Effective date: [add effective date] Last updated: [add last updated date]
Who we are
This policy explains how [add registered company name and entity type] ("United Hub Digital", "we", "us") handles personal data. We are an IT and digital consulting firm headquartered in Greenville, South Carolina, USA, with a delivery team based in Brazil. Because we have team members in Brazil, some personal data may be handled by our staff located there.
This policy covers our website at unitedhubdigital.com and the personal data we handle in the course of our business, including recruitment and client work.
For any question about this policy or your personal data, contact us at [add privacy contact email] or by mail at [add street address].
[add EU/UK representative name and contact if appointed] [add Brazil Encarregado/DPO name and contact if appointed]
The data we collect, why, and for how long
We collect three main types of personal data: information from website visitors, information from job applicants, and business contact information from client and prospect representatives. The table below sets out what we collect, why, the legal basis, and how long we keep it.
Whose data / categoryWhat we collectWhy we collect itLegal basis (EU/UK GDPR and Brazil LGPD)RetentionWebsite visitors – analytics dataOnline identifiers, device and browser type, pages viewed, approximate location derived from IP, and interactions with the site, collected through [add analytics tool if not GA4]To understand how the site is used and to improve itGDPR: consent for analytics cookies. LGPD: consent, or legitimate interest where permitted[add analytics retention period, e.g. GA4 setting of 2 or 14 months]Website visitors – server logsIP address, timestamp, requested URL, referring page, user agentTo keep the site available, secure, and working, and to detect and prevent abuseGDPR: legitimate interests in security and reliability. LGPD: legitimate interest[add server log retention period]Job applicantsName, contact details, CV/resume, work history, education, and anything you include in your application sent to [add recruitment email address]To assess your application and communicate with you about itGDPR: steps prior to entering a contract; consent for any talent-pool retention. LGPD: procedures prior to a contract; consent for talent-pool retentionUnsuccessful applicants: [add applicant data retention period, e.g. 6–12 months]. Talent pool: [add talent-pool retention period] with your consentClient and prospect business contactsName, job title, employer, business email, business phone, and records of our communications and engagementsTo provide consulting services, manage our relationship, respond to enquiries, and carry out business developmentGDPR: legitimate interests in running and developing a B2B relationship; performance of a contract where we are engaged. LGPD: performance of a contract; legitimate interest[add client/prospect contact retention period]
We do not run marketing pixels on the website, and the site does not include a contact form. We do not knowingly collect sensitive personal data through the website.
Cookies and analytics
Our website uses [add analytics tool if not GA4] to measure how visitors use the site. This tool sets cookies and collects the analytics data described in the table above.
If [add analytics tool if not GA4] is Google Analytics 4, it does not store full IP addresses. IP is used briefly to estimate location and is then discarded. We set the data retention period in the tool to [add analytics retention period].
How consent and opt-out work depends on where you are:
EEA, United Kingdom, and Brazil. We ask for your consent before non-essential analytics cookies are set. You can accept or decline through our cookie banner, and you can change your choice at any time through [add cookie preferences link or mechanism].
United States. We provide notice of our analytics through this policy. You can opt out using [add opt-out route, e.g. cookie preferences link and browser add-on]. You can also install the Google Analytics opt-out browser add-on, and you can block or delete cookies in your browser settings.
We do not sell or share your personal information for cross-context behavioral advertising, and we do not use it for targeted advertising.
How we share data
We do not sell personal data. We share it only with service providers who help us run our business, and only as needed for the purposes above. The categories are:
Website hosting and infrastructure: [add hosting provider]
Analytics: [add analytics tool if not GA4, e.g. Google]
Email and productivity tools: [add email/productivity provider]
Recruitment tools: [add ATS or recruitment tool if used]
Professional advisers, and authorities where the law requires it
We put contracts in place with these providers that require them to protect personal data and to use it only for the services they provide to us.
International data transfers
We are based in the United States and our delivery team is in Brazil, so your personal data may be transferred to and handled in the United States, Brazil, or the locations of our service providers.
From the EEA and the United Kingdom. Where we transfer personal data outside the EEA or UK, we rely on an approved transfer mechanism. For transfers to certified organizations in the United States, we may rely on the EU-US Data Privacy Framework. This framework was upheld by the EU General Court in September 2025 and remains valid, though it is under appeal to the Court of Justice of the European Union. For other transfers, we use Standard Contractual Clauses or another approved safeguard.
From Brazil. Where we transfer personal data out of Brazil, we use a transfer mechanism permitted by the LGPD, including the Standard Contractual Clauses approved by Brazil's data protection authority (ANPD).
You can ask us for more detail on the safeguards we use by contacting us at [add privacy contact email].
How we protect data
We use technical and organizational measures to protect personal data against loss, misuse, and unauthorized access. These include [add summary of security measures, e.g. access controls, encryption in transit, staff training]. No system is completely secure, so we cannot guarantee absolute security. If a data breach affects you and the law requires it, we will notify you and the relevant authorities. For South Carolina residents, we follow the notification requirements of South Carolina's data breach law.
Your rights
Your rights depend on where you live. In all cases, you can contact us at [add privacy contact email] to make a request, and we will respond within the time the law allows. We will not treat you unfairly for exercising your rights.
EEA and United Kingdom. You have the right to access your data; to correct it; to have it deleted; to restrict how we use it; to object to processing based on legitimate interests; to data portability; and to withdraw consent at any time where we rely on consent. You can also complain to your data protection authority. In the UK this is the Information Commissioner's Office. In the EEA it is the authority in your country.
California and other US states. Where a US state privacy law applies to you, you may have the right to know what personal information we collect and how we use it; to access it; to correct it; to delete it; and to opt out of any sale or sharing of personal information and of targeted advertising. We do not sell or share personal information, and we do not use it for targeted advertising. We will not discriminate against you for exercising these rights.
Brazil. Under the LGPD you have the right to confirmation that we process your data; to access it; to correct incomplete, inaccurate, or outdated data; to anonymize, block, or delete unnecessary or non-compliant data; to data portability; to delete data we process based on your consent; to information about the entities we have shared your data with; to information about your option to refuse consent and the consequences; and to withdraw consent. You can also contact the ANPD.
To make a request, contact us at [add privacy contact email]. We may need to verify your identity before we act on certain requests. You can use an authorized agent where the law allows.
Children's data
Our website and services are meant for businesses and professionals. We do not direct the site to children and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us at [add privacy contact email] and we will delete it.
Changes to this policy
We may update this policy from time to time. When we do, we will change the "last updated" date above. If the changes are significant, we will provide a more prominent notice.
Contact us
[add registered company name and entity type] [add street address] Email: [add privacy contact email] [add EU/UK representative name and contact if appointed] [add Brazil Encarregado/DPO name and contact if appointed]
