Data Protection & Governance

Privacy Policy & Data Protection Notice

Last Updated: October 2026 • Corporate Entity: Call Center Options, LLC (Jacksonville, FL) • Written for CCPA/CPRA, FDBR & GDPR

Related Disclosures: 📜 Terms of Service 🍪 Cookie & Telemetry Policy

🛡️ Privacy-First Engineering Principle

Call Center Options, LLC d/b/a Internet Security Consultants (a Florida limited liability company) operates under a strict, privacy-by-design architecture. We collect only the minimum technical information necessary to deliver forensic audits, maintain network defense, and assist commercial organizations and their legal counsel. We do not sell, rent, monetize, or broker personal data. We do not engage in cross-context behavioral advertising, and we employ zero third-party marketing pixels.

1. Data Controller Identification

For the purposes of applicable data privacy legislation—including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Florida Digital Bill of Rights (FDBR), the General Data Protection Regulation (GDPR), and related state statutory privacy enactments—the data controller responsible for the processing of your information is:

Call Center Options, LLC d/b/a Internet Security Consultants (a Florida limited liability company)

Jacksonville, Florida, United States of America

Privacy & Data Protection Directorate: [email protected]

2. Categories of Information Collected

Depending on how you interact with our website, we collect two distinct categories of information:

Category A: Voluntary Technical Intake Data

Information you voluntarily provide when requesting a baseline WCAG technical audit or litigation intake:

Business organization or corporate client name;
Target domain name or website URL to be audited;
Professional contact email address;
Optional litigation docket number or court case reference;
Technical notes regarding existing overlay widgets or CMS platforms.

Category B: Automated Edge Diagnostic Telemetry

Technical telemetry automatically captured by our edge delivery network and reverse proxies:

Client Internet Protocol (IP) address (masked/anonymized in analytics);
Browser user-agent, operating system, and screen resolution;
HTTP request timestamps and referring URLs;
Consent preference token stored in your browser's local storage (isc_cookie_consent).

Notice Regarding Sensitive Personal Information: We do NOT collect Social Security numbers, driver's license numbers, racial or ethnic origin, biometric identifiers, or consumer financial payment cards on this public website.

3. Purpose of Processing & Lawful Bases

We process collected data exclusively under the following established lawful grounds:

1. Performance of Pre-Contractual & Contractual Steps: Processing intake submissions to perform initial accessibility scans, capture baseline DOM evidence, and deliver diagnostic findings to prospective clients or their retained legal counsel.

2. Legitimate Business Interests: Preserving perimeter network security, mitigating Distributed Denial of Service (DDoS) threats, preventing abusive or automated scraping, and verifying system uptime.

3. Express User Consent: Measuring website performance and reader engagement via Google Analytics 4 strictly when you have provided explicit affirmative consent via our cookie consent banner.

4. Sub-Processors & Service Providers

We engage a strictly limited group of enterprise service providers who process data on our behalf under compliant Data Processing Agreements (DPAs):

Cloudflare, Inc. (USA): Edge content delivery network, reverse proxy, DDoS mitigation, and cookieless performance telemetry.
Google LLC (USA) — Google Analytics 4: Aggregate site traffic measurement. Strictly consent-gated: GA4 is never initialized unless you explicitly click "Accept" on our consent banner. IP anonymization is permanently enabled.
Amazon Web Services, Inc. (USA): Secure transactional email delivery (Amazon SES) relaying intake inquiries over TLS-encrypted SMTP channels.

We maintain zero integrations with data brokers, ad networks, or social tracking pixels (no Meta Pixel, TikTok, or LinkedIn tracking tags).

5. Data Retention Schedules & Evidentiary Archival

Routine edge telemetry logs are retained for thirty (30) days and automatically purged. Technical intake submissions, baseline DOM snapshots, and code audit deliverables are preserved in isolated, encrypted staging sandboxes for as long as necessary to support retained defense counsel during litigation or regulatory review windows (typically three (3) years), after which they are securely expunged in accordance with DoD 5220.22-M sanitation standards.

6. Technical & Cryptographic Security Measures

We implement rigorous organizational and technical safeguards:

Mandatory Transport Layer Security (TLS 1.3 / HTTPS) with HTTP Strict Transport Security (HSTS) headers;
Decoupled containerized architectures with zero public-facing database endpoints;
Least-privilege administrative access controls protected by multi-factor authentication (MFA);
Isolated staging sandboxes preventing spoliation or unintentional alteration of baseline evidence.

7. Your Statutory Privacy Rights (CCPA / CPRA, GDPR, Florida FDBR)

Depending on your geographic jurisdiction, you possess specific legal rights regarding your personal information:

Right to Know & Access: You may request disclosure of the specific pieces and categories of personal information we have collected about you.

Right to Deletion: You may request the permanent deletion of personal information we have collected from you, subject to evidentiary retention exemptions.

Right to Correct: You may request correction of inaccurate personal data maintained in our technical systems.

Right to Opt-Out: You may revoke consent for analytics tracking at any time using our Cookie Policy controls.

We never discriminate against any client, attorney, or individual for exercising statutory privacy rights. To submit a verifiable Data Subject Access Request (DSAR), email our designated privacy team at [email protected]. We will confirm receipt within ten (10) business days and respond substantively within statutory timeframes.

8. Global Privacy Control (GPC) & Do-Not-Track

We honor automated Global Privacy Control (GPC) and Do-Not-Track (DNT) browser signals. If our edge systems detect a valid GPC or DNT signal, non-essential cookies and analytics scripts are automatically suppressed without requiring manual interaction.

9. Children's Online Privacy Protection

Our website and services are intended exclusively for commercial enterprises, corporate officers, and licensed attorneys. We do not knowingly solicit, collect, or process information from individuals under eighteen (18) years of age.

10. Privacy & Compliance Inquiries

For all questions, DSAR requests, or data protection inquiries:

Call Center Options, LLC d/b/a Internet Security Consultants (a Florida limited liability company)

Attn: Data Protection Officer • Privacy Directorate

Jacksonville, Florida, USA

Email: [email protected]