This policy applies to all users and clients, including those located in California under the California Consumer Privacy Act (CCPA). Malimar maintains a cybersecurity program aligned with recognized industry frameworks and complies with applicable U.S. federal and state privacy and data-protection laws.

2. Information We Collect

We may collect the following categories of personal and business information:

• Contact Information: Name, business name, email, phone number, and address

• System Data: Device information, network configurations, software details

• Usage Data: Pages visited, session times, access logs

• Support Records: Chat transcripts, phone call summaries, support tickets

• Login Credentials: For systems we manage, with your authorization

• Regulated Data: Protected Health Information (PHI), Personally Identifiable Information (PII), or other sensitive data—only as needed for service delivery and only under a formal agreement

3. How We Use Your Information

We use your data to:

• Provide and manage IT and cybersecurity services (remote, onsite, phone, chat)

• Respond to support requests and inquiries

• Monitor and maintain system health and security

• Improve service quality and performance

• Ensure compliance with contracts, laws, and regulatory frameworks

• Communicate service updates, alerts, or notices

We do not sell your personal data.

4. How We Share Your Information

We may share your data under the following conditions:

• With your explicit consent

• With service providers under contract (e.g., secure cloud platforms, backup tools)

• As required by law, subpoena, or regulatory requirement

• In response to security threats or incident management (following your MSA or BAA)

All third parties are required to comply with confidentiality and security obligations consistent with applicable laws.

5. Data Security

We apply administrative, technical, and physical safeguards to protect your information, including:

• Encryption (in transit and at rest)

• Multi-factor authentication (MFA) and role-based access controls

• Regular risk assessments and vulnerability scans

• Logging, monitoring, and incident response protocols

• Employee background checks and confidentiality training

These controls are designed to support the affirmative defense available under Ohio’s cybersecurity safe-harbor law, the Ohio Data Protection Act (S.B. 220).

6. Your Rights (California Residents)

If you are a California resident, you have the following rights under CCPA:

• Right to Know what personal information we collect and how it’s used

• Right to Access a copy of your personal data

• Right to Request Deletion of your personal data

• Right to Opt-Out of the sale of your personal information (note: we do not sell data)

• Right to Non-Discrimination for exercising your rights

To exercise your rights, please contact us at support@malimar.com or through our contact form.

7. Data Retention

We retain personal and system-related data only for as long as necessary to fulfill service obligations, comply with regulations, and resolve disputes. Retention periods vary depending on the nature of the service and any governing contracts.