We keep what you type into the form for 36 months, and very little else.

01Effective date

Version 1.0 of this policy took effect on September 29, 2026, and it was last updated on the same day. Every later version carries a new number and date in the header above, and clause 18 says how you hear about it.

02Who holds the data

Wac, trading as WAC Standards Studio at wac.us.org, is the controller of the personal data this site collects. Postal address: 1325 6TH AVE, SEATTLE, WA 98101, SEATTLE, WA, United States. Email [email protected]. Phone (206) 464-3067.

We are a small consulting studio. There is no parent company and no data broker behind the site, and nobody else decides what happens to your inquiry.

03What we collect

The inquiry form posts to depab3a.php and writes these fields: your name, phone, email, the city or site address you give, the kind of inquiry, your message, the scope specification (standard, headcount, sites, audit date) and the consent tick. With it the server records, automatically, your IP address, your browser's user-agent string, the referring URL, the moment the form was rendered and the moment it was sent.

The support chat keeps the conversation itself, plus a name and an email if you give them. It stores a token in your browser so you can come back to the same thread. Your cookie answer sits in your browser under site_consent_v2. Nothing else on this site persists a choice. The web server also writes a standard access log of requests.

When you arrive from an ad, the landing link carries a click identifier: gclid, msclkid or fbclid. With your consent, advertising cookies store it; the cookie policy lists each one by name.

We take no account, no password, no payment and no card data. Nothing is sold on this site.

04What it is used for

Form fields and chat messages go to answering you, writing a scope and booking a scoping call. IP address, user-agent and timing go to blocking spam and automated submissions. Access logs keep the site running and let us trace a fault. Click identifiers and ad cookies, only with consent, tell us which ads produce inquiries, so we stop paying for the ones that do not. The consent record remembers your answer and shows that you were asked.

We build no profiles. We do not sell or rent your details.

05Legal basis

For visitors covered by European law, each purpose rests on one basis. Answering an inquiry and preparing a scope is a step taken at your request before a contract, backed by your consent tick. Spam protection and security logs rest on our legitimate interest in keeping the site and the inbox usable. Ad measurement cookies and click identifiers rest on consent, which you withdraw at any time. Keeping the consent record is a legal obligation, because we have to be able to show consent was obtained.

06Advertising platforms

Google Ads, Microsoft Advertising and Meta Ads send paid traffic to this site. When you click one of our ads, the platform adds a click identifier to the link: gclid for Google Ads, msclkid for Microsoft Advertising and fbclid for Meta Ads, where a campaign runs there. It is a random string. On its own it does not give us your name.

If you allow storage, the identifier is kept in a first-party cookie and reported back as a conversion when you send the form. If you decline, it is not stored and no conversion is reported with it. No platform has reviewed or approved this site; this policy is our own account of what it does.

07Consent Mode v2

The site runs Google Consent Mode v2. Before you choose, four signals are set to denied: ad_storage, ad_user_data, ad_personalization and analytics_storage. They switch to granted only when you press Allow on the banner. Press Decline, or withdraw later through Cookie settings in the footer, and all four go back to denied at that moment.

While they are denied, no advertising or analytics cookie is written. The Microsoft and Meta tags follow the same answer. The banner is a bar at the bottom of the page and never blocks the content.

08Who else receives it

Five recipients, named one by one.

• Google Ireland Ltd / Google LLC, for Google Ads: receives gclid and the consent signals. Google privacy policy.
• Microsoft Ireland Operations Ltd, for Microsoft Advertising: receives msclkid. Its handling is covered by the Microsoft privacy statement at privacy.microsoft.com.
• Meta Platforms Ireland Ltd, for Meta Ads: receives fbclid where a campaign runs there. Meta privacy policy.
• Our hosting provider, which serves the site and stores the inquiry database and chat transcripts.
• Our mail provider, which carries the notification of your inquiry to our inbox.

Nothing you send is passed to a certification body. If you later engage one, you give it your own records.

09Transfers abroad

The studio is in the United States and the data is handled here. If you write from Europe, your details travel to the US because that is where the reply comes from; the transfer is necessary to answer the request you made. Google, Microsoft and Meta move data between their Irish and US entities under the European Commission's Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

10Retention

Each category has a fixed period, set out in the table. When it runs out, the record is deleted. If an inquiry becomes a signed engagement, the engagement file follows the contract instead.

11Security

The whole site runs over HTTPS, so form and chat traffic is encrypted in transit. The inquiry database sits on the host behind a password-protected operator login, and only the people who answer inquiries can open it. Form submissions carry two hidden trap fields and a render timestamp to stop bots. Logs rotate out after 30 days. No system is perfectly secure. If we learn of a breach that affects you, we tell you, and we tell any regulator the law requires us to notify.

12Rights under the GDPR

If you reach the site from Europe, the GDPR gives you the right of access to the data we hold on you, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object to processing based on legitimate interest, and the right to withdraw consent at any time without affecting what was done before. Withdrawing consent for ad cookies takes one click on Cookie settings in the footer. Everything else goes through clause 17.

13Rights under US state law

In California, the CCPA as amended by the CPRA lets you ask what personal information we collected, where from, why, and who received it. You can ask us to delete or correct it, and you can opt out of its sale or sharing for cross-context behavioral advertising. We do not sell personal information. Passing click identifiers to ad platforms can count as sharing, so Decline on the banner is your opt-out. Residents of Washington and the other states with privacy laws in force have equivalent rights and use the same route. Using them changes nothing about how we treat you.

14Global Privacy Control

We honor Global Privacy Control. If your browser sends the signal (the Sec-GPC header), we treat it as an opt-out of sale and sharing and keep all four consent signals denied. We do not ask you again.

15Children

This site is for organizations buying quality consulting. It is not directed at children, and we do not knowingly collect data from anyone under 16. If we find we have, we delete it.

16Complaints

Tell us first and we will try to put it right. You can also complain to your state Attorney General, and in California to the California Privacy Protection Agency. Visitors in Europe can complain to the data protection authority in their own country.

17Data requests

Email [email protected] or write to WAC Standards Studio, 1325 6TH AVE, SEATTLE, WA 98101, SEATTLE, WA, United States. Say what you want: a copy, a correction, deletion, or an opt-out. Include the email or phone you used with us so we can find the records.

We confirm it is you by replying to that address or number before we release or delete anything. You get an answer within 7 days. There is no charge. An authorized agent can ask on your behalf with your signed permission.

18Changes to this policy

A new version goes up on this page with a new number and effective date in the header. If a change affects how we use data you already gave us, we email you at the address you used before it applies. This policy is governed by the law of Washington, United States, and disputes are heard in the courts of Seattle.

19Contact

A person at WAC reads every message. Email [email protected], call (206) 464-3067, or post to WAC Standards Studio, 1325 6TH AVE, SEATTLE, WA 98101, United States. For questions about the work itself, the contact page is quicker. The terms cover use of the site, and the cookie policy covers browser storage.