Privacy Statement
Effective Date: August 1, 2025
Clocktower Technology Services, Inc.

Clocktower Technology Services, Inc. (“Clocktower,” “we,” “our,” or “us”) respects your privacy. This Privacy Statement explains how we collect, use, disclose, and protect information in different contexts depending on your relationship with us. It applies to: (1) individuals who interact with us outside of a service agreement (e.g., website visitors, webinar registrants, newsletter subscribers) and (2) our clients and their end users.

We do not knowingly collect information from minors, and we do not market to, or do business within, the European Union or the United Kingdom.

1. Controller / Processor Roles

  • Website Visitors and Other Non-Client Interactions: Clocktower is the data controller for personal information collected through our website, event registrations, subscriptions, and other non-client engagement, meaning we determine the purposes and means of processing.
  • Clients and Their End Users: For client engagements where we provide managed IT, cybersecurity, and compliance services, we generally act as a data processor, processing data on behalf of and at the direction of our clients, except where we independently collect information (e.g., for billing or direct outreach to prospective clients), in which case we may be a controller for that subset of processing.

2. Information We Collect

A. Website Visitors and Other Non-Client Interactions

This includes individuals who visit our website, register for webinars, subscribe to newsletters, submit contact or inquiry forms, or otherwise engage with us outside of a formal service agreement.

Information We Collect:

  • Contact details: name, email address, company name, and other information you submit through forms or emails.
  • Interaction data: email engagement (e.g., opens, clicks), event registration data.
  • Technical data: IP address, browser type, referring pages, and usage analytics collected through cookies and similar technologies.

How We Use This Information:

  • To respond to inquiries and requests.
  • To deliver and manage event registrations (e.g., webinars).
  • To send informational or marketing communications (subject to opt-out).
  • To analyze and improve our website, content, and outreach efforts.

B. Clients and Their End Users

This includes businesses with which we have a service agreement and the employees or users of those businesses.

Information We Collect:

  • Contact and authentication details for authorized users.
  • Device inventory, system telemetry, and software usage data.
  • Network activity logs, alert information, email metadata, and endpoint events.
  • Backup contents and cloud application metadata (as permitted or configured by the client).
  • Support case data, including screenshots, logs, and chat transcripts.
  • Potentially sensitive data as stored, transmitted, or otherwise observed on systems we monitor or manage, insofar as that data is within the scope defined by the client.

How We Use This Information:

  • To deliver contracted IT, cybersecurity, and compliance services.
  • To monitor, detect, and protect systems from unauthorized access or threats.
  • To troubleshoot and resolve technical issues.
  • To maintain business continuity, including backup and disaster recovery.
  • To help clients meet their compliance obligations.

We act in accordance with our service agreements and applicable data processing addenda, and we process client data only as authorized by the client.

3. Cookies and Tracking Technologies

We and our service providers use cookies and similar technologies to collect usage and technical information. Cookies may be used for:

  • Essential functionality (necessary to operate the site).
  • Performance and analytics (to understand and improve how the site is used).
  • Marketing and communications (to personalize outreach and track engagement).

Users may manage cookie preferences through their browser settings.

4. Your Rights

Depending on your jurisdiction and your relationship with us, you may have rights regarding your personal information, including but not limited to:

  • The right to access or obtain a copy of personal data we hold about you.
  • The right to request correction of inaccurate information.
  • The right to request deletion or restriction of processing (where applicable).
  • The right to object to certain processing activities.
  • The right to opt out of marketing communications or, where applicable under state law, the sale or sharing of personal information.
  • The right to data portability for certain categories of information.

California Residents: If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA)/California Privacy Rights Act (CPRA), including:

  • The right to know what personal information is collected, used, shared, or sold.
  • The right to request deletion of personal information.
  • The right to opt out of the sale or sharing of personal information.
  • The right to non-discrimination for exercising your privacy rights.

To exercise any of your rights, contact us at [email protected]. We may require verification of identity before fulfilling requests. We aim to respond in accordance with applicable law.

5. Marketing and Communications

If you engage with our content (e.g., register for a webinar or download resources), we may follow up with related communications. You can opt out of marketing or promotional emails at any time by using the unsubscribe link in those emails or by contacting us directly. Service-related or transactional messages (such as webinar confirmations or account notices) may be treated separately from marketing communications.

If any collection or use of your data would constitute a “sale” or “sharing” under applicable U.S. state privacy laws and you wish to opt out, you may do so by contacting [email protected].

6. Third-Party Subprocessors and Service Providers

We may share client data with:

  • Authorized Clocktower personnel.
  • Contracted vendors or platforms used to deliver our services (e.g., backup providers, remote monitoring and management (RMM) tools, email filtering, professional services automation (PSA), and other subprocessors).
  • Legal authorities if compelled by law.

We conduct due diligence on subprocessors and require them to adhere to appropriate data protection and confidentiality obligations. Clients may request the current list of subprocessors for further details.

7. Data Security and Breach Response

We employ a layered approach to security, including technical, administrative, and physical safeguards, such as:

  • Encryption of data at rest and in transit.
  • Multi-factor authentication and access controls.
  • Endpoint and network monitoring.
  • Regular patching and vulnerability management.
  • Security awareness training for staff.

We maintain an incident response program. In the event of a security incident or data breach involving personal information, we will take appropriate steps to investigate, contain, and remediate the incident. Where required by law or contract, we will notify affected individuals and, if acting as a processor, promptly inform the applicable client so they can fulfill their controller obligations.

8. Children

Our services are not directed to children under the age of 13. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child without verifiable parental consent, we will take steps to delete that information.

9. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this statement, to comply with legal obligations, to resolve disputes, or to enforce our agreements. Specific retention periods vary depending on the type of data and the context of processing.

10. Changes to This Notice

We may update this Privacy Statement from time to time. Material changes will be reflected by updating the “Effective Date” above and, when appropriate, by providing additional notice (such as via website banner or direct communication). Your continued use of our services after changes become effective constitutes acceptance of the revised terms.

11. Jurisdictional Applicability

We are based in the United States and primarily serve U.S. clients and contacts. If you believe a specific state privacy law (e.g., California, Virginia, Colorado, etc.) applies to you, please contact us and we’ll explain how your rights are honored under that law.

12. Contact Us

Clocktower Technology Services, Inc.
Email: [email protected]