you are a resident in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, then these countries may not have data protection laws as comprehensive as those in your country. However, we will take necessary measures to protect your personal information in accordance with this Privacy Policy and applicable law. Flatirons will not transfer Personal Information from the European Economic Area (“EEA”). the United Kingdom (“UK”) or Switzerland to outside the EEA, UK, or Switzerland unless such transfer is made in accordance with an adequacy decision by the European Commission or is otherwise compliant with GDPR and the DPF Principles.

1. EU-US, UK Extension to the EU-US, and Swiss-US Data Privacy Framework. Flatirons complies with the EU-US Data Privacy Framework (EU-U.S. DFP), the UK Extension to the EU-U.S. DFP, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DFP) as set forth by the U.S. Department of Commerce and is committed to maintaining compliance with these frameworks and the DPF Principles, including any updates or changes, as part of our ongoing commitment to data privacy. Flatirons has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. (UK DPF Principles), and the Swiss-U.S. Data Privacy Framework Principles (Swiss DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF Principles. The EU-U.S. DPF Principles, the UK Principles, and the Swiss DPF Principles are sometimes referred to in this policy collectively as “DPF Principles”. If there is any conflict between the terms of this Privacy Policy and the DPF Principles, the DPF Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov.
2. Flatirons’ EU-U.S. DPF, UK Extension of the EU-U.S. DPF and Swiss-U.S. DPF certification covers the following subsidiaries and affiliates in the United States: Flatirons Solutions, Inc. To provide adequate protection for personal data from EU, UK or Swiss member countries received in the United States, Flatirons has elected to self-certify to the EU-U.S. DPF, UK Extension of the EU-U.S. DPF, and Swiss-U.S. DPF Principles. Flatirons Solutions, Inc. and its subsidiaries and affiliates in the U.S. adhere to the EU-U.S. DPF Principles.
3. Flatirons is subject to the investigatory and enforcement authority of the U.S. Federal Trade Commission (“FTC”). For more information about the EU-U.S. DPF, and UK Extension of the EU-U.S. DPF, see the U.S. Department of Commerce’s EU-U.S. DPF, UK Extension of the EU-U.S. DPF, and Swiss-U.S. DPF website located at https://www.dataprivacyframework.gov. To review our representation on the EU-U.S. DPF, UK Extension of the EU-U.S. DPF and Swiss-U.S. DPF list, please see the U.S. Department of Commerce’s EU-U.S. DPF, UK Extension of the EU-U.S. DPF, and Swiss-U.S. DPF self-certification list located at https://www.dataprivacyframework.gov/s/participant-search.
4. Flatirons is subject to the enforcement and sanctioning powers of the FTC in regard to our processing of personal data that we receive from the EU, UK, or Switzerland and our compliance with the EU-U.S. DPF, UK Extension of the EU-U.S. DPF, and Swiss-U.S. DPF. In compliance with the EU-U.S. DPF, UK Extension of the EU-U.S. DPF, and Swiss-U.S. DPF, Flatirons commits to referring unresolved complaints concerning our handling of personal data in reliance on the EU-U.S. DPF, UK Extension of the EU-U.S. DPF, and Swiss-U.S. DPF to an alternative dispute resolution provider based in the United States. European Union, UK, or Swiss individuals with inquiries or complaints regarding this should first contact Flatirons at [email protected] to try to resolve the inquiry or complaint. Flatirons will respond to your complaint within 45 days of our receipt of the complaint. If you have any unresolved privacy or data use concerns that we have not satisfactorily addressed, please contact the International Center for Dispute Resolution, international division of the American Arbitration Association (ICDR-AAA), our U.S.-based third-party dispute resolution provider (free of charge) at https://go.adr.org/dpf_irm.html or email to [email protected]. If your complaint is not resolved through this process, you may file a complaint with the Federal Trade Commission (FTC). Under certain conditions, you may be able to invoke binding arbitration under Annex 1 of the EU- U.S. DPF Principles. For more information on binding arbitration, see the Data Privacy Framework Program website located at https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction. If an individual submits a complaint to a Data Protection Authority the Gibraltar Regulatory Authority (GRA), and the Swiss Federal Data Protection and Information Commissioner (FDPIC), as applicable (collectively, “DPA”) in the EU or EEA, UK, or Switzerland, the U.S. Department of Commerce’s International Trade Administration (ITA) has committed to receive, review, and undertake best efforts to facilitate resolution of the complaint and to respond to the DPA within 90 days. Flatirons commits to cooperate with DPAs in the investigation and resolution of complaints brought under the DPF Principles; and will comply with any advice given by the DPAs where the DPAs take the view that the organization needs to take specific action to comply with the DPF Principles.
5. Under the Onward Transfer Principle, if Flatirons transfers personal data to a third party acting as a controller, it will comply with the DPF Principles and enter into a contract with the third-party controller that provides that the Personal Information will only be processed for limited and specified purposes consistent with your consent and that the third party will provide the same level of protection as the DPF Principles. Flatirons remains responsible for any of your Personal Information that is shared on our behalf with third parties acting as our agents for external processing. In addition, if Flatirons transfers your Personal Information to third parties, acting as our agent, Flatirons will (i) transfer such data only for limited and specified purposes, (ii) ascertain that the agent is obligated to provide at least the same level of privacy protection as is required by the DPF Principles; (iii) take reasonable and appropriate steps to ensure that the agent effectively processes the Personal Information transferred in a manner consistent with Flatirons’ obligations under the DPF Principles; (iv) require the agent to notify Flatirons if it determines that it can no longer meet its obligation to provide the same level of protection as is required by the DPF Principles; (v) upon notice, take reasonable and appropriate steps to stop and remediate unauthorized processing, and (vi) provide a summary or representative copy of the relevant privacy provisions of its contract with that agent. Flatirons remains responsible if its agents process your Personal Information in a manner inconsistent with this Privacy Policy or the DPF Principles, unless we can demonstrate that we are not responsible for the event giving rise to the damage. Flatirons is subject to the investigatory and enforcement powers of the FTC.

XIII. EU and UK Residents.

For purposes of this section the terms “personal data”, “processing” and “automated decision” have the same meanings set forth under the EU General Data Protection Regulation 2016/679 (“GDPR”) and the UK General Data Protection Regulation (“UK GDPR”). This section only applies to you if you are located in the EU/EEA or UK

1. Legal Basis for Processing. When Flatirons processes your personal data, it has a legal basis for doing so as required under GDPR. Flatirons will only process your personal data if: (i) it has received your express opt-in consent for such processing, (ii) the processing is necessary for performance of a contract, (iii) the processing is necessary for a legal obligation to which Flatirons is subject, (iv) the processing is necessary to protect your vital interests, (v) the processing is necessary for a task carried out in the public interest, or (vi) if Flatirons or a third party has a legitimate interest that is not overridden by your interests or fundamental rights and freedoms.
2. Right to Withdraw Your Consent. If you provide your consent for us to process your personal data, you may withdraw your consent at any time by emailing [email protected] to request such change.
3. Marketing. Flatirons does not process personal data for the purpose of marketing without first obtaining your express, opt-in consent or having a legitimate interest in doing so. You have the right to object to the processing of your personal data for marketing purposes at any time by contacting us at [email protected].
4. Automated Decision Making. Flatirons does not make any automated decisions on your behalf or about you without first obtaining your express, opt-in consent. In connection with recruitment, Flatirons may use AI-enabled features available through Pinpoint to assist in reviewing and summarizing applications and related recruitment information; however, all hiring decisions are made by our recruitment team and are not based solely on automated processing. If we secure your consent to engage in automated decision-making, you have the right to object to the processing of personal data via automated decision-making at any time by contacting us at [email protected].
5. Your Rights and Choices. GDPR provides certain rights to individuals in relation to their personal data. Accordingly, you may have the following rights under GDPR, although some exceptions apply. We will comply with any requests made relating to the following rights if required by applicable law. We may require you to prove your identity before we modify, provide, delete, or transfer your personal data.

6. Transfer to Third Parties and Countries. Flatirons will only transfer EU data subject’s personal data to third parties located outside of the EU when it has ensured appropriate safeguards for such personal data, such as through the standard contractual clauses with such third party or, as provided above, in accordance with the EU-U.S. Data Privacy Framework Principles, the UK Extension to the EU-U.S. Data Privacy Framework Principles, and the Swiss-U.S. Data Privacy Framework Principles. Flatirons may also be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

XIV. USA Residents.

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the Personal Information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your Personal Information. You may also have the right to withdraw your consent to our processing of your Personal Information. These rights may be limited in some circumstances by applicable law.

Your Rights Regarding Personal Information Under CCPA. You have rights under the CCPA, and certain other US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights may include: