Global Privacy Statement

1. Who we are and what this covers

The Budner Performance Group, LLC, a Texas limited liability company, and each of its related entities ("Company," "we," "us," or "our") is committed to protecting the privacy of visitors to our website at budnerpg.com and any successor or related sites (the "Sites"). This Global Privacy Statement (this "Statement") explains how we collect, use, share and protect information about you.

We are based in the United States and currently deliver our services to clients and participants in the United States. The Sites are hosted in the United States and can be reached from anywhere. We apply a single standard to personal data, described in this Statement, and we comply with the additional requirements of local law wherever it applies to us. Section 13 sets out the rights we honor for every individual who contacts us, regardless of where you live.

For personal data collected through the Sites, The Budner Performance Group, LLC is the controller. Where we process personal data on behalf of a client firm under a services agreement, we act as a processor and that agreement governs, not this Statement.

Where you have entered into a separate written agreement with us, such as a services agreement, statement of work or terms of engagement, this Statement is incorporated into and made part of that agreement. If there is a conflict, the terms of the signed agreement control.

We may change this Statement from time to time. We encourage you to review it periodically. If you have questions, contact us using the details in Section 17.

2. Children's personal data

The Sites are intended for adults and corporate entities interested in or using our services. The Sites are not directed to children, and we do not knowingly collect or store personal data about anyone under the age of eighteen. If you believe a child has provided us personal data, contact us and we will delete it.

3. Personal data we collect

"Personal data" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. It includes information such as your name, company name, email address, postal address, telephone number and other information you provide to us.

Information you provide directly

We collect information you give us when you complete a form on the Sites, contact us, subscribe to our insights, register for an event, engage us for services, or apply for a role with us. This information allows us to respond to you, deliver and administer services, communicate with you about your engagement, and invoice you where applicable.

Information we collect automatically

When you visit the Sites, our systems automatically record technical data about your device and your visit. We use this data to operate and improve the performance and functionality of the Sites and to understand how visitors use them. Section 10 and our Cookie Policy explain the cookies and similar technologies involved and how you control them.

Categories collected in the last twelve months

We do not seek to collect special category data under the UK GDPR or EU GDPR, or sensitive personal information under United States state privacy laws, through the Sites. Please do not submit such information to us through a website form.

4. Use of artificial intelligence

We use third-party service providers that incorporate artificial intelligence as part of our business operations. These tools support functions such as note-taking, session preparation, meeting summaries, communication analytics and process automation. Examples include Anthropic's Claude and Sybill.

These tools may process personal data such as contact details, communication metadata, and interactions with our team or services. Artificial intelligence may assist our decision-making. It is not used to make fully automated decisions producing legal or similarly significant effects on individuals without human involvement.

All personal data processed by these tools is handled in accordance with applicable data protection law and is subject to appropriate safeguards, including contractual commitments with our providers covering privacy, security and transparency. We do not permit our providers to use client personal data to train their general models where we control that setting.

If you have questions about this processing, or wish to exercise your rights in relation to it, contact us using the details in Section 17.

5. Legal bases for processing

Where the UK GDPR, EU GDPR or a similar law applies, we process personal data on one or more of the following bases.

6. How we use personal data

We use personal data to manage our relationship with you and to operate the Sites, including to:

• fulfill the reason you provided the personal data, including responding to inquiries;
• provide information or services you request from us;
• deliver, administer and improve our programs and services;
• send business insights and marketing communications in line with your preferences, including event registrations;
• provide, support, personalize and develop the Sites;
• maintain the safety, security and integrity of the Sites;
• conduct testing, research, analysis and development;
• respond to law enforcement requests and comply with applicable law, court order or governmental regulation;
• respond to other situations described to you when we collect your personal data; and
• evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, including as part of a bankruptcy, liquidation or similar proceeding.

7. How long we keep personal data

We keep personal data only as long as needed for the purpose for which it was collected, or as required by law. Our general periods are below. Where a specific engagement agreement sets a shorter period, that period applies.

8. How we share personal data

Subject to applicable law, we may share your information:

• with our subsidiaries and affiliates;
• with third-party service providers acting on our behalf, including website hosting, email, customer relationship management, analytics, artificial intelligence, accounting and technical support providers. These providers are bound by contract to process personal data only on our instructions and to protect it;
• with our accounting and bookkeeping systems and advisers. We use Intuit QuickBooks for bookkeeping and invoicing, which processes business contact and billing information. See the Intuit privacy statement at intuit.com/privacy/statement;
• with professional advisers, including our lawyers, accountants and insurers, where necessary;
• with other parties where required by law or necessary to provide or protect our services. For example, to comply with legal process or a request from a government entity or law enforcement, to prevent fraud, to verify and enforce compliance with our terms, and to protect the rights, property or safety of us, our affiliates, business partners, clients or personnel;
• in connection with a sale or transfer of all or part of our business or assets, including a merger, bankruptcy, reorganization or liquidation; and
• where you or your organization consent to or request such sharing.

We do not accept payments through the Sites. There is no checkout, cart or payment form on budnerpg.com, and we do not collect payment card numbers from you online. Client fees are invoiced directly and settled by bank transfer or check.

We do not sell, trade or rent personal data. We do not disclose personal data to third parties for cross-context behavioral advertising or targeted advertising.

9. International data transfers

We store and process personal data in the United States. Our service providers may also process personal data in other countries. If you contact us from outside the United States, the information you send will be transferred to and processed in the United States, where data protection law may differ from the law where you live.

Wherever personal data crosses a border, we put a lawful transfer mechanism in place and apply the same security and confidentiality standards described in this Statement. Where personal data originating in the United Kingdom, the European Economic Area or Switzerland is transferred, we put an appropriate safeguard in place, such as the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum and the Swiss addendum, or we rely on a finding of adequacy where one applies. For other regions we rely on the mechanism recognized in the relevant jurisdiction, which may include contractual clauses, an adequacy finding, or your explicit consent.

You may request a copy of the mechanism that applies to your personal data by contacting us using the details in Section 17.

10. Cookies and similar technologies

We use cookies and similar technologies on the Sites. Strictly necessary cookies are required for the Sites to work. With your consent, we also set analytics cookies to understand how visitors use the Sites. A consent banner appears on your first visit. You can accept or decline, and you can change or withdraw your choice at any time using the Cookie Settings link in the site footer. Withdrawing consent does not affect processing carried out before you withdrew it.

Our Cookie Policy describes each category, what is currently set, how long cookies last, and how to manage them through your browser settings and our consent tool.

Some browsers transmit "do not track" signals. There is no accepted industry standard for responding to them and we do not currently respond to them. We do honor Global Privacy Control signals where applicable law requires it.

11. Links to other websites

The Sites may contain links to third-party websites or online services. We are not responsible for the privacy or security practices of those third parties, or for the practices of any application developer, social media platform, operating system provider, wireless service provider or device manufacturer, including in relation to personal data you disclose through our social media pages or any mobile features.

12. How we protect personal data

We use administrative, technical and physical safeguards to protect personal data against unauthorized access, use, disclosure, alteration or destruction. These include access controls, encryption in transit, multi-factor authentication on business systems, and contractual security commitments from our providers. No transmission over the internet is completely secure, and any transmission is at your own risk.

13. Your privacy rights

We honor the rights below for every individual, wherever you live, as a matter of policy. Where your local law gives you a broader right or a shorter response deadline, your local law applies and we follow it.

Rights we honor for everyone

• Access. Confirm whether we process your personal data and obtain a copy of it.
• Correction. Have inaccurate or incomplete personal data corrected.
• Deletion. Ask us to delete your personal data, subject to the exceptions in this Section.
• Portability. Receive personal data you gave us in a structured, commonly used, machine-readable format, and have it sent to another organization where technically feasible.
• Restriction. Ask us to limit how we process your personal data in certain circumstances.
• Objection. Object to processing based on our legitimate interests. You may object to direct marketing at any time and we will stop.
• Withdraw consent. Withdraw consent at any time where we rely on it. This does not affect processing carried out before you withdrew.
• Automated decisions. Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions.
• Non-discrimination. Exercise any of these rights without penalty or reduced service.
• Complain. Raise a concern with us, and with the data protection authority in your country.

We may decline a deletion request where we or a service provider need to keep the information to complete a transaction, provide a service you requested, detect or prevent security incidents and fraud, debug errors, exercise or defend legal claims, comply with a legal obligation, or make internal and lawful use compatible with the context in which you provided it. Where we decline, we tell you why.

United Kingdom, European Economic Area and Switzerland

The rights above are the rights given to you by the UK GDPR, the EU GDPR and the Swiss Federal Act on Data Protection. Section 5 sets out the legal basis we rely on for each processing purpose, and Section 9 sets out the safeguards that apply to transfers. You may lodge a complaint with your supervisory authority. In the United Kingdom this is the Information Commissioner's Office at ico.org.uk. In the European Economic Area it is the authority in your country of residence, place of work, or the place of the alleged infringement. In Switzerland it is the Federal Data Protection and Information Commissioner.

United States

California. Under the California Consumer Privacy Act as amended, you may request the categories and specific pieces of personal information we collected, the categories of sources, our business or commercial purpose for collecting it, and the categories of third parties to whom we disclosed it. You may also request correction or deletion, and limit the use of sensitive personal information. We do not sell or share personal information as those terms are defined in that law. You may submit a request to know twice in a twelve-month period.

Texas, Virginia, Colorado, Connecticut and other states. Residents of states with comprehensive privacy laws, including the Texas Data Privacy and Security Act, may confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale of personal data and certain profiling. We do not sell personal data or process it for targeted advertising or profiling in furtherance of decisions producing legal or similarly significant effects. If we decline your request you may appeal by replying to our decision, and we will respond within the period the applicable law requires.

Other countries

We do not currently deliver services outside the United States. If you contact us from another country, we honor the rights listed above and we comply with any additional requirement that the law of your country places on us, including any requirement to obtain your consent for a specific processing activity or transfer. You may complain to the data protection authority in your country. If we begin delivering services in your region, we will update this Statement before we do so.

14. How to exercise your rights

To exercise any right, use the contact form on our website. Only you, or someone legally authorized to act on your behalf, may make a request. Your request must:

• provide enough information for us to reasonably verify that you are the person about whom we hold personal data; and
• describe the request in enough detail for us to understand, evaluate and respond to it.

We cannot respond to a request or provide personal data if we cannot verify your identity or authority. We use information provided in a request only to verify the requester. We respond within the deadline set by the law that applies to you, and in every case within 30 days unless that law allows a longer period and we tell you that we need it. There is no charge unless a request is manifestly unfounded or excessive.

An authorized agent may submit a request on your behalf with written proof of authorization, and we may ask you to confirm the agent's authority directly.

15. Sale, sharing and targeted advertising

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We do not process personal data for targeted advertising. We do not knowingly sell or share the personal data of anyone under sixteen years of age.

16. Changes to this statement

We may update this Statement to reflect changes in our practices or the law. The revised version takes effect on the date posted, shown at the top of this page. Where a change is material we will provide additional notice, which may include email or a notice on the Sites.