Privacy Policy

Data Controller

The data controller responsible for your personal data is:

Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR:

• •Consent: For analytics cookies and marketing communications (Article 6(1)(a))
• •Legitimate Interests: For website security, fraud prevention, and improving our services (Article 6(1)(f))
• •Contract Performance: When processing data to fulfill your requests or orders (Article 6(1)(b))
• •Legal Obligation: When required to comply with applicable laws (Article 6(1)(c))

Information We Collect

We collect limited information to improve our website and understand how visitors use our services:

• •Analytics data (pages visited, time on site, general location)
• •Information you voluntarily provide through contact forms (name, email, company, message)
• •Technical data (browser type, device information, IP address - anonymized)
• •Cookie consent preferences and timestamps

How We Use Cookies

Cookies are small text files stored on your device. We categorize cookies as follows:

• •Necessary Cookies: Essential for website functionality (always active)
• •Analytics Cookies: Help us understand website traffic and usage patterns (optional)
• •Preference Cookies: Remember your language and consent choices (optional)
• •Marketing Cookies: Used for relevant advertising - currently not in use (optional)

You can manage cookie preferences through our GDPR-compliant consent banner, which allows granular control over each cookie category.

Third-Party Services

We use the following third-party services that may process your data:

• •Google Analytics (GA4): Website traffic analysis - data processed in the US under Standard Contractual Clauses
• •Vercel: Website hosting - data processed in accordance with their privacy policy
• •Supabase: Database services - data encrypted and processed securely

We have enabled IP anonymization in Google Analytics and only activate tracking after consent is given.

Your Rights Under GDPR

As a data subject, you have the following rights:

• •Right of Access: Request a copy of the personal data we hold about you
• •Right to Rectification: Request correction of inaccurate or incomplete data
• •Right to Erasure: Request deletion of your personal data ('right to be forgotten')
• •Right to Data Portability: Receive your data in a structured, machine-readable format
• •Right to Restrict Processing: Request limitation of how we use your data
• •Right to Object: Object to processing based on legitimate interests
• •Right to Withdraw Consent: Withdraw consent at any time without affecting prior processing

To exercise any of these rights, please contact us at justin@crestwoodglobal.com. We will respond within 30 days.

Data Retention Periods

We retain personal data only as long as necessary for the purposes described:

• •Analytics data: 14 months (Google Analytics default)
• •Contact form submissions: 3 years or until request for deletion
• •Cookie consent records: 1 year, then re-consent required
• •Business correspondence: 7 years for legal and tax purposes

International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. We ensure adequate protection through:

• •Standard Contractual Clauses (SCCs) approved by the European Commission
• •Adequacy decisions where applicable
• •Technical and organizational security measures

Contact Us

If you have questions about this privacy policy, your data, or wish to exercise your rights:

Policy Updates

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. For significant changes, we will provide prominent notice.