ERMITS
ERMITS Advisory Supply Chain · Privacy · Threat
Back to Home

ERMITS ADVISORY SERVICES PRIVACY POLICY

Effective Date: April 21, 2026

Last Updated: April 21, 2026

ERMITS LLC ("ERMITS," "we," "our," or "us") is committed to protecting your privacy in connection with our professional advisory and consulting services and our public marketing site at https://www.ermits-advisory.com/. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you engage us for Advisory Services or use that site (including intake forms and the in-browser Cyber Exposure Brief), together with our Cookie & Portal Policy.

By engaging ERMITS Advisory Services or submitting information through our site, you consent to the data practices described in this policy. If you do not agree with this Privacy Policy, please do not engage our Advisory Services or submit personal data through our site.

1. SCOPE AND APPLICABILITY

1.1 Services Covered

This Privacy Policy applies to ERMITS Advisory Services, including:

Cybersecurity Advisory Services:

  • CMMC consulting and readiness assessments
  • Cybersecurity program development and maturity assessments
  • Incident response planning and tabletop exercises
  • Security architecture review and recommendations
  • Vulnerability management program development

Compliance Advisory Services:

  • NIST SP 800-171 compliance consulting
  • DFARS compliance guidance
  • HIPAA Security Rule consulting
  • Privacy compliance advisory (GDPR, CCPA/CPRA, PIPEDA)
  • Policy and procedure development

Third-Party Risk Management Advisory:

  • Vendor risk assessment consulting
  • Supply chain security advisory
  • Third-party due diligence support
  • Vendor security questionnaire development

Privacy Advisory Services:

  • Privacy program development
  • Data Protection Impact Assessments (DPIA)
  • Privacy by Design consulting
  • Data breach response and notification advisory
  • Privacy policy development

Strategic Advisory Services:

  • Executive advisory and virtual CISO services
  • Cybersecurity roadmap development
  • Budget planning and resource allocation guidance
  • Technology selection and vendor evaluation support
  • Board-level reporting and communication strategies

1.2 What This Policy Does NOT Cover

This Privacy Policy does NOT apply to:

  • ERMITS software products and platforms (covered by Master Privacy Policy)
  • Job applicant data (covered by Recruitment Privacy Notice)

Visits to the public marketing site at https://www.ermits-advisory.com/ (including the Cyber Exposure Brief and intake forms such as Talk to an advisor) are covered by this policy together with our Cookie & Portal Policy. Other ERMITS web properties may post separate notices.

1.3 Geographic Scope

This Privacy Policy applies to clients worldwide and complies with:

  • General Data Protection Regulation (GDPR) - European Union, United Kingdom, Switzerland
  • California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)
  • Personal Information Protection and Electronic Documents Act (PIPEDA) - Canada
  • Lei Geral de Proteção de Dados (LGPD) - Brazil
  • Other applicable privacy and data protection laws

1.4 Public site, analytics, intake, and Cyber Exposure Brief

On https://www.ermits-advisory.com/, we use Google Analytics 4 (measurement ID G-VEQXJHYNHG) with IP anonymization enabled, as described in our Cookie & Portal Policy. You may use browser controls or opt-out tools to limit analytics cookies.

Intake requests (for example the Talk to an advisor form) are submitted through our hosting provider's form handling (Netlify). Information you enter is processed to respond to your request and to operate our business.

The Cyber Exposure Brief runs in your browser; inputs and results are processed locally unless you choose to copy them or submit them through an intake form. ERMITS does not receive Brief content merely because you used the tool.

2. ADVISORY SERVICES DATA HANDLING PRINCIPLES

2.1 Professional Services Privacy Principles

ERMITS Advisory Services are built on professional consulting best practices:

1. Client Confidentiality

All client information is treated as confidential and protected under:

  • Non-Disclosure Agreements (NDAs) executed prior to engagement
  • Professional confidentiality standards
  • Attorney-client privilege (where applicable with legal counsel involvement)
  • Contractual confidentiality obligations in Statement of Work (SOW)

2. Need-to-Know Access

Only ERMITS personnel directly involved in your engagement have access to your information:

  • Consultants assigned to your project
  • Technical specialists providing support
  • Quality assurance reviewers (under confidentiality obligations)
  • Senior advisors providing oversight

3. Data Minimization

We collect only information necessary to deliver Advisory Services:

  • Information required for the specific engagement scope
  • Background information for context and recommendations
  • Documentation necessary for deliverable production
  • Contact information for communication and billing

4. Secure Handling

Client data is protected through:

  • Encrypted transmission (TLS 1.3) for all electronic communications
  • Encrypted storage for client documents and deliverables
  • Secure file sharing platforms (encrypted client portals)
  • Physical security for any paper documents

5. Limited Retention

Client data is retained only as long as necessary:

  • During active engagement period
  • For contractual warranty periods (typically 90 days post-delivery)
  • As required by professional standards and legal obligations
  • As agreed in engagement contracts or SOWs

3. INFORMATION WE COLLECT

3.1 Client Contact and Business Information

What We Collect:

  • Primary contact information (name, title, email, phone)
  • Company information (name, address, industry, size)
  • Billing contact information
  • Secondary contacts (technical leads, project managers)
  • Organizational structure (as relevant to engagement scope)

Why We Collect:

  • Establish and maintain client relationships
  • Communicate about engagement scope, deliverables, and recommendations
  • Deliver advisory services and consulting reports
  • Process invoices and payments
  • Provide ongoing support during warranty period

Legal Basis (GDPR):

  • Contract performance
  • Legitimate interests (business relationship management)

3.2 Engagement-Specific Information

Depending on the nature of your engagement, we may collect:

Cybersecurity Assessment Information:

  • Current security controls and implementations
  • Network architecture diagrams and documentation
  • Security policies, procedures, and standards
  • Incident response plans and documentation
  • Vulnerability scan results and penetration test reports
  • Security tool configurations and logs (sanitized/anonymized)

Compliance Assessment Information:

  • System Security Plans (SSPs)
  • Plans of Action and Milestones (POA&Ms)
  • Compliance documentation and evidence
  • Audit findings and remediation status
  • Policy and procedure documents
  • Training records and certification status

Risk Assessment Information:

  • Business context and critical assets
  • Threat landscape and risk tolerance
  • Existing risk registers and assessments
  • Vendor and third-party relationships
  • Business continuity and disaster recovery plans

Privacy Assessment Information:

  • Data inventory and data flow mapping
  • Privacy policies and notices
  • Data processing activities (Article 30 records)
  • Data Protection Impact Assessments (DPIAs)
  • Data subject request procedures
  • Privacy incident history

Organizational Information:

  • Business processes and workflows
  • IT infrastructure and technology stack
  • Organizational roles and responsibilities
  • Budget and resource constraints
  • Strategic objectives and priorities

We Do NOT Require:

  • Production data or live datasets
  • Personal data of your employees or customers (beyond contact information)
  • Credentials or passwords to your systems
  • Controlled Unclassified Information (CUI) or classified data
  • Protected Health Information (PHI) beyond what's necessary for HIPAA consulting
  • Payment card data (PCI data)

3.3 Information from Meetings and Communications

What We Collect:

  • Meeting notes and discussion summaries
  • Email and messaging communications
  • Interview responses (from stakeholder interviews)
  • Workshop participation and feedback
  • Presentation materials and responses
  • Follow-up questions and clarifications

How We Use:

  • Inform recommendations and deliverables
  • Document engagement activities
  • Provide context for advisory guidance
  • Support deliverable accuracy and completeness

Retention:

  • Meeting notes retained for engagement duration + 3 years
  • Communications retained per engagement contract terms
  • Documentation supporting deliverables retained for professional standards compliance

3.4 Information We Collect About Your Systems (With Permission)

With your explicit authorization, we may observe or collect:

During Security Assessments:

  • System configurations (sanitized of sensitive data)
  • Security control implementations
  • Log samples (anonymized and sanitized)
  • Security tool outputs
  • Network traffic patterns (aggregated, anonymized)

Privacy Protections:

  • All access conducted under signed authorization
  • Access limited to scope defined in SOW
  • No collection of personal data, CUI, or sensitive business data
  • All observations documented and disclosed to client
  • Client retains full control and oversight

3.5 Information from Third Parties

We may receive information from:

Professional References:

  • Contact information from mutual business contacts
  • Professional reputation and background information

Subcontractors and Partners:

  • Technical findings from authorized subcontractors
  • Specialist assessments (under same confidentiality terms)

Public Sources:

  • Publicly available company information
  • Industry reports and threat intelligence
  • Regulatory guidance and best practices
  • Published security advisories

We Do NOT:

  • Purchase client data from data brokers
  • Conduct covert investigations or surveillance
  • Access systems without explicit authorization
  • Share your information with partners without your consent

4. HOW WE USE INFORMATION

4.1 Service Delivery

We use collected information to:

Provide Advisory Services:

  • Conduct assessments and evaluations per SOW
  • Develop recommendations and strategic guidance
  • Produce deliverables (reports, roadmaps, policies, procedures)
  • Present findings and recommendations to stakeholders
  • Answer questions and provide clarifications
  • Support implementation of recommendations (if contracted)

Quality Assurance:

  • Internal review of deliverables for accuracy and completeness
  • Technical review by subject matter experts
  • Engagement oversight by senior advisors
  • Compliance with professional standards

Client Communication:

  • Project status updates and milestone notifications
  • Scheduling meetings and coordination
  • Deliverable transmission and review
  • Issue escalation and resolution
  • Post-engagement support during warranty period

4.2 Business Operations

We use information for legitimate business purposes:

Billing and Payment:

  • Generate invoices based on engagement terms
  • Process payments and maintain financial records
  • Track project hours and expenses (for time-and-materials engagements)
  • Comply with tax and accounting requirements

Engagement Management:

  • Resource allocation and consultant assignment
  • Project timeline and milestone tracking
  • Scope management and change control
  • Contract compliance and deliverable tracking

Legal and Compliance:

  • Comply with legal obligations and regulations
  • Respond to lawful requests from authorities
  • Enforce contracts and protect legal rights
  • Maintain professional liability insurance requirements
  • Comply with industry professional standards

4.3 Professional Development and Service Improvement

We may use anonymized, aggregated information to:

Improve Services:

  • Identify common client challenges and needs
  • Develop new service offerings and methodologies
  • Refine assessment frameworks and tools
  • Train and develop consultant capabilities

Research and Thought Leadership:

  • Publish anonymized case studies (with explicit client permission)
  • Develop industry reports and white papers
  • Contribute to industry standards and best practices
  • Present at conferences and professional events

Privacy Protections:

  • All use is with anonymized, aggregated data only
  • No client-identifiable information disclosed without explicit written consent
  • Minimum anonymity set of 10+ organizations for any published statistics
  • Opt-out available for inclusion in anonymized datasets

4.4 What We Do NOT Do

ERMITS Advisory Services Does NOT:

  • Sell or license your information to third parties
  • Use your data for marketing to other clients
  • Share your confidential information with competitors or other clients
  • Disclose engagement details without your explicit consent
  • Retain information longer than contractually necessary
  • Access your systems beyond authorized scope
  • Train AI models on your confidential data
  • Create benchmark databases with identifiable client data
  • Publish case studies without explicit written permission

5. INFORMATION SHARING AND DISCLOSURE

5.1 Limited Information Sharing

ERMITS shares client information only in the following circumstances:

With Your Consent:

  • Sharing deliverables with your designated third parties
  • Joint presentations with your technology vendors
  • Collaboration with your legal counsel or other advisors
  • Case studies or testimonials (with explicit written permission)

Service Providers (Under NDA):

  • Secure file sharing platforms (Supabase, encrypted storage)
  • Payment processors (Stripe for invoicing)
  • Document collaboration tools (as needed for engagement delivery)
  • Professional liability insurance carriers (for coverage verification)

Subcontractors and Specialists:

  • Technical specialists providing niche expertise
  • All subcontractors bound by equivalent confidentiality terms
  • Client notification and approval for subcontractor involvement
  • ERMITS remains responsible for subcontractor confidentiality

Legal and Regulatory Requirements:

  • Court orders, subpoenas, or legal process
  • Regulatory investigations or examinations
  • National security requests (where legally required)
  • Professional standards board inquiries

5.2 Confidentiality Protections

All service providers and subcontractors must:

  • Execute Non-Disclosure Agreements (NDAs) with ERMITS
  • Implement equivalent security and privacy measures
  • Use data only for specified purposes (supporting your engagement)
  • Delete or return data upon engagement completion
  • Comply with applicable privacy laws (GDPR, CCPA, etc.)

5.3 Professional References and Case Studies

References:

  • We may request your permission to list you as a client reference
  • You may decline or specify limited reference scope
  • References provided only with your explicit consent
  • You may withdraw consent at any time

Case Studies:

  • Require explicit written permission before publication
  • Client review and approval of all content before publication
  • Option to be identified or remain anonymous
  • Right to request removal of published case studies

5.4 Legal Disclosures

When legally required to disclose information:

Our Commitments:

  • Notify you promptly of requests (when legally permitted)
  • Challenge overbroad or improper requests
  • Provide minimum information required by law
  • Seek protective orders for sensitive information
  • Document all disclosures for your records

Limitations:

  • Cannot notify if legally prohibited (e.g., national security letters)
  • Cannot refuse legally valid court orders
  • Must comply with regulatory examination requests
  • Professional standards may require disclosure in limited circumstances

6. DATA SECURITY MEASURES

6.1 Technical Security Controls

Data in Transit:

  • TLS 1.3 encryption for all electronic communications
  • Secure file transfer protocols (SFTP, HTTPS)
  • Encrypted email options available (S/MIME, PGP)
  • VPN connections for remote system access

Data at Rest:

  • AES-256 encryption for stored client documents
  • Encrypted file storage platforms (Supabase with encryption)
  • Encrypted laptop drives (BitLocker, FileVault)
  • Secure document destruction (digital wiping, physical shredding)

Access Controls:

  • Multi-factor authentication (MFA) required for all consultants
  • Role-based access control (RBAC) for client data
  • Strong password requirements (minimum 16 characters)
  • Automatic session timeout and screen locking
  • Privileged access monitoring and logging

Endpoint Security:

  • Company-managed devices with security controls
  • Endpoint detection and response (EDR) software
  • Regular security patching and updates
  • Full-disk encryption on all devices
  • Remote wipe capability for lost/stolen devices

6.2 Physical Security

Office Security:

  • Controlled access to office facilities
  • Visitor management and escort policies
  • Secure document storage (locked cabinets)
  • Clean desk policy for confidential materials
  • Secure disposal (shredding) of paper documents

Remote Work Security:

  • Home office security requirements for consultants
  • Prohibition on public Wi-Fi for client work
  • Private workspace requirements for video calls
  • Secure storage of client materials at home

6.3 Operational Security

Consultant Training:

  • Annual security awareness training
  • Privacy and confidentiality training
  • Data handling and classification training
  • Incident response training
  • Client data protection protocols

Background Checks:

  • Background checks for all consulting personnel
  • Enhanced screening for sensitive engagements
  • Confidentiality agreements signed by all personnel
  • Code of professional conduct

Document Handling:

  • Classification of client documents (Confidential, Highly Confidential)
  • Secure transmission protocols for document sharing
  • Version control and document tracking
  • Secure deletion after retention period

6.4 Security Incident Response

In the event of a security incident affecting client data:

Immediate Response (0-24 hours):

  • Containment and isolation of affected systems
  • Assessment of scope and impact
  • Notification to affected clients within 24 hours
  • Engagement of incident response procedures

Investigation (24-72 hours):

  • Forensic analysis of incident
  • Determination of data affected
  • Root cause identification
  • Evidence preservation

Notification (Within 72 hours):

  • Formal written notification to affected clients
  • Details of incident, data affected, and remediation steps
  • Recommendations for client protective measures
  • Ongoing communication and updates

Remediation:

  • Implementation of corrective measures
  • Enhanced security controls
  • Post-incident review and lessons learned
  • Updated security procedures

7. DATA RETENTION AND DELETION

7.1 Active Engagement Data

During active engagements, we retain:

Data Type Retention Period Purpose
Client Contact Information Engagement duration + 7 years Contract compliance, communication, professional standards
Engagement Deliverables Engagement duration + 7 years Warranty support, professional liability, legal compliance
Working Documents Engagement duration + 3 years Quality assurance, issue resolution, professional standards
Meeting Notes Engagement duration + 3 years Deliverable support, context documentation
Communications (Email) Engagement duration + 7 years Contract compliance, dispute resolution, professional standards
Financial Records 7 years from engagement end Tax compliance, audit requirements, financial regulations

7.2 Post-Engagement Retention

After engagement completion:

Warranty Period (Typically 90 days):

  • Full engagement file retained for issue resolution
  • Client access to consultants for questions and clarifications
  • Errata or corrections to deliverables if needed

Professional Standards Period (3 years):

  • Core deliverables and supporting documentation retained
  • Required for professional liability insurance
  • Support for quality assurance and peer review
  • Evidence of professional standards compliance

Legal Compliance Period (7 years):

  • Financial records and invoices
  • Contracts and Statements of Work
  • Core deliverables (final reports)
  • Required by tax regulations and professional standards

7.3 Data Deletion Process

At the end of retention periods:

Automated Deletion:

  • Working documents deleted after 3 years
  • Communications purged from email systems
  • Encrypted files deleted and keys destroyed

Verified Deletion:

  • Secure data wiping (DoD 5220.22-M standard)
  • Physical document shredding (cross-cut, unrecoverable)
  • Certificate of destruction available upon request

Early Deletion Requests:

  • Clients may request early deletion of data
  • Subject to legal and professional standard requirements
  • Cannot delete financial records (7-year requirement)
  • Cannot delete documents under legal hold
  • Deletion typically completed within 30 days of request

7.4 Engagement File Closeout

Upon engagement completion:

  1. Deliverable Handoff: Final deliverables transmitted to client
  2. File Review: Engagement file reviewed for completeness
  3. Data Classification: Client data classified for retention/deletion
  4. Secure Storage: Long-term retention materials moved to secure archive
  5. Access Restriction: Access limited to authorized personnel only
  6. Deletion Scheduling: Short-term materials scheduled for deletion

8. YOUR PRIVACY RIGHTS

8.1 Universal Rights (All Clients)

All clients have the following rights:

Right to Access:

  • Request copies of all information we hold about you or your organization
  • Receive engagement files and working documents
  • Obtain documentation of data processing activities
  • Request: privacy@ermits.com

Right to Rectification:

  • Correct inaccurate information in our records
  • Update contact information or organizational details
  • Request corrections to deliverables (during warranty period)
  • Turnaround: 10 business days

Right to Deletion:

  • Request deletion of information (subject to legal/professional requirements)
  • Cannot delete financial records (7-year legal requirement)
  • Cannot delete documents under legal hold
  • Deletion completed within 30 days (where legally permissible)

Right to Restrict Processing:

  • Request limitation of data use
  • Object to specific processing activities
  • Suspend processing pending dispute resolution

Right to Data Portability:

  • Receive engagement data in machine-readable format (JSON, XML, CSV)
  • Transfer data to another service provider
  • Provided at no charge within 30 days

Right to Object:

  • Object to processing for research or thought leadership
  • Opt out of anonymized data aggregation
  • Decline reference or case study requests

8.2 Additional Rights for EU/UK/Swiss Clients (GDPR)

Legal Basis for Processing:

We process your data based on:

  • Contract: To perform advisory services under our engagement agreement
  • Legitimate Interests: Professional standards compliance, quality assurance, legal compliance
  • Consent: For case studies, testimonials, marketing communications (explicit opt-in)
  • Legal Obligation: Tax compliance, regulatory requirements, legal process

Right to Lodge a Complaint:

Data Protection Officer:

Right to Withdraw Consent:

  • Withdraw consent for optional processing anytime
  • Does not affect processing based on contract or legal obligation
  • Does not invalidate prior processing conducted with consent

8.3 Additional Rights for California Clients (CCPA/CPRA)

Right to Know:

  • Categories of personal information collected
  • Sources of personal information
  • Business purposes for collection
  • Categories of third parties with whom we share information
  • Specific pieces of personal information collected

Right to Delete:

  • Request deletion of personal information (subject to exceptions)
  • Exceptions: Contract performance, legal compliance, professional standards

Right to Opt-Out of Sale:

ERMITS Advisory Services does not sell client information

  • We have not sold personal information in the past 12 months
  • We will not sell your information in the future

Right to Non-Discrimination:

  • Equal service quality regardless of privacy rights exercise
  • No penalties for exercising privacy rights

Authorized Agent:

  • May designate an authorized agent to make requests
  • Agent must provide written authorization
  • We may require identity verification

Submit Requests:

8.4 Exercising Your Rights

How to Submit Requests:

Email:
  • Address: privacy@ermits.com
  • Subject: "Privacy Rights Request - Advisory Services"
  • Include: Name, organization, email, description of request
Online Form:

Submit requests via our{' '} Privacy Rights Request Form

Verification Process:

  • Email verification to registered contact
  • Additional verification for sensitive requests (government ID, contract details)
  • Authorized representatives must provide written authorization

Response Timeline:

  • Initial acknowledgment: 10 business days
  • Complete response: 30 days (GDPR), 45 days (CCPA)
  • Extensions: May extend with notice for complex requests

No Cost:

  • First two requests per year are free
  • Reasonable fees for excessive or repetitive requests

9. INTERNATIONAL DATA TRANSFERS

9.1 Data Processing Locations

ERMITS Advisory Services operates from the United States. Client data may be:

Processed in:

  • United States (primary operations)
  • European Union (EU-based consultants for EU clients)
  • Canada (Canadian consulting team)

Stored in:

  • United States (encrypted cloud storage - Supabase US)
  • European Union (optional EU data residency for EU clients)
  • Client-designated locations (for on-premises engagements)

9.2 Safeguards for International Transfers

For data transfers from EEA, UK, or Switzerland to the United States:

Standard Contractual Clauses (SCCs):

  • European Commission-approved SCCs (Decision 2021/914)
  • Module Two (Controller to Processor) for subprocessors
  • Module One (Controller to Controller) for consulting relationships
  • Full text available upon request: privacy@ermits.com

UK International Data Transfer Addendum:

  • UK Addendum to EU SCCs for UK clients
  • Compliance with UK GDPR requirements
  • Approved by UK Information Commissioner's Office (ICO)

Swiss Data Transfer Mechanisms:

  • Swiss-adapted Standard Contractual Clauses
  • Compliance with Swiss Federal Data Protection Act (FADP)
  • Swiss FDPIC-approved transfer mechanisms

Additional Safeguards:

  • End-to-end encryption for all data transfers
  • Access controls and authentication (MFA, RBAC)
  • Data minimization (collect only what's necessary)
  • Regular security assessments and audits
  • Incident notification within 72 hours
  • Client notification of government access requests (when legally permitted)

9.3 Data Residency Options

EU Data Residency (Available):

  • EU-based consultants for EU client engagements
  • Data stored in EU regions only (Supabase EU - Frankfurt)
  • No transfer to United States (unless client authorizes)
  • Request at engagement initiation: privacy@ermits.com

On-Site Engagements:

  • Consultant travel to client location
  • Data processed and stored at client facilities
  • No transmission to ERMITS infrastructure (if preferred)
  • Client retains complete control of data

Client-Controlled Storage:

  • Store all engagement data on client-provided infrastructure
  • ERMITS access via secure VPN or on-site only
  • No ERMITS cloud storage used
  • Available for sensitive engagements (CUI, classified, ITAR)

10. SPECIAL CONSIDERATIONS

10.1 Federal Contractor Clients (CUI/FCI)

For clients handling Controlled Unclassified Information (CUI) or Federal Contract Information (FCI):

Special Protections:

  • CUI/FCI is NOT stored on ERMITS infrastructure
  • All CUI/FCI processed on-site at client facilities or client-approved systems
  • ERMITS consultants access CUI/FCI only under client supervision and authorization
  • Consultants trained on CUI/FCI handling per NIST SP 800-171 and 32 CFR Part 2002

Client Responsibilities:

  • Properly mark CUI/FCI per regulations
  • Provide secure workspace and systems for consultant access
  • Monitor and log consultant access to CUI/FCI
  • Report cyber incidents per DFARS 252.204-7012 (ERMITS will cooperate)

ERMITS Responsibilities:

  • Personnel with CUI/FCI access undergo background checks
  • Sign SF-312 Classified Information Nondisclosure Agreement (if required)
  • Comply with client's CUI/FCI handling procedures
  • Do not transmit CUI/FCI outside authorized systems
  • Report suspected security incidents immediately

Incident Reporting:

  • ERMITS will immediately report suspected incidents to client
  • Client is responsible for reporting to DoD within 72 hours
  • ERMITS will cooperate with authorized investigations

10.2 Healthcare Clients (HIPAA)

For healthcare organizations subject to HIPAA:

Business Associate Agreement (BAA):

  • Required before any access to Protected Health Information (PHI)
  • Executed as part of engagement contract
  • HIPAA-compliant safeguards implemented
  • Request: privacy@ermits.com

PHI Handling:

  • PHI accessed only as necessary for engagement scope
  • Minimum necessary standard applied
  • PHI not stored on ERMITS infrastructure (processed at client site)
  • Encrypted transmission if PHI must be transmitted
  • Breach notification within 48 hours

Recommended Approach:

  • Use de-identified or anonymized data for assessments (when possible)
  • On-site consulting to avoid PHI transmission
  • Client retains all PHI on client-controlled systems
  • ERMITS access via secure client VPN only

Your Responsibilities:

  • Determine if BAA is required for engagement scope
  • Execute BAA before PHI access
  • Provide HIPAA training to ERMITS consultants (if required)
  • Supervise consultant access to PHI
  • Report breaches involving PHI per HIPAA Breach Notification Rule

10.3 Financial Services Clients (GLBA, SOX, PCI-DSS)

For financial institutions and public companies:

Special Protections:

  • No access to customer financial data or payment card information
  • No storage of financial records on ERMITS systems
  • Consultants sign confidentiality agreements acknowledging SOX requirements
  • Support for SOX 404 compliance assessments (IT general controls)

Compliance Support:

  • Advisory services designed to support GLBA, SOX, PCI-DSS compliance
  • No certification or attestation authority (recommend third-party auditors)
  • Deliverables may be used to support compliance programs
  • Professional services do not constitute audit or assurance

Restrictions:

  • Do not process payment card data (PCI data)
  • Do not access customer personally identifiable information (PII)
  • Financial records reviewed on-site or via sanitized/anonymized samples
  • Client retains all sensitive financial data

10.4 Attorney-Client Engagement Model

For engagements conducted at the direction of legal counsel:

Attorney-Client Privilege Protection:

  • ERMITS may be engaged by your legal counsel to provide technical consulting
  • Work product prepared at counsel's direction may be privileged
  • Communications routed through legal counsel to preserve privilege
  • Disclosure restrictions to protect privilege

Our Role:

  • Technical advisor to legal counsel
  • Consultant under attorney work-product doctrine
  • No independent client relationship (engagement through counsel only)

Maintaining Privilege:

  • Clearly identify counsel as client in engagement documents
  • Route all communications through legal counsel
  • Mark documents "Attorney-Client Privileged - Prepared at Request of Counsel"
  • Limit disclosure to preserve privilege

Not Legal Advice:

  • ERMITS provides technical and cybersecurity consulting only
  • We are not attorneys and do not provide legal advice
  • Legal counsel responsible for legal advice and strategy
  • Consult your attorney regarding privilege protections

11. CHILDREN'S PRIVACY

ERMITS Advisory Services are business-to-business professional services not directed at children under 18. We do not knowingly collect information from children under 18.

If we learn we have inadvertently collected information from a child under 18, we will delete it immediately.

12. UPDATES TO THIS PRIVACY POLICY

12.1 Policy Updates

We may update this Privacy Policy to reflect:

  • Changes in advisory service offerings
  • Legal or regulatory developments
  • Industry best practices for professional services
  • Client feedback

12.2 Notification of Changes

Material Changes:

  • 30 days' advance notice via email to active clients
  • Opportunity to discuss changes with your account manager
  • Option to terminate engagement if you object to changes (during active engagement)

Non-Material Changes:

  • Update "Last Updated" date
  • Effective immediately upon posting
  • Notification in next scheduled client communication

12.3 Version History

Previous versions available upon request: privacy@ermits.com

Current Version: 1.1 (April 2026)

13. CONTACT INFORMATION

13.1 Advisory Services Privacy Inquiries

General Privacy Questions:

Email: privacy@ermits.com

Subject: "Advisory Services Privacy Inquiry"

Website: https://www.ermits-advisory.com/privacy-policy.html

Data Rights Requests:

Email: privacy@ermits.com

Subject: "Privacy Rights Request - Advisory Services"

Engagement-Specific Questions:

Contact your assigned consultant or project manager

Email: advisory@ermits.com

For technical support inquiries:

Email: support@ermits.com

13.2 Jurisdiction-Specific Contacts

Data Protection Officer (EU/UK/Swiss):

Email: privacy@ermits.com

Subject: "GDPR Inquiry - Advisory Services"

California Privacy Requests (CCPA/CPRA):

Email: privacy@ermits.com

Subject: "CCPA Request - Advisory Services"

HIPAA Privacy Officer (Healthcare Clients):

Email: privacy@ermits.com

Subject: "HIPAA Privacy Matter - Advisory Services"

13.3 Security Concerns

Security Issues or Data Breaches:

Email: security@ermits.com

Subject: "Security Issue - Advisory Services [Urgent]"

13.4 Mailing Address

ERMITS LLC - Advisory Services

[Physical Address to be inserted]

Attn: Privacy Team - Advisory Services

14. EFFECTIVE DATE AND ACCEPTANCE

Effective Date: April 21, 2026

Last Updated: April 21, 2026

By engaging ERMITS Advisory Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

If you do not agree with this Privacy Policy, please discuss concerns with us before engagement commencement or terminate the engagement in accordance with contract terms.

ERMITS Advisory Services - Professional. Confidential. Trusted.

Advisory Terms of Service Advisory Acceptable Use Policy Cookie & Portal Policy

These policies apply to ERMITS Advisory Services only. For software product policies, see{' '} Product Privacy Policy.