Privacy Notice
Revision: October 1, 2025
This notice concerns the use of Mastermind’s website and services.
Revision: October 1, 2025
This notice concerns the use of Mastermind’s website and services.
Mastermind Assurance, LLC and its subsidiaries, divisions, affiliates, and related entities (“we,” “us,” or “Mastermind”) recognize the importance of protecting the privacy of your personal data and want you to be familiar with how we collect, use and disclose the information you provide by engaging our services on the website, mobile website, social media site, software, email exchanges, mobile apps, and other online services on which this Privacy Notice (the “Notice”) is posted, including but not limited to any services, features, pages, and functions contained or offered therein, and any transactions, orders, sales, purchases, or acquisitions of goods, products, or services (collectively, the “Service”).
Your use of the Service is conditioned on your agreement with this Privacy Notice and our Terms of Use. This Notice also explains your rights in relation to your personal information and how to contact us or relevant data protection authorities in the event you have a complaint.
This Notice does not apply where Mastermind assesses a management system (“Assessment Services”). Data related to Assessment Services is processed in accordance with an agreement, including any relevant order forms and Data Processing Addendums (“Agreement”). Assessment Services means the assessment or auditing of management systems for schemes, including ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001, ISO/IEC 27017, ISO/IEC 27018, and CSA STAR.
By making any transaction, order, or purchase or by visiting or otherwise using the Service in any manner, you acknowledge and accept without limitation or qualification that you have read and understood the Notice and Terms of Use and you agree to be bound by them. This Notice is written in the English language. We do not guarantee the accuracy of any translated versions of this Notice. To the extent any translated versions of this Notice conflict with the English language version, the English language version of this Notice shall control.
While using the Service, we may ask you to provide us with certain personal data that can be used to contact or identify you. By providing this data, you do so under your free will and consent to the collection. The following are the categories and types of personal data that we may collect from or about you, depending on how you interact with us:
We collect personal information automatically as you navigate our Service. By browsing the Service, you freely consent to this collection. The technologies deployed through our Service collect your device information, browsing actions, and patterns as follows:
Our Services may include social media features and plugins, such as social media widgets.
These social media features may use cookies or other tracking technologies to collect information about your internet activity, such as your IP address and which page you are visiting on our Service. We may collect personal data that is already associated with your social media account, such as your name, email address, activities or contact list associated with that account.
Such social media features are hosted by third parties and your interactions with those features are governed by the privacy policies of the companies that provide them. Specifically, Mastermind allows you to use the Service through the following social media services:
We use Cookies and similar tracking technologies to track the activity on the Service and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyze the Service. Cookies can be “Persistent” or “Session” Cookies. Persistent Cookies remain on Your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close Your web browser.
We use these technologies for the purposes set out below:
Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Service. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network. You can opt-out having made your activity on the Service available to Google Analytics by installing the Google Analytics opt-out browser add-on. The add-on prevents the Google Analytics JavaScript (ga.js, analytics.js and dc.js) from sharing information with Google Analytics about visits activity. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy
We may use your personal data to contact you with newsletters, marketing or promotional materials and other information that may be of interest to You. You may opt-out of receiving any, or all, of these communications from Us by following the unsubscribe link or instructions provided in any email We send or by contacting Us. We may use email marketing service providers to manage and send emails to you. For more information on our email marketing service providers, beehiiv, please visit: https://www.beehiiv.com/privacy
Mastermind, located in Alpharetta, GA, United States is the data controller because Mastermind alone or jointly with others determines the purposes and means of the processing. Details are included below but Mastermind will gladly help to clarify the specific legal basis that applies to the processing.
The Company may use Personal Data for the following purposes:
We disclose personal data to the following categories of recipients as long as there is a business purpose and as long as we have sufficient commitment to controls to protect your personal data:
Based on your location and applicable laws, you may have certain rights related to your personal data. Mastermind will review rights requests and respond within a reasonable period of time. Our response may include whether an exception or limitation applies and whether we need more time.
You may exercise your rights by contacting us (see the Contact Us section below). Please note that we may ask you to verify your identity and the applicable law before responding to such requests. If you make a request, we will try our best to respond to you as soon as possible. You have the right to complain to a Data Protection Authority about Mastermind’s collection and use of your personal data. For more information, if you are in the European Economic Area (EEA), please contact your local data protection authority in the EEA.
The Company will retain your personal data and usage data only for as long as is necessary for the purposes set out in this Privacy Notice. We will retain and use your personal data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.
We use industry standard technical and organizational measures to secure your information. Due to the fallibility of these measures and the systems they protect, we cannot guarantee that data, including personal data, is absolutely safe from intrusion or other unauthorized access.
The Service is controlled and operated by us from the United States. Mastermind may process, transfer, and store your information on servers located in a number of countries, including the United States. As a result, your personal data may be subject to data protection and other laws that may differ from your country of residence. Your personal information may be disclosed in response to inquiries or requests from government authorities or to respond to judicial processes in the countries in which we operate. By using the Service, or by providing us with any information, you consent to the collection, processing, maintenance, and transfer of such information in and to the United States and other applicable territories in which the privacy laws may not be as comprehensive as, or equivalent to, those in the country where you reside or are a citizen.
Your personal data may be transferred to, stored, and processed in another country than where it was collected. It may be processed by individuals who work for Mastermind or Mastermind’s sub processors. Mastermind is headquartered in the United States. Because of this, most data we process will be transferred to the United States. In cases where the personal data originates in the EEA/EU or UK and is transferred to the United States, we will take appropriate steps to ensure an adequate level of data protection of the recipient. Technical and Organizational Measures (TOMS) are in place to provide administrative, physical, and technical safeguards for Personal Data. Measures include:
Mastermind customers using Assessment Services requiring transfers out of the EU/EEA can take advantage of a data processing agreement as well as Standard Contractual Clauses and the UK International Data Transfer Addendum (if applicable).
This privacy notice section for California residents supplements the information contained in Mastermind’s Privacy Notice and it applies solely to all visitors, users, and others who reside in the State of California. Business, for the purpose of CCPA/CPRA, refers to Mastermind as the legal entity that collects Consumers’ personal information and determines the purposes and means of the processing of Consumers’ personal information, or on behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers’ personal information, that does business in the State of California. CCPA and/or CPRA refers to the California Consumer Privacy Act (the “CCPA”) as amended by the California Privacy Rights Act of 2020 (the “CPRA”). Consumer, for the purpose of the CCPA/CPRA, means a natural person who is a California resident.
We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device. The following is a list of categories of personal information which we may collect or may have been collected from California residents within the last twelve (12) months.
We obtain the categories of personal information listed above from the following categories of sources:
We may use or disclose personal information we collect for business purposes or commercial purposes. See the “Use of Collected Information” section above for details.
We may use or disclose and may have used or disclosed in the last twelve (12) months the following categories of personal information for business or commercial purposes:
The categories listed above are defined in the CCPA/CPRA and not all of the examples of that category of personal information were disclosed. When we disclose personal information for a business purpose or a commercial purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.
We may share, and have shared in the last twelve (12) months, Your personal information identified in the above categories with the following categories of third parties:
Sale of Personal Information
As defined in the CCPA/CPRA, “sell” and “sale” mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer’s personal information by the Business to a third party for valuable consideration. This means that we may have received some kind of benefit in return for sharing personal information, but not necessarily a monetary benefit.
We do not sell personal information as the term sell is commonly understood. We do allow Service Providers to use your personal information for the business purposes described in Mastermind’s Privacy Notice, for activities such as advertising, marketing, and analytics, and these may be deemed a sale under CCPA/CPRA.
We may sell and may have sold in the last twelve (12) months the following categories of personal information:
The categories listed above are defined in the CCPA/CPRA and not all of the examples of that category of personal information were disclosed.
We do not knowingly collect personal information from minors under the age of 16 through our Service, although certain third party websites that we link to may do so. These third-party websites have their own terms of use and privacy policies, and we encourage parents and legal guardians to monitor their children’s Internet usage and instruct their children to never provide information on other websites without their permission.
We do not sell the personal information of Consumers we know are less than 16 years of age, unless we receive affirmative authorization from either the Consumer who is between 13 and 16 years of age, or the parent or guardian of a Consumer less than 13 years of age. Consumers who opt in to the sale of personal information may opt out of future sales at any time. To exercise the right to opt-out, you (or your authorized representative) may submit a request to us by contacting us.
If You have reason to believe that a child under the age of 13 (or 16) has provided us with personal information, please contact us with sufficient detail to enable us to delete that information.
The CCPA/CPRA provides California residents with specific rights regarding their personal information. If You are a resident of California, You have the following rights:
If you are a California resident, in order to exercise any of your rights under the CCPA/CPRA, you can contact us:
Your request to us must:
We cannot respond to Your request or provide you with the required information if we cannot:
We will disclose and deliver the required information free of charge within 45 days of receiving your verifiable request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary and with prior notice.
Any disclosures we provide will only cover the 12-month period preceding the verifiable request’s receipt.
For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.
As defined above, you have the right to opt-out of the sale of your personal information. Once we receive and confirm a verifiable consumer request from you, we will stop selling your personal information. To exercise your right to opt-out, please contact us.
The Service Providers we partner with (for example, our analytics or advertising partners) may use technology on the Service that sells personal information as defined by the CCPA/CPRA law. If you wish to opt out of the use of Your personal information for interest-based advertising purposes and these potential sales as defined under CCPA/CPRA law, you may do so by following the instructions below. Please note that any opt out is specific to the browser You use. You may need to opt out on every browser that You use.
If applicable, click “Privacy Preferences”, “Update Privacy Preferences” or “Do Not Sell My Personal Information” buttons listed on the Service to review Your privacy preferences and opt out of cookies and other technologies that We may use. Please note that you will need to opt out from each browser that you use to access the Service.
Additionally, you can opt out of receiving ads that are personalized as served by our Service Providers by following our instructions presented on the Service:
The opt out will place a cookie on your computer that is unique to the browser you use to opt out. If you change browsers or delete the cookies saved by your browser, you will need to opt out again.
Your mobile device may give you the ability to opt out of the use of information about the apps You use in order to serve You ads that are targeted to Your interests:
You can also stop the collection of location information from your mobile device by changing the preferences on Your mobile device.
Mastermind’s Service does not respond to Do Not Track (DNT) signals. DNT is a concept that was promoted by US regulatory authorities, in particular the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing internet users to control the tracking of their online activities across websites.
Under California Civil Code Section 1798 (California’s Shine the Light law), California residents with an established business relationship with us can request information once a year about sharing their Personal Data with third parties for the third parties’ direct marketing purposes. If you’d like to request more information under the California Shine the Light law, and if you are a California resident, you can contact us using the contact information provided below.
California Business and Professions Code Section 22581 allows California residents under the age of 18 who are registered users of online sites, services or applications to request and obtain removal of content or information they have publicly posted. To request removal of such data, and if you are a California resident, you can contact us using the contact information provided below, and include the email address associated with your account. Be aware that your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.
Mastermind’s Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If you are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact us. If we become aware that we have collected Personal Data from anyone under the age of 13, we take steps to remove that information from Mastermind’s servers. If you are using this Service from a jurisdiction where there may be a different age threshold, contact us and we are happy to clarify the requirements.
Mastermind’s Service may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Notice. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.
We may update Mastermind’s Privacy Notice from time to time. We will notify you of any changes by posting the new Privacy Notice on this page. You are advised to review this Privacy Notice periodically for any changes. Changes to this Privacy Notice are effective when they are posted on this page.
If you have any questions about this Privacy Notice, a right to exercise, or a grievance to address, you can contact us: