This Privacy Policy explains how Naataanii Consulting, LLC collects, uses, shares, stores and protects information when people visit our website, contact our team or engage our community strategy and program advisory services. Naataanii Consulting maintains this policy and is the central point of contact for every privacy question described below. We keep the practice small, and we keep our data practices equally modest: we gather only what we need to answer a question, serve a client or keep an accurate business record.
We wrote this policy in plain language on purpose. Advisory work depends on trust, and trust begins with people understanding exactly what happens to the details they share with us. If any part of this document is unclear, please write to the contact address given near the end and ask. We would rather answer a direct question than leave uncertainty in place.
Naataanii Consulting, LLC
1319 W 750 S
Provo - 84601-3949
United States (US)
Email: info@naataaniiconsulting.lol
Phone: +17793149925
1. Scope of This Policy
This policy applies to information processed by Naataanii Consulting, LLC in connection with this website and with the advisory services we provide to organizations. It covers visitors who browse the site, people who send an enquiry through the contact form or by email, and representatives of client organizations who work with our team. It does not cover information that a client organization collects independently in the course of running its own programs, because that organization remains responsible for its own data practices.
When we work on a needs assessment or a planning circle, we sometimes receive community information from a client. In those cases the client is the primary controller of the information and we act as its processor, following written instructions and returning or deleting the material when the engagement closes. This policy still describes how we protect that material internally, but the client organization should be approached first for requests about its own program records.
2. Information We Collect
We collect a narrow set of information and we try to keep it that way. The categories below describe everything we may hold in ordinary operation of the practice.
2.1 Information you provide directly
- Name and preferred form of address.
- Email address, telephone number and, where relevant, a postal address.
- The content of messages sent through the contact form, by email or by telephone.
- The name and role of the organization you represent, and a description of the program or question you bring to us.
- Meeting notes, workshop outputs and documents you share during an engagement.
- Billing and payment details needed to issue an invoice and keep a tax record.
- Signed agreements, letters of engagement and correspondence about scope.
2.2 Information collected automatically
- Internet protocol address and approximate region derived from it.
- Browser type, device type, operating system and screen characteristics.
- Pages visited, the time of the visit and the referring address.
- Technical error reports generated when a page fails to load correctly.
2.3 Information from client engagements
- Program plans, budgets, narrative drafts and reporting templates produced with a client.
- Survey responses, interview notes and observation records gathered for a needs assessment.
- Board and staff meeting records created during facilitation work.
- Grant calendars and funder correspondence shared for funding guidance.
We do not intentionally collect special category information such as health details, religious belief, ethnic origin or political opinion unless a client engagement genuinely requires it, for example in a community health needs assessment. When that happens we minimize the data, aggregate it as early as possible and store it separately with restricted access.
3. How We Obtain Information
Most information reaches us directly from the person it concerns. You fill in the contact form, you send an email, you join a planning circle, you sign an agreement. Some information arrives from a client organization when it introduces a team member or shares program files with us. A small amount is generated automatically by the web server and by ordinary network infrastructure whenever a page is requested.
We do not buy contact lists, we do not purchase profile data from data brokers and we do not scrape personal information from social platforms. If a colleague recommends your organization to us, we will still ask you directly before adding you to any record or list.
4. Purposes for Processing
We use the information described above for the following purposes, and for nothing else without a fresh notice:
- Answering enquiries and arranging an introductory conversation.
- Preparing, delivering and invoicing advisory services under a written scope.
- Producing planning documents, assessments, meeting records and reporting frameworks for a client.
- Maintaining business records, accounting entries and tax documentation.
- Managing the security of the website and the studio network.
- Complying with legal obligations and responding to lawful requests from authorities.
- Improving our own service design based on aggregated, non-identifying patterns.
We do not sell personal information, we do not rent it, and we do not use it to build advertising profiles. If we ever wish to use information for a purpose that is not listed here, we will ask for consent first and record that consent in writing.
5. Legal Bases for Processing
Where data protection law requires a legal basis, we rely on one or more of the following. Performance of a contract applies when we deliver services under a signed scope, and steps taken before a contract applies when we respond to an enquiry that may lead to one. Legitimate interests applies to the operation and security of our practice, provided those interests are not overridden by your rights. Legal obligation applies to accounting, tax and record keeping duties. Consent applies whenever we ask for it directly, such as for an optional newsletter, and consent may be withdrawn at any time.
Where a client organization is the controller and we act as its processor, the client is responsible for identifying the legal basis for its own program data. Our processing follows its written instructions under the agreement between us.
8. Service Providers and Processors
We use a small group of established providers for email, cloud document storage, accounting and website hosting. Each provider is bound by a written agreement that limits its use of our data to the service it supplies, requires reasonable security measures and requires deletion or return of data when the relationship ends.
Where a provider would need to process personal information outside the country in which it was collected, we rely on the provider contractual safeguards and, where available, recognized transfer mechanisms. We review the provider list annually and remove any service that cannot meet our standards.
9. International Data Transfers
The practice operates from Provo, Utah, in the United States. Information submitted through this website is processed in the United States and, where a cloud provider stores copies, in the regions that provider documents. If you contact us from another country, please be aware that United States law will apply to the handling of the information, and that privacy protections may differ from those in your home jurisdiction.
Where required, we use standard contractual clauses or an equivalent recognized safeguard for transfers out of the European Economic Area or the United Kingdom, and we will provide a copy of the relevant safeguard on request.
10. Retention of Information
We keep information only as long as needed for the purpose that justified collecting it, plus any period required by law. The general schedule below guides our practice.
- Enquiries that do not become engagements: up to twenty four months, then deleted.
- Client engagement records: seven years after the close of the final fiscal year of the engagement, to satisfy accounting and tax requirements.
- Grant and reporting files: as long as the funder agreement requires, often three to seven years after closeout.
- Needs assessment raw material: deleted or returned at the close of the engagement unless the client instructs otherwise in writing.
- Website server logs: up to ninety days, unless retained longer for a specific security investigation.
When a retention period ends, records are deleted from active systems and from routine backups as those backups rotate. Aggregated statistics that cannot reasonably identify a person may be kept longer for planning and improvement.
11. How We Protect Information
Security measures include encrypted connections to this website, encrypted storage for client files, multi factor authentication on accounts that hold personal information, least privilege access rules and regular review of who can see what inside the practice. Paper notes taken during workshops are kept in a locked cabinet in the studio and are destroyed by cross cut shredding when the engagement closes.
Access to client material is limited to the people working on that engagement. Team members receive a short written briefing on confidentiality at the start of each engagement and confirm in writing that they have read it. No system is perfect, and we cannot promise absolute security, but we work on the assumption that careful habits prevent far more incidents than expensive tools.
12. Your Privacy Rights
Depending on where you live, you may hold some or all of the following rights in relation to your personal information.
- Access. A copy of the information we hold about you.
- Correction. Fixing information that is inaccurate or incomplete.
- Deletion. Removal of information that is no longer needed, subject to legal retention duties.
- Restriction. A pause on processing while a concern is examined.
- Objection. An objection to processing based on legitimate interests.
- Portability. A machine readable copy of information you provided to us.
- Withdrawal of consent. Ending any processing that relied on consent.
- Non discrimination. Equal service regardless of whether you exercise a right.
Utah resident rights under the Utah Consumer Privacy Act are honored in full, including the rights to know, to delete and to obtain a portable copy of personal data. California resident rights under the California Consumer Privacy Act are honored in full, including the right to opt out of sale or sharing, a right that is easy for us to satisfy because we do neither.
13. Exercising Your Rights
To exercise a right, write to info@naataaniiconsulting.lol with the subject line Privacy Request, or send a letter to Naataanii Consulting, LLC, 1319 W 750 S, Provo - 84601-3949, United States (US). Please describe the right you wish to exercise and the information concerned so that we can locate the correct record.
We may ask for enough verification to confirm that the request comes from the person concerned, such as a reply from the email address we already hold. We aim to respond within thirty days and will tell you in advance if a lawful extension applies. If you represent a client organization as an authorized agent, we will confirm that authority before acting. We do not charge a fee for an ordinary request, though we may charge a reasonable administrative fee for repeated or clearly excessive requests, and we will explain the fee first.
14. Privacy for Children
This website is intended for adults acting in a professional or community capacity, and we do not knowingly collect information from anyone under sixteen through the website. Our advisory work sometimes involves programs that serve young people, and in those engagements any information about participants is gathered by the client organization under its own parental consent procedures, shared with us only in de-identified or aggregate form wherever possible.
If you believe that a child has sent personal information to us directly, please contact the studio and we will delete it promptly.
15. Marketing Communications
We send very little marketing mail. When we do send an occasional note about planning circle seats or a published report, it goes only to people who asked to receive it or to existing clients with whom we already have a working relationship. Every message includes a clear way to stop receiving future notes, and a request to stop is honored within two business days.
We do not add contact form enquiries to any mailing list automatically. Asking a question through the website is not consent to receive future marketing.
16. Analytics and Website Logs
We review aggregate counts of page visits to understand which pages are useful and which are rarely read. These counts are produced from server logs and contain no names, email addresses or persistent identifiers. We do not use cross site trackers, we do not build visitor profiles and we do not share traffic statistics with advertising networks.
Log entries are kept for a short period for security and troubleshooting, then deleted automatically. If we ever adopt a third party analytics service, this section will name the service, state what it collects and explain how to opt out before any such service is deployed.
17. Third Party Websites
This website may link to funder portals, partner organizations or reference material maintained by other parties. Those websites have their own privacy policies, and we are not responsible for their content or their data practices. We recommend reading the privacy notice of any site before submitting personal information there.
Our policy does not extend to social media platforms where the practice may be mentioned. Interactions on those platforms are governed by the platform terms and by the settings you have chosen.
18. Automated Processing and Advisory Tools
We do not use automated decision making that produces legal or similarly significant effects about individuals. Advisory judgments about a program, a budget or a plan are always made by people who know the context and the community.
Where our team uses writing or editing software to help draft internal documents, client material is handled under the same confidentiality rules as any other engagement record, and no client program data is used to train a public model. Clients may ask in writing that no such tool be used on their material, and we will honor that instruction for the whole engagement.
19. Security Incidents
If we become aware of a security incident that is likely to result in a risk to the rights of individuals, we will investigate promptly, contain the incident and notify affected clients and, where required, supervisory authorities without undue delay. Notifications will describe what happened, what information was involved, what we have done and what steps affected people may wish to take.
We keep an internal incident log, review each event after it closes and change procedures where the review shows a gap. Lessons learned are shared with the team in the next monthly practice meeting.
20. Changes to This Policy
We review this policy at least once a year and whenever our tools or services change in a meaningful way. The effective date at the top of the page always reflects the most recent version. If a change materially affects how we use personal information, we will post a clear notice on the homepage and, where we hold an email address, send a short message describing the change.
Continued use of the website after a revised policy takes effect indicates acceptance of the updated terms. If you do not agree with a revision, you may ask us to delete your information subject to any legal retention duty.
21. How to Contact Us
Questions, concerns and privacy requests are welcome. Write to Naataanii Consulting at info@naataaniiconsulting.lol, call +17793149925 during business hours, or send a letter to Naataanii Consulting, LLC, 1319 W 750 S, Provo - 84601-3949, United States (US). A member of the practice reads every message personally.
If you are not satisfied with our response, you may have the right to complain to a data protection authority in your jurisdiction. We will cooperate fully with any such authority and, where possible, we would appreciate the chance to resolve the concern directly first.