2.2 Information Collected Automatically
When you visit our Site, we automatically collect certain technical and usage information:
2.3 Information from Third-Party Sources
We may receive personal information from third-party sources, including:
2.4 Client Data Processed on Behalf of Our Clients
In delivering our Services, we access and process data within our clients' business systems (CRM records, pipeline data, customer success metrics, support tickets, revenue data, and similar operational information). This data frequently contains personal information belonging to our clients' customers, prospects, and employees. We process this data strictly as a service provider under the direction of our clients and subject to client-specific data processing agreements. We do not sell, share, or use this client data for any purpose other than performing the Services.
How We Use Your Information
We use the personal information we collect for the following purposes:
Benchmark database: VANDFORT maintains a proprietary benchmark database derived from anonymized and aggregated data across client engagements. Individual client data is stripped of all personally identifiable information and company identifiers before inclusion. No individual or company can be identified from benchmark data. This database is used to improve industry benchmarking, refine our diagnostic frameworks, and inform the development of future products including our GTM Health Score tool.
AI and Automated Decision-Making Technology
VANDFORT is an AI-native firm. Artificial intelligence is embedded throughout our service delivery, and we believe in transparent disclosure of how AI is used in our operations.
4.1 How We Use AI
4.2 Human Oversight
AI-generated outputs used in client deliverables are reviewed by VANDFORT's team before being shared with clients. We do not make fully automated decisions that produce legal or similarly significant effects on individuals without meaningful human involvement.
4.3 AI Subprocessors
When we process data using AI tools, the data may be transmitted to the providers of those tools (such as Anthropic and OpenAI) subject to their respective data processing terms. We use API access with data processing agreements in place and, where available, configure our use to minimize data retention by these providers. We do not use client data to train third-party AI models, and we contractually prohibit our AI subprocessors from doing so.
4.4 Your Rights Regarding Automated Processing
You have the right to request information about our use of automated decision-making technology as it relates to you. If you are a California resident, you may have additional rights regarding automated decision-making technology under the CCPA, as described in Section 11. To exercise these rights, contact us at the address listed in Section 15.
Cookies and Tracking Technologies
5.1 Types of Cookies We Use
5.2 Managing Your Cookie Preferences
When you first visit our Site, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookies. You may update your preferences at any time through our cookie settings panel accessible in the Site footer, or by adjusting your browser settings to refuse or delete cookies. Note that disabling certain cookies may affect Site functionality.
5.3 Do Not Track & Global Privacy Control
Our Site honors Global Privacy Control (GPC) signals. When we detect a GPC signal from your browser, we treat it as a valid opt-out request for the sale or sharing of personal information and for targeted advertising, in compliance with applicable state privacy laws. We also honor Do Not Track (DNT) browser signals by disabling non-essential tracking when such signals are detected.
Information Sharing and Disclosure
VANDFORT does not sell your personal information. We do not rent, trade, or otherwise make your personal information available to third parties for their own marketing purposes.
We may disclose your personal information in the following limited circumstances:
6.1 Service Providers and Contractors
We share personal information with trusted service providers and independent contractors who perform services on our behalf, including CRM hosting, email delivery, payment processing, analytics, cloud infrastructure, and specialized consulting services (such as CS Operations platform specialists and revenue intelligence analysts). These parties are contractually obligated to use the information only for the purposes we specify and to maintain appropriate security measures.
6.2 Professional Tools and Platforms
In delivering our Services, information may be processed through professional tools and platforms including HubSpot, Salesforce, Clay, Zapier, Make, Google Workspace, Slack, and similar business software. Each of these platforms operates under its own privacy policy and data processing terms.
6.3 Legal Requirements
We may disclose personal information if required to do so by law or in the good-faith belief that such action is necessary to comply with a legal obligation or valid legal process (such as a subpoena, court order, or government investigation), protect and defend our rights or property, prevent fraud or illegal activity, or protect the personal safety of our users or the public.
6.4 Business Transfers
If VANDFORT is involved in a merger, acquisition, asset sale, reorganization, bankruptcy, or similar business transaction, your personal information may be transferred as part of that transaction. We will notify you via email or prominent notice on our Site before your personal information becomes subject to a different privacy policy.
6.5 With Your Consent
We may share your information in other circumstances with your express consent or at your direction.
6.6 Aggregated and De-Identified Data
We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you. This includes aggregated industry benchmarks, performance trends, and statistical analyses derived from our engagement data. We maintain technical and organizational safeguards to prevent the re-identification of de-identified data and do not attempt to re-identify such data.
Third-Party Services and Subprocessors
Our Site and Services rely on third-party tools and platforms. These third parties have their own privacy policies, and we encourage you to review them. Key categories include:
We maintain data processing agreements with subprocessors that handle personal information on our behalf. A current list of subprocessors is available upon written request to privacy@vandfort.com.
Data Security
We implement commercially reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:
No method of electronic transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. If we become aware of a security breach involving your personal information, we will notify you and any applicable regulatory authorities as required by law.
Data Retention
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Our general retention practices are:
Upon expiration of the applicable retention period, we will securely delete or anonymize the personal information. Anonymized data that cannot be used to identify an individual may be retained indefinitely.
Your Privacy Rights
Depending on your jurisdiction, you may have the following rights regarding your personal information:
How to Exercise Your Rights
You may submit a verifiable request to exercise any of the above rights by contacting us at:
We will verify your identity before processing your request. For requests submitted by email, we may ask you to provide information that matches what we have on file. We will respond to your request within 45 calendar days. If we need additional time (up to 90 days total), we will notify you of the extension and the reason.
You may designate an authorized agent to submit a request on your behalf. We may require the authorized agent to provide proof of written authorization and may verify your identity directly.
California-Specific Disclosures (CCPA/CPRA)
This section provides additional disclosures required under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), effective as of January 1, 2026, including the regulations adopted by the California Privacy Protection Agency.
11.1 Categories of Personal Information Collected
In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:
11.2 Sale and Sharing of Personal Information
VANDFORT does not sell personal information as defined under the CCPA. VANDFORT does not share personal information for cross-context behavioral advertising as defined under the CCPA.
11.3 Sensitive Personal Information
We do not intentionally collect categories of sensitive personal information as defined under the CCPA (such as Social Security numbers, financial account numbers combined with access codes, precise geolocation, racial or ethnic origin, religious beliefs, biometric data, health data, sexual orientation, or the contents of private communications). If we inadvertently receive sensitive personal information in the course of an engagement, we will limit our use to what is strictly necessary to provide the Services and will delete such information promptly when it is no longer needed.
11.4 Automated Decision-Making Technology (ADMT)
VANDFORT uses AI-powered tools in connection with its diagnostic and analytical Services as described in Section 4. Where our use of automated decision-making technology constitutes a "significant decision" as defined by the CCPA's ADMT regulations, we will provide the required pre-use notice and honor your right to opt out and your right to access information about the logic and likely outcome of such processing. As of the effective date of this policy, our use of AI tools does not result in fully automated significant decisions about consumers as contemplated by the ADMT regulations, because all AI outputs are subject to meaningful human review before being incorporated into client deliverables or business decisions.
11.5 Financial Incentives
We do not offer financial incentives in exchange for the collection, sale, or deletion of personal information.
11.6 California "Shine the Light" Law
Under California Civil Code Section 1798.83, California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. As stated above, we do not disclose personal information to third parties for their own direct marketing purposes.
International Data Transfers
VANDFORT is based in the United States, and personal information we collect is stored and processed in the United States. If you are accessing our Site or providing information from outside the United States, please be aware that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction.
By providing your personal information to us, you consent to such transfer, storage, and processing. Where required by applicable law, we will implement appropriate safeguards (such as standard contractual clauses or equivalent mechanisms) to protect personal information transferred internationally.
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal information on the legal bases of legitimate interests (for business development, service improvement, and security purposes), contract performance (for delivering Services you have engaged), consent (where you have provided it, such as for marketing communications), and compliance with legal obligations.
Children's Privacy
Our Site and Services are designed for business professionals and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18 (or the age of digital consent in their jurisdiction). If we become aware that we have inadvertently collected personal information from a child under 18, we will take immediate steps to delete that information. If you believe a child has provided us with personal information, please contact us at privacy@vandfort.com.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. When we make material changes, we will update the "Last Updated" date at the top of this page and, where required by law, provide you with additional notice (such as a banner on our Site or an email notification).
We encourage you to review this Privacy Policy periodically. Your continued use of our Site or Services after the posting of changes constitutes your acceptance of such changes.
If a revision materially reduces your rights, we will make reasonable efforts to notify individuals whose personal information we hold and who would be affected by the change.
Contact Information
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Vandfort LLC — Privacy Inquiries
Mail: Vandfort LLC, Attn: Privacy 2 S Biscayne Blvd, Ste 3200 #5922 Miami, FL 33131 United States
We aim to respond to all privacy-related inquiries within 10 business days. For verifiable consumer requests under applicable privacy laws, we will respond within the timeframes mandated by law.
Governing Law and Dispute Resolution
This Privacy Policy is governed by and construed in accordance with the laws of the State of Florida, United States, without regard to its conflict-of-law provisions, except where preempted by applicable federal law or where a different jurisdiction's privacy law applies to your personal information by its own terms (such as the CCPA for California residents).
Any dispute arising out of or relating to this Privacy Policy that cannot be resolved through good-faith negotiation shall be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, with the arbitration seated in Miami-Dade County, Florida. The arbitrator's award shall be final and binding. Nothing in this section limits either party's right to seek injunctive or equitable relief in a court of competent jurisdiction to prevent irreparable harm.
Notwithstanding the foregoing, nothing in this Privacy Policy shall be construed to limit or override any rights you have under applicable data protection laws, including the right to lodge a complaint with a supervisory authority.