Privacy Policy

Draft needed

Counsel to address. Should enumerate every category of personal information collected and the source. Known categories:

• Contact form submissions: name, work email, company, role, inquiry type, vertical, free-text message, dynamically-generated email subject
• Server logs / technical data: IP address, browser/user-agent, referrer, timestamps (depending on hosting setup)
• Email correspondence initiated by visitors
• No accounts, no purchases, no payment data collected via site

Also clarify what is not collected (e.g., no behavioral profiling, no sale of personal information).

Draft needed

Counsel to address. Purposes of processing should include:

• Responding to and triaging inquiries (licensing, technical evaluation, partnership, investment, press)
• Routing inquiries internally based on type and vertical
• Ongoing business correspondence with prospective licensees, partners, and counterparties
• Site security and abuse prevention
• Compliance with legal obligations

Draft needed

Counsel to address GDPR/UK GDPR lawful bases. Likely combination of:

• Consent (form submission acts as affirmative consent)
• Legitimate interest (responding to inquiries from prospective business counterparties)
• Necessary for the performance of a contract or pre-contractual steps
• Legal obligation where applicable

Decide whether to also address CCPA/CPRA-equivalent disclosures here or in Section 08 (Your Rights).

Draft needed

Counsel to address. Categories likely include:

• Service providers (form processor, email host) — see Section 05
• Legal counsel and professional advisors
• Compliance with law, court orders, or regulatory requests
• In connection with a business transaction (asset sale, merger, acquisition)
• With explicit consent of the data subject

Explicitly state that LatticeWorks does not sell personal information.

Draft needed

Counsel to enumerate sub-processors and their privacy policies. Confirmed third-party services in current site:

• Formspree (formspree.io) — processes contact form submissions. Link to their privacy policy and DPA.
• Google Fonts (fonts.googleapis.com) — serves typography. Confirm whether self-hosting fonts is preferred to avoid third-party font requests under stricter EU interpretations.
• Web hosting provider — depends on deployment (Netlify, Vercel, Cloudflare Pages, etc.) — to be filled in once hosting is confirmed.
• Email provider (for replies to inquiries) — Google Workspace or similar.

Counsel may recommend a Data Processing Addendum review for each sub-processor before publication.

Draft needed

Counsel to define retention periods. Considerations:

• Inquiry data retained for the duration of any active or prospective business relationship
• Records of correspondence retained for limitations periods under applicable law
• Inquiry data with no follow-up retained for a defined period (e.g., 24 months) then purged
• Deletion request handling per Section 08 takes precedence over default retention

Draft needed

Counsel to describe security posture without overclaiming. Likely elements:

• TLS in transit for all site and form traffic
• Reliance on reputable sub-processors with industry-standard security
• Access controls on internal inquiry data
• Standard disclaimer that no system can guarantee absolute security

Draft needed

Counsel to enumerate rights per applicable regimes. Should cover:

• GDPR / UK GDPR: access, rectification, erasure, restriction, portability, objection, withdrawal of consent
• CCPA / CPRA: right to know, delete, correct, opt out of sale/sharing, limit sensitive PI use, non-discrimination
• How to exercise rights (likely via email to a designated address)
• Verification process for rights requests
• Right to lodge a complaint with a supervisory authority

Draft needed

Counsel to address. LatticeWorks is a Delaware LLC; personal information from EU/UK/other jurisdictions may be processed in the US. Should address:

• Mechanisms for lawful transfer (Standard Contractual Clauses, UK IDTA, adequacy decisions where applicable)
• Notice to EU/UK data subjects about US processing
• Whether to commit to specific safeguards beyond SCCs

Draft needed

Counsel to address. The site is B2B-only, not directed at children. Standard language:

• Site not directed to persons under 18 (or 13/16 per applicable regime)
• No knowing collection of children's personal information
• Procedure if such collection is identified

Draft needed

Counsel to address. Current site is essentially cookie-free (no analytics, no marketing pixels). Should address:

• Any cookies set by Formspree, hosting provider, or other sub-processors
• Use of localStorage, sessionStorage, or similar (currently none)
• Browser do-not-track and Global Privacy Control honoring
• If analytics are added later, this section will need expansion (likely a cookie banner becomes required)

Draft needed

Counsel to draft standard amendment clause. Should specify:

• LatticeWorks may update this Policy from time to time
• Material changes will be communicated by [method to be determined]
• "Last updated" date at the top of this Policy reflects most recent revision
• Continued use of the site after changes constitutes acceptance

Draft needed

Counsel to finalize contact details. Should include:

• Company name: LatticeWorks, LLC
• State of organization: Delaware
• Privacy-specific contact email (e.g., privacy@latticeworks.solutions — or use info@ until set up)
• Mailing address (registered agent or business address)
• Whether to designate an EU representative under Art. 27 GDPR if EU traffic warrants