Privacy policy

This policy describes how Sosa & Arvelo, LLC (“Sosa & Arvelo,” “we,” “us”) collects, uses, and shares information when you visit sosaarvelo.com or contact us through this site.

It covers this website. It does not cover information we receive under a separate engagement letter or other written agreement. Those relationships are governed by that agreement.

Sosa & Arvelo, LLC is the controller of personal information collected through this site.

01What this site does — and does not — collect

This site is informational. You can read published pages and send us a message through the contact form.

This is a brochure website. It does not offer user registration, comments, Gravatar, or image uploads by visitors, and it does not extract EXIF GPS data from photos.

We collect the following.

Information you send us. If you use the contact form or email [email protected], we receive what you provide: name, email address, telephone number if you include one, organization, the subject you select (for example nonprofit finance, security and compliance, or general), and the content of your message. We use that information to respond to you and, if you ask us to, to discuss a possible engagement.

Technical information created by visiting the site. Our hosting environment may record standard server logs: IP address, browser type, referring URL, pages requested, and date and time. We use this to operate and secure the site.

Analytics. This site runs no third-party analytics. There is no Google Analytics tag, no advertising pixel, and no visitor-tracking script. Fonts are served from this site rather than from a font provider. What we can see about a visit is the server-log information described above, and nothing more.

Cookies. The site may set cookies that are strictly necessary to deliver pages (for example a session or security cookie). Cloudflare Turnstile, which checks that a contact-form submission is not automated, may set a short-lived cookie as part of that check. The optional Chat.co assistant may set cookies under Chat.co’s terms.

We do not collect payment-card numbers through this site.

02Why we use the information

We use site information to:

• respond to inquiries and consultation requests;
• operate, secure, and diagnose the website;
• meet legal obligations, including a request from a regulator or court; and
• establish, exercise, or defend legal claims.

We do not use site information to make automated decisions that produce legal or similarly significant effects.

03Lawful basis

For visitors in jurisdictions that require a lawful basis, we rely on:

• steps at your request, before a contract — when you ask us to discuss work or request a consultation;
• legitimate interests — operating a professional-services website, responding to people who write to us, and keeping the site secure, where those interests are not overridden by your rights; and
• consent — where a non-essential cookie requires it.

If you are in the United States, we collect and use the information described above in order to respond to you, run the site, and comply with law.

04We do not sell personal information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use contact-form contents to build advertising audiences.

05Who we share information with

We share information only as needed to run the site and respond to you:

• Hosting providers that operate sosaarvelo.com.
• Form processor. The contact form is sent through Resend and delivered to [email protected]. Before it sends, Cloudflare Turnstile checks that the submission is not automated.
• Email transmission. Messages sent to [email protected] travel through ordinary email systems. Transport encryption (TLS) is typical. We do not claim end-to-end encryption of ordinary email.
• Consultations are arranged by email or telephone after you write to us. There is no third-party scheduling tool on this site.
• Chat widget. The optional Chat.co assistant (bot 69eb944a39891e4f3f97a845) may process questions you type into that widget under Chat.co’s terms.
• Professional advisers and authorities when we are legally required to disclose information, or when we must establish or defend a legal claim.

Processors are permitted to use the information only to provide their service to us.

We do not disclose contact-form contents to unaffiliated marketing lists.

06Retention

• Contact-form and inquiry email: kept for as long as needed to respond and to maintain a record of the inquiry. If an inquiry becomes an engagement, retention follows the engagement file, not this policy.
• Server logs: kept for a limited operating period, then deleted or overwritten in the ordinary course of hosting.

07Security

We use administrative, technical, and physical safeguards appropriate to a small professional-services firm operating a public website. No method of transmission or storage is completely secure. If you need to send sensitive documents, ask us for a channel before you attach them to a web form or an unencrypted email.

08Breach notification

In the event of a data breach affecting personal information we hold, we will notify affected individuals within 48 hours of detection, and we will notify any regulator the law requires, on the timeline that law sets.

That 48-hour client-notice commitment is a firm practice. It is not a substitute for statutory clocks that may be shorter or longer (for example, a 72-hour superintendent notice under 23 NYCRR 500.17, or other sector-specific rules).

09Your rights

Depending on where you live, you may have the right to request access to the personal information we hold about you, correction of inaccurate information, deletion, and a copy of information you provided to us. You may also have the right to appeal a refusal.

To make a request, write to [email protected]. We will need enough information to confirm that the request is yours. We will not discriminate against you for exercising a privacy right.

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with a supervisory authority, you may also lodge a complaint with that authority. We would rather hear from you first.

10Children

This site is directed at organizations and the adults who run them. We do not knowingly collect personal information from children.

11International visitors

The site is operated from the United States. If you write to us from another country, your information will be processed in the United States, where privacy law may differ from the law where you live.

12Changes to this policy

We will post updates on this page and change the “Last updated” date. If a change materially expands how we use information you already gave us, we will say so in plain language at the top of the page.

13How to contact us

Controller: Sosa & Arvelo, LLC
Email: [email protected]
Telephone: +1 917 410 3335

Legal notice address: 99 Wall Street, Suite 557, New York, NY 10005. This is a virtual office used for legal notices. It is not presented as a New York walk-in office. The site lists offices in Florida, Puerto Rico, New York, and Washington, DC; street addresses for those offices are not published on this page.

If you have a question about this policy, or about personal information we hold, use the email above.