Privacy Policy

1. Who we are and what this policy covers

Ashley Koehler Consulting, LLC is a limited liability company registered in the state of Utah, United States. The company provides management and systems consulting to small operations and growing teams, with a focus on operations roadmapping, systems selection and integration, workflow design, team process coaching, vendor and tool evaluation, and ongoing advisory retainers. The company address is 1976 Heywood Dr, Kaysville - 84037-9421, United States (US).

This policy applies to the website published at koehlerconsulting.buzz, to email and telephone communication with the company, and to information we receive in the course of a consulting engagement. It does not apply to information that a client organization collects and stores in its own systems, even where we helped design or integrate those systems. In those cases the client organization is the party responsible for the information, and its own privacy notices govern how that information is handled.

Where we act as a processor for a client, meaning that we handle personal information on the instruction of that client rather than for our own purposes, the client is the controller and our processing is governed by the written agreement between the client and the company. This policy describes our own practices as an independent business, including the limited processing we do when a client asks us to support its operations. If a client agreement conflicts with this policy, the client agreement takes precedence for the data covered by that agreement.

The policy is written in English and uses the exact legal name of the company throughout. Where the policy refers to we, us, or our, it refers to Ashley Koehler Consulting, LLC. Where it refers to you or your, it refers to the visitor, enquirer, client contact, or other individual whose information we handle.

2. Information we collect

We try to collect as little as possible. The information we hold falls into four broad groups: information you give us, information we receive during an engagement, information generated by ordinary web server operation, and information that clients ask us to handle on their behalf.

Information you give us directly

• Your name, work email address, telephone number, job title, and organization name.
• The subject and content of messages you send through the contact form, by email, or by telephone.
• Information you choose to include in a message, such as the size of your team, the systems you use, or a description of the problem you would like help with.
• Scheduling preferences, such as the times you are available for a call or the address of a meeting location.
• Billing and administrative details provided by a client organization when an engagement begins, such as a billing contact, purchase order reference, and invoicing address.

Information created during an engagement

• Meeting notes, interview summaries, and working documents that describe how a client operation runs.
• Process maps, workflow charts, roadmaps, and system diagrams prepared by the company for the client.
• Correspondence and project records, including dates, decisions, and agreed actions.
• Feedback and review notes gathered at the end of a pass or the close of an engagement.

Information generated by web server operation

• The internet protocol address from which a page was requested.
• The date and time of a request and the page or file requested.
• The referring page, browser type, and device type reported by the browser.
• Basic error logs produced when a page or file cannot be served.

We do not use these server records to build advertising profiles, and we do not attempt to identify individual visitors from them except where needed to investigate a security incident or to respond to a request that you have made.

Information handled on behalf of clients

During some engagements we gain access to client systems that contain information about the client customers, staff, or suppliers. This access is limited to what is necessary to complete the agreed work, is governed by a written confidentiality agreement, and is never used for our own purposes. We do not extract, copy, or retain personal information from client systems unless the client has asked us in writing to do so as part of the project.

3. How information reaches us

Most of the information we hold comes from you directly. You may send it through the contact form on the website, by writing to the mailbox address, by calling the planning room, or during a conversation with the company.

The contact form on this website is prepared so that it opens your own email application with a completed message. The content is not submitted to a database on the website. When you press send in your email application, the message travels through your email provider and arrives at our mailbox. This design means that the website itself does not store the contents of your message, and you retain a copy in your own sent folder.

Some information arrives indirectly. A colleague may introduce you by email, a client may share your details as a contact for a project, or a public source such as a company website may be used to prepare for a first call. In those cases we record only the information that is relevant to the conversation and we tell you where it came from if you ask.

Server logs are generated automatically whenever a browser requests a page or a file from this website. Those logs are created by the hosting provider and are retained for a short period for security and diagnostic purposes.

During an engagement, information also reaches us through shared documents, video calls, screen sharing sessions, and, where agreed, temporary access to client systems. We ask that clients avoid sending sensitive personal information through casual channels and that they use the secure location agreed at the start of the project for any sensitive material.

4. Why we use your information

We use information for purposes that are tied to the services we provide and to the ordinary operation of a small consulting business. The main purposes are listed below.

• To answer enquiries and arrange an initial conversation.
• To prepare proposals, statements of work, and engagement plans.
• To deliver consulting services, including interviews, analysis, system selection, workflow design, coaching, and documentation.
• To issue invoices, keep accounting records, and meet tax and company law obligations.
• To maintain records of decisions and agreed actions so that the work can be continued consistently over time.
• To keep the website secure, diagnose technical problems, and prevent abuse.
• To send occasional updates where you have asked to receive them.
• To comply with a legal obligation or respond to a lawful request from a competent authority.
• To establish, exercise, or defend legal claims where that becomes necessary.

We do not sell personal information. We do not rent subscriber lists. We do not use information about individual visitors to build profiles for advertising, and we do not place advertising on this website.

Where we use information for a purpose that is not listed here, we will explain that purpose at the time the information is collected or seek your consent where the law requires it.

5. Our lawful basis for processing

Where data protection laws require a legal basis for processing, we rely on one or more of the following grounds.

• Contract. We process information because it is necessary to take steps at your request before entering into a contract, or to perform a contract that we have with you or with your organization.
• Legitimate interests. We process information because it is necessary for our legitimate interest in running a consulting practice, answering enquiries, keeping the website secure, and maintaining accurate business records, provided that those interests are not overridden by your own rights and freedoms.
• Legal obligation. We process information because we are required to do so by law, for example to keep accounting records or to respond to a valid request from a regulator.
• Consent. Where we rely on consent, for example for an occasional update list, you may withdraw that consent at any time by writing to the mailbox address. Withdrawal does not affect the lawfulness of processing that took place before the withdrawal.
• Vital interests. In the rare case where processing is needed to protect someone from serious harm, we may rely on this basis.

Where we process information on behalf of a client organization, that client is responsible for identifying the lawful basis and for providing the relevant notices to the individuals concerned. We provide reasonable assistance to clients in meeting those obligations where the work requires it.

6. Cookies and similar technologies

This website is built as a set of static pages with a small stylesheet and a small script. It does not use advertising cookies, tracking pixels, or cross site profiling technologies. We do not embed social media widgets that would set cookies on your device without your knowledge.

Some short lived technical cookies or equivalent storage may be set by the hosting platform or by a content delivery network to balance traffic and to protect the site from abusive requests. These are essential to serving the pages and are not used to build a profile of your behaviour.

If you arrive from a web server that records access logs, those logs are conventional server records rather than cookies stored in your browser. They are retained only for the short period needed for security and diagnostics.

Where the website is updated to add optional features such as embedded video or a scheduling widget, those features may set their own cookies. Where that happens, we will update this policy and, where required, ask for consent before the feature loads. If you prefer not to accept cookies, you can set your browser to refuse them, though some parts of the site may then not work as expected.

7. Messages sent through the website

The contact form is designed as a convenience rather than as a data collection system. It prepares a message in your own email application with the name, email address, subject, and message text that you have entered. Nothing is transmitted to the company until you press send in your email application.

When a message arrives at our mailbox, it is stored in the mailbox account and may be copied into a project folder so that the conversation can be found later. We keep enquiry messages for as long as needed to answer the enquiry and to decide whether an engagement will follow. If no engagement follows, we usually delete the message within twelve months unless it is part of an active conversation or is needed for a legal or accounting purpose.

Please do not send passwords, payment card numbers, government identification numbers, health information, or other highly sensitive personal information through the contact form. If we need such information for a project, we will arrange a more appropriate method and explain how the information will be protected.

Email is not perfectly secure. Messages can be intercepted, misdirected, or read by someone with access to an account. We take reasonable steps to protect our mailbox, including strong authentication and access limited to people who need it, but we cannot guarantee the security of a message while it is in transit across the public internet.

8. Client records and engagement data

Consulting engagements produce a large amount of working material: interview notes, process maps, roadmaps, system inventories, vendor comparisons, training notes, and review records. Most of this material describes how an organization works rather than the personal details of an individual, but it can contain names, job titles, email addresses, and descriptions of individual work situations.

We keep engagement records in a structured project folder for each client, with access limited to the people working on the project. Where an engagement involves personal information about client staff or client customers, we treat that material as confidential and use it only for the purpose of the engagement.

When an engagement ends, we provide the client with the final deliverables and offer to archive the working material. If the client prefers, we delete working material within an agreed period, keeping only the minimum records needed for accounting, legal, and professional obligations. The client retains the deliverables under the terms of the engagement and the license described in our Terms of Service.

If a client asks us to take temporary access to a system in order to integrate it or to diagnose a problem, that access is granted for a defined period, is recorded, and is removed at the end of the work. We ask that shared credentials be rotated after the engagement so that any residual access is closed.

9. When we share information

We do not sell, rent, or trade personal information. We share information only in the limited circumstances described below, and only to the extent necessary for the purpose.

• With service providers. We use a small number of providers for email, file storage, accounting, and website hosting. These providers process information on our instruction under written terms and are not permitted to use it for their own purposes.
• With your organization. Where we work with a team, the results of the work are shared with the people leading the engagement inside that organization, as agreed in the project plan.
• With professional advisers. Our accountant, attorney, or insurer may receive limited information where necessary for tax, legal, or insurance purposes, subject to professional confidentiality.
• With authorities. We may disclose information where required by law, a court order, or a valid regulatory request, or where disclosure is necessary to protect the rights, property, or safety of the company, a client, or another person.
• In a business change. If the company is involved in a merger, acquisition, or transfer of assets, information may be transferred as part of that transaction, subject to the protections described in this policy and to applicable law.
• With your direction. We may share information with a third party at your request, for example when you ask us to coordinate with another consultant or a new vendor.

Where a service provider is located outside the United States, we take reasonable steps to ensure that the transfer is protected by an appropriate mechanism, as described in the section on international transfers below.

10. Service providers and processors

Like most small businesses, we rely on a handful of service providers rather than operating all systems ourselves. These providers are chosen for reliability and security, are reviewed from time to time, and are bound by terms that limit their use of our information.

The categories of provider we use are email hosting, file storage and document editing, accounting and invoicing, website hosting and content delivery, scheduling, and password management. We do not list individual vendor names in this policy because the list changes as tools are evaluated, but we can provide a current list of categories and the countries in which they process information on request.

Where a provider acts as a processor, we remain responsible for the information and for choosing a provider that offers appropriate safeguards. Where a provider acts as an independent controller, for example an email provider that handles a message under its own terms, its own privacy notice applies in addition to this policy.

We do not permit a provider to use information received from the company for advertising or for training general purpose models unless we have specifically agreed to that use in writing and informed the affected client.

11. How long we keep information

We keep information only for as long as it is needed for the purpose for which it was collected, for a period required by law, or for the period needed to resolve a dispute. The main retention periods are outlined below.

• Enquiry messages that do not lead to an engagement. Usually deleted within twelve months of the last message in the conversation.
• Proposals and engagement plans. Kept for the duration of the engagement and for a short period afterwards, then archived or deleted if the engagement does not proceed.
• Engagement records and deliverables. Kept for the duration of the engagement and for a reasonable period afterwards so that questions about the work can be answered. Where a client agreement sets a different period, that agreement applies.
• Accounting and tax records. Kept for the period required by United States tax and company law, which is generally seven years from the end of the relevant tax year.
• Web server logs. Kept for a short period, usually weeks rather than months, for security and diagnostic purposes.
• Marketing preferences. Kept until you withdraw consent or ask to be removed from the update list.

When a retention period ends, information is deleted or, where deletion is not immediately possible, placed beyond ordinary use and scheduled for deletion at the next review. Backups are cycled on a fixed schedule, so a deletion request may take a short period to propagate through backup copies.

12. How we protect information

We use a set of practical safeguards that are appropriate for a small consulting practice. These include strong authentication on the accounts that hold client information, full disk encryption on laptops, automatic screen locking, a password manager, and the principle of least privilege when access is granted.

Access to client material is limited to the people working on the engagement. Shared links are used sparingly and are set to expire where the tool allows it. Printed material is kept in a locked cabinet and shredded when it is no longer needed. Temporary access to client systems is removed at the end of the work, and the client is asked to rotate any credentials that were shared.

We keep software up to date, review the security settings of our providers from time to time, and train ourselves to recognise phishing and social engineering attempts. We also keep an incident plan so that we know who to contact and what to do if information is lost, accessed without authorisation, or otherwise compromised.

No method of transmission or storage is perfectly secure. If we become aware of a security incident that affects personal information, we will investigate promptly, take steps to contain the incident, and notify affected individuals and any relevant authority where the law requires it and where doing so will not obstruct an ongoing investigation.

13. International transfers

Ashley Koehler Consulting, LLC is based in the United States and works primarily with organizations in the same country. Some of the service providers we use may store information in data centres located in other countries. Where that happens, the information may be subject to the laws of the country in which it is stored, including lawful requests from authorities in that country.

When we transfer personal information from a jurisdiction with transfer restrictions to a country that has not been recognised as providing an adequate level of protection, we rely on an appropriate transfer mechanism, such as standard contractual clauses or a provider that has committed to equivalent safeguards. We will provide further detail about the safeguards used for a particular transfer if you ask.

If you are located outside the United States, please be aware that information you send to us may be processed in the United States, where privacy laws may differ from those in your country. By sending information to the planning room, you understand that this transfer will take place for the purposes described in this policy.

14. Your privacy rights

Depending on where you live and on the relationship you have with the company, you may have some or all of the following rights.

• Access. You may ask whether we hold personal information about you and request a copy of it.
• Correction. You may ask us to correct information that is inaccurate or incomplete.
• Deletion. You may ask us to delete personal information that we no longer have a lawful reason to keep.
• Restriction. You may ask us to limit the way we use your information while a concern is investigated.
• Objection. You may object to processing that we carry out on the basis of legitimate interests.
• Portability. You may ask for a copy of information you provided to us in a structured, commonly used format, where the law provides this right.
• Withdrawal of consent. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.
• Non-discrimination. We will not refuse service or charge a different price because you exercised a privacy right, except where the law permits a different price for a different level of service.

To exercise a right, write to mailbox@koehlerconsulting.buzz with enough detail for us to identify the information concerned. We may need to verify your identity before acting on a request, particularly where the information is sensitive or where the request involves deletion. We aim to respond within thirty days, and we will tell you if we need more time and why.

If your request concerns information we hold on behalf of a client organization, we may refer the request to that client, because the client is responsible for deciding how the information is used. We will assist the client where the law requires it.

If you are not satisfied with our response, you may have the right to complain to a data protection authority in your country or to the relevant regulator in the United States. We would appreciate the chance to resolve the matter with you first.

15. Privacy for Children

The website and the consulting services of Ashley Koehler Consulting, LLC are intended for businesses and for adults acting in a professional capacity. They are not directed at children, and we do not knowingly collect personal information from anyone under the age of sixteen.

If you believe that a child has sent personal information to the planning room, please contact mailbox@koehlerconsulting.buzz so that we can delete the information promptly. If we learn that we have collected information from a child without appropriate consent, we will delete it as soon as we can verify the situation.

Client engagements sometimes involve systems that contain information about a client customers, and some of those customers may be children. In such cases the client organization is responsible for obtaining any consent and for providing notices to the families concerned. We handle that information only on the instruction of the client and only to the extent needed to complete the agreed work.

We do not use information about children for marketing, profiling, or any purpose unrelated to the engagement, and we do not knowingly allow a child to use the contact form.

16. Marketing and communications

We do not send a regular newsletter at present. If we introduce one, it will be operated on an opt in basis: you will only receive updates if you have asked for them, and every message will include a simple way to stop receiving them.

We may send transactional messages about an active enquiry or engagement without a separate marketing consent, because those messages are part of the service you have asked for. Typical transactional messages include replies to questions, scheduling confirmations, project updates, and invoices.

We do not share contact details with third parties for their marketing. We do not use purchased lists, and we do not add people to a list because they attended a meeting or visited the website. If you ask to be removed from the update list, we will remove you promptly and keep a minimal record of the request so that we do not add you again by mistake.

17. Third party websites and links

This website may contain links to other sites, for example a scheduling service, a document sharing service, or a reference article. Those sites are operated by other organizations and have their own privacy policies. We do not control their content or their practices and we are not responsible for the way they handle information.

We encourage you to read the privacy notice of any site you visit before providing personal information. A link from our website does not mean that we endorse the other site or that we have verified its security.

Where we share a document through a third party service, the service may record who accessed the document and when. That access record is used to understand whether a deliverable has been received and is not used for advertising.

If you believe that a link on our website points to an unsafe or misleading site, please let us know so that we can review it.

18. Automated tools and artificial intelligence

We use ordinary software for scheduling, document editing, and project management. Some of that software includes optional features that are described as artificial intelligence, such as summaries or suggested edits. We use these features sparingly and only where the tool is covered by a business agreement that limits the use of our information.

We do not send client confidential material to a general purpose public model for the purpose of generating content. Where a client asks us to experiment with an automated tool as part of an engagement, we agree the scope in writing first and we consider the sensitivity of the material before it is used.

We do not use automated decision making to make decisions about individuals that produce legal or similarly significant effects. Decisions about an engagement, a proposal, or a recommendation are made by a person, informed by the written analysis and by conversations with the client.

If we introduce an automated feature that changes how information is used, we will describe it in an update to this policy.

19. Business changes and transfers

If Ashley Koehler Consulting, LLC merges with another firm, is acquired, or transfers a substantial part of its business or assets, information held by the company may be transferred as part of that transaction. We will take reasonable steps to ensure that the recipient is bound by confidentiality and privacy obligations consistent with this policy.

Where a transfer would materially change how your information is used, we will give notice before the change takes effect, either by a message to the contact address we hold or by a prominent notice on the website. You may then have the option to object to the transfer or to ask for your information to be deleted before it takes place, where the law provides that option.

If the company ceases trading without a successor, personal information will be retained only for as long as needed to meet legal obligations and to close the business, and will then be deleted or transferred to a secure archive in accordance with applicable records rules.

20. Notice for California residents

This section applies to residents of California and describes rights that may be available under California privacy law. It is written in plain language and applies in addition to the general rights described above.

In the past twelve months we have collected the categories of information described in the section on information we collect: identifiers such as name, email address, and telephone number; professional information such as job title and organization; internet activity information such as server logs; and commercial information such as the services discussed in an engagement.

We collect this information from you, from your organization, and from ordinary web server operation. We use it for the business purposes described in this policy. We do not sell personal information and we do not share personal information for cross context behavioural advertising. We do not knowingly sell or share the personal information of consumers under sixteen years of age.

California residents may request access to the specific pieces of personal information we hold, request deletion, request correction, and request information about the categories of information we have collected and disclosed. You may designate an authorized agent to make a request on your behalf. We will verify the request before acting on it and will not discriminate against you for exercising a right.

To make a request, write to mailbox@koehlerconsulting.buzz with the subject line Privacy request and enough detail for us to identify the information concerned. You may also call +15307878498 during business hours.

21. Changes to this policy

We review this policy from time to time and update it when our practices change, when a new tool is introduced, or when the law changes. The date at the top of the page shows when the current version took effect.

For small corrections, such as fixing a typo or clarifying a sentence, we update the page without a separate notice. For a material change, we will describe what has changed in a short note at the top of the page and, where we hold an email address for you and the change is significant, we will send a message to let you know.

We encourage you to check this page occasionally if you want to understand how your information is handled. Continuing to use the website or the services after an update means that you accept the updated policy, unless the law requires a separate consent for the change.

Previous versions of the policy can be provided on request, so that you can see what applied at the time information was collected.

22. How to reach the planning room

If you have a question about this policy, a concern about how information has been handled, or a request relating to a privacy right, please contact the planning room using the details below.

Email: mailbox@koehlerconsulting.buzz
Telephone: +15307878498

We answer messages during business hours on Monday to Friday and aim to respond within one working day. Privacy requests are logged when they arrive so that we can track progress and confirm that the request has been completed.

This policy is published by Koehler Consulting for Ashley Koehler Consulting, LLC. It is provided for information and does not create rights beyond those that already exist under applicable law.