This Privacy Policy explains how Catalyst47 Consulting Group, Inc. ("Catalyst47", "we", "us" or "our") handles personal information when you visit catalyst47.com or contact us through the contact details or enquiry features provided on our website.
1 Who is responsible for your information
Catalyst47 Consulting Group, Inc. operates this website. Our US headquarters is at 447 Broadway, 2nd Floor, Suite 2453, New York, NY 10013, USA. Contact us about privacy at privacy@catalyst47.com.
Where the EU General Data Protection Regulation (GDPR) applies, Catalyst47 is the "controller" of the website information it processes for its own purposes. Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), applies, Catalyst47 is the responsible "business". "Personal data" and "personal information" mean information relating to an identified or identifiable person, or otherwise protected by the applicable law.
This notice covers website browsing and initial enquiries. It does not describe the processing of client datasets during service delivery, employment records, recruitment assessments or separate software platforms. We provide additional privacy information for those activities where required.
2 Information collected through the website
Information you provide: If you contact us, we receive the details you choose to send, such as your name, work email address, telephone number, company, job title, service interests and message content. We also keep relevant correspondence and communication preferences. The source is you or someone contacting us on your behalf.
Technical information: Our hosting and technical providers may process your IP address, browser and device type, requested pages, access times, referring page and diagnostic or security logs when delivering and protecting the website. This information comes from your browser, device and interaction with the site. An IP address may indicate an approximate location.
Analytics information: If you accept analytics cookies, Google Analytics 4 may collect page views, interactions, approximate location, device and browser information, traffic source and cookie identifiers. We configure Google Analytics without Google Signals or advertising-personalisation features. You can reject or later withdraw analytics consent through Cookie settings.
Please provide only information relevant to your enquiry. Do not submit passwords, payment-card credentials, government identity documents, health information or confidential third-party datasets through an ordinary enquiry. If a later engagement requires such information, we will explain the appropriate process separately.
You can browse without providing contact details. If you want a response, we need enough information to understand your request and contact you. Fields identified as required are necessary for the stated purpose; other details are optional. A feature that generates or downloads a brief locally does not, by that action alone, send its contents to us. We receive the contents only if you subsequently submit or send them.
3 How and why we use information
We use website information to deliver and maintain the site, respond to enquiries, arrange requested discussions, understand the services you are interested in, investigate technical problems, prevent abuse and protect legal rights. We use contact details for marketing only where permitted by applicable law and in accordance with your choices.
Where GDPR applies, we rely on legitimate interests under Article 6(1)(f) to operate a secure website, respond to ordinary business enquiries and manage relevant follow-up, after considering your rights. Article 6(1)(b) applies where processing is necessary to take steps you request before entering into a contract personally with us. Article 6(1)(a) applies where consent is required, including relevant optional tracking or marketing. Article 6(1)(c) applies where an applicable EU or Member State legal obligation requires processing.
We do not treat visiting the website or reading this policy as consent to optional tracking or marketing. You may withdraw consent or object to processing as described below.
4 Cookies and communication choices
Cookies and similar technologies can support website functionality or remember choices. Where optional analytics, advertising or other non-essential device access requires consent, those features must remain inactive until you consent. Any such feature will be accompanied by information about its purpose and an appropriate way to change or withdraw your choice.
Our website does not use advertising pixels for cross-context behavioural advertising. Technical server logs used to deliver or secure the website are distinct from advertising tracking. You can also manage cookies through your browser; disabling necessary functionality may affect how the site works.
To stop marketing emails, use the unsubscribe option in the message or email privacy@catalyst47.com. We may retain a limited suppression record to respect your preference. We may still respond to an enquiry you initiate or send necessary administrative or security communications.
5 Who may receive website information
Authorised personnel and providers supporting hosting, website maintenance, security, analytics, business email and enquiry management may access relevant information for those functions. This includes Google as the provider of Google Analytics 4 where analytics consent is accepted. We require appropriate confidentiality, security and contractual restrictions where they process information on our behalf, including GDPR Article 28 or CCPA service-provider requirements where applicable.
Our India sister concern, Tarkus AI Labs Private Limited, may support website administration or respond to enquiries on our behalf. It is a separate legal entity operating the India headquarters and delivery centre at WeWork, Berger Delhi One, 19th Floor, C-01/A, Sector 16B, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301, India. Its access is limited to the authorised task; the sister-company relationship does not itself permit unrestricted use of your information.
We may also disclose necessary information to professional advisers, competent authorities or courts where lawfully required or justified, or to relevant parties in a proposed business transaction subject to appropriate safeguards. We do not sell website personal information or share it for cross-context behavioural advertising.
6 International access and storage
Website and enquiry information may be processed in the United States and accessed in India, including by authorised Tarkus personnel. Providers may operate in other countries. Those countries may have different data-protection laws from your country.
For a transfer subject to GDPR Chapter V, we require an applicable transfer mechanism, such as an adequacy decision covering the actual recipient or the European Commission’s Standard Contractual Clauses, together with any necessary transfer assessment and supplementary safeguards. Affiliation alone is not a transfer safeguard. Contact privacy@catalyst47.com for details of the countries and safeguards relevant to your information, or a copy of applicable safeguards subject to appropriate confidentiality redactions.
7 How long we keep information and how we protect it
We retain enquiry and contact information for as long as reasonably necessary to respond, manage relevant follow-up and maintain an ongoing relationship. Technical information is retained according to operational, diagnostic and security needs. Our decisions consider the information’s sensitivity, the purpose, the status of the enquiry and applicable legal requirements.
We may retain limited information longer where needed for a legal obligation, dispute, investigation, privacy-request record or marketing suppression. When retention is no longer justified, we delete or anonymise the information. Residual backup copies remain restricted until removed through the applicable backup lifecycle. These criteria apply to each category described in section 2.
We apply technical and organisational measures appropriate to the information and risk, including access restrictions and confidentiality requirements. No website, transmission or storage method can guarantee absolute security. This does not limit any security or notification obligation imposed by applicable law.
8 Your privacy rights
Where GDPR applies, you may request access, correction, erasure, restriction and, where its conditions are met, data portability. You may object to processing based on legitimate interests, and object at any time to direct marketing and related profiling. You can withdraw consent without affecting the lawfulness of earlier processing. GDPR Article 22 provides protections concerning qualifying solely automated decisions; we do not use website enquiries to make such decisions.
Where CCPA applies, California residents may request to know or access personal information, including relevant categories, sources, purposes and disclosures; request deletion or correction; and receive information in a portable form where required. Rights also include opting out of sale or sharing, limiting qualifying uses of sensitive information, and freedom from unlawful discrimination or retaliation.
We honour legally recognised opt-out preference signals, including Global Privacy Control, where applicable. Because our website does not sell or share information for cross-context behavioural advertising, there is no such website activity to stop. Legacy browser "Do Not Track" settings do not change our practices and are distinct from legally recognised opt-out signals.
We do not seek sensitive personal information through ordinary website enquiries or use it to infer characteristics about visitors. Please contact us if you have inadvertently sent sensitive information. Any mandatory privacy right remains available regardless of the wording of this policy.
9 How to make a request
Email privacy@catalyst47.com or write to Catalyst47 Consulting Group, Inc., Data Privacy Officer, 447 Broadway, 2nd Floor, Suite 2453, New York, NY 10013, USA. Explain your request and how you interacted with the website. You do not need to quote a law or create an account. Contact us if you need an accessible copy of this policy or assistance submitting a request.
We may request proportionate information to verify your identity and locate relevant records. An authorised agent may submit a request, subject to legally permitted checks of identity and authority. We use verification information only for verification, security and related legal compliance. Sale or sharing opt-outs do not require identity verification.
For GDPR requests, we normally respond within one month, with up to two additional months where legally permitted and explained within the initial month. For CCPA requests to know, delete or correct, we acknowledge receipt within 10 business days and normally respond within 45 calendar days; a further 45 days may be used where permitted with notice. Applicable opt-out or limitation requests are handled as soon as feasible and within the legally required period.
Requests are ordinarily free. We may retain information, limit a response, refuse a request or charge a reasonable fee only where applicable law permits. Relevant exceptions may protect legal obligations, legal claims, privilege or other people’s rights. We explain a refusal or limitation and available complaint routes where required.
You may complain to the competent EU supervisory authority, including in your country of habitual residence or work, or where an alleged infringement occurred. California residents may complain to the California Privacy Protection Agency or California Attorney General. You do not have to contact us first.
10 Children external links and policy updates
This website is intended for adults seeking information about our business and is not directed to children under 16. If you believe a child has supplied personal information, contact us so we can investigate and take appropriate action.
External websites linked from our site have their own privacy practices. Their operators are responsible for their processing. We update this policy when our website practices or legal obligations change and revise the date above. We provide additional notice or obtain consent before a change where required by law.
11 Relevant legal references
EU GDPR — Regulation (EU) 2016/679, particularly Articles 6, 12–22, 28, 32, 44–49 and 77
International transfer clauses — Commission Implementing Decision (EU) 2021/914
CCPA as amended — California Civil Code §§1798.100–1798.199.100
California implementing regulations — 11 CCR, including §§7011–7012 and 7020–7027
