Privacy Policy

Last updated: September 7, 2025

1) Who we are & scope

This Privacy Policy explains how Andrea Carter Consulting (“we,” “us,” “our”) collects, uses, discloses, and safeguards personal information when you use our websites and online services, including www.andreacarterconsulting.com and www.belongingfirst.com (the “Websites”), our forms, events, newsletters, and related services (collectively, the “Services”). By using the Services, you agree to this Policy and our Terms of Use.

2) What we collect

Information you provide: name, contact details, organization/role, communication preferences, content you submit (forms, messages, testimonials), and purchase/enrollment information (processed by our payment providers).
Automatic data: device, browser, IP address, general location, pages viewed, timestamps, referral/UTM data, and cookie/SDK identifiers.
From third parties: platform partners (analytics, ad platforms), payment processors, email/CRM tools, and event vendors (as applicable).

3) Why we use your information

To operate and secure the Services; process purchases and registrations; provide support; send administrative messages; deliver marketing with proper consent/opt-out; personalize content; (if enabled) measure/serve ads; analyze and improve our Services; comply with law; and protect our rights and users.

4) Legal bases (EU/UK)

Where the GDPR/UK GDPR applies, we rely on one or more: consent, contract, legitimate interests (e.g., to improve and secure our Services), and legal obligations. Transparency and data subject rights apply as set out below. GDPR

5) Cookies, analytics & ad tech

We use cookies and similar technologies for core functionality, performance, analytics, and—if enabled—advertising/retargeting. In the EU/UK, non-essential cookies (e.g., analytics/ads) require opt-in consent before they’re set; you can withdraw consent any time via our Cookie Preferences tool and browser controls. ICO+1

If we use cross-context behavioral advertising in the US, certain states (e.g., California) treat that as “sharing”; residents can opt out (see Your region-specific rights below). We also honor recognized opt-out preference signals (e.g., Global Privacy Control) where required. Legal Information InstituteCalifornia Privacy Protection Agency

6) Your privacy choices

• Marketing emails: Unsubscribe via any message footer or by contacting us. Canadian recipients: we follow CASL (consent, identification, and easy unsubscribe). CRTC+1

• Cookies/trackers: Use our Cookie Preferences tool and your browser/device settings.

• Do Not Sell or Share / Your Privacy Choices (US states): If we “sell” or “share” personal information under applicable US laws, use our [Your Privacy Choices] link (and/or your browser’s GPC signal) to opt out. Legal Information InstituteCalifornia DOJ

7) How we share information

We share personal information with: service providers/contractors (hosting, security, payment, analytics, CRM/email, event/fulfilment) under contracts; professional advisors; affiliates under common control; and as required by law, in connection with corporate transactions, or to protect rights, safety, and security. We don’t allow vendors to use your data for their own marketing.

8) International transfers

We may process data in Canada, the US, the UK, the EU, and other countries. When the EU/UK rules apply, we use approved mechanisms—e.g., EU-US Data Privacy Framework and the UK-US Data Bridge for certified US recipients, or SCCs/BCRs otherwise. Note: on September 3, 2025, the EU General Court upheld the EU-US Data Privacy Framework adequacy decision. EUR-LexGOV.UKReuters

9) Security & retention

We use administrative, technical, and physical safeguards appropriate to the nature of the data and our operations. No method is 100% secure. We retain data only as long as needed for the purposes described above, to meet legal obligations, resolve disputes, and enforce agreements.

10) Children

Our Services aren’t directed to children under 13. We do not knowingly collect personal information from children under 13; if you believe we have, contact us to delete it. (US: COPPA applies.) Québec residents: see Law 25 notes below. eCFR

Regional supplements

A) European Union / European Economic Area (GDPR) & United Kingdom (UK GDPR/PECR)

Controller: Andrea Carter Consulting.
Your rights include: access, rectification, erasure, restriction, portability, and objection (including to direct marketing); where processing is based on consent, you can withdraw consent at any time. You also have the right to lodge a complaint with your local authority (e.g., EDPB/DPAs or ICO in the UK). Data Protection Commission

Cookies: Under PECR (UK) and the EU ePrivacy regime, non-essential cookies require prior, informed consent; simple “continued browsing” isn’t valid consent. The UK ICO has recently reiterated consent standards and is reviewing “consent or pay” implementations; any such models must still meet GDPR consent requirements. ICOArnold & Porter

Transfers: We may rely on the EU-US Data Privacy Framework (for certified US recipients), the UK-US Data Bridge (for UK transfers), SCCs, or BCRs, as appropriate. EUR-LexGOV.UK

Breach notice: Where the GDPR/UK GDPR applies, we will notify authorities and affected individuals as required (e.g., supervisory authority within 72 hours for certain incidents).

B) United States (California and other state privacy laws)

Some US states provide specific privacy rights (e.g., California CPRA, Colorado, Connecticut, Virginia, Utah, and others). Depending on your state and our processing, you may have the right to know/access, correct, delete, portability, opt-out of targeted advertising, sale, or profiling, and appeal our decision on your request. We will verify and respond within required timelines.

California: If our activities constitute “sale” or “sharing” of personal information, you can opt out via [Your Privacy Choices] and by sending a recognized opt-out preference signal (e.g., GPC)—which we honor as required. (California also recognizes “OOPS”—Opt-Out Preference Signals—in its regulations.) Legal Information InstituteCalifornia Privacy Protection Agency

Colorado: We recognize approved universal opt-out mechanisms (currently GPC) as required under the Colorado Privacy Act. Duane Morris

Patchwork note: US state privacy requirements continue to expand; the IAPP tracks active/enacted laws nationwide. We update our practices to align with applicable state law where you reside. IAPPReuters

C) Canada (PIPEDA) & commercial email (CASL)

We comply with PIPEDA where applicable (including meaningful consent, access/correction, openness, and accountability) and with CASL when sending commercial electronic messages (consent, identification, unsubscribe). You can withdraw consent at any time subject to legal/contractual limits. CRTC

Mandatory breach reporting: If a breach creates a “real risk of significant harm,” we will notify the Office of the Privacy Commissioner of Canada and affected individuals, and keep required incident records. The OPC provides a public RROSH assessment tool. Privacy Commissioner Canada+1

Provincial notes

• Québec (Law 25): We designate a person in charge of personal information (Privacy Officer), maintain an incident register, assess impacts as required, and (since Law 25 phases took effect) obtain parental consent for personal information of children under 14 unless an exception applies. We notify the Commission d’accès à l’information (CAI) of confidentiality incidents posing a risk of serious injury. Légis Québec

• British Columbia (PIPA-BC) and Alberta (PIPA-AB): Private-sector organizations must obtain appropriate consent, limit collection/use/disclosure to reasonable purposes, provide access/correction, and meet mandatory breach notification requirements in Alberta; BC provides similar rights under its PIPA and guidance via the OIPC. BC Lawsoipc.ab.ca

11) Exercising your rights

Submit a request by emailing [privacy@andreacarterconsulting.com] with your name, region, and the rights you wish to exercise (access, deletion, correction, portability, opt-out, etc.). We’ll verify your identity and respond within applicable timelines. If we refuse your request (e.g., due to legal exemptions), you may have the right to appeal (US states), or to complain to your regulator (EU/UK/Canada).

12) Third-party links & social features

Our Services may link to third-party sites or offer social media features. Their practices are governed by their own policies.

13) Changes to this Policy

We may update this Policy. The “Last updated” date shows the effective date. Where required by law, we’ll provide additional notice.

14) Contact (Privacy Officer)

Andrea Carter Consulting
Attn: Privacy Officer
Email: [privacy@andreacarterconsulting.com]