Privacy Policy

1. Introduction

Malo Santo (“we,” “us,” or “our”) is an AI consulting firm specializing in AI safety testing, governance, and due diligence. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website at malosanto.com (the “Site”) or engage with our services.

We are committed to complying with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable data protection laws.

2. Data Controller

For the purposes of the GDPR, the data controller is:

Malo Santo
Email: techwithx@gmail.com

If you have questions about this policy or our data practices, please contact us at the email address above.

3. Information We Collect

3.1 Information You Provide

• Contact information: name, email address, phone number, company name, and job title when you fill out a form, request a consultation, or contact us directly.
• Engagement information: details you share in proposals, contracts, or assessments related to our consulting services.
• Communications: any messages, feedback, or correspondence you send to us.

3.2 Information Collected Automatically

• Device and usage data: IP address, browser type, operating system, referring URLs, pages visited, time spent on pages, and click patterns.
• Cookies and similar technologies: we use essential cookies to ensure the Site functions properly and analytics cookies to understand how visitors use the Site. See Section 9 for details.

3.3 Information from Third Parties

We may receive information about you from publicly available sources, business partners, or analytics providers to supplement the data we collect directly.

4. How We Use Your Information

We use the personal data we collect for the following purposes:

• To provide, operate, and improve our consulting services
• To respond to inquiries and communicate with you
• To send relevant updates about our services, research, and insights (with your consent where required)
• To comply with legal obligations and enforce our agreements
• To analyze website usage and improve the user experience
• To detect, prevent, and address security issues

5. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your data on the following legal bases:

• Consent: where you have given clear consent for us to process your personal data for a specific purpose (e.g., marketing communications).
• Contract: where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
• Legitimate interests: where processing is necessary for our legitimate interests (e.g., improving our services, website analytics), provided these interests are not overridden by your rights.
• Legal obligation: where processing is necessary for compliance with a legal obligation.

6. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

• Service providers: trusted third parties who assist us in operating the Site, conducting our business, or providing services to you (e.g., hosting, analytics, email delivery), bound by contractual obligations to protect your data.
• Legal requirements: when required by law, subpoena, or government request, or to protect our rights, safety, or property.
• Business transfers: in connection with a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.

7. International Data Transfers

Your personal data may be transferred to and processed in countries outside your country of residence, including the United States. Where we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on an adequacy decision.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

• Contact form submissions: retained for up to 2 years after the last interaction.
• Client engagement data: retained for the duration of the engagement plus 5 years for legal and compliance purposes.
• Analytics data: aggregated and anonymized within 26 months.

9. Cookies and Tracking Technologies

We use the following categories of cookies:

• Essential cookies: required for the Site to function properly. These cannot be disabled.
• Analytics cookies: help us understand how visitors interact with the Site. We use Google Analytics, Microsoft Clarity, and Vercel Web Analytics to measure usage patterns such as pages visited, time on site, and scroll depth.
• Marketing cookies: used for personalized advertising and tracking across sites. These are only set with your explicit consent.

You can manage your cookie preferences using the consent banner displayed when you first visit the Site, or at any time by clicking the “Cookie Preferences” link in the footer. You may also control cookies through your browser settings. Disabling certain cookies may affect Site functionality.

10. Your Rights Under GDPR

If you are in the EEA, you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data (“right to be forgotten”).
• Right to restriction: request that we limit the processing of your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: withdraw consent at any time where processing is based on consent.

To exercise any of these rights, you can submit a data subject request or email us at techwithx@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

11. Your Rights Under CCPA/CPRA

If you are a California resident, you have the following rights:

• Right to know: request disclosure of the categories and specific pieces of personal information we have collected, the sources of collection, the business purpose, and the categories of third parties with whom we share it.
• Right to delete: request deletion of your personal information, subject to certain exceptions.
• Right to correct: request correction of inaccurate personal information.
• Right to opt-out of sale or sharing: we do not sell or share your personal information for cross-context behavioral advertising.
• Right to non-discrimination: we will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your rights, email us at techwithx@gmail.com. We will verify your identity before processing your request and respond within 45 days.

12. Do Not Sell My Personal Information

Malo Santo does not sell personal information as defined under the CCPA/CPRA. We do not sell, rent, or trade your personal data to third parties for monetary or other valuable consideration.

13. Children’s Privacy

Our Site and services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we learn that we have collected personal data from a child under 16, we will take steps to delete that information promptly.

14. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS), access controls, and regular security assessments. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will post the updated policy on this page and update the “Last updated” date. We encourage you to review this page periodically.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Malo Santo
Email: techwithx@gmail.com