Privacy Policy

1. SCOPE, ROLES, AND JURISDICTIONS

1.1 Global Scope. The Applications may be used internationally. Where local laws impose additional requirements, BTG will apply such requirements to the extent they are applicable to BTG’s processing activities.

1.2 Controller vs. Processor.

• BTG as Controller (or Business): BTG acts as a controller/business for account administration, licensing/entitlement validation, product security, fraud prevention, billing/transaction administration (where applicable), and direct support communications.
• BTG as Processor (or Service Provider): BTG acts as a processor/service provider when processing Customer/Enterprise Content that customers choose to input, upload, connect, or process through the Applications.

1.3 Governing Law. To the extent permitted by law, and without limiting any mandatory statutory rights, New Jersey law governs the interpretation of this Privacy Policy.

2. INFORMATION WE COLLECT

We may collect the following categories of information (depending on the specific Application and your configuration):

• User and License Validation Information: Name, email address, user principal name, tenant and/or organization identifiers, subscription or entitlement status, and related identifiers provided via registration, sign-in, Microsoft Entra ID (Azure AD), Microsoft Partner Center, or Microsoft Marketplace/Commercial Marketplace transactions, to validate licensing/entitlements and administer access.
• Usage Statistics and Telemetry: Details about how users interact with the Applications, such as access times, features used, clicks/events, error reports, performance metrics, and diagnostic logs.
• Support and Communications Data: Information you provide when you contact us for support (e.g., issue descriptions, screenshots, attachments, and correspondence).
• Technical Data: IP address, device type, operating system, browser identifiers, Application version, and configuration information.
• Customer/Enterprise Content (as applicable): Data that you or your organization choose to input, upload, connect, or process through the Applications (for example, data from HR, Payroll, ERP, HCM, or other corporate systems). BTG processes such content only as needed to provide the Application’s functionality and related support.

3. LEGAL BASIS FOR PROCESSING (GDPR/UK GDPR/LGPD AND SIMILAR FRAMEWORKS)

Where the EU GDPR, UK GDPR, LGPD, or similar laws apply, BTG relies on one or more of the following lawful bases (or analogous legal grounds) depending on the context:

• Contractual Necessity: To provide the Applications and related support, authenticate users, administer accounts, and perform our contractual obligations to customers.
• Legitimate Interests: To secure, maintain, and improve the Applications; prevent fraud/abuse; ensure network and information security; and operate our business efficiently (where those interests are not overridden by your rights).
• Consent: Where required by applicable law for specific processing activities (for example, where optional features would require consent under local rules). You may withdraw consent at any time where processing is based on consent.
• Legal Obligation: To comply with applicable laws, regulations, lawful requests, and to establish, exercise, or defend legal claims.

4. HOW WE USE YOUR INFORMATION

We use the collected information to:

• Provide and operate the Applications, including authentication, access control, license/entitlement validation, and delivery of requested features.
• Provide support, troubleshoot issues, respond to inquiries, and communicate about incidents, updates, and service-related notices.
• Improve and develop the Applications, including analyzing usage statistics and telemetry to enhance performance, reliability, and user experience.
• Maintain security and integrity, including monitoring for abuse, fraud, unauthorized access, and software theft.
• Comply with applicable legal obligations and Microsoft Marketplace/Commercial Marketplace requirements (as applicable).

5. DATA SHARING AND DISCLOSURE

We do not sell your personal data and do not share it with third parties for their independent marketing purposes.

We may disclose information only in the following limited circumstances:

• Microsoft Marketplace / Microsoft Processing: As needed to enable listing, purchasing, billing, entitlement management, and related processing through Microsoft Marketplace/Commercial Marketplace, and to support Applications that extend Microsoft Cloud services.
• Service Providers (as needed): Vendors that help us operate the Applications (e.g., hosting, monitoring, customer support tooling). Such providers are permitted to process information only on our instructions and for the purposes described in this Policy.
• Legal and Compliance: When required by law, regulation, legal process, or governmental request, or to protect the rights, security, and property of BTG, our customers, or others.

6. COOKIES, TRACKING, AND CONSENT MANAGEMENT (NO TRACKING COOKIES)

We do not use browser cookies or similar tracking technologies for advertising, marketing, profiling, or cross-site tracking purposes. The Applications are designed to operate without cookie-based tracking mechanisms for behavioral advertising.

If the Applications use any storage mechanisms necessary for core functionality (for example, strictly necessary session identifiers, configuration storage, or local/session storage used to keep you signed in or to maintain security settings), those mechanisms are used solely for strictly necessary operational purposes and not for tracking or advertising.

6.1 Technical and Operational Compliance Standards

BTG implements the following privacy compliance standards across governed regions, as applicable:

1. Categorization & Tracking Transparency: We audit and categorize scripts into Strictly Necessary, Functional, Analytics, and Advertising/Marketing categories. No advertising/marketing tracking cookies are deployed.
2. Conditional Loading & Tag Managers: Any non-essential scripts (if ever introduced) will not fire without appropriate consent where required (including opt-in regimes in the EU/UK and other jurisdictions with consent-based rules), or will be handled in accordance with local legal frameworks.
3. Global Privacy Control (GPC): We actively detect and honor GPC signals, including by detecting navigator.globalPrivacyControl and related HTTP header signals where implemented, to automatically respect global opt-out preferences where applicable.
4. Consent Management Platforms (CMPs): We deploy geo-targeted consent frameworks (e.g., OneTrust, Cookiebot, Usercentrics) to adjust notices and consent flows based on visitor jurisdiction, where such notices/controls are required.
5. Audit Logging: We maintain anonymized, time-stamped logs recording user privacy choices, consent records (where applicable), and banner versions to support regulatory compliance.

6.2 Cookie/Tracking Compliance Table

No advertising/marketing tracking cookies are deployed. Strictly necessary storage (if any) is limited to core operational functionality as described above.

7. INTERNATIONAL DATA TRANSFERS

BTG is based in the United States and may process information in the United States and other countries where we or our service providers operate. Where the EU GDPR/UK GDPR (or similar regimes) apply and personal data is transferred internationally:

• We use appropriate safeguards such as the Standard Contractual Clauses (SCCs) and, where required, the UK International Data Transfer Agreement or UK addendum to the EU SCCs, and we implement supplementary measures as appropriate.
• We limit transfers to what is necessary to provide, secure, and support the Applications.

8. DATA SECURITY

We implement reasonable and appropriate technical and organizational measures designed to protect information from unauthorized access, disclosure, alteration, and destruction. Measures may include access controls (least privilege), encryption in transit, secure authentication, logging/monitoring, and security reviews.

Given the Applications’ enterprise and automation use cases, our security program may also include (as appropriate): environment segregation, secure key management, vulnerability management and patching, audit trails, incident response procedures, and role-based access controls for administrative functions. No method of transmission or storage is 100% secure, but we work to protect information consistent with enterprise-grade security practices.

9. DATA RETENTION

We retain personal data only for as long as necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

Typical retention periods include:

• Account, licensing, and entitlement records: retained for the duration of the customer relationship and up to 7 years thereafter to support audit, compliance, and contractual needs.
• Support tickets and communications: typically retained up to 3 years after closure (unless a longer period is necessary to resolve issues, comply with legal obligations, or establish/defend legal claims).
• Security logs and diagnostic logs: typically retained from 30 days to 12 months depending on log type and security requirements.
• Customer/Enterprise Content: retained according to the customer’s instructions and configuration and typically deleted or returned upon contract termination in accordance with applicable agreements, subject to legal retention requirements.

10. YOUR RIGHTS (GLOBAL PRIVACY RIGHTS SUMMARY)

Depending on your location and applicable law, you may have certain rights regarding your personal information. These rights may be subject to limitations and exceptions under applicable law. You can exercise rights by contacting us using the details in Section 11.

10.1 EU GDPR and UK GDPR Rights (and similar frameworks)

Where applicable, you may have the right to:

• Access (including confirmation of processing and a copy of your personal data) (DSAR).
• Rectification (correct inaccurate or incomplete data).
• Erasure (“right to be forgotten”).
• Restriction of processing.
• Data portability.
• Object to processing (including objection to processing based on legitimate interests and certain direct marketing uses).
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with a supervisory authority (see Section 10.5 for UK ICO and EU references).

10.2 U.S. State Privacy Rights (e.g., CA CCPA/CPRA and other state laws)

Where applicable, you may have the right to:

• Know/Access categories and specific pieces of personal information collected, used, disclosed, and (where applicable) shared.
• Delete personal information (subject to exemptions).
• Correct certain inaccurate personal information (where applicable).
• Opt out of sale/sharing of personal information and certain targeted advertising (BTG does not sell personal information and does not share personal information for cross-context behavioral advertising).
• Non-discrimination for exercising privacy rights.

10.3 Brazil LGPD Rights (representative South America framework)

Where applicable, you may have rights including: confirmation of processing, access, correction, anonymization/blocking/deletion where appropriate, portability (as applicable), information about sharing, and the ability to withdraw consent where processing is based on consent.

10.4 Africa and APAC Rights (representative frameworks)

Where applicable under laws such as South Africa’s POPIA, Nigeria’s Nigeria Data Protection Act, Japan’s APPI, Singapore PDPA-style laws, and China’s PIPL, you may have rights that can include access, correction, deletion/erasure (in certain circumstances), objection/opt-out of certain processing, and complaint mechanisms through relevant authorities or regulators. BTG will respond to rights requests in accordance with applicable local law.

10.5 Complaints (EU and UK)

• UK: You may lodge a complaint with the Information Commissioner’s Office (ICO) (UK supervisory authority). Website: https://ico.org.uk/
• EU/EEA: You may lodge a complaint with your local supervisory authority in the EU/EEA member state where you reside, work, or where an alleged infringement occurred.

11. CONTACT US (DPO / PRIVACY CONTACT)

For questions regarding this Policy or to submit a data subject request:

If you are submitting a request on behalf of an organization, we may need to verify your authority to act on behalf of that organization. We may also need to verify your identity before fulfilling certain requests. Certain information may be exempt from requests as permitted by law (e.g., to comply with legal obligations, protect security, and prevent fraud).

1. ACCEPTANCE OF TERMS

By accessing or using software applications developed by Boomer Technology Group (“BTG”), you agree to be bound by these Terms of Use and all applicable laws and regulations.

2. LICENSE GRANT

BTG grants you a non-exclusive, non-transferable, revocable license to use the Application solely for your internal business purposes, subject to the limitations of your specific subscription or purchase through the Microsoft Marketplace.

3. INTELLECTUAL PROPERTY OWNERSHIP

All rights, title, and interest in and to the Application, including source code (.NET), Dynamics 365 configurations, algorithms, AI-enabled solutions, and all documentation, remain the exclusive property of BTG. Unauthorized reproduction or reverse engineering is strictly prohibited.

4. PROHIBITED CONDUCT

Users shall not:

• Decompile, reverse engineer, or attempt to derive the source code of the Application.
• Use the Application to facilitate illegal activity.
• Remove or obscure any copyright, trademark, or other proprietary notices.

5. DISCLAIMER OF WARRANTIES

The Application is provided “as is” and “as available.” BTG disclaims all warranties, express or implied, including warranties of merchantability and fitness for a particular purpose.

6. LIMITATION OF LIABILITY

To the maximum extent permitted by law, BTG shall not be liable for any indirect, incidental, or consequential damages arising out of the use of or inability to use the Application.

1. WORK PRODUCT

“Work Product” means all inventions, code (.NET, C#, SQL), designs, Dynamics 365 configurations, documentation, and AI models created by Contributor for the Company.

2. WORK MADE FOR HIRE

Contributor acknowledges that all Work Product is a “work made for hire” under the U.S. Copyright Act. BTG shall own all right, title, and interest in and to the Work Product.

3. ASSIGNMENT OF RIGHTS

To the extent any Work Product does not qualify as a “work made for hire,” Contributor hereby irrevocably assigns to BTG all worldwide rights, including copyrights, patents, and trade secrets, in the Work Product.

4. FURTHER ASSURANCES

Contributor agrees to assist BTG, at the Company’s expense, to secure and protect BTG’s intellectual property rights, including executing formal assignment documents for patent or copyright registration.

1. DEFINITION OF CONFIDENTIAL INFORMATION

“Confidential Information” includes all non-public information disclosed by BTG, including but not limited to source code, business processes, client lists (HR/Payroll/ERP), and technical architecture.

2. OBLIGATIONS OF RECEIVING PARTY

The Receiving Party shall:

• Hold Confidential Information in strict confidence.
• Use information only for the purpose of the business relationship with BTG.
• Apply at least a reasonable standard of care to prevent unauthorized disclosure.

3. EXCLUSIONS

Confidential Information does not include information that is: (a) publicly known through no fault of the Receiving Party; (b) already known by the Receiving Party; or (c) independently developed without use of BTG’s information.

4. REMEDIES

Receiving Party acknowledges that unauthorized disclosure may cause irreparable harm for which monetary damages are inadequate, and BTG shall be entitled to seek injunctive relief.

5. GOVERNING LAW

This Agreement shall be governed by the laws of the State of New Jersey, USA.