This Privacy Policy applies to the websites, mobile applications, and software platforms (together, the "Sites" and "Services") provided by Santiago & Company Consulting, LLC ("Santiago & Company," "we," "us," or "our"), a company headquartered in Lenexa, Kansas, USA.
The Sites include www.santiagocompany.com, our mobile application, our program and platform management tools, and additional websites or applications produced and managed by Santiago & Company.
Santiago & Company knows that your privacy is important to you and takes user privacy very seriously. We are committed to protecting your personal data in accordance with this Privacy Policy and applicable data protection laws.
Santiago & Company reserves the right, at its sole discretion, to alter and update this Privacy Policy from time to time. We therefore invite you to review the current version of the Privacy Policy each time you return to our Sites.
Depending on the context, Santiago & Company may act as either a Data Controller or a Data Processor with respect to personal data:
When We Act as a Data Controller
We act as a Data Controller when we collect and process personal data for our own purposes, such as:
• When you visit our websites or use our mobile application
• When you subscribe to our publications or marketing communications
• When you inquire about our services or contact us
• When you apply for a position with Santiago & Company
• When you participate in our surveys or join our alumni community
In these situations, this Privacy Policy governs how we collect, use, and protect your personal data.
When We Act as a Data Processor (Service Provider)
We act as a Data Processor when we process personal data on behalf of our clients inconnection with our consulting services.
In these situations:
• Our clients are the Data Controllers and determine the purposes and means of processing.
• We process personal data only in accordance with our clients' documented instructions.
• Our clients' privacy policies govern their collection and use of personal data.
• We maintain appropriate Data Processing Agreements withour clients that establish data protection obligations.
• We implement appropriate technical and organizational security measures to protect client data.
When acting as a Data Processor, we may process categories of personal data such as contact information, professional information, financial information, and business dataon behalf of our clients. The specific data processed depends on the nature ofthe consulting engagement.
If you havequestions about how your personal data is processed by one of our clients,please contact that organization directly.
Santiago & Company collects personal data from you when you request information or supply information through our Sites and Services. This can occur when you fill out a subscription form, make an inquiry about our services, opt in to receive our emails, participate in our surveys, join our alumni community, use our mobile application or software platforms, or apply for a role with us.
Categories of Personal Data We Collect
The personal data we might collect includes:
• Contact information: name, email address, phone number, mailing address
• Professional information: title, occupation, company or university affiliation, industry, region/country
• Relationship information: your relationship to Santiago & Company, your reason for reaching out, topics of interest
• Application information: background information provided during a job application
• Communications: content in messages you send to us
• Usage information: information about how you use ourwebsites, mobile application, and software platforms, as detailed in our Cookie Policy
How We Use Your Personal Data
We use yourpersonal data for the following purposes:
• To respond to your inquiries and provide information you request
• To send you marketing communications (with your consent where required)
• To process and evaluate job applications
• To improve our services, websites, and applications
• To notify you about Santiago & Company events or publications we believe may interest you
• To comply with legal obligations
Declining toshare personal data with us is your prerogative. However, without it, we may beunable to address your inquiries or provide the services you seek.
Santiago & Company uses artificial intelligence ("AI") and automatedtechnologies to enhance our services and operations. We believe in transparency about how these technologies are used.
How We Use AI
We may useAI-powered tools and services for the following purposes:
• Candidate screening and resume parsing during recruitment processes
• Analysis, research, and insights generation in connection with client consulting engagements
• Document review and summarization
• Content creation assistance for publications andcommunications
• Forecasting and predictive analytics
• Improving user experience on our websites and applications
Human Oversight
Important: Santiago & Company does not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. All AI-assisted processes include meaningful human review and oversight beforeany final decisions are made. Human judgment remains central to ourdecision-making processes.
AI Service Providers
We use AI platforms and services from third-party providers to support these capabilities. These providers are listed on our Subprocessors page and are bound by contractual obligations to protect your data.
Santiago & Company develops and operates applications and software platforms as part of our service offerings.
Mobile Application (Santiago Insights App)
Our mobile application provides access to our advisory content and self-service diagnostic tools. The mobile application is designed for reading our published content and conducting self-assessments. The diagnostic tools help users identify business challenges and opportunities.The mobile application does not collect personal data directly from users beyond standard analytics data as described in our Cookie Policy.
Program and Platform Management Tools (Ascent, and Ascent PMI)
We offer web-based program and platform management tools designed to help organizationsmanage strategic initiatives, track progress, and measure outcomes. These tools are enterprise software platforms used by our clients. When you use these platforms as a user authorized by one of our clients, our client is the Data Controller and their privacy policy governs the collection and use of your personal data.
We process data in these platforms as a Data Processor on behalf of our clients. All of our applications and platforms use cookies, analytics, and tracking technologies as described in our Cookie Policy.
Santiago & Company may share your personal data with affiliated companies as well aswith select third parties, which may be located in countries different fromyour country of residence. Santiago & Company will never sell your personaldata to any third party for their own marketing or commercial purposes.
Categories of Recipients
Yourpersonal data may be shared with:
• Other offices within Santiago & Company
• Third-party service providers who help us operate our business, including cloud infrastructure providers, CRM and marketing platforms, collaboration tools, analytics providers, and AI platforms
• Professional advisors including legal counsel andauditors
• Legal authorities or governmental agencies when required by law
Our Subprocessors
We maintain a list of our subprocessors (the third-party service providers who may processpersonal data on our behalf). This list is available at www.santiagocompany.com/policies/subprocessors and includes our:
• Cloud infrastructure providers (Microsoft Azure, AmazonWeb Services, Google Cloud)
• CRM and marketing platforms (HubSpot, Salesforce)
• Collaboration and productivity tools (Microsoft 365, Asana)
• Analytics providers (Google Analytics, Webflow)
• AI platforms (OpenAI, Anthropic, Google, Perplexity AI)
All third parties process your personal data only on Santiago & Company's behalf andin accordance with our instructions. We require all subprocessors to maintain appropriate security measures and comply with applicable data protection laws.
Santiago & Company may publish testimonials, case studies, or other content that references our client work. We only include information that identifies individuals in such materials when we have obtained appropriate permission from those individuals and organizations. If you have provided a testimonial or participated in a case study and wish to update or remove your information, please contact us using the information provided below.
Santiago & Company retains personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.
Specific retention periods vary based on the type of data and the purpose of processing:
• Marketing and CRM data: Retained while we maintain an active relationship with you and for a reasonable period thereafter
• Job application data: Retained for up to five years to consider you for future opportunities
• Client project data: Retained in accordance with our contractual obligations and applicable legal requirements
• Website and application usage data: Retained inaccordance with our Cookie Policy
We maintain automated processes to manage data retention and deletion in accordance withour retention schedules.
Santiago & Company employs cookies and similar technologies to gather informationwhen you explore our websites and use our applications. Details about the data collected, how it is used, and your choices can be found in our Cookie Policy.
Santiago & Company places paramount importance on the security of your personal data. We have implemented robust technical and organizational measures to protect your data from loss, misuse, alteration, or destruction.
Our securitymeasures include:
• Encryption of data in transit and at rest
• Access controls limiting data access to authorized personnel
• Regular security assessments and testing
• Employee training on data protection
• Incident response procedures
Only authorized personnel from Santiago & Company and our service providers haveaccess to your data, and solely for tasks directly related to their roles.
In the event of a personal data breach that poses a risk to your rights and freedoms, Santiago & Company will notify affected individuals and relevant regulatory authorities in accordance with applicable data protection laws. We maintain incident response procedures to detect, investigate, and respond to potential data breaches promptly.
Based on your residence, you may possess certain rights concerning your personal data held by Santiago & Company.
Rights Available to All Users
These rights may include:
• Requesting access to your personal data
• Seeking correction of inaccurate or incomplete information
• Requesting deletion of your personal data
• Objecting to or requesting restriction of processing
• Requesting portability of your data
• Withdrawing consent for data processing
To exercise any of these rights, please use our data subject request form or contact us at [email protected]. If you are receiving marketing communications from Santiago & Company, you can opt out of future communications using the unsubscribe link in any marketing email or by submitting a request through our data subject request form. To protect your data and privacy, we will take necessary measures to verify your identity before processing your request.
Residents of certain U.S. states have additional rights under state privacy laws. This section describes those rights and how to exercise them.
California
California residents have rights under the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA").
As a California resident, you have the right to:
• Know what personal information we collect, use, disclose, and sell or share
• Request deletion of your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information (note: we do not sell personal information)
• Limit the use of sensitive personal information
• Not be discriminated against for exercising your rights
We confirm that we do not sell your personal information as defined by the CCPA/CPRA.
Virginia
Virginia residents have rights under the Virginia Consumer Data Protection Act ("VCDPA"), effective January 1, 2023.
As a Virginia resident, you have the right to:
• Confirm whether we are processing your personal dataand access that data
• Correct inaccuracies in your personal data
• Delete personal data you have provided or that we have obtained
• Obtain a portable copy of your personal data
• Opt out of targeted advertising, sale of personal data, or profiling
Colorado
Colorado residents have rights under the Colorado Privacy Act ("CPA"), effective July 1, 2023.
As a Colorado resident, you have the right to:
• Confirm whether we are processing your personal dataand access that data
• Correct inaccuracies in your personal data
• Delete personal data
• Obtain a portable copy of your personal data
• Opt out of targeted advertising, sale of personal data,or profiling
Connecticut
Connecticut residents have rights under the Connecticut Data Privacy Act ("CTDPA"), effective July 1, 2023.
As a Connecticut resident, you have the right to:
• Confirm whether we are processing your personal dataand access that data
• Correct inaccuracies in your personal data
• Delete personal data
• Obtain a portable copy of your personal data
• Opt out of targeted advertising, sale of personal data,or profiling
Utah
Utah residents have rights under the Utah Consumer Privacy Act ("UCPA"), effective December 31, 2023.
As a Utah resident, you have the right to:
• Confirm whether we are processing your personal dataand access that data
• Delete personal data you have provided
• Obtain a portable copy of your personal data
• Opt out of targeted advertising or sale of personal data
Texas
Texas residents have rights under the Texas Data Privacy and Security Act ("TDPSA"), effective July 1, 2024.
As a Texas resident, you have the right to:
• Confirm whether we are processing your personal dataand access that data
• Correct inaccuracies in your personal data
• Delete personal data
• Obtain a portable copy of your personal data
• Opt out of targeted advertising, sale of personal data,or profiling
Oregon
Oregon residents have rights under the Oregon Consumer Privacy Act ("OCPA"), effective July 1, 2024.
As an Oregon resident, you have the right to:
• Confirm whether we are processing your personal dataand access that data
• Correct inaccuracies in your personal data
• Delete personal data
• Obtain a portable copy of your personal data
• Opt out of targeted advertising, sale of personal data,or profiling
Montana
Montana residents have rights under the Montana Consumer Data Privacy Act ("MTCDPA"), effective October 1, 2024.
As a Montana resident, you have the right to:
• Confirm whether we are processing your personal data and access that data
• Correct inaccuracies in your personal data
• Delete personal data
• Obtain a portable copy of your personal data
• Opt out of targeted advertising, sale of personal data, or profiling
Delaware
Delaware residents have rights under the Delaware Personal Data Privacy Act ("DPDPA"), effective January 1, 2025.
As a Delaware resident, you have the right to:
• Confirm whether we are processing your personal data and access that data
• Correct inaccuracies in your personal data
• Delete personal data
• Obtain a portable copy of your personal data
• Opt out of targeted advertising, sale of personal data, or profiling
Iowa
Iowa residents have rights under the Iowa Consumer Data Protection Act ("ICDPA"), effective January 1, 2025.
As an Iowa resident, you have the right to:
• Confirm whether we are processing your personal data and access that data
• Delete personal data
• Obtain a portable copy of your personal data
• Opt out of targeted advertising or sale of personal data
Nebraska
Nebraska residents have rights under the Nebraska Data Privacy Act ("NDPA"),effective January 1, 2025.
As a Nebraska resident, you have the right to:
• Confirm whether we are processing your personal data and access that data
• Correct inaccuracies in your personal data
• Delete personal data
• Obtain a portable copy of your personal data
• Opt out of targeted advertising, sale of personal data, or profiling
New Hampshire
New Hampshire residents have rights under the New Hampshire Privacy Act ("NHPA"), effective January 1, 2025.
As a New Hampshire resident, you have the right to:
• Confirm whether we are processing your personal data and access that data
• Correct inaccuracies in your personal data
• Delete personal data
• Obtain a portable copy of your personal data
• Opt out of targeted advertising, sale of personal data, or profiling
New Jersey
New Jerseyresidents have rights under the New Jersey Data Privacy Act ("NJDPA"), effective January 15, 2025.
As a New Jersey resident, you have the right to:
• Confirm whether we are processing your personal data and access that data
• Correct inaccuracies in your personal data
• Delete personal data
• Obtain a portable copy of your personal data
• Opt out of targeted advertising, sale of personal data,or profiling
Tennessee
Tennessee residents will have rights under the Tennessee Information Protection Act ("TIPA"), effective July 1, 2025.
As a Tennessee resident, you will have the right to:
• Confirm whether we are processing your personal data and access that data
• Correct inaccuracies in your personal data
• Delete personal data
• Obtain a portable copy of your personal data
• Opt out of targeted advertising, sale of personal data,or profiling
Minnesota
Minnesota residents will have rights under the Minnesota Consumer Data Privacy Act ("MCDPA"), effective July 31, 2025.
As a Minnesota resident, you will have the right to:
• Confirm whether we are processing your personal data and access that data
• Correct inaccuracies in your personal data
• Delete personal data
• Obtain a portable copy of your personal data
• Opt out of targeted advertising, sale of personal data,or profiling
Maryland
Maryland residents will have rights under the Maryland Online Data Privacy Act("MODPA"), effective October 1, 2025.
As a Maryland resident, you will have the right to:
• Confirm whether we are processing your personal data and access that data
• Correct inaccuracies in your personal data
• Delete personal data
• Obtain a portable copy of your personal data
• Opt out of targeted advertising, sale of personal data, or profiling
How to Exercise Your State Privacy Rights
To exerciseyour rights under any applicable state privacy law, please submit a request through our data subject request form or email us [email protected]. You may also designate an authorized agent to make a request on your behalf. If you use anauthorized agent, we may require verification of your identity and confirmationof the agent's authority. If we denyyour request, you may appeal our decision by contacting us at [email protected] with the subject line "Privacy Rights Appeal."
Santiago & Company's websites may feature links to third-party websites, including social media platforms. These external websites operate under their own terms of use and privacy policies. Before interacting with or submitting information to these sites, we recommend reviewing their respective terms and policies.
Santiago & Company neither endorses nor accepts responsibility for the content, practices, or your use of these third-party websites.
Santiago & Company's websites, applications, and services are not designed for or targeted at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected information from a child under 16, please contact us immediately at [email protected].
If you havequestions about this Privacy Policy or our data practices, please contact us:
Email: [email protected]
For data subject requests, including requests to access, correct, delete, or port your personal data, please use our data subject request form or email [email protected].
Insituations where you believe Santiago & Company is processing your data unlawfully, you are encouraged to contact us. You may also be entitled to file a complaint with the appropriate regulatory authority in your jurisdiction.