Your Privacy Matters

Introduction

Effective Date: September 26, 2026

This Privacy Policy outlines how Ecay Design and Ecay Architects, together with its brands, business divisions, and other brands operating under or managed by Ecay Design and Ecay Architects (collectively, “Ecay,” “we,” “us,” or “our”), collects, uses, stores, protects, and discloses personal information.

This Privacy Policy applies to individuals who interact with us in connection with our business, including website visitors, prospective clients, current and former clients, customers, business contacts, vendors, contractors, consultants, applicants, and other individuals who communicate or otherwise interact with us.

For purposes of this Privacy Policy, references to Ecay Design and Ecay Architects include the applicable business, brand, division, or entity responsible for the particular service, website, communication, or transaction with which you interact. Where another brand operates independently or is a separate legal entity, its own privacy practices or privacy policy may apply where specifically identified.

This Privacy Policy applies to personal information collected through or in connection with our websites, online forms, applications, social media or other digital channels, email communications, telephone calls, SMS/text messages, customer and business communications, consultations, transactions, and other interactions with us, whether online, by telephone, by text message, in person, or through other communication methods.

It describes the categories of personal information we may collect, the purposes for which we use that information, how we may share or disclose it, how we protect and retain it, and the rights and choices that may be available to individuals concerning their personal information.

By visiting our websites, submitting information to us, communicating with us, requesting information or services, becoming a client or customer, or otherwise interacting with Ecay, you acknowledge that you have had an opportunity to review this Privacy Policy. Your particular rights, choices, and any applicable consent requirements may vary depending on your location, the nature of your relationship with us, and the services or communications involved.

This Privacy Policy is intended to apply across Ecay Design and  Ecay Architects and the applicable brands operating under or with us; however, additional or separate privacy notices may apply to particular services, websites, forms, programs, or communications where required or appropriate. Where such a notice applies, it will supplement this Privacy Policy and will govern the specific processing described in that notice.

We may update this Privacy Policy from time to time to reflect changes in our business, services, technologies, legal requirements, or privacy practices. The Effective Date and Last Updated date above indicate when this version became effective and when it was most recently revised. We encourage you to review this Privacy Policy periodically for updates.

For questions regarding this Privacy Policy or our privacy practices, please contact us using the information provided in the Contact Us / Privacy Contact section of this Privacy Policy.

2. Information We Collect

Ecay Design and Architects, together with the applicable brands, divisions, and business entities operating under or managed by Ecay Design and Architects (collectively, “Ecay,” “we,” “us,” or “our”), may collect personal information directly from individuals, from their interactions with us, automatically through our websites and digital services, and from third parties or other lawful sources. The information we collect depends on the nature of an individual’s relationship with us, the services requested, the communications exchanged, and how our websites and other services are used.

For purposes of this Privacy Policy, “personal information” generally means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual or household, as defined under applicable California privacy law. California law recognizes numerous categories of personal information, including identifiers, commercial information, internet or other electronic network activity, geolocation data, professional or employment-related information, and inferences. Certain categories are considered “sensitive personal information” and receive additional protections under California law.

2.1 Names and Identifiers

We may collect identifying information such as:

• • • First and last name
    • Preferred name or alias
    • Business or professional name
    • Username or account identifier
    • Online identifiers
    • Customer or client identification numbers
    • Other identifiers provided in connection with our services or communications

We may obtain this information when an individual contacts us, submits a form, becomes a client or customer, creates an account, requests information, enters into an agreement, communicates with us, or otherwise interacts with Ecay.

2.2 Email Address and Electronic Contact Information

We may collect:

• • • Email addresses
    • Secondary or alternate email addresses
    • Email account or communication identifiers
    • Marketing subscription and communication preferences
    • Records of email consent, subscription, unsubscribe, or suppression requests

We may use this information to communicate with individuals regarding inquiries, projects, accounts, services, transactions, customer support, administrative matters, and, where permitted and appropriately authorized, marketing or promotional communications.

2.3 Telephone and Mobile Phone Information

We may collect:

• • • Telephone numbers
    • Mobile telephone numbers
    • Business telephone numbers
    • Voicemail-related information
    • Calling preferences
    • SMS/text-message preferences
    • Records of SMS or telephone consent, opt-in, opt-out, or other communication preferences

We may use telephone and mobile information for customer service, project-related communications, appointment or scheduling communications, business communications, account or transaction communications, and other communications that are requested, authorized, or otherwise permitted by applicable law.

Where applicable, separate terms or notices may govern SMS/text messaging and marketing communications.

2.4 Mailing, Physical, and Billing Information

Depending on the nature of our relationship with you, we may collect:

• • • Mailing address
    • Physical address
    • Billing address
    • Shipping or delivery address
    • Project, job-site, or property address
    • Business address
    • Other address information provided in connection with a project, service, transaction, or communication

We may collect this information to communicate with you, administer accounts and projects, provide requested services, process transactions, send documents or materials, and perform other legitimate business functions.

2.5 Account, Client, Customer, and Project Information

When an individual becomes a client, customer, prospective client, vendor, contractor, consultant, or other business contact, we may collect information relating to that relationship, including:

• • • Account information
    • Client or customer identification information
    • Company or organization information
    • Service or project information
    • Project requirements, preferences, specifications, and requests
    • Records of products or services requested, considered, purchased, obtained, or used
    • Transaction and billing information
    • Service history
    • Appointment and scheduling information
    • Correspondence and other account-related information
    • Information concerning properties, projects, locations, or services where reasonably necessary to provide our services

Where applicable, this may constitute commercial information under California law, including information concerning products or services purchased, obtained, or considered.

2.6 Communication Records

We may maintain records of communications and interactions with individuals, including:

• • • Emails
    • SMS/text messages
    • Telephone calls
    • Voicemails
    • Messages submitted through websites or online forms
    • Customer-service communications
    • Meeting or consultation records
    • Other correspondence or communications with Ecay

Where permitted by law and applicable to a particular communication, we may also collect information concerning the date, time, participants, subject matter, and method of communication.

Call recording, call transcription, or analysis of communication content should only be included to the extent Ecay actually performs or uses those activities. To the extent communications contain the contents of emails, text messages, or other communications, those contents may constitute sensitive personal information under the California Consumer Privacy Act in circumstances covered by the law.

2.7 Website, Device, and Internet Activity Information

When individuals visit or interact with our websites, online forms, applications, or other digital services, we may automatically collect certain technical and usage information, including:

• • • IP address
    • Browser type and version
    • Operating system
    • Device type
    • Device identifiers and online identifiers
    • Date and time of visits
    • Referring and exit pages
    • Pages or content viewed
    • Links or features interacted with
    • Search or navigation activity on our websites
    • Session and usage information
    • Network information
    • Information concerning interaction with our websites, applications, advertisements, or other online services

This information may constitute internet or other electronic network activity information under California law.

2.8 IP Addresses and Technical Information

We may collect IP addresses and related technical information automatically when individuals access or interact with our websites, systems, online forms, or other digital services.

Depending on the circumstances, this information may be used for:

• • • Security and fraud prevention
    • Website and system administration
    • Troubleshooting
    • Performance monitoring
    • Analytics
    • Understanding website usage
    • Maintaining the integrity and functionality of our services

An IP address may constitute personal information when it identifies, relates to, or could reasonably be linked with a particular consumer or household.

2.9 Cookies and Similar Tracking Technologies

We may use cookies, pixels, tags, scripts, local storage, and similar technologies to operate, secure, analyze, and improve our websites and digital services.

These technologies may collect information such as:

• • • Online identifiers
    • Device and browser information
    • IP address
    • Website activity
    • Pages viewed
    • Referring websites
    • Interaction with content or advertisements
    • Preferences and settings
    • Information concerning how users interact with our websites over time

We may use cookies and similar technologies for essential website functionality, security, analytics, personalization, advertising, and other business purposes, depending on the technologies actually deployed on our websites.

Where required by applicable California law, we will provide appropriate disclosures and choices concerning cookies, tracking technologies, and the sale or sharing of personal information. California law also requires applicable privacy policies to describe the business’s online and offline information practices, including relevant categories of personal information collected and the purposes for collection.

2.10 Information Submitted Through Forms and Other Direct Interactions

We may collect information that individuals voluntarily provide through:

• • • Website contact forms
    • Quote or consultation requests
    • Project inquiry forms
    • Account-registration forms
    • Appointment or scheduling forms
    • SMS/text-message opt-in forms
    • Email subscriptions
    • Surveys
    • Applications
    • Client onboarding materials
    • Documents submitted to us
    • Social-media interactions
    • In-person communications
    • Telephone communications
    • Other forms or methods through which information is provided to Ecay

The information collected will depend on the particular form or interaction and may include contact information, project information, preferences, communications, account information, and any other information an individual chooses to submit.

2.11 Professional and Business Information

In connection with clients, prospective clients, vendors, contractors, consultants, business contacts, or other professional relationships, we may collect professional or employment-related information, such as:

• • • Job title
    • Employer or business name
    • Professional contact information
    • Professional qualifications
    • Business role
    • Information concerning a professional relationship with Ecay

California law recognizes professional or employment-related information as a category of personal information where it is reasonably capable of being associated with an individual.

2.12 Geolocation Information

Where applicable and actually collected, we may collect information concerning the general location associated with an individual’s interaction with our websites, devices, services, or project-related activities.

We will not describe information as precise geolocation unless Ecay actually collects precise geolocation information. Precise geolocation is treated as sensitive personal information under California law.

2.13 Sensitive Personal Information

Ecay may collect certain information that is classified as sensitive personal information under California law only where it is actually collected and where necessary, appropriate, or permitted for the applicable business purpose.

Depending on the circumstances, sensitive personal information may include categories such as certain government-issued identifiers, account credentials, financial account information, precise geolocation, the contents of certain communications, biometric information used to uniquely identify an individual, or certain characteristics or information relating to health, racial or ethnic origin, religious or philosophical beliefs, citizenship or immigration status, sexual orientation, sex life, or union membership.

Ecay should only identify specific sensitive categories in this Privacy Policy if it actually collects, uses, or discloses those categories. The CCPA applies data-minimization and purpose-limitation concepts, and information should not be represented as being collected merely because it could theoretically be collected.

2.14 Information from Other Sources

We may receive personal information from sources other than the individual, where permitted by law, including:

• • • Clients or customers
    • Representatives of clients or customers
    • Business partners
    • Vendors and service providers
    • Contractors and consultants
    • Professional advisers
    • Publicly available sources
    • Social-media or other online platforms
    • Referral sources
    • Other individuals who provide information on behalf of or in connection with an individual

The categories of information received from these sources depend on the nature of the relationship and the applicable service or transaction.

2.15 Information We Do Not Intentionally Collect

We do not intentionally request or collect personal information that is unnecessary for the purposes described in this Privacy Policy. Where a particular service, transaction, legal obligation, or business process requires additional information, the applicable collection point or notice may provide additional information concerning what is requested and why.

2.16 California-Specific Categorization of Personal Information

For California privacy compliance purposes, the categories of personal information described in this section should correspond to the categories of personal information that Ecay actually collected during the preceding 12 months and should be kept current as Ecay’s information practices change. California regulations require applicable businesses to identify the categories of personal information collected and describe them in a manner that gives consumers a meaningful understanding of the information being collected.

How We Use Personal Information

Ecay Design and Architects, together with its applicable brands, divisions, and affiliated or related business entities covered by this Privacy Policy (collectively, “Ecay,” “we,” “us,” or “our”), uses personal information for the purposes reasonably necessary to operate our business, provide our services, communicate with individuals, protect our business and systems, comply with legal obligations, and perform the other activities described in this Privacy Policy.

We do not use personal information for purposes that are incompatible with the purposes for which the information was collected, unless otherwise permitted by applicable law or we obtain any consent required by law. To the extent California privacy law applies, our collection, use, retention, and sharing of personal information is intended to be reasonably necessary and proportionate to the purposes for which the information is processed.

3.1 Providing Products, Services, and Project-Related Services

We may use personal information to provide, administer, manage, and improve our products and services and to carry out activities associated with our architecture, design, consulting, project, and other business services.

This may include using information to:

Understand and evaluate project, service, or business requirements.

Prepare proposals, estimates, quotations, agreements, plans, designs, or other requested materials.

Establish and manage client or customer relationships.

Perform contracted or requested services.

Coordinate projects, consultations, meetings, site visits, appointments, deliveries, installations, inspections, or other activities.

Communicate with clients, customers, prospective clients, project participants, vendors, contractors, consultants, and other relevant parties.

Administer project-related documentation and records.

Process payments, invoices, billing, and other transactions.

Provide customer or project support.

Manage changes, requests, questions, complaints, or issues relating to our services.

Maintain records necessary to administer ongoing or completed projects and business relationships.

Deliver documents, materials, notices, or other items requested or required in connection with our services.

Where information relates to a project, property, business, or other matter involving multiple individuals or entities, we may use the information to the extent reasonably necessary to perform the applicable service or fulfill the relevant business purpose.

3.2 Customer Service and Support

We may use personal information to provide customer service and support, including to:

Respond to questions and requests.

Investigate and resolve complaints or service issues.

Review prior interactions and relevant account, project, or transaction information.

Provide technical or administrative assistance.

Follow up on requests or unresolved matters.

Maintain records of customer-service interactions.

Improve our customer-service processes.

Communication information may be used to understand the context of an individual’s request and to provide an appropriate response.

3.3 Responding to Inquiries and Requests

When an individual contacts us, submits a form, requests a consultation, asks for information, requests a quote, or otherwise expresses interest in our business or services, we may use the information provided to:

Respond to the inquiry.

Contact the individual using the communication method provided.

Understand the individual’s needs or interests.

Determine which Ecay brand, business division, service, or personnel may be appropriate to address the request.

Schedule a consultation or other follow-up.

Prepare requested information or materials.

Track and manage inquiries and prospective business relationships.

Follow up regarding an inquiry or request where reasonably appropriate.

Where an inquiry concerns a particular Ecay brand or business entity, information may be shared internally with the personnel or entity responsible for responding to that inquiry, subject to applicable privacy requirements.

3.4 Account, Client, and Relationship Administration

We may use personal information to establish, maintain, and administer accounts and business relationships, including to:

Create and maintain customer, client, prospect, vendor, or other business records.

Verify or update account information.

Manage contracts, agreements, statements of work, proposals, and related documentation.

Administer billing, payments, invoices, and account balances.

Maintain project and service histories.

Manage preferences and communication settings.

Authenticate or secure accounts where applicable.

Maintain records of permissions, consents, opt-outs, and other privacy choices.

Communicate administrative notices concerning accounts, projects, services, or transactions.

3.5 Scheduling, Appointments, Meetings, and Project Coordination

We may use personal information to schedule and coordinate:

• • • Consultations
    • Meetings
    • Appointments
    • Site visits
    • Project activities
    • Calls
    • Deliveries or other scheduled services
    • Follow-up communications

This may involve using names, telephone numbers, email addresses, addresses, calendar information, project information, and other information reasonably necessary to coordinate the relevant activity.

3.6 Transactional and Service Communications

We may send communications that are necessary, requested, or reasonably related to a transaction, project, account, service, or business relationship.

These communications may include:

• • • Confirmation messages
    • Appointment and scheduling notices
    • Project updates
    • Service notifications
    • Account notices
    • Billing or payment communications
    • Requests for information or documentation
    • Changes to services or appointments
    • Responses to customer or client communications
    • Administrative notices
    • Security-related notices
    • Other communications directly related to a requested or existing business relationship

These communications may be delivered through email, telephone, SMS/text message, postal mail, or other available communication channels.

Where a communication is operational, transactional, or otherwise necessary to provide a requested service, opting out of marketing communications may not prevent us from sending that necessary communication.

3.7 Email Communications and Marketing

We may use personal information to communicate with individuals by email for service-related, administrative, informational, and marketing purposes, where permitted by applicable law.

Marketing-related uses may include:

Sending newsletters or informational materials.

Providing information about our services, projects, products, capabilities, events, or activities.

Sending offers or promotions.

Communicating about services that may be relevant to an individual’s stated interests or prior interactions with us.

Managing subscriptions and communication preferences.

Measuring and improving email communications.

Maintaining records of subscriptions, consent, opt-outs, and communication preferences.

Marketing communications will be subject to applicable consent, disclosure, and opt-out requirements. Individuals may have the ability to unsubscribe from marketing communications through the mechanism provided in the communication or through other methods described in this Privacy Policy.

3.8 Telephone and SMS/Text Communications

We may use telephone numbers and mobile telephone numbers to communicate with individuals regarding:

• • • Customer-service matters
    • Inquiries
    • Consultations
    • Appointments
    • Project or service matters
    • Account matters
    • Transactions
    • Administrative information
    • Other communications requested or authorized by the individual
    • Marketing or promotional communications, where applicable and permitted

Where an individual has separately opted in to an SMS program, we may use the individual’s mobile number and related consent information to provide the categories of text messages described in the applicable SMS Terms of Service and consent disclosure.

We may maintain information concerning SMS and communication preferences, including opt-in, opt-out, and suppression information, for purposes of administering communication preferences and complying with applicable requirements.

3.9 Marketing

Where permitted by law, we may use personal information to conduct marketing activities concerning Ecay and its applicable brands, including to:

Inform individuals about our services and capabilities.

Promote products, services, events, content, or other offerings.

Develop and distribute marketing communications.

Maintain marketing and prospect databases.

Manage subscriptions and preferences.

Measure the effectiveness of marketing activities.

Understand general interests and engagement with our communications.

Develop and improve our marketing strategies and materials.

Conduct outreach to prospective clients or business contacts.

Marketing uses will be limited by applicable privacy, communications, and consumer-protection laws and by any choices or opt-outs that apply to the individual.

We do not intend this section to authorize uses of personal information that are inconsistent with the disclosures elsewhere in this Privacy Policy or with an individual’s legally applicable privacy choices.

3.10 Advertising

Where Ecay actually uses advertising, analytics, or similar technologies that involve personal information, we may use information for purposes such as:

Delivering or displaying advertisements.

Measuring advertising performance.

Understanding how users interact with advertisements or our websites.

Measuring conversions and campaign effectiveness.

Limiting repetitive advertising.

Managing advertising preferences.

Improving the relevance or performance of advertising.

Depending on the technologies and services actually used, certain advertising-related activities may constitute a “sale” or “sharing” of personal information under the California Consumer Privacy Act, even where no money is directly exchanged for the information. California law gives applicable consumers rights to opt out of certain sales or sharing, including certain forms of cross-context behavioral advertising.

Accordingly, our actual advertising and tracking practices, along with any applicable opt-out mechanisms, should be accurately reflected elsewhere in this Privacy Policy and on our websites.

3.11 Business Development and Relationship Management

We may use personal information for ordinary business development and relationship-management activities, including to:

Maintain relationships with current and prospective clients.

Follow up on proposals, consultations, or inquiries.

Understand business needs and project interests.

Coordinate with business contacts.

Identify opportunities to provide services that an individual or organization has requested or may reasonably expect based on its relationship with us.

Maintain records of business communications and interactions.

Any such use will remain subject to applicable privacy requirements and the context in which the information was collected.

3.12 Fraud Prevention, Security, and Protection of Rights

We may use personal information to protect Ecay, our clients, customers, employees, vendors, systems, websites, and others from fraud, abuse, unauthorized activity, security incidents, and other unlawful or harmful conduct.

This may include:

Detecting, preventing, and investigating fraud.

Detecting unauthorized access or use.

Securing accounts, systems, networks, websites, and facilities.

Identifying malicious or deceptive activity.

Investigating suspected violations of our agreements or policies.

Protecting the physical safety of individuals.

Preventing misuse of our services or communications systems.

Responding to security incidents.

Preserving evidence and maintaining security logs where appropriate.

Enforcing applicable policies and contractual rights.

California law recognizes security and integrity activities as an important permitted business purpose for the use of personal information, including certain uses of sensitive personal information.

3.13 Legal, Regulatory, and Compliance Purposes

We may use and disclose personal information where reasonably necessary to:

Comply with applicable federal, state, local, or other laws and regulations.

Respond to lawful requests, subpoenas, warrants, court orders, or other legal processes.

Cooperate with governmental, regulatory, or law-enforcement authorities where legally required or permitted.

Establish, exercise, or defend legal claims and rights.

Enforce contracts, agreements, terms, policies, and other legal rights.

Investigate suspected violations of law or contractual obligations.

Maintain records required by law or reasonably necessary for legal, tax, accounting, insurance, professional, or regulatory purposes.

Meet applicable reporting or recordkeeping obligations.

Protect the rights, property, safety, and security of Ecay, its clients, customers, employees, contractors, vendors, or other individuals.

3.14 Internal Business Operations

We may use personal information for internal operational purposes reasonably necessary to conduct and manage our business, including:

• • • Accounting and financial administration
    • Billing and payment administration
    • Business planning
    • Project administration
    • Vendor and contractor management
    • Personnel and workforce administration where applicable
    • Internal communications
    • Document management
    • Records management
    • Quality assurance
    • Business continuity
    • Insurance administration
    • Procurement
    • Auditing
    • Corporate governance
    • Managing our various brands, business divisions, and related business operations

Where multiple Ecay brands, divisions, or entities share systems or administrative functions, personal information may be processed internally for these purposes to the extent permitted by applicable law and reasonably necessary for the relevant business function.

3.15 Analytics, Measurement, and Service Improvement

We may use personal information and information derived from our interactions with individuals to understand and improve our websites, services, communications, and business operations.

This may include:

Measuring website traffic and engagement.

Identifying technical problems.

Understanding how users navigate our websites.

Evaluating service performance.

Analyzing customer or prospect interactions.

Measuring communications performance.

Improving website functionality and user experience.

Testing and improving business processes.

Identifying trends and aggregate patterns.

Evaluating the effectiveness of marketing and advertising activities.

Where feasible and appropriate, we may use aggregated, de-identified, or otherwise protected information for analytics and operational purposes rather than directly identifying information.

3.16 Research, Development, and Improvement

We may use information to develop, test, evaluate, maintain, and improve our services, websites, systems, processes, communications, and business operations, provided that such use is permitted under applicable law and consistent with the context and purpose for which the information was collected.

This may include:

Improving existing services.

Developing new services or features.

Testing website functionality.

Evaluating operational processes.

Identifying and correcting errors.

Maintaining and improving the quality and safety of our systems and services.

3.17 Managing Privacy Choices and Legal Requests

We may use personal information to administer privacy-related requests and preferences, including:

Processing access, deletion, correction, or other privacy requests.

Verifying requests where verification is required.

Processing opt-out requests.

Maintaining records of privacy choices.

Maintaining suppression lists so that opted-out individuals are not inadvertently contacted for the applicable purpose.

Communicating with individuals regarding privacy requests.

Administering applicable consent and communication preferences.

California privacy law requires covered businesses to honor applicable consumer rights and maintain processes that allow consumers to exercise those rights.

3.18 Business Transfers and Corporate Transactions

If Ecay or any applicable brand, division, or related business entity is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, dissolution, or similar corporate transaction, personal information may be used or disclosed as reasonably necessary to evaluate, facilitate, or complete the transaction, subject to applicable legal requirements and any required notices.

3.19 Aggregation, De-Identification, and Other Permitted Uses

Where permitted by applicable law, we may aggregate, de-identify, or otherwise process information so that it is no longer reasonably associated with an identifiable individual, and may use such information for legitimate business purposes such as analytics, reporting, research, service improvement, planning, and benchmarking.

Where information has been de-identified, we will maintain it in accordance with applicable legal requirements governing de-identified information.

3.20 Use of Sensitive Personal Information

Ecay does not intend to use sensitive personal information for purposes beyond those permitted by applicable law unless we provide any notice or obtain any consent required by law.

Where California law provides consumers with a right to limit certain uses or disclosures of sensitive personal information, the applicability of that right depends on how the information is actually used or disclosed. Certain uses permitted under California law—including providing reasonably expected services, preventing security incidents and fraud, maintaining accounts, providing customer service, complying with law, and other specified purposes—are treated differently under the CCPA.

Ecay will not state that it collects or uses a particular category of sensitive personal information unless that category is actually collected or used by the applicable Ecay business or brand.

3.21 Purposes Beyond Those Listed Above

We may use personal information for additional purposes that are reasonably necessary and proportionate to the purposes disclosed at or before collection, purposes that are compatible with the individual’s reasonable expectations, or purposes otherwise permitted by applicable law.

Where required by California law, we will provide additional notice and/or obtain consent before using personal information for a materially different purpose that is not reasonably compatible with the original collection context or otherwise permitted by law. California’s current privacy framework places particular emphasis on purpose limitation, data minimization, and reasonably necessary and proportionate processing.

3.22 Data Minimization and Purpose Limitation

Ecay seeks to collect, use, retain, and share only the personal information that is reasonably necessary and proportionate to accomplish the purposes described in this Privacy Policy or otherwise permitted by applicable law.

We do not intend to use personal information for unrelated purposes merely because the information is available to us. The purposes for which information is collected and subsequently processed should be consistent with the individual’s reasonable expectations, the context in which the information was collected, applicable disclosures, and any consent or privacy choices that apply.

4. Email Communications & Email Marketing

Ecay Design and Architects, together with its applicable brands, divisions, and related business entities covered by this Privacy Policy (collectively, “Ecay,” “we,” “us,” or “our”), may use email to communicate with individuals for business, service, administrative, customer-support, and marketing purposes. The nature and frequency of email communications will depend on an individual’s relationship with Ecay, the services requested, the individual’s communication preferences, and the requirements of applicable law.

Our email practices are designed to distinguish between communications that are necessary to provide or administer a requested service or existing business relationship and communications whose primary purpose is to advertise, promote, or market Ecay’s products or services. Federal law, including the CAN-SPAM Act, imposes specific requirements on commercial email, including truthful sender information, non-deceptive subject lines, a clear method for opting out of future commercial emails, and a valid physical postal address.

4.1 Types of Emails We May Send

Depending on the nature of the individual’s relationship with Ecay and the communications applicable to that relationship, we may send the following categories of email:

Transactional and Service Emails

These are emails associated with a transaction, project, service, account, request, or other business relationship. They may include:

• • • Confirmation of a request or transaction
    • Project-related communications
    • Service updates
    • Requests for information or documentation
    • Delivery of requested materials
    • Notices concerning appointments, consultations, or other scheduled activities
    • Billing, invoicing, payment, or account communications
    • Changes to services, appointments, or other transaction-related matters
    • Other communications reasonably necessary to provide, administer, or fulfill a service or transaction
    • Customer-Service Emails

We may use email to:

• • • Respond to customer or client questions
    • Respond to inquiries and requests
    • Resolve complaints or service issues
    • Provide support
    • Follow up on an unresolved matter
    • Communicate concerning a project, service, account, or prior interaction
    • Maintain records of customer-service communications
    • Account-Related Emails

Where applicable, we may send emails relating to:

• • • Account creation or administration
    • Account status
    • Account verification
    • Account changes
    • Security or access matters
    • Billing and payment status
    • Changes to account terms or features
    • Other information directly related to an ongoing account or business relationship
    • Administrative Emails

We may send administrative communications concerning:

• • • Privacy practices
    • Changes to policies or terms
    • Security matters
    • Legal or regulatory notices
    • Service changes
    • Operational matters
    • Business relationship matters
    • Other notices that are necessary or reasonably related to our operations or our relationship with an individual
    • Marketing and Promotional Emails

Where permitted by applicable law, we may send commercial or promotional emails concerning:

• • • Ecay Design and Architects
    • Applicable Ecay brands
    • Architecture, design, consulting, or other services we offer
    • Products or services we believe may be relevant to an individual’s interests
    • Events, announcements, educational materials, publications, or other business content
    • Promotions, offers, or other marketing initiatives

Commercial email communications will be sent in accordance with applicable law and applicable communication preferences. The fact that an individual is an existing or former customer does not eliminate the recipient’s right to opt out of future marketing communications.

Newsletters and Subscription Communications

Where we offer newsletters, publications, or other recurring email communications, individuals may subscribe through an applicable form, website, communication, or other enrollment mechanism.

Subscription-based communications may contain informational, educational, business, or promotional content. Where such communications constitute commercial email, we will provide the opt-out mechanisms required by applicable law.

4.2 Email Information We Collect

In connection with email communications, we may collect and maintain information such as:

• • • Email address
    • Name associated with the email address
    • Company or organization associated with the individual, where applicable
    • Communication preferences
    • Marketing subscription preferences
    • Newsletter or mailing-list subscription status
    • Consent or other authorization records, where applicable
    • Date, time, source, and method of subscription or preference submission, where maintained
    • Unsubscribe or suppression status
    • Records of requests to receive or stop receiving particular categories of communications
    • Records of communications sent to or received from an individual
    • Information concerning an individual’s interaction with our emails, where email tracking technologies are used
    • Technical information associated with email delivery or interaction, where available through our email service providers

We may use this information to deliver requested communications, administer subscriptions and preferences, maintain accurate communication records, evaluate the effectiveness of our communications, prevent unintended communications after an opt-out, and comply with applicable legal and operational requirements.

4.3 Email Consent, Subscription, and Authorization

We may obtain an individual’s email address and communication preferences through website forms, inquiries, consultations, account or client relationships, transactions, subscriptions, direct communications, referrals, or other lawful business interactions.

Where we request affirmative consent to receive marketing or subscription emails, the individual may provide that consent through the applicable enrollment or subscription process. The manner in which consent is collected may include a website form, checkbox, subscription mechanism, written request, or other method appropriate to the communication.

Where marketing consent is requested, it is intended to be distinguishable from consent or information necessary to provide requested products, services, transactions, account administration, or customer support.

An individual may also provide an email address in connection with a business inquiry or existing relationship without subscribing to marketing communications. Providing an email address for purposes of receiving a requested response, service, transaction, or other necessary communication does not by itself necessarily constitute a subscription to unrelated promotional communications.

Where applicable law permits commercial email to be sent without prior affirmative consent, Ecay may send such communications in compliance with applicable law, including applicable requirements concerning sender identification, commercial-message disclosures, and opt-out rights. The CAN-SPAM Act generally regulates commercial email through these requirements and does not establish a general prior-consent requirement for all commercial email.

Where consent, authorization, or another legally recognized basis is relied upon, we may maintain records sufficient to administer that preference or demonstrate how the communication relationship was established.

Existing customers, clients, and business contacts may continue to receive non-marketing transactional, service, account, administrative, or relationship communications that are necessary or reasonably related to an existing relationship, even after opting out of marketing communications, where permitted by applicable law. The CAN-SPAM Act distinguishes transactional or relationship messages from commercial messages based in part on the primary purpose of the message.

When a message combines transactional and promotional content, the classification of the message may depend on its primary purpose. Accordingly, Ecay will not treat an email as purely transactional merely because it is sent to an existing customer or client when its primary purpose is commercial or promotional.

4.4 Email Marketing and Communication Providers

Ecay may use third-party service providers to operate, deliver, manage, secure, analyze, and administer email communications.

Depending on the services actually used by Ecay, these providers may include:

• • • Email delivery and email service providers
    • Marketing automation platforms
    • Customer relationship management (“CRM”) platforms
    • Customer-support platforms
    • Website and form providers
    • Data storage and hosting providers
    • Analytics providers
    • Email performance and deliverability providers
    • Security and fraud-prevention providers
    • Other contractors or technology providers supporting our email operations

These providers may process personal information on our behalf for specified business purposes, such as delivering email, maintaining suppression lists, administering subscriptions, managing customer relationships, analyzing performance, or providing technical support.

We do not authorize service providers to use email addresses or other personal information provided to them by Ecay for their own independent marketing purposes except where such use is separately disclosed, authorized, or otherwise permitted by applicable law.

Where California privacy law applies, disclosures to service providers and contractors are subject to the applicable requirements governing those relationships, including restrictions concerning the use of personal information beyond the business purpose for which it was provided. California law also distinguishes service-provider or contractor processing from other types of disclosures that may constitute a sale or sharing of personal information.

4.5 Email Tracking, Analytics, and Similar Technologies

Depending on the email systems and technologies actually used by Ecay, our emails may contain technologies that allow us or our service providers to determine whether an email was delivered, opened, viewed, clicked, or otherwise interacted with.

Depending on the particular service or campaign, these technologies may include:

Open Tracking

Open-tracking technologies may provide information indicating whether an email was opened or rendered by a recipient’s email application.

Link and Click Tracking

Links contained in our emails may be configured to record whether a recipient clicked a particular link and, where supported, when the interaction occurred.

Pixels and Similar Technologies

Emails may contain small electronic files, pixels, tags, or similar technologies that support delivery, measurement, security, or analytics.

Cookies and Related Technologies

Where email links direct an individual to our websites or other digital services, cookies or similar technologies may be used to associate an interaction with the relevant website visit or campaign, subject to the applicable disclosures and choices governing those technologies.

Conversion Tracking

Where implemented, we may use information concerning interactions with an email and subsequent activity on our websites or digital services to measure campaign performance, conversions, or other outcomes.

Other Email Analytics

We may use aggregated or individual-level information concerning email delivery and interaction to evaluate:

• • • Delivery and bounce rates
    • Opens and clicks
    • Engagement
    • Campaign performance
    • Subscriber activity
    • Content effectiveness
    • Technical problems
    • Deliverability and reputation
    • Marketing performance

Not every email, campaign, website, or communication will use every tracking technology described above. The technologies actually deployed will depend on the email system, campaign, website configuration, and applicable settings.

Where email or website tracking results in the collection, use, or disclosure of personal information subject to California privacy law, those practices will be handled in accordance with applicable California requirements and any applicable rights or choices, including rights relating to the sale or sharing of personal information where those rights apply. California regulations require businesses to consider the context and reasonable expectations associated with the collection and subsequent use of personal information.

4.6 Unsubscribe and Marketing Preferences

Recipients of Ecay marketing or promotional emails may opt out of future marketing communications by using the unsubscribe or opt-out mechanism provided in the applicable email or by contacting us using the contact information provided in this Privacy Policy.

An unsubscribe mechanism for commercial email should be clear, conspicuous, reasonably easy to use, and should not require unnecessary steps beyond those permitted by applicable law. The CAN-SPAM Act requires commercial emails to provide recipients with an effective method to opt out of future commercial messages and requires opt-out requests to be honored within the statutory timeframe.

Where our marketing systems provide preference-management functionality, recipients may also be able to choose among different categories of communications rather than unsubscribing from all marketing communications.

Where an individual requests to stop receiving marketing communications, we may retain the individual’s email address or other necessary information on a suppression or do-not-contact list solely as needed to ensure that the individual’s opt-out preference is respected and to prevent the individual from being inadvertently re-added to a marketing list. The FTC specifically recognizes that addresses subject to an opt-out may be retained for compliance purposes, while restricting their transfer or use for unrelated purposes.

Opting out of marketing communications does not necessarily prevent all email communications from Ecay. We may continue to send emails that are transactional, service-related, account-related, security-related, legally required, or otherwise necessary to provide a requested service or administer an existing business relationship, where permitted by applicable law.

For example, an individual who unsubscribes from promotional emails may still receive communications regarding an active project, account, appointment, invoice, service request, transaction, or other existing business relationship.

Where applicable, individuals may also exercise separate California privacy rights concerning the sale or sharing of personal information. Those rights are distinct from an email marketing unsubscribe request. The California Consumer Privacy Act provides applicable consumers with rights concerning, among other things, access, deletion, correction, and opting out of the sale or sharing of personal information.

4.7 Email Data Sharing and Disclosure

Ecay may disclose email addresses and related information when reasonably necessary to operate our business, provide requested services, administer communications, fulfill transactions, provide customer support, maintain our systems, or perform other purposes described in this Privacy Policy.

Depending on the circumstances, email information may be disclosed to:

• • • Email service and delivery providers
    • Marketing and marketing-automation providers
    • CRM providers
    • Customer-support providers
    • Website, form, and hosting providers
    • Analytics and measurement providers
    • Security and fraud-prevention providers
    • Professional advisers
    • Vendors, contractors, and other service providers acting on our behalf
    • Government authorities, regulators, law-enforcement agencies, or other parties where disclosure is required or permitted by law
    • Parties involved in a corporate transaction, such as a merger, acquisition, financing, restructuring, sale of assets, or similar transaction

These disclosures may be necessary to send emails, maintain subscription and suppression records, respond to inquiries, administer client and customer relationships, measure communication performance, protect systems, comply with legal obligations, or perform other legitimate business functions.

Email Addresses and Third-Party Marketing

Ecay will not disclose an individual’s email address to an unrelated third party for that third party’s independent marketing purposes unless such disclosure is separately disclosed and permitted by applicable law or the individual has otherwise authorized it where authorization is required.

Our email service providers, CRM platforms, and other vendors may process email addresses on Ecay’s behalf in order to provide services to us. Such processing is different from providing those vendors with the right to independently market their own products or services to the individual.

Sale or Sharing of Email Information

Where applicable California law applies, certain disclosures of personal information for cross-context behavioral advertising may constitute “sharing,” and certain disclosures for monetary or other valuable consideration may constitute a “sale,” even where the business does not describe the activity in those terms. The legal characterization depends on the actual data flows, contractual relationships, purposes, and circumstances.

Ecay’s treatment of email addresses and related online identifiers for purposes of advertising, analytics, and marketing should therefore be evaluated based on the actual technologies and vendors deployed on our websites and in our email systems. Where California law grants a consumer the right to opt out of a sale or sharing of personal information, Ecay will provide the applicable notice and mechanism required by law.

Information of Individuals Who Have Opted Out

Once an individual has opted out of receiving future commercial email from Ecay, we will maintain and use the information necessary to honor that preference and prevent future marketing emails, except as otherwise permitted or required by law. The FTC specifically states that an email address subject to a CAN-SPAM opt-out generally cannot be sold or transferred as part of a mailing list, other than a transfer to a company engaged to help the sender comply with CAN-SPAM.

Email Marketing Conduct

Ecay and companies acting on our behalf are expected to follow applicable requirements governing commercial email. Among other things, commercial email must use accurate identifying information, avoid deceptive subject lines, provide an appropriate physical postal address, and provide a functional opt-out mechanism. Ecay remains responsible for monitoring third-party providers it engages to conduct email marketing on its behalf.

4.8 Email Records, Preferences, and Retention

We may retain information relating to email communications for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

• • • Maintain customer and prospect records
    • Document transactions and business communications
    • Administer subscriptions and preferences
    • Maintain marketing suppression lists
    • Demonstrate or administer consent or authorization where applicable
    • Respond to disputes or inquiries
    • Comply with legal, regulatory, accounting, or contractual obligations
    • Protect our legal rights and interests
    • Prevent repeated communications after an unsubscribe or suppression request
    • Maintain security and operational records

Retention periods may differ depending on the type of information, the nature of the relationship, whether the information is required for an active project or transaction, applicable legal requirements, and our legitimate business needs.

We do not retain personal information indefinitely merely because it was once collected. Consistent with applicable California privacy requirements, retention should be limited to what is reasonably necessary and proportionate for the disclosed purpose or otherwise permitted by law.

4.9 Email Communications Across Ecay Brands

Because Ecay Design and Architects operates or manages multiple brands and business lines, an individual may interact with more than one Ecay brand or business entity.

Where reasonably necessary to respond to an inquiry, administer a client or customer relationship, provide requested services, manage communications, or perform shared administrative or operational functions, relevant contact information may be processed by the applicable Ecay entity, brand, division, or shared service provider responsible for that interaction.

We will not treat an individual’s subscription to communications from one Ecay brand as automatically constituting consent to receive unrelated marketing communications from every Ecay brand unless the applicable disclosure, consent mechanism, or other lawful basis supports that use. This distinction is important because California privacy rules consider the context in which information was collected and the reasonable expectations of the individual when evaluating whether a subsequent use is compatible with the original purpose.

Where separate brands have separate legal entities, privacy practices, or marketing programs, additional notices or terms may apply to those entities or programs.

5. Telephone Calls & Voice Communications

Ecay Design and Architects, together with its applicable brands, divisions, and related business entities covered by this Privacy Policy (collectively, “Ecay,” “we,” “us,” or “our”), may use telephone and voice communications to conduct business, provide services, respond to inquiries, communicate with clients and prospective clients, coordinate projects and appointments, provide customer support, administer accounts and transactions, and, where permitted by applicable law, conduct sales or marketing activities.

This section applies to telephone communications conducted through Ecay’s business telephone systems, including communications facilitated through third-party telecommunications and communications platforms such as RingCentral, as well as other telephone or voice systems used by Ecay.

The information collected and the manner in which it is used depend on the nature of the call, the individual’s relationship with Ecay, the communication technology involved, and applicable law.

5.1 Types of Calls

Ecay may receive or initiate different types of telephone communications, including:

Incoming Customer and Client Calls

We may receive calls from:

• • • Current clients and customers
    • Prospective clients and customers
    • Individuals requesting information or consultations
    • Vendors, contractors, consultants, and other business contacts
    • Individuals contacting a particular Ecay brand, business division, or employee
    • Other individuals who choose to contact us by telephone

We may use information from these calls to identify the caller, understand the purpose of the call, respond to requests, provide services, route the call to the appropriate person or business unit, and maintain appropriate business records.

Outgoing Customer-Service and Client Communications

We may place calls to clients, customers, prospective clients, or other contacts for purposes including:

• • • Responding to inquiries
    • Providing customer service
    • Addressing questions or complaints
    • Following up on service requests
    • Discussing active projects
    • Requesting information or documentation
    • Providing project or service updates
    • Resolving issues
    • Following up on previous communications
    • Sales and Business Development Calls

Where appropriate and permitted by applicable law, we may make calls for business development or sales purposes, including:

• • • Following up on inquiries or requests
    • Discussing requested services
    • Following up on proposals or consultations
    • Communicating with prospective clients
    • Discussing products or services that may be of interest
    • Developing or maintaining business relationships

When telephone calls constitute telemarketing or telephone solicitation, Ecay will comply with applicable federal and state requirements governing such communications, including applicable Do-Not-Call, consent, identification, calling-time, and other requirements. Federal telemarketing rules restrict certain solicitation calls to individuals on the National Do Not Call Registry and impose requirements concerning entity-specific Do-Not-Call requests.

We may use telephone communications to:

• • • Schedule consultations
    • Confirm or modify appointments
    • Coordinate site visits
    • Coordinate project-related activities
    • Confirm service arrangements
    • Provide reminders
    • Reschedule or cancel appointments
    • Obtain information necessary to perform requested services
    • Administrative Calls

We may make or receive calls concerning:

• • • Account administration
    • Billing and payment matters
    • Contracts and agreements
    • Project administration
    • Documentation
    • Privacy requests
    • Security matters
    • Legal or regulatory matters
    • Business operations
    • Other administrative matters relating to our relationship with an individual or organization
    • Marketing Calls

Where permitted by applicable law and where Ecay actually conducts telephone marketing, we may use telephone numbers to make marketing or promotional calls concerning Ecay or its applicable brands, products, services, events, or other offerings.

Marketing calls may be subject to additional consent requirements, Do-Not-Call requirements, calling-hour restrictions, and other federal or state requirements. Certain automated, artificial-voice, or prerecorded telemarketing calls are subject to heightened federal consent requirements.

Automated, Prerecorded, or Artificial-Voice Calls

Where Ecay uses automated dialing, prerecorded messages, artificial or generated voices, or similar technologies to make telephone calls, such communications will be subject to the additional requirements applicable to the technology and purpose of the call.

Federal law imposes heightened consent requirements on certain autodialed, artificial-voice, and prerecorded telemarketing calls, particularly calls directed to wireless numbers. (fcc.gov)

California also regulates automatic dialing-announcing devices and certain prerecorded telephone communications. Accordingly, Ecay will use such technologies only where the applicable legal requirements have been satisfied.

5.2 Telephone Information We Collect

In connection with telephone communications, Ecay may collect or receive:

Telephone Numbers

This may include:

• • • Telephone number
    • Mobile telephone number
    • Business telephone number
    • Direct-dial number
    • Extension
    • Number provided during an inquiry, account relationship, project, or transaction
    • Caller Identification Information

Depending on the telephone system and information transmitted by the caller’s carrier or device, we may receive:

• • • Caller ID information
    • Telephone number associated with the incoming call
    • Name associated with the caller ID record, where provided
    • Date and time of the call
    • Call routing information
    • Information concerning the telephone line or device used to contact us

Caller ID information may be used to route calls, identify existing customer or client relationships, respond to inquiries, maintain records, and support security and fraud-prevention activities.

Name and Identifying Information

We may associate a telephone number with information such as:

• • • Name
    • Business or organization
    • Client or customer status
    • Project or account information
    • Contact preferences

The information associated with a telephone number depends on information previously provided by the individual or obtained through the applicable business relationship.

Call-Related Account, Customer, and Project Information

During or in connection with a call, we may access or create records concerning:

• • • Account information
    • Client or customer information
    • Project information
    • Service history
    • Appointment information
    • Transaction information
    • Prior communications
    • Requests and inquiries
    • Notes concerning the call
    • Follow-up actions

Such information may be used to understand the context of the communication and provide an appropriate response or service.

Call History and Call Metadata

Our telephone systems and communications providers may automatically generate records concerning calls, which may include:

• • • Incoming and outgoing call records
    • Date and time
    • Call duration
    • Telephone numbers
    • Call status
    • Call routing
    • Transfers
    • Voicemail status
    • Technical information associated with the call

This information may be used for business administration, customer service, security, troubleshooting, billing, system management, and analytics.

Voicemail Information

Where voicemail is available, we may collect:

• • • Voicemail messages
    • Voice recordings contained in voicemails
    • Telephone number associated with the voicemail
    • Date and time of the voicemail
    • Transcriptions of voicemails, where transcription functionality is used
    • Other metadata associated with the voicemail

Voicemail information may be accessed by authorized personnel and service providers as reasonably necessary to respond to messages and conduct our business.

5.3 Call Recording

Where Ecay records telephone calls, the following practices apply. If Ecay does not record calls, this subsection should be removed or replaced with a statement accurately reflecting that practice.

Ecay may record certain telephone communications for purposes such as:

• • • Quality assurance
    • Training
    • Customer-service review
    • Documentation
    • Security
    • Fraud prevention
    • Dispute resolution
    • Compliance
    • Internal business administration
    • Maintaining records of important business communications

Not every call will necessarily be recorded. Recording practices may vary depending on the telephone system, call type, business unit, purpose of the call, and applicable legal requirements.

Because California law imposes significant restrictions on recording confidential communications, Ecay will provide any legally required notice and obtain any consent required before recording a call. California Penal Code section 632 generally prohibits intentionally recording a confidential communication without the consent of all parties, and section 632.7 separately addresses intentional recording of certain communications involving cellular or cordless telephones without the consent of all parties.

Where a recorded call involves individuals in different jurisdictions, Ecay will consider the applicable recording and consent requirements associated with the parties and jurisdictions involved.

Storage of Recordings

Where calls are recorded, recordings may be stored through Ecay’s internal systems or through authorized third-party communications, cloud-storage, customer-service, or technology providers.

Access to Recordings

Access to call recordings may be limited to authorized personnel and service providers who require access for legitimate business purposes, such as:

• • • Customer service
    • Management
    • Quality assurance
    • Training
    • Security
    • Compliance
    • Dispute resolution
    • Legal or regulatory matters
    • Technical administration
    • Protection of Recordings

Ecay will use reasonable administrative, technical, and organizational safeguards appropriate to the nature of recorded information and the purposes for which it is maintained.

Retention of Recordings

Recorded calls will be retained only for as long as reasonably necessary for the purposes for which they were collected, subject to applicable legal, contractual, operational, security, and dispute-resolution requirements.

Retention may vary depending on:

• • • The nature of the call
    • Whether the recording relates to an active project or transaction
    • Legal or regulatory requirements
    • Business-record requirements
    • Security or dispute considerations
    • The applicable Ecay business or brand
    • The requirements of the provider storing the recording

Ecay does not intend to retain recordings indefinitely solely because they were created.

5.4 Call Transcription, AI, and Voice Analytics

This subsection should apply only to technologies actually used by Ecay.

Where our telephone systems or service providers provide transcription, artificial intelligence, automated summaries, speech analytics, or similar functionality, Ecay may process telephone communications and related information for purposes such as:

• • • Creating voicemail or call transcripts
    • Generating call summaries
    • Identifying action items
    • Improving customer-service processes
    • Quality monitoring
    • Searching or organizing communication records
    • Analyzing call performance
    • Supporting employees in handling customer or client communications
    • Identifying operational issues
    • Security and fraud prevention

Where such functionality processes the contents of a call, Ecay will use it only for purposes permitted by applicable law and consistent with the applicable notice and consent requirements.

If a third-party provider performs transcription, artificial-intelligence processing, speech analysis, or related services on our behalf, that provider may process the relevant information as necessary to perform the contracted service, subject to applicable contractual and legal restrictions.

Ecay will not represent that it uses artificial intelligence, automated transcription, voice analytics, or call summarization unless those technologies are actually deployed.

Where an automated or artificial voice is used to initiate telephone communications, additional federal or California requirements may apply depending on the type and purpose of the call. Federal law requires prior express written consent for certain autodialed or prerecorded/artificial-voice telemarketing calls, particularly to wireless numbers.

California also regulates the use of automatic dialing-announcing devices and, for certain prerecorded messages, requires disclosures concerning the use of an artificial voice. (turn257180search0)

5.5 Telephone Consent, Calling Preferences, and Do-Not-Call Requests

Ecay may obtain telephone numbers through:

• Website forms
• Consultation or inquiry forms
• Client or customer onboarding
• Contracts and agreements
• Account registration
• Direct telephone communications
• Existing client or customer relationships
• Business contacts
• Referrals
• Other lawful business interactions

Providing a telephone number does not necessarily constitute consent to receive marketing, automated, prerecorded, or artificial-voice calls. The type and purpose of a communication, the way the number was obtained, and applicable law determine what additional consent may be required.

Consent for Automated and Telemarketing Calls

Where applicable law requires prior express consent or prior express written consent for a particular type of telephone communication, Ecay will obtain and maintain the required consent before placing the applicable call.

For certain autodialed, prerecorded, artificial-voice, or telemarketing calls, federal law requires specific forms of consent and disclosures.

Where written or electronic consent is required, Ecay may maintain records concerning:

• The telephone number authorized
• The individual providing the consent
• The date consent was provided
• The method through which consent was obtained
• The disclosure presented when consent was obtained
• The purpose or category of calls authorized
• Subsequent withdrawal or modification of consent
• Marketing Calling Preferences

Individuals may request that Ecay stop making marketing or solicitation calls to their telephone number.

A request to stop marketing calls will be handled as an entity-specific Do-Not-Call request where applicable. Ecay may maintain the telephone number and other information necessary to ensure that the request is honored and to prevent the number from being inadvertently re-added to a marketing calling list.

The FTC’s Telemarketing Sales Rule prohibits sellers and telemarketers from calling consumers who have specifically asked not to receive further calls from the seller and requires sellers and telemarketers to maintain procedures for honoring such requests.

National Do-Not-Call Registry

Where applicable to a particular telemarketing program, Ecay will honor the National Do Not Call Registry and other applicable federal or state calling restrictions.

Businesses engaged in covered telemarketing activities generally must use the National Do Not Call Registry to identify numbers that should not be called, subject to applicable exceptions. The FTC currently states that telemarketers must access the Registry and maintain procedures to avoid prohibited calls.

The existence of an existing customer relationship or prior inquiry does not automatically permit every type of telephone solicitation. The applicable rules and exemptions depend on the nature and timing of the relationship, the type of call, the number being called, and whether the individual has separately requested that Ecay not call.

Withdrawal of Consent

Where an individual has provided consent for a category of calls and subsequently withdraws that consent, Ecay will update the applicable communication preference or suppression record and will cease the communications covered by the withdrawal within the period required by applicable law.

A request to stop marketing or promotional calls does not necessarily prevent Ecay from making calls that are:

• Necessary to provide a requested service
• Related to an active transaction or project
• Necessary to administer an account
• Necessary for security or fraud prevention
• Legally required
• Otherwise permitted independently of marketing consent

5.6 Telephone Data Sharing and Service Providers

Ecay may disclose telephone information and related call information when reasonably necessary to provide services, operate our telephone systems, administer customer and client relationships, protect our business, or perform the purposes described in this Privacy Policy.

Depending on the services actually used by Ecay, telephone information may be processed by:

Telecommunications and Communications Providers

Third-party providers may provide:

• Telephone services
• Voice communications
• Number provisioning
• Call routing
• Call management
• Voicemail
• Caller ID
• Network and telecommunications infrastructure

These providers may process telephone numbers, call metadata, and related information as necessary to provide the communications service.

Call-Center and Customer-Service Providers

Where Ecay uses third-party customer-service or call-center providers, those providers may process information necessary to:

• Answer calls
• Route communications
• Provide customer service
• Record or document interactions where authorized
• Manage call queues
• Provide follow-up support
• CRM and Business-Management Platforms

Telephone information may be processed through CRM, project-management, customer-service, or business-management systems that Ecay uses to maintain client, customer, prospect, or project records.

Recording, Transcription, and Communications-Analytics Providers

Where applicable, third-party providers may process recorded calls, voicemails, transcripts, call metadata, or related information to provide:

• Recording
• Storage
• Transcription
• Call summaries
• Quality monitoring
• Analytics
• Search
• Security
• Other communications-related functionality
• Technology, Hosting, and Cloud-Service Providers

Other vendors may process telephone-related information when providing:

• Cloud hosting
• Data storage
• Security
• Technical support
• System administration
• Backup services
• Infrastructure
• Software and business applications
• Professional Advisers and Legal-Service Providers

Ecay may disclose telephone or call-related information to attorneys, accountants, auditors, insurers, consultants, and other professional advisers where reasonably necessary to obtain professional services, protect Ecay’s rights, administer our business, investigate disputes, or comply with legal obligations.

Government, Regulatory, and Law-Enforcement Disclosures

Ecay may disclose telephone information where required or permitted by law, including in response to:

• Subpoenas
• Court orders
• Warrants
• Government requests
• Regulatory requirements
• Legal proceedings
• Law-enforcement requests
• Other lawful processes
• Corporate Transactions

Telephone information may be disclosed as reasonably necessary in connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, dissolution, or similar business transaction.

Service Providers and Independent Marketing

Ecay may use service providers that process telephone information on our behalf. Such processing is intended to be limited to the services those providers perform for Ecay.

Ecay does not intend to provide an individual’s telephone number to an unrelated third party for that third party’s independent marketing purposes merely because Ecay has collected the number. Where a disclosure constitutes a sale or sharing of personal information under applicable California law, it will be handled according to the applicable provisions of this Privacy Policy and any rights or opt-out mechanisms required by law.

Telephone Information and California Privacy Rights

Telephone numbers and certain related information may constitute personal information under California privacy law. Depending on the circumstances, call-related information may also fall within other statutory categories.

Accordingly, individuals covered by California privacy law may have rights concerning personal information associated with their telephone communications, subject to applicable exceptions and limitations. These rights may include rights to know/access, delete, correct, and opt out of certain sales or sharing of personal information.

Where Ecay processes telephone information through service providers or contractors, those relationships will be structured and administered in accordance with applicable California requirements governing the handling of personal information.

5.7 Call Security, Fraud Prevention, and Abuse Prevention

Ecay may use telephone numbers, caller information, call metadata, voicemail information, and other call-related information to:

• Detect suspicious or fraudulent activity
• Prevent unauthorized access
• Protect employees, customers, clients, and business contacts
• Investigate misuse of telephone systems
• Detect abusive or threatening communications
• Protect our systems and infrastructure
• Investigate security incidents
• Maintain records necessary to enforce our agreements and policies
• Support legal or regulatory investigations

Where permitted by law, we may use technical information associated with telephone communications to investigate suspicious activity, detect unauthorized use, and protect the security and integrity of our communications systems.

5.8 Retention of Telephone Information

Ecay may retain telephone numbers, call records, voicemail information, consent records, Do-Not-Call requests, communication preferences, and other telephone-related information for as long as reasonably necessary for the purposes described in this Privacy Policy.

Retention periods may vary based on:

• The type of information
• The purpose for which it was collected
• Whether the information is associated with an active client, customer, prospect, project, or transaction
• Whether the information is necessary to honor a Do-Not-Call or other communication preference
• Legal, regulatory, accounting, contractual, or insurance requirements
• Security and fraud-prevention needs
• Disputes or potential legal claims
• The requirements of third-party service providers

Do-Not-Call and suppression information may need to be retained after an individual stops receiving marketing calls so that Ecay can continue to honor the individual’s request.

Call recordings, where used, may be retained for a different period from call metadata or telephone numbers.

Ecay seeks to limit retention of personal information to the period reasonably necessary and proportionate to the applicable purpose or otherwise permitted by law.

5.9 Communications Across Ecay Brands

Because Ecay Design and Architects operates or manages multiple brands, divisions, and business activities, an individual may communicate with more than one Ecay brand or business entity.

Where reasonably necessary to respond to an inquiry, administer a client or customer relationship, provide requested services, coordinate a project, operate shared business systems, or perform shared administrative functions, telephone information may be accessed or processed by the applicable Ecay entity, brand, division, or authorized service provider responsible for that activity.

A telephone number provided in connection with one Ecay brand will not automatically be treated as authorization to receive unrelated marketing calls from every Ecay brand or business entity. The scope of any applicable consent or communication preference will depend on the context in which the number was collected, the disclosures provided, the nature of the relationship, and applicable law.

Where separate Ecay brands or entities maintain separate marketing programs, additional notices, consent mechanisms, or communication preferences may apply.

6. SMS / Text Messaging Privacy

Ecay Design and Architects, together with its applicable brands, divisions, and related business entities covered by this Privacy Policy (collectively, “Ecay,” “we,” “us,” or “our”), may use SMS and text messaging to communicate with clients, customers, prospective clients, business contacts, and other individuals who interact with us.

SMS communications may be provided through third-party communications platforms and service providers, including RingCentral and other technology providers used by Ecay. The information collected and the purposes for which it is used depend on the particular SMS program, the individual’s relationship with Ecay, the manner in which consent or authorization was obtained, and the nature of the messages being sent.

This section specifically addresses Ecay’s collection, use, disclosure, and retention of personal information in connection with SMS and text messaging. It should be read together with the applicable SMS Terms of Service, including the disclosures and terms presented when an individual elects to receive SMS communications.

Ecay intends to administer its SMS communications consistently with applicable federal and California privacy and communications requirements. The federal Telephone Consumer Protection Act (“TCPA”) generally requires prior express consent for covered autodialed or prerecorded calls and texts, subject to applicable exceptions, and gives consumers the right to revoke consent through reasonable means. The FCC’s rules also recognize text-based methods such as “STOP” and similar requests as reasonable methods of revoking consent.

6.1 SMS Information We Collect

In connection with SMS and text messaging, Ecay may collect, receive, generate, or maintain the following information:

Mobile Telephone Number

We may collect the mobile telephone number associated with an individual’s SMS communications.

A mobile number may be provided through:

• Website forms
• Contact forms
• Consultation or inquiry forms
• Client or customer onboarding
• Account registration
• Project-related communications
• Direct communications
• Existing customer or client relationships
• Other lawful business interactions
• Name and Identifying Information

Where provided, we may associate a mobile telephone number with:

• First and last name
• Preferred name
• Company or organization
• Client or customer information
• Prospect information
• Account information
• Project information
• Other identifying information reasonably associated with the communication
• SMS Consent and Opt-In Information

Where SMS consent or authorization is required or collected, we may maintain records concerning:

• Whether an individual opted in to SMS communications
• The telephone number to which the consent applies
• The date and time consent was provided
• The method or source through which consent was obtained
• The disclosure or consent language presented at the time of opt-in
• The type or category of SMS communications authorized
• Any applicable consent status
• Subsequent withdrawal or revocation of consent

Maintaining these records helps Ecay administer communication preferences, prevent unauthorized messaging, honor revocation requests, and demonstrate the source and scope of an individual’s SMS authorization where appropriate.

SMS Preferences and Suppression Information

We may maintain information concerning:

• SMS communication preferences
• Types of messages an individual has elected to receive
• Opt-out requests
• STOP requests
• HELP requests
• Suppression or do-not-text status
• Other requests concerning SMS communications

We may retain information necessary to ensure that an individual who has opted out is not inadvertently re-enrolled or contacted for the category of communication from which the individual opted out.

SMS Communication History and Metadata

Depending on the communications systems used by Ecay, we may maintain records concerning SMS interactions, including:

• Messages sent to or received from an individual
• Date and time of messages
• Telephone numbers involved
• Delivery status
• Message status
• Routing or technical information
• Records associated with customer-service interactions
• Other metadata generated by the SMS provider

The information available to Ecay may depend on the functionality of the particular SMS platform or provider.

6.2 How We Use SMS Information

Ecay may use SMS-related personal information for purposes including:

• Providing customer service
• Responding to inquiries
• Communicating with clients and prospective clients
• Conducting conversational communications
• Providing transactional or service-related communications
• Sending appointment or scheduling notifications
• Providing project-related updates
• Providing account-related notifications
• Managing customer and client relationships
• Administering SMS subscriptions and preferences
• Processing and honoring opt-out requests
• Maintaining consent and suppression records
• Protecting the security and integrity of our communications systems
• Detecting fraud, abuse, or unauthorized activity
• Maintaining business and communication records
• Complying with legal and regulatory requirements
• Sending marketing or promotional communications, where applicable and where the required consent or other lawful basis exists
• Measuring and improving SMS communications and related business processes, where permitted by applicable law

We seek to use SMS information only for purposes reasonably necessary and proportionate to the purpose for which it was collected or otherwise permitted by applicable law. California privacy regulations place particular emphasis on purpose limitation, data minimization, and processing that is reasonably necessary and proportionate to the disclosed purpose.

6.3 SMS Consent and Opt-In

How SMS Consent May Be Obtained

Depending on the particular SMS program, an individual may opt in to receive SMS messages through mechanisms such as:

• Website forms
• SMS-specific consent forms
• Client or customer onboarding processes
• Online inquiries
• Other electronic forms
• Written authorization
• Other methods that provide the disclosures and consent required by applicable law

Where Ecay uses a website form to obtain SMS consent, the SMS consent mechanism should clearly identify that the individual is consenting to receive SMS messages and should identify the types of messages to which the consent applies.

RingCentral specifically instructs businesses collecting SMS opt-in consent through a website form to use an optional, unchecked-by-default SMS consent checkbox next to the telephone-number field and to provide the relevant SMS disclosure and Privacy Policy link.

Voluntary Nature of SMS Consent

Where Ecay requests separate SMS marketing or promotional consent, that consent should be distinguishable from unrelated terms of service, privacy acknowledgments, or other permissions.

Where required by applicable law, Ecay will not make consent to receive marketing or promotional SMS a condition of purchasing goods or services.

Scope of Consent

SMS consent applies only to the communications and purposes described when the consent is obtained, subject to applicable law.

Consent to receive SMS messages from one Ecay brand, program, or business entity should not automatically be interpreted as consent to receive unrelated marketing messages from every Ecay brand, affiliate, or unrelated third party.

The scope of an individual’s consent may depend on:

• The identity of the sender identified at the time of consent
• The type of messages disclosed
• The purpose for which consent was obtained
• The telephone number involved
• The consent mechanism used
• Any subsequent modification or withdrawal of consent
• Applicable federal and California law

For certain calls and texts governed by the TCPA, consent is tied to the party or communication for which the consent was provided, and the FCC has emphasized that consumers have the right to revoke consent through reasonable means.

Consent Records

Where appropriate, Ecay may retain records sufficient to establish:

• Who provided consent
• Which number was authorized
• When consent was provided
• How consent was provided
• What disclosure accompanied the consent
• What type of messaging was authorized
• When consent was withdrawn or modified

6.4 Categories of SMS Messages

The actual SMS messages sent by Ecay may fall into one or more of the following categories, depending on the applicable Ecay business, service, and SMS program.

Conversational Messages

These may include ordinary back-and-forth communications initiated by an individual or occurring in response to an inquiry or ongoing conversation.

Examples include:

• Responses to customer inquiries
• Responses to project questions
• Customer-service communications
• Follow-up communications concerning a previously initiated conversation
• Informational and Service Messages

These may include information associated with an ongoing customer, client, project, or service relationship.

Examples include:

• Appointment reminders
• Scheduling communications
• Project updates
• Service notifications
• Requests for information
• Administrative notices
• Account-related communications
• Transactional Messages

Where applicable, Ecay may use SMS to communicate information directly associated with a transaction, requested service, account, project, or other business relationship.

Promotional or Marketing Messages

Where Ecay actually conducts SMS marketing and obtains the required authorization, messages may include:

• Promotions
• Offers
• Announcements
• Information about Ecay services
• Information concerning applicable Ecay brands
• Marketing campaigns
• Other promotional communications

Ecay will not represent that an individual has consented to promotional SMS merely because the individual provided a telephone number for a different purpose.

The selected SMS use case, consent language, Privacy Policy, SMS Terms, and actual SMS messages should correspond with one another. RingCentral specifically instructs businesses that the types of messages described in the SMS consent language must be consistent with the selected SMS use case.

6.5 SMS Opt-Out and Revocation of Consent

Individuals may revoke their consent to receive SMS communications through the opt-out mechanisms made available by Ecay.

STOP

Where an individual replies STOP to an SMS communication, Ecay will treat the request as an instruction to stop the applicable SMS communications, subject to applicable law and the limited circumstances in which a subsequent administrative confirmation may be sent.

The FCC recognizes “stop” and similar standard responses as reasonable methods for consumers to revoke consent to covered robotexts.

Other Reasonable Revocation Methods

Depending on the SMS program, an individual may also revoke consent by using another reasonable method made available by Ecay, such as:

• Contacting Ecay by telephone
• Contacting Ecay by email
• Using an applicable online preference or opt-out mechanism
• Submitting a request through another designated contact method

Ecay will not intentionally make the process of withdrawing SMS consent unnecessarily burdensome.

The FCC has stated that consumers may revoke TCPA consent through any reasonable means and that covered callers and texters must honor applicable revocation requests within the required timeframe.

Effect of an Opt-Out

After an applicable opt-out or revocation request is received, Ecay will update the relevant communication preference or suppression record and cease the SMS communications covered by that request within the period required by applicable law and the applicable communications system.

Where the individual has opted out of marketing or promotional SMS, Ecay may continue to send communications that are independently permitted or necessary, such as certain communications relating to an active service, transaction, project, account, security matter, or legal obligation, to the extent permitted by applicable law.

Retention of Opt-Out Information

Ecay may retain the information necessary to honor an individual’s opt-out request. Maintaining suppression or do-not-text information may be necessary to prevent an individual from being inadvertently contacted in the future.

6.6 SMS Help and Customer Support

Individuals who receive SMS messages from Ecay may use HELP, where supported by the applicable SMS program, to request assistance or information concerning the SMS service.

Help functionality may provide information concerning:

• The identity of the sender
• How to obtain support
• How to opt out
• How to contact Ecay
• Other information concerning the applicable SMS program

Individuals may also contact Ecay using the customer-service information provided in the applicable SMS communication, SMS Terms of Service, Privacy Policy, or Ecay website.

6.7 SMS Message Frequency and Charges

Messaging frequency may vary depending on the nature of the individual’s relationship with Ecay, the individual’s interactions with us, the types of communications requested or authorized, and the applicable SMS program.

Message and data rates may apply. An individual’s wireless carrier may impose charges for SMS messages or data usage. Ecay does not control the rates charged by wireless carriers.

RingCentral specifically identifies messaging frequency may vary and message and data rates may apply as disclosures to include in SMS consent/terms information.

6.8 SMS Data Sharing and Disclosure

Ecay may disclose SMS-related personal information when reasonably necessary to provide SMS services, operate our business, respond to communications, administer customer relationships, maintain our systems, satisfy legal requirements, protect our rights and security, or perform another purpose described in this Privacy Policy.

Service Providers

SMS information may be disclosed to or processed by service providers that perform services for Ecay, including providers supporting:

• SMS and telecommunications services
• Communications infrastructure
• SMS delivery
• Customer relationship management
• Customer support
• Website and form functionality
• Cloud hosting and storage
• Security
• Analytics
• Business administration
• Other technical or operational functions

These providers may have access to mobile telephone numbers, messaging information, consent information, and related metadata to the extent reasonably necessary to perform services for Ecay.

Mobile Numbers and Third-Party Marketing

Ecay does not sell or rent mobile telephone numbers for third-party marketing purposes.

Ecay does not provide SMS opt-in information, SMS consent, or mobile-message authorization to unrelated third parties or affiliates for their own independent marketing purposes.

SMS Opt-In and Consent Information

No mobile opt-in information or text-message consent will be shared with third parties or affiliates for their own marketing or promotional purposes.

This restriction applies specifically to the individual’s SMS consent or authorization and is intended to prevent a third party or affiliate from treating an individual’s consent to receive Ecay SMS communications as authorization to send its own unrelated marketing messages.

This does not prevent Ecay from using or disclosing SMS information to service providers and contractors that process the information on Ecay’s behalf for legitimate business purposes, such as operating the SMS program, delivering messages, managing opt-out records, maintaining CRM systems, providing customer support, or fulfilling other services for Ecay.

Ecay Brands and Related Businesses

Where Ecay operates or manages multiple brands, divisions, or related business activities, relevant SMS information may be processed internally when reasonably necessary to:

• Respond to an inquiry
• Provide a requested service
• Administer an existing client or customer relationship
• Coordinate a project
• Maintain shared systems
• Perform shared administrative functions
• Honor privacy and communication preferences

However, consent to receive SMS from one Ecay brand or program is not automatically treated as authorization for unrelated promotional messaging from another Ecay brand or unrelated business.

Legal and Regulatory Disclosures

Ecay may disclose SMS-related information where reasonably necessary or legally required, including in response to:

• Subpoenas
• Court orders
• Warrants
• Government requests
• Regulatory requirements
• Law-enforcement requests
• Legal proceedings
• Investigations
• Other lawful processes
• Corporate Transactions

SMS-related information may also be disclosed as reasonably necessary in connection with a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, dissolution, or similar corporate transaction, subject to applicable legal requirements.

6.9 SMS Service Providers and Technology Providers

Ecay may use third-party providers to operate and administer SMS communications.

Depending on the actual systems implemented by Ecay, these providers may include:

Communications and SMS Providers

Providers that facilitate:

• Telephone numbers
• SMS transmission
• Message delivery
• Messaging infrastructure
• Call and message routing
• Delivery status
• Communications management
• CRM and Customer-Management Systems

CRM providers may process:

• Mobile numbers
• Customer information
• Client information
• SMS preferences
• Consent records
• Communication history
• Project or account information
• Customer-Support Platforms

Customer-support systems may process SMS communications and related information to allow authorized personnel to respond to inquiries and provide service.

Hosting and Cloud Providers

Hosting and cloud-service providers may process SMS-related information in connection with:

• Data storage
• Backups
• Infrastructure
• Security
• Technical administration
• Analytics Providers

Where analytics are actually used, providers may process limited information concerning SMS delivery, engagement, campaign performance, or related operational metrics.

Ecay will not describe an analytics, advertising, AI, recording, or other third-party service as being used for SMS unless that service is actually part of our SMS environment.

Where applicable California law governs a provider relationship, Ecay will structure and administer the relationship consistently with the applicable requirements concerning service providers and contractors, including limitations on the provider’s use of personal information beyond the authorized business purpose.

6.10 SMS Privacy, Security, and Access Controls

Ecay may use administrative, technical, and organizational safeguards designed to protect SMS-related personal information from unauthorized access, use, alteration, disclosure, or destruction.

Depending on the systems used, safeguards may include:

• Access controls
• Authentication mechanisms
• Role-based access
• Vendor controls
• Account-management procedures
• System monitoring
• Security measures provided by communications platforms
• Data-management procedures
• Incident-response procedures

Access to SMS information may be limited to personnel and service providers who have a legitimate business need to access that information.

No security measure can guarantee absolute security, and Ecay cannot guarantee that information transmitted or stored through electronic communications systems will never be subject to unauthorized access or security incidents.

6.11 SMS Data Retention

Ecay may retain SMS-related information only for as long as reasonably necessary for the purposes described in this Privacy Policy or as otherwise permitted or required by law.

Different categories of SMS information may have different retention periods.

Mobile Telephone Numbers

Mobile numbers may be retained while they remain associated with an active client, customer, prospect, account, project, communication preference, or other business relationship, and thereafter as reasonably necessary for legitimate business, legal, security, or compliance purposes.

SMS Consent Records

Consent records may be retained for as long as reasonably necessary to:

• Administer the SMS program
• Demonstrate the source and scope of consent where appropriate
• Address disputes
• Comply with applicable legal requirements
• Prevent unauthorized messaging
• SMS Opt-Out and Suppression Records

Opt-out and suppression records may be retained after an individual stops receiving messages because retaining this information may be necessary to ensure that the individual’s request is honored and prevent inadvertent future messaging.

SMS Communication Records

Message history, delivery records, metadata, customer-service records, and related information may be retained for periods appropriate to the applicable business, project, transaction, customer relationship, operational requirements, legal requirements, security needs, and dispute-resolution needs.

Third-Party Provider Retention

Where SMS information is processed by a third-party provider, that provider may retain information in accordance with its contractual obligations to Ecay and its applicable retention and deletion practices.

Ecay seeks to limit retention of personal information to what is reasonably necessary and proportionate to the applicable purpose or otherwise permitted by law. California’s current privacy regulations emphasize that businesses should not retain personal information longer than reasonably necessary and proportionate to the purpose for which it was collected or otherwise permitted by law.

6.12 SMS and California Privacy Rights

To the extent Ecay is subject to the California Consumer Privacy Act (“CCPA”) with respect to a particular individual or processing activity, applicable California privacy rights may apply to personal information collected through SMS communications.

Depending on the circumstances and applicable statutory exceptions, these rights may include:

• The right to know/access certain personal information
• The right to request correction
• The right to request deletion
• The right to opt out of certain sales or sharing of personal information
• The right to limit certain uses or disclosures of sensitive personal information where applicable
• Other rights provided by applicable California law

Not every right applies to every individual, business activity, or category of information. Ecay’s procedures for exercising applicable California privacy rights are described in the California Privacy Rights section of this Privacy Policy.

California’s current privacy framework also distinguishes between ordinary service-provider processing and activities that may constitute a sale or sharing of personal information. Accordingly, the actual technology and vendor relationships used by Ecay should control the final description of SMS data practices.

6.13 SMS Communications and Ecay’s Multiple Brands

Ecay Design and Architects may operate, manage, or provide services through multiple brands, divisions, or related business entities.

Where multiple Ecay businesses use shared communications infrastructure, a mobile telephone number or SMS-related record may be accessible to the applicable personnel or systems responsible for administering the relevant client, customer, project, inquiry, or communication.

However, Ecay does not treat SMS consent as unlimited authorization to market every Ecay brand to an individual.

Where consent was obtained for a specific SMS program, the applicable brand, business entity, communication type, or purpose will determine the scope of that consent, subject to applicable law.

Where a separate Ecay brand or business entity operates its own SMS program, that program may use a separate consent mechanism, SMS Terms of Service, Privacy Policy, or other applicable notice.

6.14 Changes to SMS Practices

If Ecay materially changes the way it collects, uses, discloses, or otherwise processes SMS-related personal information, we may update this section of the Privacy Policy and, where required by applicable law, provide additional notice or obtain additional consent.

Changes to an individual’s SMS preferences or consent will be handled separately from ordinary updates to this Privacy Policy where the applicable law or communications rules require separate consent, notice, or revocation procedures.

7. Cookies, Tracking, and Analytics

Ecay Design and Architects, together with its applicable brands, divisions, and related business entities covered by this Privacy Policy (collectively, “Ecay,” “we,” “us,” or “our”), may use cookies, pixels, tags, scripts, local storage, software development kits, log files, web beacons, and similar technologies on our websites, applications, emails, and other digital services. These technologies may collect information about a device, browser, online activity, interactions with our communications, and use of our websites and services.

The technologies actually used by a particular Ecay website or brand may vary. This section is intended to describe the categories and purposes of technologies we may use, rather than represent that every technology described below is used on every Ecay website.

California’s privacy framework requires applicable businesses to disclose their online information practices, including relevant categories of information collected, purposes of collection, third-party collection, and treatment of tracking mechanisms. California’s Online Privacy Protection Act also requires applicable website operators to disclose how they respond to browser-based “Do Not Track” signals or similar mechanisms and whether third parties may collect personally identifiable information through the website.

7.1 Cookies and Similar Website Technologies

Cookies are small files or pieces of information stored on or accessed from a user’s browser or device. We may use cookies and similar technologies to allow our websites and online services to function, maintain security, remember preferences, understand website activity, and support other disclosed business purposes.

Cookies and similar technologies may be used to recognize a returning browser or device, maintain a session, remember settings, determine whether a particular feature has previously been used, measure website performance, and associate online activity with a particular interaction.

Depending on their purpose and configuration, cookies may be:

Strictly necessary or essential, which are used to provide core website functions, security, authentication, load balancing, session management, or other functionality that users reasonably expect the website to provide.

Functional or preference-related, which may remember preferences, settings, language choices, or other selections to make the website operate according to the user’s preferences.

Analytics or performance-related, which may help us understand traffic, usage, performance, navigation, and interactions with our websites.

Advertising or marketing-related, where applicable, which may be used to measure advertising, understand interactions with advertisements, or support interest-based or cross-context advertising.

The actual classification and operation of a cookie depends on the vendor, technology, configuration, and purpose for which it is deployed.

7.2 Information Collected Through Cookies and Similar Technologies

Depending on the technologies actually used, information collected may include:

• IP address or an identifier derived from an IP address
• Browser type and version
• Device type and operating system
• Device or online identifiers
• Website pages visited
• Content viewed
• Links or buttons selected
• Referring and exit pages
• Date and time of visits
• Session information
• Website search and navigation activity
• General interaction patterns
• Advertising interactions
• Conversion activity
• Cookie identifiers
• Similar identifiers
• Preferences and settings
• Information concerning the website or campaign through which an individual reached our website

Some of this information may constitute personal information under California law when it identifies, relates to, describes, or is reasonably capable of being associated with a particular consumer or household. California law also recognizes internet or other electronic network activity as a category of personal information.

7.3 Analytics

Ecay may use analytics technologies to understand how our websites, forms, communications, and digital services are used and to identify opportunities to improve them.

Analytics may be used to understand:

• How visitors arrive at our websites
• Which pages or content are viewed
• How visitors navigate through a website
• How frequently particular features are used
• Whether forms or other functions are successfully completed
• Whether technical errors or performance problems occur
• General traffic and engagement patterns
• The effectiveness of digital communications
• The effectiveness of advertising or marketing campaigns
• Whether a website visit resulted from a particular advertisement, email, referral, or campaign

Analytics information may be viewed in an aggregated or statistical form, but certain analytics providers may process information associated with identifiable or reasonably linkable online identifiers.

Where we use third-party analytics providers, those providers may collect information directly through cookies, pixels, tags, software development kits, or similar technologies and may process that information in accordance with their contractual arrangements with Ecay and their applicable privacy practices.

Where an analytics technology is used in a manner that constitutes a sale or sharing of personal information under California law, the activity will be addressed through the applicable California disclosures and opt-out mechanisms described in this Privacy Policy. California’s definition of “sharing” includes certain disclosures for cross-context behavioral advertising.

7.4 Advertising Cookies and Advertising Technologies

Where Ecay uses online advertising, we may permit advertising platforms or other third parties to use cookies, pixels, tags, identifiers, or similar technologies to measure advertising performance, deliver advertisements, understand interactions with advertisements, or support advertising based on online activity.

Advertising technologies may allow a provider to recognize a browser or device across multiple websites or online services. Depending on the technology and the circumstances, this activity may constitute cross-context behavioral advertising under California law.

Ecay will not describe advertising technologies as being used unless they are actually deployed. The specific vendors, identifiers, and purposes may vary between websites, brands, advertising campaigns, and platforms.

When advertising technology involves the sale or sharing of personal information as defined by applicable California law, applicable opt-out rights will be provided. Covered businesses are required to honor valid opt-out preference signals, including Global Privacy Control where applicable.

7.5 Tracking Pixels, Web Beacons, and Similar Technologies

We may use tracking pixels, web beacons, clear GIFs, tags, scripts, and similar technologies on our websites or in electronic communications.

These technologies may be used to:

• Determine whether content has been viewed
• Measure website or email engagement
• Understand campaign effectiveness
• Record interactions with links or content
• Support security
• Measure conversions
• Determine whether an advertisement or communication resulted in a subsequent interaction
• Improve website and communication performance

A tracking pixel may operate in combination with a cookie or other identifier. Accordingly, blocking or deleting cookies does not necessarily prevent every form of tracking technology from operating.

7.6 Email Tracking

Where Ecay uses email marketing, communications, or automation platforms that provide tracking functionality, emails may contain technologies that allow us or our service providers to determine whether an email was delivered, opened, rendered, clicked, or otherwise interacted with.

Depending on the platform, email tracking may involve:

• Open tracking
• Link or click tracking
• Pixels
• Redirected links
• Conversion tracking
• Delivery and bounce monitoring
• Engagement analytics

Information generated through these technologies may be associated with an email address, campaign, customer or prospect record, device, or online identifier.

The use of email tracking will depend on the actual email platform and configuration used by Ecay. An email message may contain tracking functionality even when the recipient does not knowingly interact with a tracking mechanism.

7.7 Conversion Tracking

Ecay may use conversion-tracking technologies to determine whether a marketing communication, advertisement, referral, or other campaign resulted in a desired action.

For example, conversion information may be used to determine whether an individual:

• Submitted an inquiry
• Requested a consultation
• Completed a form
• Contacted us
• Requested a service
• Made or initiated a transaction
• Completed another action associated with a campaign

Conversion information may be combined with campaign, device, website, or online identifier information for measurement and reporting.

Where conversion tracking involves cross-site or cross-context data collection that constitutes “sharing” under California law, the applicable opt-out rights will apply.

7.8 Device and Browser Information

When an individual accesses our websites or digital services, we may automatically collect information concerning the device or browser used to access them.

This may include:

• Device type
• Browser type and version
• Operating system
• Screen characteristics
• Language settings
• Time zone
• Network information
• IP address
• Device or online identifiers
• Referring URL
• Website activity
• Technical logs
• Date and time of access

We may use this information to operate and secure our websites, troubleshoot technical problems, understand website performance, perform analytics, detect suspicious activity, and improve the functionality and experience of our digital services.

7.9 Third-Party Collection Through Our Websites

Some third-party services embedded in or connected to our websites may independently collect information through cookies, pixels, SDKs, tags, or other technologies.

These third parties may include providers of:

• Analytics
• Advertising
• Video or media
• Social-media functionality
• Maps or location-related functionality
• Security
• Website performance
• Customer-support features
• Scheduling
• Payment functionality
• Other embedded digital services

The presence of a third-party technology does not necessarily mean that Ecay has direct access to every piece of information collected by that technology.

Where required by California law, our privacy disclosures will identify relevant categories of third parties and explain applicable choices concerning the collection, sale, or sharing of personal information. CalOPPA specifically requires applicable online privacy policies to state whether third parties may collect personally identifiable information about users of the website.

7.10 How Users Can Control Cookies and Tracking

Individuals may have several ways to control cookies and related technologies.

Most modern browsers allow users to:

• Block cookies
• Delete previously stored cookies
• Restrict certain categories of cookies
• Receive notifications before cookies are stored
• Configure privacy or tracking settings

Disabling or deleting cookies may affect the functionality of portions of our websites. Certain essential cookies may be necessary for basic website functionality, security, account access, or other requested services.

Where Ecay provides a cookie-management or privacy-preference tool, individuals may use that tool to manage the applicable categories of optional cookies and tracking technologies.

Browser-based controls are not necessarily equivalent to California’s separate right to opt out of the sale or sharing of personal information. California’s current regulations expressly distinguish cookie controls from the required mechanisms for opting out of sale or sharing.

7.11 Global Privacy Control and Opt-Out Preference Signals

Where Ecay is subject to California requirements concerning the sale or sharing of personal information, Ecay will process valid opt-out preference signals in accordance with applicable law.

A user-enabled Global Privacy Control (“GPC”) may communicate a consumer’s request to opt out of the sale or sharing of personal information. California’s Attorney General explains that businesses subject to the applicable requirement must honor a valid GPC as a request to stop the sale or sharing of personal information.

A cookie banner or cookie-preference tool is not, by itself, a substitute for a legally required sale/sharing opt-out mechanism. California’s current regulations expressly state that cookie controls alone do not satisfy the requirement to provide a method for opting out of the sale or sharing of personal information.

7.12 Do Not Track Signals

Our response to browser-based Do Not Track (“DNT”) signals or similar mechanisms will depend on the actual tracking technologies and services used by the applicable website.

Where required by California law, this Privacy Policy will state whether our websites respond to DNT signals or similar mechanisms and whether third parties may collect personally identifiable information through our websites.

DNT should not be confused with a California opt-out preference signal such as GPC. They are separate mechanisms and may have different legal effects.

California’s Online Privacy Protection Act specifically requires covered website operators to disclose how they respond to DNT signals or similar mechanisms and whether third parties can collect personally identifiable information through the website.

7.13 Links, Advertisements, and Third-Party Technologies

Our websites may contain links to third-party websites, applications, advertisements, social-media features, or other technologies that are not controlled by Ecay.

A third party may use its own cookies, pixels, identifiers, or similar technologies when an individual interacts with its service. The third party’s processing is governed by its own privacy policy and practices.

The presence of an advertisement or third-party feature does not necessarily mean that Ecay endorses the third party’s privacy practices.

7.14 Changes to Cookie and Tracking Technologies

The technologies used on our websites may change over time. We may add, remove, replace, or modify analytics, advertising, communications, security, or other technologies as our systems and business practices evolve.

Where a change materially affects the purposes for which personal information is collected, used, sold, or shared, we will provide any notice or choice required by applicable law.

8. How We Share Personal Information

Ecay may disclose personal information to third parties when reasonably necessary to operate our business, provide requested products or services, administer client and customer relationships, process transactions, communicate with individuals, maintain our systems, protect our business and users, comply with legal requirements, or carry out another purpose described in this Privacy Policy.

The fact that Ecay discloses information to a third party does not necessarily mean that Ecay “sells” the information or that the third party is permitted to use the information for its own purposes. California law distinguishes between service-provider and contractor processing, ordinary third-party disclosures, sales, and sharing for cross-context behavioral advertising.

8.1 Service Providers and Contractors

Ecay may disclose personal information to service providers and contractors that perform services on our behalf.

These providers may support:

• Website hosting
• Cloud storage
• Communications
• Email
• SMS
• Telephone services
• CRM systems
• Customer support
• Marketing operations
• Analytics
• Advertising
• Payment processing
• Accounting
• Security
• Technology management
• Document management
• Professional services
• Other business functions

Where California law applies, Ecay will use applicable contractual and operational controls intended to restrict service providers and contractors from retaining, using, or disclosing personal information beyond the purposes permitted by law and the applicable service relationship.

8.2 Communications Providers

We may disclose contact information and communications-related information to providers that facilitate:

• Email
• Telephone calls
• SMS/text messaging
• Voicemail
• Communications routing
• Number provisioning
• Video or conferencing services
• Other communications services

Examples may include telecommunications carriers and platforms such as RingCentral, email providers, and related communications infrastructure providers.

These providers may process information necessary to deliver and administer communications.

8.3 Marketing Providers

Where Ecay uses third-party marketing platforms, those providers may process information needed to:

• Send marketing communications
• Manage subscriptions
• Maintain suppression lists
• Track campaign performance
• Manage prospect or customer records
• Conduct marketing automation
• Measure conversions
• Administer campaigns

Ecay will not treat a marketing provider as having unlimited rights to use Ecay’s customer or prospect information for its own unrelated marketing activities merely because the provider performs marketing services for Ecay.

8.4 CRM and Business Management Providers

Ecay may use CRM, project-management, customer-management, or business-management platforms to store and organize information concerning:

• Clients
• Customers
• Prospective clients
• Business contacts
• Projects
• Communications
• Accounts
• Service histories
• Preferences
• Transactions

Such providers may process personal information as necessary to provide their services.

8.5 Payment Processors

Where payment functionality is provided through third parties, payment processors may receive information necessary to process transactions.

Depending on the payment method, this may include information such as:

• Name
• Billing information
• Payment-card or account information
• Transaction details
• Amounts
• Payment status
• Fraud-prevention information

Ecay should identify the actual payment processors used by each applicable brand where practical.

Payment processors may have their own privacy practices and may be independently subject to financial-services, payment-card, or other laws.

8.6 Professional Advisers

Ecay may disclose personal information to attorneys, accountants, auditors, insurers, consultants, financial advisers, architects, engineers, contractors, or other professional advisers where reasonably necessary to:

• Obtain professional services
• Administer our business
• Manage projects
• Evaluate or defend legal claims
• Address insurance matters
• Perform accounting or auditing
• Comply with legal obligations
• Protect our rights and interests

8.7 Legal, Regulatory, and Government Authorities

Ecay may disclose personal information when required or permitted by applicable law, including to:

• Courts
• Law-enforcement agencies
• Government agencies
• Regulatory authorities
• Administrative bodies
• Tax authorities
• Other governmental entities

Disclosures may occur in response to subpoenas, warrants, court orders, legal proceedings, regulatory obligations, investigations, or other lawful processes.

8.8 Affiliates and Related Ecay Entities

Because Ecay Design and Architects operates or manages multiple brands and business activities, personal information may be accessible to or processed by affiliated, related, or commonly managed entities when reasonably necessary to:

• Provide requested services
• Respond to inquiries
• Administer customer relationships
• Coordinate projects
• Operate shared infrastructure
• Perform accounting or administrative functions
• Maintain business records
• Manage security
• Honor communication preferences
• Perform other disclosed business purposes

Affiliation or common ownership does not, by itself, mean that every Ecay brand may use every individual’s information for unrelated marketing purposes.

8.9 Corporate Transactions

Personal information may be disclosed as reasonably necessary in connection with a proposed or completed:

• Merger
• Acquisition
• Financing
• Reorganization
• Sale of assets
• Transfer of a business line
• Bankruptcy
• Dissolution
• Similar corporate transaction

Where applicable, information will be handled subject to the legal requirements governing the transaction and subsequent use of personal information.

8.10 Other Disclosures Authorized by the Individual

Ecay may disclose personal information when an individual specifically requests or authorizes such disclosure, or when disclosure is otherwise consistent with the purpose for which the information was provided and permitted by applicable law.

8.11 Distinguishing Service-Provider Processing From Sale or Sharing

A third party’s receipt of personal information does not automatically constitute a sale or sharing under California law.

For example, an email provider may receive an email address to deliver a requested email, or a CRM provider may process a telephone number to maintain a customer record. These activities may be service-provider or contractor processing rather than a sale.

By contrast, certain disclosures to advertising or other third parties for cross-context behavioral advertising may constitute “sharing” under the CCPA even when no money changes hands. California also separately defines “sale” in a manner that can cover certain transfers of personal information for monetary or other valuable consideration.

Ecay therefore evaluates these relationships based on the actual data flows, purposes, contractual arrangements, and applicable California definitions rather than treating all third-party disclosures as equivalent.

9. Sale, Sharing, and Other Disclosure of Personal Information

California law distinguishes among ordinary disclosures, service-provider processing, the sale of personal information, and the sharing of personal information for cross-context behavioral advertising.

Ecay’s treatment of personal information under these categories depends on the actual technologies, vendors, transactions, and business practices in use by the applicable Ecay entity or brand.

9.1 Sale of Personal Information

Ecay does not intend to sell personal information merely because it uses third-party service providers to operate its business.

Where information is transferred for monetary or other valuable consideration in a manner that meets California’s statutory definition of a sale, the transfer will be treated according to applicable California requirements.

Ecay will accurately disclose whether it sells personal information rather than making a blanket statement that could become inaccurate if our technology, advertising, or business practices change.

9.2 Sharing for Cross-Context Behavioral Advertising

Certain online advertising practices may constitute “sharing” under the CCPA. California defines sharing to include certain disclosures of personal information to a third party for cross-context behavioral advertising.

If Ecay engages in activities that constitute sharing, applicable California consumers may have the right to opt out of that sharing.

Where required, Ecay will provide an appropriate Do Not Sell or Share My Personal Information mechanism and will process valid opt-out preference signals, including applicable GPC signals.

9.3 Categories of Information Potentially Involved

Depending on the technologies and business activities actually used, information potentially involved in disclosures for advertising or similar purposes may include:

• Identifiers
• Email addresses
• Telephone numbers
• Online identifiers
• IP addresses
• Device information
• Internet or electronic network activity
• Website interactions
• Advertising interactions
• Approximate location information, where collected
• Inferences concerning preferences or interests, where created

The actual categories involved will depend on the specific activity and provider.

9.4 Categories of Recipients

Potential recipients may include:

• Advertising networks
• Advertising technology providers
• Analytics providers
• Social-media platforms
• Marketing platforms
• Communications providers
• CRM providers
• Service providers and contractors
• Business partners
• Professional advisers
• Governmental or regulatory authorities
• Corporate transaction participants

A recipient’s classification may vary depending on its contractual role and the nature of the information transfer.

9.5 Mobile Numbers and SMS Consent Information

Ecay does not sell or rent mobile telephone numbers for unrelated third-party marketing purposes.

No mobile opt-in information or text-message consent will be shared with third parties or affiliates for their own marketing or promotional purposes.

This does not prevent Ecay from disclosing a mobile number, SMS consent record, or SMS-related information to a service provider or contractor that processes that information on Ecay’s behalf to provide communications services, operate an SMS program, maintain customer records, deliver messages, honor opt-outs, or perform another authorized business function.

Consent to receive SMS messages from Ecay is not treated as authorization for an unrelated third party to send its own marketing messages.

9.6 California Consumer Opt-Out Rights

Where Ecay is subject to the CCPA and engages in a sale or sharing to which the applicable opt-out right applies, California consumers may request that Ecay stop the applicable sale or sharing.

California requires covered businesses to honor valid opt-out preference signals, including qualifying GPC signals, and to provide appropriate methods for submitting opt-out requests.

Opting out of sale or sharing is separate from unsubscribing from marketing email, telephone marketing, or SMS communications.

10. Data Security

Ecay takes reasonable measures designed to protect personal information against unauthorized access, disclosure, alteration, misuse, loss, and destruction.

The safeguards used will depend on the type of personal information, the systems involved, the nature of the processing, the risks associated with the information, and the actual technical capabilities available to Ecay.

10.1 Administrative Safeguards

Where appropriate, Ecay may maintain administrative practices concerning:

• Privacy and security responsibilities
• Employee access
• Vendor management
• Information handling
• Security awareness
• Incident response
• Access management
• Data retention
• Secure disposal
• Internal procedures

These controls may differ by business unit, system, provider, and type of information.

10.2 Technical Safeguards

Depending on the systems actually used, technical safeguards may include:

• Authentication
• Account controls
• Permission management
• Access logging
• Network protections
• Security monitoring
• Malware and intrusion protections
• Backups
• Secure communications
• Encryption where appropriate
• Security updates
• Vulnerability management

Ecay does not represent that every system uses every safeguard listed above. Security controls should be evaluated and described according to the systems actually deployed.

10.3 Physical Safeguards

Where personal information is maintained in physical form or accessed in physical locations, safeguards may include appropriate:

• Facility controls
• Restricted access
• Document storage
• Secure disposal
• Visitor controls
• Protection of physical records

10.4 Access Controls

Access to personal information may be restricted according to business need and role.

Employees, contractors, and service providers may be permitted to access information only to the extent reasonably necessary to perform their assigned functions, subject to applicable contractual, technical, and organizational controls.

10.5 Service Provider Security

Where third parties process personal information for Ecay, we may evaluate the provider’s services, contractual obligations, security practices, and access requirements as appropriate to the nature of the processing.

The security capabilities of individual providers may vary.

10.6 Encryption

Ecay may use encryption or other protective measures where appropriate and supported by the systems involved.

Because encryption capabilities vary between systems and providers, this Privacy Policy does not represent that every piece of personal information is encrypted in every circumstance.

10.7 Incident Response

Ecay may maintain procedures for identifying, investigating, containing, documenting, and responding to actual or suspected security incidents.

Where a security incident affects personal information and applicable law requires notification, Ecay will provide notices within the time and manner required by applicable law.

10.8 Limitations of Security

No method of electronic transmission, storage, or processing can be guaranteed to be completely secure.

Accordingly, while Ecay takes reasonable measures appropriate to the circumstances, we cannot guarantee that personal information will never be accessed, disclosed, altered, lost, or destroyed as a result of an unforeseen event or unauthorized act.

11. Data Retention

Ecay retains personal information only for as long as reasonably necessary and proportionate to the purposes for which it was collected, to maintain an ongoing business relationship, to provide requested services, to comply with applicable legal and contractual obligations, to resolve disputes, to protect our rights, or for other purposes permitted by law.

California law requires covered businesses to disclose, at or before collection, how long they intend to retain categories of personal information or the criteria used to determine the retention period. The California privacy regulations also emphasize limiting retention to periods reasonably necessary and proportionate to the disclosed purpose.

Because the appropriate retention period can differ substantially depending on the purpose and circumstances, Ecay may use retention criteria rather than a single fixed period for every category of information.

11.1 Customer, Client, and Project Information

Customer, client, and project information may be retained for the duration of the applicable relationship and for a reasonable period afterward to:

• Complete services
• Maintain project records
• Address warranty or service matters
• Resolve disputes
• Maintain accounting and tax records
• Comply with contracts
• Protect legal rights
• Meet legal or regulatory requirements
• Maintain appropriate business records

Architectural, design, project, contractual, and business records may require longer retention than ordinary marketing information because of their connection to ongoing or completed projects, professional obligations, disputes, insurance, accounting, or legal requirements.

11.2 Email Information

Email addresses and email communication records may be retained while an individual remains an active client, customer, prospect, subscriber, or business contact and thereafter as reasonably necessary for:

• Customer or project administration
• Communication records
• Legal or contractual obligations
• Marketing suppression
• Business records
• Security
• Dispute resolution

Marketing suppression information may be retained after an individual unsubscribes so that Ecay can continue to honor the opt-out and avoid inadvertently re-adding the individual to a mailing list.

11.3 Telephone Information

Telephone numbers and related records may be retained while they are associated with an active customer, client, prospect, account, project, or business relationship and thereafter where reasonably necessary for legitimate business, legal, security, or compliance purposes.

Do-Not-Call or telephone suppression records may be retained after an individual requests that marketing calls stop so that the request can continue to be honored.

11.4 Call Recordings

Where Ecay records calls, recordings may be retained for a shorter or longer period depending on:

• The purpose of recording
• Whether the recording concerns an active project or transaction
• Legal or regulatory requirements
• Dispute-resolution needs
• Security needs
• Insurance requirements
• Business-record requirements

Recordings are not intended to be retained indefinitely solely because they exist.

11.5 Call Transcripts and AI-Generated Summaries

Where applicable, transcripts, summaries, speech analytics, and related information may be retained according to the purpose for which the underlying call information was processed.

The retention period may differ between the original recording, transcript, summary, metadata, and customer-service record.

11.6 SMS Information

Mobile numbers, SMS history, metadata, and related customer or project records may be retained for as long as reasonably necessary to:

• Provide communications
• Maintain client or customer records
• Administer projects
• Respond to inquiries
• Resolve disputes
• Maintain security
• Comply with applicable legal or contractual obligations

11.7 SMS Consent Records

SMS consent records may be retained for as long as reasonably necessary to administer the SMS program, establish the source or scope of consent where appropriate, handle disputes, and demonstrate compliance.

11.8 Marketing Preferences and Opt-Out Records

Marketing preferences, unsubscribe requests, suppression records, Do-Not-Call requests, and SMS opt-out information may need to be retained after an individual stops receiving marketing communications.

The reason for retaining such records is to ensure that the individual’s preference continues to be honored.

11.9 Backups and Archived Information

Personal information may persist for a limited period in backup systems, archives, disaster-recovery systems, or other systems that are not designed for immediate deletion.

Where information is deleted from active systems, deletion from backup or archival systems may occur according to the applicable backup lifecycle and security procedures, subject to legal and operational requirements.

11.10 Retention Criteria

When determining an appropriate retention period, Ecay may consider:

• The purpose for which the information was collected
• Whether the purpose remains active
• The nature and sensitivity of the information
• Whether the information is needed to provide a requested service
• The duration of a client, customer, prospect, or business relationship
• Contractual obligations
• Accounting and tax requirements
• Insurance requirements
• Legal and regulatory requirements
• Potential disputes or legal claims
• Security requirements
• The need to maintain suppression or opt-out records
• Whether information can be deleted, de-identified, or aggregated without impairing the applicable business purpose

• 12. California Consumer Privacy Rights

This section describes privacy rights available to individuals to the extent Ecay is subject to the California Consumer Privacy Act (“CCPA”) with respect to the applicable individual and processing activity.

The CCPA provides California consumers with rights that include the right to know/access, delete, correct, opt out of certain sale or sharing, limit certain uses or disclosures of sensitive personal information, and receive equal treatment for exercising applicable rights.

Not every right applies in every circumstance, and the CCPA contains exceptions and limitations.

12.1 Right to Know and Access

A California consumer may have the right to request information about personal information collected, used, disclosed, sold, or shared by Ecay, including:

• Categories of personal information collected
• Specific pieces of personal information, subject to applicable limitations
• Categories of sources
• Business or commercial purposes for collection or use
• Categories of third parties to whom personal information is disclosed
• Categories of personal information sold or shared
• Other information required by applicable law

The CCPA generally permits an applicable consumer to request this information without charge, subject to statutory limitations and verification requirements.

12.2 Right to Delete

A California consumer may request that Ecay delete personal information collected about them, subject to exceptions provided by law.

Deletion is not absolute. Ecay may retain information where permitted or required to:

• Complete a transaction
• Provide a requested service
• Maintain security
• Detect or prevent fraud
• Comply with legal obligations
• Exercise or defend legal claims
• Maintain certain internal uses permitted by law
• Satisfy other statutory exceptions

Where a deletion request is granted, applicable service providers and contractors may also be directed to delete the information where required by law.

12.3 Right to Correct

A California consumer may request correction of inaccurate personal information maintained by Ecay.

Ecay may consider the nature of the information, the purposes for which it is maintained, and other information reasonably necessary to determine whether correction is appropriate.

California law requires covered businesses to provide a method for submitting correction requests and to process applicable requests subject to verification and statutory requirements.

12.4 Right to Opt Out of Sale or Sharing

Where applicable, California consumers have the right to opt out of the sale or sharing of personal information.

“Sharing” under the CCPA includes certain disclosures of personal information for cross-context behavioral advertising.

Where Ecay is subject to this requirement, we will provide an appropriate mechanism to submit an opt-out request and will honor qualifying opt-out preference signals, including Global Privacy Control where applicable. California’s current rules require an opt-out preference signal plus an appropriate additional method for businesses that sell or share personal information online.

An opt-out of sale or sharing is separate from an email unsubscribe, SMS opt-out, or Do-Not-Call request.

12.5 Right to Limit Certain Uses and Disclosures of Sensitive Personal Information

California consumers may, in certain circumstances, have the right to limit a business’s use or disclosure of sensitive personal information to the purposes permitted by the CCPA.

The right does not apply to every use of sensitive personal information. California law permits certain uses without requiring the consumer to exercise a limitation right, including specified uses reasonably necessary to provide requested services, maintain accounts, protect security, prevent fraud, comply with law, and perform other legally permitted activities.

If Ecay’s actual processing creates a right to limit, the applicable notice and mechanism will be provided.

12.6 Right to Equal Treatment and Non-Discrimination

Ecay will not discriminate against a consumer for exercising rights provided by applicable California law.

A consumer’s exercise of a privacy right should not result in unlawful denial of goods or services, unlawful differences in price or service level, or other prohibited discriminatory treatment. California expressly prohibits discrimination against consumers for exercising applicable CCPA rights.

12.7 Right to Opt Out of Certain Automated Decisionmaking Technology

California’s new automated decisionmaking rules establish rights concerning certain uses of Automated Decisionmaking Technology (“ADMT”), including applicable rights to opt out and obtain information about certain uses.

These requirements are relevant where a covered business uses qualifying ADMT for covered purposes. The CPPA’s adopted regulations became effective January 1, 2026, but certain ADMT requirements have a later compliance date of January 1, 2027.

Ecay should therefore include detailed ADMT disclosures only if it actually uses qualifying ADMT for covered purposes, and the final policy should be updated before any applicable January 1, 2027 compliance deadline.

12.8 Other Privacy Rights That May Apply

Individuals may have additional rights under other federal, state, local, or international privacy laws depending on their location, status, and relationship with Ecay.

Those rights may include:

• Rights concerning marketing communications
• Rights concerning telephone solicitation
• Rights concerning children’s information
• Rights concerning data subject access
• Rights to object or restrict certain processing
• Rights concerning specific regulated information
• Other rights created by applicable law

Where another law provides a right that applies to an individual, Ecay will administer that right according to the applicable law and circumstances.

12.9 Marketing Preferences

Individuals may separately manage their preferences for:

• Marketing email
• Newsletters
• Promotional communications
• SMS/text messages
• Marketing telephone calls

An individual may opt out of one communication channel without necessarily opting out of all others.

Similarly, opting out of marketing does not necessarily prevent necessary transactional, service, account, security, or legally required communications.

12.10 How to Submit a Privacy Request

A privacy request may be submitted using the designated contact methods described in the Privacy Requests and Contact Information portion of this Privacy Policy.

Depending on the applicable right, Ecay may provide request mechanisms through:

• An online privacy request form
• A designated privacy email address
• A toll-free telephone number
• Other methods required or permitted by applicable law

Covered California businesses generally must provide at least two designated methods for submitting requests to know, delete, or correct, with specific requirements depending on the business and whether it operates exclusively online.

12.11 Verification of Privacy Requests

Ecay may need to verify the identity of an individual before fulfilling certain privacy requests.

The verification process will be reasonably related to the nature and sensitivity of the requested information and will be designed to avoid collecting unnecessary information solely for verification.

For requests involving sensitive or specific personal information, Ecay may require a stronger level of verification than for requests involving less sensitive information, subject to applicable law.

If a request cannot be verified sufficiently, Ecay may be unable to fulfill the request or may limit the response as permitted by law.

12.12 Authorized Agents

Where permitted by California law, an individual may designate an authorized agent to submit a privacy request on the individual’s behalf.

Ecay may require documentation sufficient to establish the agent’s authority and may require the individual to verify their identity directly where permitted or required by law.

12.13 Response Timelines

For applicable requests to know, delete, or correct, California currently requires covered businesses to respond within 45 calendar days, with a possible additional 45-day extension when permitted and accompanied by the required notice.

The current CPPA regulations also require confirmation of receipt of certain requests within 10 business days.

Opt-out requests and requests to limit use of sensitive personal information are subject to different timing requirements. The California Attorney General currently states that applicable sale/sharing opt-out requests must be handled as soon as feasible, up to a maximum of 15 business days.

12.14 Appeals

Where applicable California law provides a right to appeal a decision concerning a privacy request or a related automated decisionmaking process, Ecay will provide the applicable appeal mechanism.

The appeal process may require:

• Identification of the request being appealed
• The basis for the appeal
• Additional information reasonably necessary to evaluate the appeal
• A method for submitting the appeal
• Information regarding the outcome of the appeal

Where applicable, Ecay will provide information regarding the reasons for a denial or limitation and the available next steps.

12.15 Exercising Rights Without Creating an Account

Ecay will not require an individual to create an account solely for the purpose of submitting a California privacy request where applicable law prohibits such a requirement.

The specific verification process may differ depending on whether the individual already has an account and on the sensitivity of the information requested.

13. Children’s Privacy

Ecay’s websites and services are generally intended for a general audience and are not designed specifically for children under 13.

Ecay does not knowingly direct its services or marketing activities to children under 13 or knowingly collect personal information online from children under 13 except where permitted and handled in accordance with applicable law.

The federal Children’s Online Privacy Protection Rule (“COPPA”) applies to operators of websites or online services directed to children under 13 and, in certain circumstances, to general-audience services that have actual knowledge that they are collecting personal information from children under 13. Where COPPA applies, the operator may have obligations including parental notice and verifiable parental consent before collecting certain information.

If Ecay learns that it has collected personal information from a child under 13 in circumstances requiring parental consent and the required consent was not obtained, Ecay will take reasonable steps to address the situation, which may include deleting the information where required by applicable law.

If an individual believes a child under 13 has provided personal information to Ecay in circumstances that may implicate children’s privacy requirements, the individual may contact Ecay using the privacy contact information provided in this Privacy Policy.

Where California-specific children’s privacy laws apply to a particular service or circumstance, Ecay will comply with those requirements as applicable.

If Ecay operates a child-directed website, application, service, educational program, or other offering in the future, the applicable privacy notice should be supplemented to specifically address the additional children’s privacy requirements associated with that service.

14. Third-Party Websites and Services

Ecay’s websites and digital services may contain links to websites, applications, social-media platforms, advertisements, plug-ins, payment services, scheduling systems, maps, embedded content, or other services operated by third parties.

These third-party services may collect information directly from individuals and may use their own cookies, pixels, identifiers, or other technologies.

A third party’s collection or use of information is governed by that third party’s privacy policy and terms, not solely by this Privacy Policy.

14.1 External Websites

When an individual follows a link from an Ecay website to another website, the external website may collect information independently from Ecay.

Ecay does not control the privacy practices, security practices, content, or data-collection practices of external websites.

Individuals should review the privacy policies of external websites before providing personal information.

14.2 Embedded Services

Certain Ecay websites may contain embedded third-party services such as:

• Maps
• Videos
• Scheduling tools
• Payment functionality
• Social-media features
• Analytics
• Customer-support tools
• Advertising technologies
• Other interactive functionality

Depending on the service, interacting with an embedded component may cause the third party to collect information directly.

14.3 Social-Media Platforms

Ecay may maintain profiles or use features provided by social-media platforms.

Interactions with those platforms may be visible to or collected by the platform according to its own privacy practices.

When an individual interacts with Ecay through a social-media platform, the platform may collect information independently from Ecay.

14.4 Third-Party Platforms Used to Provide Ecay Services

Ecay may use third-party technology platforms to provide functionality such as:

• Email
• SMS
• Telephone services
• CRM
• Payment processing
• Scheduling
• Cloud storage
• Project management
• Customer support
• Analytics
• Website hosting

Those providers may process personal information on Ecay’s behalf under applicable contractual arrangements.

14.5 Third-Party Advertising

Where Ecay uses third-party advertising services, those services may collect information through cookies, pixels, SDKs, or other tracking technologies.

Some advertising-related data sharing may constitute “sharing” under California law when used for cross-context behavioral advertising. Where applicable, Ecay will provide the required disclosures and opt-out mechanisms.

14.6 Third-Party Privacy Practices

Ecay does not control how an independent third party uses information after receiving it in circumstances where the third party acts as an independent business rather than as an Ecay service provider or contractor.

Individuals should consult the third party’s privacy policy for information regarding its collection, use, retention, and disclosure practices.

15. International and Cross-Border Data Transfers

Ecay may use service providers, technology platforms, communications providers, cloud services, contractors, and other business partners whose personnel, systems, or operations are located in jurisdictions outside the location in which an individual resides.

As a result, personal information may be accessed, stored, processed, or transferred across state or international borders.

The location in which personal information is processed may vary depending on the provider, service, system architecture, business function, and applicable Ecay brand or entity.

Where personal information is transferred to another jurisdiction, Ecay will take steps appropriate to the circumstances and applicable law to maintain appropriate contractual, organizational, and technical protections.

Where a particular jurisdiction imposes additional requirements concerning international transfers, Ecay will comply with those requirements to the extent applicable to the relevant processing activity.

Because third-party providers may operate data centers and support functions in multiple jurisdictions, Ecay may not be able to guarantee that every item of information remains in a single geographic location.

16. Changes to This Privacy Policy

Ecay may update this Privacy Policy from time to time to reflect changes in:

• Our business
• Our brands or organizational structure
• Our products or services
• Our websites and technology
• Our communications practices
• Our data-collection or processing practices
• Applicable privacy laws or regulations
• Our service providers or technology platforms
• Security practices
• Consumer privacy rights

When the Privacy Policy is updated, we will revise the Effective Date and/or Last Updated date displayed at the beginning of the policy.

16.1 Material Changes

Where a change materially alters the purposes for which personal information is collected, used, sold, or shared, Ecay will provide any notice or obtain any consent required by applicable law.

We will not rely solely on updating the Privacy Policy as a substitute for a legally required notice, consent, or choice mechanism.

16.2 Notice of Changes

Depending on the nature and significance of a change, we may communicate an update through:

• Posting the updated Privacy Policy on our website
• Updating the Privacy Policy link or notice
• Providing a notice through an account or online service
• Sending an email or other communication
• Providing an additional notice at the point of collection
• Other methods appropriate to the circumstances and required by law

16.3 Continued Use

An updated Privacy Policy will apply from its stated effective date, subject to any rights, notices, consents, or other requirements applicable to the change.

We encourage individuals to review this Privacy Policy periodically.

17 Privacy Requests

Privacy requests should be directed to the designated privacy contact or privacy-request mechanism identified in the website.

For California consumers exercising applicable CCPA rights, Ecay will provide the designated methods required by applicable law for submitting requests to know, delete, correct, opt out of sale or sharing, or exercise other applicable rights. California currently requires covered businesses to designate appropriate request methods and to make the process reasonably accessible to consumers.

Individuals should provide enough information for Ecay to understand the nature of the request and, where required, verify the identity of the person making the request.

17.2 Questions and Complaints

Individuals may contact Ecay regarding:

• Questions about this Privacy Policy
• Concerns about personal information
• Requests to exercise applicable privacy rights
• Marketing communication preferences
• SMS or telephone communication preferences
• Questions concerning cookies or tracking
• Suspected unauthorized use of personal information
• Other privacy-related concerns

Ecay will review and respond to privacy inquiries in accordance with applicable law and the circumstances of the request.