Privacy Policy

Ozola Advisory LLC

Effective Date: September 1, 2026

Last Updated: August 27, 2026

This Privacy Policy explains how Ozola Advisory LLC (“Ozola Advisory,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information in connection with (i) our public-facing informational website located at https://ozolaadvisory.com (the “Site”) and (ii) our human resources consulting and advisory services (the “Services”). The Site is intended primarily as an informational brochure-style website and does not provide a user login portal or e-commerce checkout functionality.

By accessing or using the Site, contacting us, or engaging us for Services, you acknowledge that you have read and understood this Privacy Policy.  If you enter into a separate written agreement with Ozola Advisory for consulting or other services (an "Engagement Agreement"), that Engagement Agreement will control with respect to those services, and this Privacy Policy will apply only to your use of the Site to the extent not inconsistent with the Engagement Agreement.

If you do not agree with this Privacy Policy, please do not use the Site.

IMPORTANT NOTICE: DISPUTES RELATING TO THIS PRIVACY POLICY OR OUR PRIVACY PRACTICES MAY BE SUBJECT TO THE MANDATORY ARBITRATION, CLASS ACTION WAIVER, AND JURY TRIAL WAIVER PROVISIONS IN OUR TERMS OF USE, EXCEPT WHERE PROHIBITED BY APPLICABLE LAW.

1. Who We Are and How to Contact Us

Ozola Advisory LLC

Privacy Contact Email: sandra@ozolaadvisory.com

You may contact us using the information above with questions about this Privacy Policy or to exercise privacy rights where available.

2. Scope and Important Notes

This Privacy Policy applies to personal information we process when you:

• visit or interact with the Site;
• contact us through the Site, email, phone, or other channels;
• schedule a meeting with us using a scheduling link (if available);
• engage us for Services or communicate with us about Services; or
• otherwise interact with us in a business context.

This Privacy Policy does not apply to third-party websites or services that may be linked from the Site. Those third parties have their own privacy practices and policies.

If you provide personal information about another person (for example, by referring a colleague), you represent that you have authority to do so and that you have provided appropriate notice to the individual.

3. Personal Information We Collect

We limit the personal information we collect to what is reasonably necessary for the purposes described.  We collect personal information from: (a) information you provide directly, (b) information collected automatically when you use the Site, and (c) information received from third parties.  The categories of personal information we collect depend on how you interact with us.

3.1 Information You Provide Directly

Examples of information you may provide include:

• Identifiers and contact information (for example, name, email address, phone number, mailing address).
• Professional or business information (for example, company name, title/role, and information about your organization’s needs).
• Communications (for example, the content of emails, messages, questions, and any attachments you choose to send).
• Meeting and scheduling details (for example, preferred meeting times and topics, if you use a scheduling link).
• Client engagement information (for example, contract and invoicing information and records related to our Services).

Please do not submit sensitive personal information (for example, Social Security numbers, government-issued ID numbers, bank account numbers, health information, or passwords) through general website forms unless we specifically request it and provide a secure method.

3.2 Information Collected Automatically

When you use the Site, we and vendors acting on our behalf may automatically collect certain information, including:

• Technical and request information, such as IP address and server, security, and diagnostic log information.
• Device and browser information, such as browser type, operating system, device type, and language settings.
• Usage and analytics information, such as pages viewed, referring pages, interactions with the Site, and analytics events.
• Approximate location information derived from technical request information, such as country, state or region, and city.

As described in Section 6, we use Vercel Web Analytics to obtain aggregate information about Site usage. Vercel Web Analytics does not use cookies for analytics and is designed so that analytics data is not associated with an identified individual or IP address.

3.3 Information We Receive from Third Parties

We may receive personal information from third parties such as:

• Website hosting and analytics providers, including Vercel Inc. and Vercel Web Analytics, and any separate security or anti-spam provider that we may use.
• Professional referrals or introductions.
• Publicly available sources (for example, information on professional networking sites) where permitted by law.

3.4 Client-Related Information in the Course of Services (“Client Data”)

In the course of providing HR consulting/advisory Services to clients, we may receive or access personal information relating to a client’s employees, workers, candidates, contractors, or other individuals (“Client Data”). Client Data may include contact information, professional information, and other HR-related information that a client shares with us to perform the Services.

For Client Data, our client is typically the party that determines what information is processed and for what purpose. In that context, Ozola Advisory generally acts as a “service provider” under the CCPA/CPRA and as a “processor” under applicable data protection laws and processes Client Data solely on the client’s documented instructions and pursuant to our agreement(s) with the client, and as required or otherwise addressed within the Engagement Agreement.  If you are an employee, worker, candidate, or contractor of one of our clients and have questions about how your personal information is handled, please contact the client directly.

3.5 Enterprise Clients; Client Data; Additional Contractual Terms

Where Ozola Advisory provides Services to a client and processes personal information on the client’s behalf, including personal information relating to the client’s employees, workers, candidates, contractors, or other personnel, such information will be handled in accordance with the applicable Engagement Agreement and any applicable data processing addendum, data protection agreement, confidentiality agreement, or similar written agreement between Ozola Advisory and the client. Those agreements may include additional terms addressing processing instructions, confidentiality, security measures, subprocessors, assistance with privacy rights requests, incident notification, deletion or return of information, audits or assessments, and international data transfers. In the event of a conflict between this Privacy Policy and such written agreement with respect to Client Data, the written agreement will control.

4. How We Use Personal Information

We use personal information for the following business and commercial purposes (as applicable):

• To operate, maintain, and secure the Site (including troubleshooting, performance monitoring, and security).
• To respond to inquiries and communicate with you, including providing information about our Services.
• To provide the Services and manage our relationship with you or your organization (including contracting, administration, and billing).
• To improve our Site and Services, including through analytics and quality assurance activities.
• To send administrative information (for example, updates to policies, security notices, and other non-marketing communications).
• For marketing and business development, where permitted by law and consistent with your choices.
• To comply with legal obligations and to protect our rights, property, and safety, and those of others (including fraud prevention and dispute resolution).

5. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients, as applicable:

• Service providers and vendors that help us operate our business and the Site (for example, hosting, analytics, communications, scheduling, and security providers).
• Professional advisors (for example, attorneys, accountants, auditors, and insurers).
• Government authorities or other third parties when required by law or legal process, or to protect rights and safety.
• A buyer, seller, or other party in connection with a business transaction (for example, a merger, acquisition, financing, or sale of assets), subject to appropriate protections.

We do not sell personal information and do not share personal information for cross-context behavioral advertising.  We do not disclose personal information to third parties for their own direct marketing purposes unless disclosed to you and permitted by law.

6. Analytics and Similar Technologies

We use Vercel Web Analytics to understand, in aggregate, how visitors use the Site and to improve the Site’s content, operation, and performance.

Vercel Web Analytics does not use cookies for analytics and is designed to provide aggregated analytics without associating page views or analytics events with an identified individual or IP address. The limited data points processed through Vercel Web Analytics may include an event timestamp, page URL, referring page, filtered query parameters, approximate location, browser and operating-system information, and device type. Vercel uses a hash generated from the incoming request to distinguish visits during a limited period, and that visitor-session identifier is reset or discarded after twenty-four (24) hours.

We do not use Vercel Web Analytics for cross-context behavioral advertising and do not currently use advertising or marketing cookies, pixels, or similar tracking technologies on the Site. We do not permit personal information, such as names, email addresses, client identifiers, or other sensitive information, to be included in analytics events, page URLs, or query parameters.

For visitors in the United Kingdom and European Economic Area, where the UK GDPR or EU GDPR applies, we rely on our legitimate interests under Article 6(1)(f) to measure Site performance, understand aggregate Site usage, and improve the visitor experience. We assess that this processing is proportionate, limited to aggregate usage information, and does not override the rights and freedoms of visitors. You may object to this processing by contacting us at sandra@ozolaadvisory.com.

If we materially change our analytics practices or begin using cookies or similar technologies for advertising, behavioral tracking, or other purposes, we will update this Privacy Policy and provide any notices or choices required by applicable law.

7. Data Retention

We retain personal information for as long as reasonably necessary to achieve the purposes described in this Privacy Policy, including to provide the Site and Services, maintain business records, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary depending on the type of information and context.

Typical retention periods are:

• Site inquiries and communications: generally retained for 12–24 months after the last interaction, unless a longer period is reasonably necessary for follow-up communications, business development, legal compliance, dispute resolution, or protection of our rights.
• Client engagement records, including contracts, invoices, and engagement-related communications: generally retained for 7 years after the end of the engagement, unless a longer period is required or permitted by law, contract, professional obligations, dispute-resolution needs, or legitimate business recordkeeping purposes.
• Website analytics data: aggregate analytics data is generally retained for the period made available under our applicable Vercel service plan and configuration, and no longer than reasonably necessary to measure Site performance and improve the Site. The temporary visitor-session identifier used by Vercel Web Analytics is reset or discarded after twenty-four (24) hours.
• Security logs: generally retained for 12–24 months, unless longer retention is reasonably necessary to investigate or prevent fraud, misuse, security incidents, technical issues, legal claims, or other threats to the Site, our business, or others.

8. Data Security

We implement and maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, acquisition, disclosure, alteration, and destruction. Our security measures are designed to be appropriate to the nature of the information processed and the risks presented.

8.1 Administrative Safeguards

Our administrative safeguards may include:

• Documented information security policies and procedures;
• Role-based access controls based on least-privilege principles;
• Confidentiality obligations applicable to personnel and contractors;
• Security awareness training for personnel;
• Background checks for personnel where appropriate and permitted by law;
• Vendor risk assessment and due diligence procedures;
• Written agreements with service providers that include data protection and confidentiality obligations.

8.2 Technical Safeguards

Our technical safeguards may include:

• Encryption of data in transit using industry-standard protocols (e.g., HTTPS/TLS);
• Encryption of data at rest where appropriate to the risk profile;
• Multi-factor authentication for administrative or privileged access;
• Logging and monitoring of access to systems containing personal information;
• Network security controls, including firewalls and endpoint protections;
• Patch management and vulnerability remediation processes;
• Access revocation procedures upon personnel termination or role change.

8.3 Physical Safeguards

Physical safeguards may include:

• Secure office environments with controlled access;
• Device security controls (e.g., password protection, device encryption);
• Secure disposal or destruction of records and media when no longer needed.

8.4 Incident Response

We maintain incident response procedures designed to:

• Detect, investigate, and contain security incidents;
• Mitigate potential harm;
• Document and remediate identified vulnerabilities; and
• Comply with applicable breach notification laws.

Where required by law or contract, we will provide notice of security incidents involving personal information in accordance with applicable legal requirements.

8.5 Business Continuity and Resilience

We maintain business continuity and data backup practices designed to support operational resilience and recovery in the event of system disruption, subject to the nature and scale of our operations.

8.6 No Absolute Security

While we maintain safeguards designed to protect personal information, no method of transmission over the Internet or method of electronic storage is completely secure. Accordingly, we cannot guarantee absolute security.

9. International Data Transfers

Ozola Advisory is headquartered in the United States. If you access the Site or engage us for Services from outside the United States (including from the United Kingdom or the European Economic Area), your personal information may be transferred to, stored in, and processed in the United States and other jurisdictions where we or our service providers operate.

Where required by law (including the UK GDPR and EU GDPR), we will implement appropriate safeguards for international transfers, which may include Standard Contractual Clauses and related addenda, or other lawful transfer mechanisms. You may request additional information about transfer safeguards by contacting us at sandra@ozolaadvisory.com.

10. Your Choices

Marketing communications: We do not currently send newsletters or bulk marketing emails. If we begin sending marketing communications, we will provide an opt-out mechanism as required by law, and you may opt out at any time by contacting us at sandra@ozolaadvisory.com. We may still send you non-marketing communications (for example, responses to inquiries or engagement-related messages).

Analytics: We use Vercel Web Analytics as described in Section 6. Vercel Web Analytics does not use analytics cookies. Where applicable, you may object to our analytics processing by contacting us at sandra@ozolaadvisory.com.

11. California Privacy Notice (CCPA/CPRA)

This section applies to “consumers” who are California residents and describes our practices and your rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”). This California notice applies to personal information we collect online through the Site and in our business communications and service delivery contexts (including B2B contacts), to the extent the CCPA/CPRA applies.

11.1 Notice at Collection (Summary)

At or before the point of collection, California law requires us to provide a notice that includes the categories of personal information collected, the purposes for collection and use, and information about retention and sales/sharing (if applicable). The table below summarizes our current practices for the preceding 12 months. We may provide a separate notice at collection for specific interactions (for example, if we collect additional information through a particular form).

We do not collect sensitive personal information through the Site. If sensitive personal information is required in connection with a specific client engagement, we will seek to collect it through appropriate secure methods and only as permitted by law and the applicable Engagement Agreement or data processing addendum. If sensitive personal information is processed in connection with the Services, we use and disclose it only for permitted engagement purposes and do not use it to infer characteristics about individuals.  

11.2 Sources of Personal Information

In the preceding 12 months, we may have collected personal information from the following sources:

• Directly from you (for example, via forms, emails, phone calls, and meeting requests).
• Automatically from your device or browser when you access the Site, including through Vercel Web Analytics and technical, server, and security logs.
• Our service providers (for example, hosting, analytics, scheduling, and security providers).
• Referrals and publicly available sources (as applicable and permitted by law).

11.3 Disclosures for a Business Purpose

In the preceding 12 months, we may have disclosed the categories of personal information listed above for business purposes to the following categories of recipients:

• Service providers that help us operate the Site and our business (for example, hosting, analytics, communications, scheduling, and security providers).
• Professional advisors (for example, legal, accounting, insurance).
• Authorities and others as required by law or to protect rights and safety.

11.4 Selling and Sharing of Personal Information

California law defines “sell” and “share” broadly. “Share” includes disclosures of personal information for cross-context behavioral advertising.

Based on the Site’s current intended use as an informational brochure-style website, Ozola Advisory does not sell personal information and does not share personal information for cross-context behavioral advertising.

11.5 California Consumer Rights

Subject to certain exceptions, California residents have the following rights:

• Right to know/access: you may request information about the categories and specific pieces of personal information we collected about you, the sources, purposes, and categories of third parties to whom we disclose it.
• Right to delete: you may request deletion of personal information we collected from you, subject to legal exceptions.
• Right to correct: you may request correction of inaccurate personal information.
• Right to opt out of sale/sharing: you may direct us not to sell or share your personal information (if applicable).
• Right to limit use and disclosure of sensitive personal information: in certain circumstances, you may direct us to limit the use or disclosure of sensitive personal information to purposes permitted by the CCPA/CPRA.
• Right to non-discrimination: you will not be discriminated against for exercising your CCPA/CPRA rights.

11.6 How to Submit a California or Other Privacy Rights Request

You or your authorized agent may submit a privacy rights request by emailing sandra@ozolaadvisory.com with the subject line “Privacy Request.” Please describe your request with sufficient detail so that we can understand and respond to it.

Where applicable law requires us to provide additional methods for submitting privacy rights requests, we will make those methods available and identify them in this Privacy Policy.

We will respond to verifiable privacy requests within the time required by applicable law. Where the CCPA/CPRA applies, we will respond within forty-five (45) days after receipt, subject to extensions permitted by law. If additional time is required, we will notify you of the extension period and the reason for the delay in accordance with applicable law.

11.7 Authorized Agents

You may designate an authorized agent to submit a request on your behalf. We may require proof of authorization and may also require you to verify your identity directly with us, as permitted by law.

11.8 Verification of Requests

To protect your personal information, we may need to verify your identity before processing certain requests (for example, requests to access, delete, or correct personal information). Verification typically involves matching information you provide with information we maintain. If we cannot verify your identity, we may be unable to fulfill your request.

11.9 Opt-Out Preference Signals

If we sell or share personal information in the future, we will process eligible opt-out preference signals (such as the Global Privacy Control) as requests to opt out of sale/sharing for the browser or device that sends the signal, as required by law.

11.10 Financial Incentives

We do not offer financial incentives or price/service differences in exchange for personal information.

11.11 Retention (California)

We retain or may retain personal information as described in Section 7. For California purposes, we either state a specific retention period for each category or the criteria used to determine the period.

12. UK and EEA Privacy Disclosures (UK GDPR / EU GDPR)

If you are located in the United Kingdom or the European Economic Area (“EEA”), you have certain rights under applicable data protection laws. This section describes key UK/EEA disclosures. In many cases, we process UK/EEA personal data in a business-to-business/professional context.

12.1 Legal Bases for Processing

Where UK GDPR or EU GDPR applies, we rely on one or more of the following legal bases (as applicable to the processing):

• Contract / pre-contract steps: to provide Services or take steps at your request before entering into an engagement.
• Legitimate interests: to operate and improve the Site, communicate with business contacts, and maintain security and fraud prevention measures (except where overridden by your rights).
• Consent: where required (for example, certain cookies or marketing in some contexts). You may withdraw consent at any time.
• Legal obligation: to comply with applicable legal requirements.

12.2 UK/EEA Individual Rights

Depending on the circumstances, you may have the right to request access to, correction of, deletion of, or restriction of your personal data; to object to certain processing; and to request data portability.

You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) or, if you are located in the European Economic Area, with your local supervisory authority.

To exercise your rights, contact us at sandra@ozolaadvisory.com.

We will respond to requests to exercise data protection rights without undue delay and, in any event, within one (1) month of receipt, subject to extensions permitted under applicable data protection law. Where an extension is necessary, we will inform you within one month of receipt of the request and explain the reasons for the delay.

12.3 International Transfers

If we transfer your personal data outside the UK/EEA, we will implement appropriate safeguards as described in Section 9 (for example, Standard Contractual Clauses and related addenda), where required.

13. Third-Party Links and Social Media

The Site may contain links to third-party websites or social media platforms. If you follow a link to a third-party site or interact with our social media pages, your information will be handled according to that third party’s privacy practices. We encourage you to review their privacy policies.

14. Children’s Privacy

The Site and Services are not directed to children under 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided us personal information, please contact us at sandra@ozolaadvisory.com so we can take appropriate steps.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on the Site and update the “Last Updated” date at the top of this document. If changes are material, we will provide additional notice as required by law.

16. Dispute Resolution

Any dispute, claim, or controversy arising out of or relating to this Privacy Policy, our privacy practices, or our collection, use, disclosure, retention, or protection of personal information in connection with the Site shall be subject to the dispute-resolution, mandatory arbitration, class action waiver, jury trial waiver, governing law, and venue provisions set forth in our Terms of Use, available at https://ozolaadvisory.com/terms, except to the extent prohibited by applicable law.

Nothing in this Privacy Policy limits any non-waivable privacy rights you may have under applicable law, including the right to submit a privacy rights request to us, the right to lodge a complaint with a data protection authority or other regulatory authority, or the right to seek relief from a regulator where such rights cannot be waived by contract.

If you have entered into an Engagement Agreement, data processing addendum, data protection agreement, confidentiality agreement, or similar written agreement with Ozola Advisory, that agreement will control with respect to disputes relating to Client Data or Services to the extent inconsistent with this Privacy Policy or the Terms of Use.

17. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or if you would like to submit a privacy request, please contact us at sandra@ozolaadvisory.com.