Privacy & Data Handling Policy

Information We Collect

We may collect information you choose to provide, including:

• Name

• Email address

• Phone number

• Company name

• Project location

• Approximate square footage

• Requested services

• Project timeline

• Preferred contact method

• Other details included in your inquiry

If an inquiry becomes an active engagement, SpaceMade may also maintain ordinary business communications, project notes, estimates, invoices, approvals, and service records necessary to deliver and document our work.

Website hosting and technical service providers may collect basic operational data such as:

• IP address

• Browser type

• Device information

• Pages visited

• Usage logs

This information is collected solely to operate, secure, and maintain the website.

SpaceMade does not intentionally collect sensitive personal information—including Social Security numbers, financial account numbers, health information, passwords, government-issued identification numbers, or biometric data—through its website. Please do not submit such information through any web form.

How We Use Information

SpaceMade may use information to:

• Respond to inquiries

• Understand workspace goals

• Schedule consultations

• Prepare proposals

• Coordinate service delivery

• Communicate regarding active projects

• Maintain accounting and project records

• Meet tax, insurance, safety, dispute-resolution, and legal requirements

Where SpaceMade processes personal data on behalf of a Client, it does so solely for the specific business purposes set forth in the written agreement with that Client and for no other purpose.

SpaceMade will not use personal data for:

• Marketing to individuals identifiable from that data

• Data mining

• Algorithmic calculations

• Artificial intelligence model training or improvement

• Distribution to third parties

Any commercial purpose outside the direct business relationship established under the applicable agreement

What We Do Not Do

SpaceMade does not:

• Sell, rent, trade, or disclose personal data to data brokers or third-party advertisers

• Use personal data for unrelated advertising or resale

Use personal data for purposes outside the specific business purposes identified in client agreements

Combine personal data received from one client with personal data from other clients, third parties, or independent sources

• Re-identify or attempt to re-identify de-identified data

SpaceMade has implemented technical and organizational safeguards designed to prevent re-identification and publicly commits to maintaining de-identified information only in de-identified form.

Limited Sharing and Subcontractor Controls

SpaceMade may share information only when reasonably necessary for business operations, including with providers of:

• Website hosting

• Form processing

• Email services

• Scheduling services

• Payment processing

• Bookkeeping

• Project support

• Professional advisory services

• Legal services

• Compliance services

These parties are permitted to use personal data only as necessary to provide services to SpaceMade in connection with the applicable engagement.

Where a Client agreement requires prior written authorization before engaging subcontractors to process Client personal data, SpaceMade will obtain such authorization before any subcontractor access occurs.

SpaceMade will enter into written agreements with subcontractors that impose data privacy, confidentiality, security, and use restrictions at least as stringent as those required under the applicable Client agreement and this Policy.

SpaceMade remains responsible for subcontractor compliance with these obligations throughout the duration of the engagement.

SpaceMade may also disclose information:

• If required by law

• If authorized by the individual or Client

If reasonably necessary to protect rights, safety, property, site security, or business operations

Legal Process and Government Requests

If SpaceMade receives a subpoena, court order, governmental demand, or other legal request for personal data processed on behalf of a Client, SpaceMade will provide prompt written notice to the Client before disclosure unless prohibited by law or court order.

SpaceMade will provide the Client a reasonable opportunity to seek a protective order or other appropriate relief.

SpaceMade will not release personal data to any governmental entity, organization, or individual except where legally required and will coordinate with the Client throughout the process.

SpaceMade will similarly notify the Client promptly of any request by a foreign government for access to personal data or information regarding legal process or electronic surveillance related to the Client's end users, unless prohibited by law.

Individual Rights and Client Notifications

Individuals may request that SpaceMade review, correct, delete, or limit the use of personal information they have submitted, subject to:

• Reasonable identity verification

Records SpaceMade is required or permitted to retain for legal, tax, accounting, insurance, safety, dispute, or active business purposes

Depending on applicable law, individuals may have additional privacy rights, and SpaceMade will honor such rights as required.

Where SpaceMade collects or processes personal data on behalf of a Client, SpaceMade will immediately notify the Client of any inquiry, request, or complaint concerning:

• Access

• Modification

• Deletion

• Correction

• Other handling of personal data associated with the Client's services

SpaceMade will not respond independently to such requests and will direct the individual to the Client.

SpaceMade will provide all necessary information in its possession and reasonable technical and organizational assistance to support the Client's fulfillment of individual rights obligations under applicable law.

Retention and Data Return

SpaceMade retains personal information only as long as reasonably necessary for the business purposes for which it was collected.

If a consultation does not become an active project, SpaceMade will delete or de-identify unnecessary inquiry records when they are no longer needed for business purposes.

Where SpaceMade processes personal data on behalf of a Client, SpaceMade will, upon termination or expiration of the applicable agreement or upon the Client's written request:

• Return all personal data in a format acceptable to the Client

• Securely delete all copies, including copies held by subcontractors

This obligation is subject to any retention required by applicable law.

Any personal data retained pursuant to a legal requirement will remain protected under this Policy and the applicable Client agreement until deleted.

Security

SpaceMade uses reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, misuse, loss, alteration, or disclosure.

These safeguards include:

• Access controls based on least-privilege principles

• Encryption of data in transit and at rest where appropriate

• Regular assessment of security controls

SpaceMade applies equivalent security requirements to subcontractors and technical providers with access to personal data.

Personnel with access to personal data are subject to confidentiality obligations.

In the event of a confirmed or reasonably suspected security incident affecting personal data processed on behalf of a Client, SpaceMade will:

• Notify the Client promptly in writing

• Cooperate fully with the Client's investigation and incident response efforts

• Support remediation activities

SpaceMade acknowledges that no system is completely secure and will remain transparent with Clients regarding circumstances that may affect the security of their data.

Compliance, Audits, and Continuous Assessment

SpaceMade will continuously reassess compliance with this Policy and with data processing obligations contained in Client agreements.

Upon reasonable request and appropriate notice, SpaceMade will make available information necessary to demonstrate compliance with applicable privacy and data processing requirements.

SpaceMade will cooperate with audits or assessments of its personal data handling practices as permitted by law and contractual obligations.

SpaceMade will promptly notify the applicable Client if it determines it can no longer meet its data handling obligations under an agreement.

Legal Compliance and Certification

SpaceMade processes personal data as a Service Provider, Contractor, or analogous party as defined under the California Consumer Privacy Act (CCPA), as amended, and other applicable state and federal privacy laws.

SpaceMade understands the limitations imposed on the use and sharing of personal data under applicable law and client agreements and certifies that it will comply with those requirements, including providing the same level of privacy protection required under the CCPA.

SpaceMade's compliance obligations will be updated as privacy laws evolve.

Cookies, Children, and Updates

The website may use essential cookies, security tools, analytics, hosting logs, and similar technologies provided by website platforms or service providers.

The website is intended for business and professional inquiries and is not directed to children under the age of 13.

SpaceMade may update this Policy from time to time to reflect changes in:

• Website operations

• Business practices

• Service providers

• Legal requirements

Material changes will be reflected by an updated effective date.

Contact

For privacy questions, requests, or concerns, individuals may submit a request through SpaceMade's consultation request process and include "Privacy Request" in the message, or contact SpaceMade using the contact information provided on the website.

Clients with active agreements should direct data processing inquiries to the designated contact identified in their agreement.

Back to Request Consultation