DATA HANDLING POLICY

1. Scope

This Data Handling Policy applies to all personal and business information processed by The Emporium Agency LLC in the course of:

• Website inquiries and contact form submissions at TheEmporiumAgency.com
• Cybersecurity consulting engagements, including risk assessments and incident response planning
• Remote IT and security management engagements, including remote access to client systems and account administration
• Website, network, and IAM configuration projects, including temporary access to hosting, DNS, and identity platform credentials
• Computer and hardware repair services, including temporary custody of client devices and the data stored on them
• Social media management and automation services, including access to client social accounts and analytics
• Digital brand protection services, including IP monitoring and executive privacy engagements

This policy supplements and should be read alongside our Privacy Policy and Terms of Service.

2. Data Classification

We classify all client data into one of four tiers, each carrying corresponding handling requirements:

3. Data Handling by Service Area

Cybersecurity Consulting

Security engagements involve access to highly sensitive information. We apply the following controls:

• All security assessment findings are classified as Confidential or Restricted by default
• Vulnerability data, system architecture details, and infrastructure information are never stored beyond the active engagement period without explicit client authorization
• Security reports are delivered via encrypted channels and are not retained on TEA systems after delivery and client confirmation of receipt
• Access to client systems during assessment work is documented, time-limited, and requires written authorization

Remote IT & Security Management

Ongoing management engagements involve standing, remote access to client systems. We manage this as follows:

• Administrative access is provisioned under named accounts, protected by multi-factor authentication, and documented with the client in writing
• Remote access tooling is limited to platforms reviewed under our vendor assessment process
• Actions taken on client systems are logged and summarized in regular client reporting
• All access is revoked, and credentials rotated or returned, at engagement conclusion

Configuration & Repair Services

Deployment projects and hardware repairs can involve temporary custody of credentials or physical devices:

• Project credentials (hosting, DNS, identity platforms) are used only for the agreed scope and are rotated or handed off at project close
• Client devices in our custody for repair are stored securely and accessed only as needed to perform the requested service
• We do not retain copies of client device data unless explicitly authorized for migration or recovery purposes, and any such copies are securely deleted after confirmed delivery

Social Media Management & Automation

Social media engagements require access to client account credentials and audience data. We manage this as follows:

• Social platform credentials are stored using credential management tools with encryption at rest, never in plain text
• Access is granted on a need-to-operate basis and revoked immediately upon engagement conclusion
• Audience data and analytics processed during engagements are used exclusively for client benefit and are not aggregated, analyzed, or retained for TEA's own purposes
• Content drafts and creative materials are treated as Confidential until published and approved by the client

Digital Brand Protection

Brand monitoring and executive privacy engagements involve collection of publicly available data and may include personal information:

• Monitoring data is collected only through lawful means, with no unauthorized access or scraping of private systems
• Executive personal information gathered for privacy assessments is classified as Restricted and handled accordingly
• Brand monitoring reports contain only information relevant to the client's engagement scope
• Crisis management communications are treated as Restricted and are retained only for the duration necessary to resolve the incident

4. Technical Security Controls

• Encryption in transit: All data transmitted to and from TEA systems uses TLS 1.2 or higher (TLS 1.3 where supported)
• Encryption at rest: Confidential and Restricted data is encrypted at rest using AES-256 or equivalent
• Access control: Role-based access control (RBAC) with least-privilege principles applied to all internal systems
• Multi-factor authentication: Required for all systems storing Confidential or Restricted client data
• Audit logging: Access to client data environments is logged and retained for security review
• Secure deletion: Data is securely deleted or returned to clients upon engagement conclusion per agreed terms

5. Third-Party Sub-Processors

TEA may use third-party tools or sub-processors to deliver services. Any sub-processor with access to client data must meet the following requirements:

Current sub-processors include Web3Forms, which processes website inquiry form submissions solely to deliver them to our inbox, and Cloudflare, which hosts and serves this website.

• Completion of TEA's vendor security assessment prior to onboarding
• Execution of a Data Processing Agreement (DPA) establishing confidentiality and security obligations
• Demonstration of equivalent or greater security controls to TEA's own standards
• Ongoing compliance monitoring throughout the vendor relationship

Clients may request a list of active sub-processors relevant to their engagement at any time by contacting us at the address below.

6. Data Retention and Deletion

7. Incident Response

In the event of a data security incident affecting client information, TEA will:

• Notify affected clients within 72 hours of becoming aware of the incident
• Provide clear information about the nature, scope, and potential impact of the incident
• Take immediate steps to contain and remediate the incident
• Provide a written incident report within 14 days of resolution
• Cooperate fully with any required regulatory notifications

8. Contact

Data handling inquiries, requests, or concerns: