Privacy Policy

1.1 Who we are. JD Works (“JD Works,” “we,” “us,” or “our”) provides business automation, artificial intelligence implementation, custom software development, systems integration, and related maintenance and technical support services. We operate the website located at jdworks.co and any related pages and subdomains (together, the “Website”). We are based in the State of Washington, United States.

1.2 What this Privacy Policy covers. This Privacy Policy applies to personal information that we handle in the following contexts:

• visitors to the Website;
• individuals who contact us by email, through a contact form, or by any other means;
• business contacts and prospective clients, including individuals whom we contact or who are introduced to us in the course of our business development activities;
• clients and their personnel, representatives, and authorized users, in connection with our engagement with them; and
• personal information that we process on behalf of our clients while performing our services (“Client Data”), to the extent described in Section 1.3.

1.3 Our two roles. The way we handle personal information depends on the context.

• As a controller or “business.” For information about Website visitors, inquiries, prospective clients, and our own business relationships, we decide why and how the information is processed. This Privacy Policy is our notice to you about that processing.
• As a processor or “service provider.” For Client Data, we process personal information only on behalf of, and on the documented instructions of, the client that engaged us. The client determines the purposes of that processing and is responsible for giving its own customers, employees, and contacts any legally required notice. If you are an individual whose personal information is held by one of our clients and you wish to exercise a privacy right, please contact that client directly. If you contact us, we will direct your request to the relevant client where we are able to identify it.

1.4 Business-to-business services. Our services are directed to businesses and professionals. They are not offered to individuals for personal, family, or household purposes.

1.5 Relationship to our Terms of Service. This Privacy Policy is incorporated into, and forms part of, our Terms of Service. Capitalized terms that are not defined in this Privacy Policy have the meanings given in the Terms of Service.

In this Privacy Policy, “personal information” means information that identifies, relates to, describes, or is reasonably capable of being associated with an identified or identifiable individual. The categories of personal information we collect are described below.

2.1 Information you provide to us. We collect the information you choose to give us, which may include:

• Contact details and identifiers: your name, email address, company or organization, job title, and, if you provide it, your telephone number.
• Communications: the content of emails and messages you send us, information you enter into a contact form (including your first and last name, email address, message, and the service you indicated an interest in), and notes that we make of calls and meetings with you.
• Engagement information: descriptions of your business, systems, processes, and requirements; proposals and statements of work; and related correspondence.
• Billing and payment information: billing name and address, tax information where required, invoices, and records of payments. Payment card details are handled by our third-party payment processors, and we do not store full payment card numbers.
• Access and account information: credentials, application programming interface (API) keys, access tokens, or delegated permissions that you grant so that we can connect to your systems and perform the services.

2.2 Information collected automatically. When you visit the Website, our hosting and network infrastructure automatically records certain technical information, which may include your internet protocol (IP) address, browser type and version, device and operating system type, the referring web address, the pages and files requested, the date and time of each request, and diagnostic and error data. We use this information to deliver the Website, keep it secure, diagnose problems, and protect against abuse.

2.3 Cookies and similar technologies. As of the Effective Date, the Website does not set advertising, analytics, or cross-site tracking cookies, and it does not use third-party advertising, retargeting, or behavioral analytics tools. Our hosting and network providers may use technical mechanisms that are strictly necessary to deliver the Website securely and reliably, such as mechanisms for caching, load balancing, and protection against malicious traffic. If we introduce analytics or any non-essential cookies or similar technologies in the future, we will update this Privacy Policy before doing so and, where the law requires, obtain your consent.

2.4 Response to “Do Not Track” signals. Because the Website does not track visitors across other websites or online services over time, it does not change its behavior in response to “Do Not Track” browser signals.

2.5 Information from other sources. We may receive personal information about you from sources other than you, including:

• colleagues, clients, business partners, and other referral sources who introduce you to us;
• sales, lead-generation, or referral partners who introduce prospective clients to us and provide limited contact and business information about them;
• publicly available sources, such as business websites, professional profiles, and public business directories; and
• your employer or the client on whose behalf you interact with us.

2.6 Client Data. In the course of performing our services, we may access or receive Client Data. Depending on the engagement, Client Data may include business records, customer and contact records, invoices, documents, message content, and system and configuration data, and it may include personal information about our client’s own customers, employees, and business contacts. We handle Client Data as described in Sections 1.3, 5, 6, and 7 and in our Terms of Service.

2.7 Sensitive information. We do not seek to collect sensitive personal information through the Website. Please do not send us Social Security or other government identification numbers, financial account numbers, health information, biometric data, precise location data, or information about children through the Website or by email. Where a client’s project requires us to process information of that kind, we do so only under a written agreement that addresses appropriate safeguards, as described in our Terms of Service.

3.1 Purposes of use. We use personal information for the following purposes:

• to respond to your inquiries and provide information about our services;
• to evaluate your needs, prepare proposals and statements of work, and enter into and perform agreements with you or your organization;
• to provide, operate, monitor, maintain, support, and improve our services and the solutions we build;
• to communicate with you about an engagement, including scheduling, project updates, support, and administrative or service notices;
• to issue invoices, process payments, keep accounting and tax records, and collect amounts owed;
• to operate, secure, and protect the Website, our systems, and our clients’ systems, including to detect, prevent, and respond to fraud, abuse, and unauthorized access;
• to communicate with business contacts and prospective clients about our services, consistent with applicable law and subject to your right to opt out;
• to comply with legal and regulatory obligations, enforce our agreements, and establish, exercise, or defend legal claims; and
• to create aggregated or de-identified information about our business operations, which does not identify any individual or any client.

3.2 Restrictions on use of Client Data. We use Client Data only to provide the services to the client that engaged us and as that client instructs. We do not sell Client Data, we do not use it to market to the client’s customers or for our own marketing, and we do not use it to train or improve artificial intelligence models.

3.3 Legal bases for processing (EEA, UK, and Switzerland). Where the General Data Protection Regulation of the European Union, the United Kingdom General Data Protection Regulation, or the Swiss Federal Act on Data Protection applies, we rely on the following legal bases:

• Performance of a contract, where processing is necessary to enter into or perform an agreement with you or to take steps at your request before entering into one;
• Legitimate interests, where processing is necessary for our legitimate interests in operating and securing our business, responding to inquiries, developing business relationships, and providing our services, and those interests are not overridden by your rights and freedoms;
• Legal obligation, where processing is necessary to comply with a legal requirement, such as tax and accounting obligations; and
• Consent, where the law requires it, for example for non-essential cookies or certain electronic marketing. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

3.4 Automated decision-making. We do not make decisions about visitors, prospective clients, or clients that produce legal or similarly significant effects on the basis of solely automated processing.

4.1 No sale of personal information. We do not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising or targeted advertising, and we have not done so in the twelve months preceding the Effective Date.

4.2 Categories of recipients. We disclose personal information only as follows:

• Service providers and subprocessors. We use third parties that process personal information on our behalf and under written terms that restrict their use of it. These include providers of website hosting and delivery (currently Vercel Inc.), domain, network, and security services (currently Cloudflare, Inc.), email, document, calendar, and productivity tools (currently Google LLC), workflow automation and application hosting platforms, project and client-record management tools, invoicing, payment processing, and accounting services, and the artificial intelligence providers described in Section 5. A current list of the principal service providers that process Client Data is available on request.
• Professional advisers. Our attorneys, accountants, insurers, and other professional advisers, who are bound by duties of confidentiality.
• Introducing parties. A referral, sales, or lead-generation partner that introduced you to us may receive the limited information necessary to confirm that an engagement has begun and to administer the related referral arrangement. Such a partner does not receive access to Client Data or to any client system.
• Clients’ designated recipients. Third parties that a client directs us to share information with in the course of the services.
• Legal and safety disclosures. Courts, regulators, law enforcement, and other parties, where we believe disclosure is required by law, legal process, or governmental request, or is necessary to protect the rights, property, or safety of JD Works, our clients, or others, or to detect, prevent, or address fraud, security, or technical issues.
• Business transfers. A successor or acquirer, in connection with an actual or proposed merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, subject to this Privacy Policy or a substantially equivalent commitment.
• With your consent or at your direction. Any other party to whom you ask or authorize us to disclose information.

4.3 Aggregated and de-identified information. We may disclose aggregated or de-identified information that cannot reasonably be used to identify you or any client.

5.1 Use of AI providers. Some of our services incorporate artificial intelligence. To deliver those services, content that a client provides or that flows through a client’s workflow, which may include personal information, may be transmitted to third-party artificial intelligence model providers through their application programming interfaces, solely for the purpose of generating the output required by the service.

5.2 Safeguards. We select artificial intelligence providers that make their services available on commercial or API terms that do not, by default, permit the provider to train its general models on content that we submit. We limit the content sent to a provider to what the relevant function requires and, where practicable and appropriate, remove or mask personal information before it is sent. On request, we will identify the artificial intelligence providers used for a particular engagement, and a client may instruct us in writing to exclude particular categories of data from artificial intelligence processing.

5.3 Our own use. We do not train artificial intelligence models on Client Data, and we do not permit Client Data to be used to train a provider’s general models where the provider offers a setting that prevents it.

5.4 Accuracy. Outputs generated by artificial intelligence may be inaccurate or incomplete. Our Terms of Service explain the responsibilities of our clients in reviewing and relying on those outputs.

6.1 Retention principles. We keep personal information only for as long as it is needed for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law. Our standard retention periods are set out below.

• Inquiries and correspondence that do not lead to an engagement: up to twenty-four (24) months after our last communication with you, after which they are deleted or anonymized.
• Business development contacts: until you ask us to stop or for up to twenty-four (24) months after our last interaction, whichever occurs first.
• Website server logs: in accordance with the standard retention periods of our hosting and network providers, which are generally short.
• Engagement, contract, invoicing, and payment records: for the duration of the engagement and seven (7) years afterward, to meet legal, tax, and accounting requirements and to establish, exercise, or defend legal claims.
• Client Data and access credentials: only as long as needed to provide the services. When an engagement ends, we revoke and delete the credentials, keys, and tokens provided to us promptly and in any event within thirty (30) days. We return or delete Client Data within sixty (60) days after the engagement ends or after the client’s written request, whichever is earlier, and copies held in routine backups are overwritten in the ordinary course within ninety (90) days after that.

6.2 Exceptions. We may retain information for longer where necessary to comply with a legal obligation, resolve a dispute, enforce our agreements, or preserve evidence in connection with an actual or reasonably anticipated legal claim.

7.1 Our safeguards. We maintain administrative, technical, and organizational safeguards that are designed to protect personal information against unauthorized access, use, alteration, disclosure, and loss, and that are appropriate to the nature of the information and the risks of processing it. These include:

• least-privilege access, meaning that we request and use only the access that a specific engagement requires;
• separate storage of each client’s credentials, so that one client’s access details are not held alongside or shared with another’s;
• encryption of data in transit using Transport Layer Security (TLS), and, where supported by the underlying platforms, encryption of data at rest;
• authentication and access controls on the accounts and systems we use;
• restrictions on who may access personal information, limited to individuals who need it to perform their work and who are bound by confidentiality obligations; and
• prompt revocation of access when it is no longer needed.

7.2 Limits. No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your own account credentials confidential and for using the access controls that your own systems offer.

7.3 Security incidents. If we become aware of a security incident that affects personal information we hold, we will investigate it promptly and notify affected clients, individuals, and regulators as required by applicable law. For an incident affecting Client Data, we will notify the affected client without undue delay after confirming the incident.

8.1 Processing in the United States and elsewhere. We are based in the United States, and the personal information we collect is processed in the United States and in other countries in which our service providers operate. Those countries may have data protection laws that differ from the laws of your country.

8.2 Transfer safeguards. Where we transfer personal information originating in the European Economic Area, the United Kingdom, or Switzerland to a country that has not been recognized as providing an adequate level of protection, we rely on appropriate safeguards recognized by law. Depending on the recipient, these include the recipient’s certification under the EU-U.S. Data Privacy Framework and its United Kingdom and Swiss extensions, or the European Commission’s Standard Contractual Clauses together with the United Kingdom International Data Transfer Addendum or an equivalent mechanism. You may contact us to request further information about these safeguards.

9.1 Your rights. Depending on where you live and the law that applies, you may have some or all of the following rights regarding personal information that we hold about you as a controller:

• the right to know whether we process your personal information and to access it;
• the right to correct inaccurate or incomplete personal information;
• the right to request deletion of your personal information;
• the right to receive your personal information in a portable, commonly used format;
• the right to restrict or object to certain processing;
• the right to withdraw consent where processing is based on consent;
• the right to opt out of the sale of personal information, the sharing of personal information for targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in any of these activities); and
• the right not to receive discriminatory treatment for exercising any of these rights.

9.2 How to exercise your rights. To exercise a right, email contact@jdworks.co with the subject line “Privacy Request” and describe your request. We may need to verify your identity, and we may ask for information that matches details we already hold, before acting on a request. You may use an authorized agent to submit a request on your behalf, and we may require written proof of the agent’s authority. We do not charge a fee to process a request unless it is manifestly unfounded or excessive, in which case the law may permit us to charge a reasonable fee or decline to act.

9.3 Our response. We will respond to a verified request within forty-five (45) days, or within one month where the General Data Protection Regulation or the United Kingdom General Data Protection Regulation applies. Where the law permits, we may extend that period once by a further period (up to forty-five days, or two months under those regulations) and will tell you the reason for the extension. If we decline a request, we will explain why and describe any rights you have.

9.4 Appeals. If we decline to act on your request and you live in a jurisdiction that provides a right of appeal, you may appeal by replying to our decision within thirty (30) days of receiving it, stating that you are appealing. We will respond in writing within the period the law requires, and, if we deny the appeal, we will tell you how to contact your state attorney general or other competent regulator.

9.5 Marketing communications. You may opt out of business development and marketing communications at any time by replying to the message with a request to stop or by emailing contact@jdworks.co. We will honor your request promptly. Opting out does not stop service, billing, security, or legal notices that relate to an existing engagement.

9.6 Requests about Client Data. If your request concerns personal information that we process on behalf of a client, we act only on that client’s instructions. We will refer your request to the client, and the client is responsible for responding to it.

9.7 Complaints. You may lodge a complaint with a data protection authority or other competent regulator in your place of residence or work. We encourage you to contact us first so that we have an opportunity to address your concern.

10.1 Application. Several United States states, including California, Colorado, Connecticut, Oregon, Texas, Utah, and Virginia, have enacted comprehensive privacy laws that give residents specific rights regarding personal information. This Section 10 supplements the rest of this Privacy Policy. We extend the rights described in Section 9 to residents of the United States generally, whether or not a particular state law applies to us.

10.2 Categories of personal information collected. In the twelve months preceding the Effective Date, we collected the following categories of personal information, for the business purposes described in Section 3 and from the sources described in Section 2:

• Identifiers: such as name, email address, telephone number, and IP address.
• Customer and contact records: such as name, business address, and billing details.
• Commercial information: such as records of services considered, purchased, or proposed.
• Internet or other electronic network activity information: such as server log data described in Section 2.2.
• Professional or employment-related information: such as job title and employer.
• Sensitive personal information: limited to account log-in credentials that clients grant us in order to connect to their systems. We use this information solely to perform the services requested by that client and not to infer characteristics about any individual.

10.3 Disclosure for a business purpose. We disclose the categories above to the recipients described in Section 4.2 for the business purposes described in Section 3. We have not sold or shared personal information, as those terms are defined under applicable state privacy laws, in the twelve months preceding the Effective Date, and we do not knowingly sell or share the personal information of individuals under 18 years of age.

10.4 Retention. We retain each category of personal information for the periods described in Section 6.

10.5 California “Shine the Light”. California Civil Code Section 1798.83 permits California residents to request information about the disclosure of their personal information to third parties for those third parties’ direct marketing purposes. We do not make such disclosures.

10.6 Nevada. Nevada law permits residents to opt out of the sale of certain personal information. We do not sell covered information as Nevada law defines that term. Nevada residents may nevertheless submit a request to contact@jdworks.co.

10.7 Washington. To the extent that Client Data includes consumer health data as defined in the Washington My Health My Data Act, we process it solely as a processor on behalf of the client that provided it.

11.1 Controller. For the processing described in Section 1.3 in which we act as a controller, the controller is JD Works, which you can contact at contact@jdworks.co.

11.2 Your rights. In addition to the rights described in Section 9, you have the rights conferred by Articles 15 through 22 of the General Data Protection Regulation or the corresponding provisions of the United Kingdom General Data Protection Regulation and Swiss law, including the right to object at any time to processing based on our legitimate interests and to processing for direct marketing.

11.3 Legal bases and transfers. The legal bases on which we rely are set out in Section 3.3, and the safeguards that apply to international transfers are set out in Section 8.

11.4 Provision of information. Providing personal information to us is voluntary, but if you do not provide the information we need, we may be unable to respond to your inquiry or provide the services you request.

11.5 Representatives. We do not currently maintain an establishment or an appointed representative in the European Economic Area or the United Kingdom. Inquiries from individuals in those regions may be sent to contact@jdworks.co.

11.6 Supervisory authorities. You have the right to lodge a complaint with the supervisory authority in the country where you live or work or where an alleged infringement occurred.

The Website and our services are directed to businesses and professionals and are not intended for individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe that a child has provided personal information to us, please contact us at contact@jdworks.co, and we will delete it promptly.

The Website may contain links to websites and services that we do not own or control. This Privacy Policy does not apply to them, and we are not responsible for their content or their privacy practices. We encourage you to read the privacy policy of every website or service you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or the law. We will post the revised version on the Website and update the “Last Updated” date at the top. If we make a material change, we will provide additional notice, for example by a prominent notice on the Website and, for clients with an active engagement, by email. Changes take effect when posted unless a later effective date is stated. Where the law requires your consent to a change, we will seek it. Prior versions are available on request.

If you have questions about this Privacy Policy, wish to exercise a privacy right, or wish to raise a concern about how we handle personal information, please contact us:

• Email: contact@jdworks.co
• Subject line for rights requests: Privacy Request
• Website: jdworks.co

We aim to acknowledge every privacy inquiry within five (5) business days and to respond in accordance with Section 9.3.