Privacy Policy

Data Controller & Contact

The data controller is Lavandula Group LLC. To exercise any of the rights described below, or for any privacy question, please get in touch. (The controller's registered address and a dedicated privacy contact — [privacy@lavandulagroup.com] — will be confirmed before launch.)

Data We Collect

Contact form. The personal data you voluntarily submit through our contact form: the required name, email address, and message, and optionally your organization / nonprofit, phone number, area of interest, and how you heard about us.

Analytics — only with your consent. If you accept "Analytics" cookies, we use Google Analytics 4 to collect usage data such as pages viewed, approximate location (from IP, not stored in full by us), device/browser type, referring source, and on-site actions — including contact-form submissions counted as a "Lead" event, without your form content. No analytics data is collected before you consent.

Advertising — only with your consent. If you accept "Marketing" cookies, our advertising partners' tags ([Meta Pixel, Google Ads, LinkedIn Insight Tag — those that are live]) may collect data about your visit to measure ad performance and show you relevant ads. No advertising tags load before you consent.

Consent records. We store a record of your cookie choices (a strictly necessary cookie) so we can honor them. If you accept or customize non-essential cookies, your consent is also logged with our consent-management provider for our compliance records. If you reject non-essential cookies, that choice is kept only in a first-party cookie on your device and is not sent to that provider — because rejecting loads no third-party service at all.

Lawful Basis

We rely on your consent for analytics and advertising cookies (which you may withdraw at any time), and on our legitimate interest in responding to your enquiry and operating a secure website. Contact-form data is processed to respond to you and, where relevant, to take steps at your request prior to a possible engagement.

Data Processor

We share personal data only with service providers that process it on our behalf, under contract: Formspree (contact-form processing/delivery, United States), Cloudflare (hosting/CDN/security), Google (Analytics 4, and Google Ads in Phase B — consent-gated), our consent management platform (records your cookie choices), and, in Phase B, [Meta] and [LinkedIn] (advertising — consent-gated). We do not sell your personal data for money. A Data Processing Agreement with each processor will be confirmed before launch.

International Transfers

Several providers are located in the United States. Where we transfer EEA/UK personal data internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) and/or a provider's participation in the EU–US Data Privacy Framework. The specific mechanism for each processor will be confirmed before production launch.

Data Retention

Contact-form submissions are retained only as long as needed to respond and to maintain a submission audit log (at least 90 days), then deleted. Analytics data is retained per the Google Analytics retention setting; consent records are kept as needed to demonstrate compliance. Final retention periods will be confirmed before launch.

Your Rights

If you are in the EEA or UK, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data.
• Restriction — ask us to limit how we use your data.
• Objection — object to our processing of your data.
• Portability — receive your data in a portable format.

You may also withdraw consent to analytics/advertising cookies at any time via "Cookie Preferences" in the footer, without affecting prior processing. If you are a U.S. resident (e.g. California under CCPA/CPRA), you may opt out of the sale or sharing of personal data and of targeted advertising using the "Do Not Sell or Share My Personal Information" link in the footer; we also honor Global Privacy Control (GPC) signals as this opt-out. To exercise any right, contact us.

Cookies

We set no non-essential cookies until you consent. On your first visit a consent banner lets you accept or reject the Analytics and Marketing categories; Essential cookies (including the consent record) are always active. You can change or withdraw consent anytime via "Cookie Preferences" in the footer. Full details, including the cookie inventory, are in our Cookie Policy.

Complaints

If you believe we have mishandled your data, you have the right to lodge a complaint with your local data-protection supervisory authority (in the EEA, your national Data Protection Authority; in the UK, the ICO).