Who this policy covers
LibScor Associates, Inc., Compliance.Network LLC and Compliance.Network LATAM LLC, collectively Compliance.Network, explain in this policy how personal information is handled through our website, business communications, professional relationships and services. Personal information means information identifying a person directly or indirectly.
The group company that determines why and how information is used is the responsible controller or equivalent under applicable law. For an engagement, the relevant company is identified in the agreement. For other interactions, contact support@compliance.network to identify the responsible company and direct a request. Group coverage does not make every company a party to every engagement.
Our services are directed to businesses and professionals, not children. We serve businesses internationally where United States law and applicable local law permit. This policy applies to those activities worldwide; particular rights and requirements depend on the applicable law and processing activity. Mandatory local protections take precedence over inconsistent terms in this policy.
Our role when working for clients
For website inquiries, business administration and professional applications, we determine the purposes of our own processing. When we handle personal information solely on a client’s instructions to deliver services, we act as its processor or service provider, as applicable. The engagement and applicable data-processing terms govern that work. This policy does not authorize additional use of information entrusted to us by a client.
People whose information is handled on a client’s behalf may contact that client or support@compliance.network. We will route requests and assist as appropriate. Independent Network professionals may have their own agreements and privacy obligations; participation alone does not make them employees or place all their services under our control.
Contact us
Send privacy questions, requests and complaints to support@compliance.network, with “Privacy request” in the subject. You may also write to Compliance.Network, 401 E. Las Olas Blvd., Suite 130 PMB 785, Fort Lauderdale, FL 33301. Please describe your relationship with us and the request without including unnecessary sensitive information.
Information and Business Purposes
Information and sources
We receive business contact details, organization and role information, service interests and correspondence directly from you through inquiries, applications and engagements. We also receive relevant information from clients, professional contacts and representatives acting for an organization. Engagement information can include instructions, supplied documents and work product. Business administration can involve agreements, billing details, transaction records and communications.
Professional applications may include qualifications, employment and professional history, references and identity or entity-verification material. Relevant public sources include licensing and corporate registries, disciplinary records, sanctions sources and publicly available professional information. Collection and use of sensitive information or background-check material must be necessary for the activity and permitted under applicable law. Please do not send account numbers, identity documents or other sensitive records through a general website inquiry.
Providing information for optional communications is voluntary. If information is necessary to respond to a request, assess an application or deliver an engagement, not providing it may prevent that activity. We will explain mandatory requirements in the relevant collection process.
Purposes and lawful grounds
We use relevant information to respond to inquiries, arrange and deliver professional services, administer relationships and payments, assess Network applications, communicate about our services, protect operations, resolve disputes and meet applicable obligations.
Where EU or UK data-protection law applies, we rely on contract necessity when processing is needed for a contract with you personally or steps you request before that contract. For contacts representing an organization, our legitimate interests may instead support necessary business communications and relationship administration. Those interests include responding to requests, delivering services, managing professional relationships, preventing misuse and protecting legal rights, balanced against individual rights.
We rely on legal obligation where the applicable legal requirements support that basis, and consent where required for an optional activity. Consent can be withdrawn prospectively. We do not treat this policy or a website visit as blanket consent. In jurisdictions using different legal grounds, processing must meet that jurisdiction’s consent requirements or applicable exceptions; EU legitimate interests are not a universal substitute for consent.
Marketing and website technologies
You may decline optional marketing or ask us to stop it by contacting support@compliance.network. This does not prevent necessary engagement or administrative communications. A minimal record of an opt-out may be kept to respect the choice.
Our website does not use analytics, advertising pixels or other tracking. Hosting services may process technical information to deliver and secure the site. Before introducing technologies requiring consent, we will explain their purposes and obtain consent. External sites have their own privacy practices.
AI Sharing and Protection
Internal AI use
Our personnel use AI-assisted tools for research, summarization, drafting, analysis, knowledge management, project administration and workflow support. Our AI tools are not currently offered for direct client access. AI assistance does not replace professional judgment or accountability.
We keep model-training settings turned off. We do not upload a client’s customers’ data into AI tools unless that use forms part of the agreed engagement. ElevenLabs voiceovers do not include personal information. Disabling training does not mean that providers perform no service-related processing or retain no information; handling depends on the product, settings and terms.
An authorized engagement does not remove applicable privacy, confidentiality or transfer requirements. Before introducing solely automated decisions with legal or similarly significant effects, the applicable notice, lawful basis and safeguards must be addressed. Our current description of AI-assisted work does not authorize such decisions. Further information appears at https://www.compliance.network/ai-transparency.html.
Recipients and disclosures
Information may be shared with group personnel and contracted professionals for their assigned work, and with providers supporting communications, hosting, file storage, business administration and authorized AI functions. Relevant information may also be provided to professional advisers and to authorities or other parties where legally required or necessary and lawful to establish, exercise or defend legal rights.
Access and sharing must be limited to the relevant purpose. Providers handling information on our behalf must be subject to appropriate confidentiality, security and processing obligations. A provider acting for its own purposes has its own legal responsibilities and must be identified in the relevant service or collection notice where required. Group membership does not itself authorize unrestricted access or cross-border disclosure.
Client-controlled information is shared according to the engagement, authorized instructions and applicable law. This policy does not grant permission to sell client information or use it for unrelated advertising or shared model training.
Protection of information
Compliance.Network manages IT and information security in-house. Our policy is to apply administrative, technical and organizational safeguards proportionate to the information, processing and risks. Access must be limited to authorized purposes, sensitive information must use appropriate handling channels, and providers must be assessed for their role in the processing. The AI restrictions and deletion requirements described here also apply to relevant working materials.
No system or transmission method guarantees absolute security. Where an incident triggers legal or contractual notification duties, notification must follow those duties.
International Handling and Retention
International processing
We use Microsoft and other service providers to store, transmit and protect business information. We configure regional infrastructure under our control for US East hosting. Storage and processing locations for each cloud service depend on that service’s settings and contractual commitments. Authorized personnel in the United States and Argentina may access information as needed to carry out their work.
For covered Microsoft services, Microsoft’s Products and Services Data Protection Addendum governs its handling of personal information and includes standard contractual protections for applicable international transfers. Other providers’ protections depend on their applicable service terms. Where additional safeguards are required for our own handling of information or a client engagement, we will establish them before the relevant transfer.
Information handled internationally may be subject to privacy laws that differ from those in your country. You may contact support@compliance.network for information about the locations and safeguards relevant to your information, or to request a copy of applicable transfer safeguards.
Retention of personal information
We retain personal information for as long as reasonably necessary to provide our services, administer our business relationships, and meet applicable legal, contractual and recordkeeping requirements. Retention periods depend on the information, its purpose and any applicable legal hold. When information is no longer required, we delete or irreversibly anonymize it in accordance with our retention procedures and applicable obligations.
Client information and working materials
For information processed on a client’s behalf, retention, return and deletion follow the applicable engagement terms, lawful client instructions and legal requirements. Our retention procedures cover working files, AI content, client-specific template content, provider copies and backups. Backup copies follow the applicable backup retention schedule and remain protected until removed. Where retained backups are restored, applicable deletion instructions must be reapplied.
Records subject to a legal hold or required retention obligation are retained for the relevant purpose and period, with access restricted accordingly. Generic Studio formatting and reusable material may be retained; client-specific procedures, personal information and confidential content remain subject to the applicable engagement and retention requirements.
Business records and preferences
For our own business records, retention takes account of the status of an inquiry, application or relationship; the continuing need for communications; applicable accounting and tax requirements; and relevant claims or disputes. We retain only the information necessary for those purposes. A minimal suppression record may be retained to respect a marketing opt-out. Retention is reviewed periodically and is not indefinite by default.
Individual Rights and Regional Protections
Requests and choices
Depending on the applicable law and circumstances, you may request confirmation of processing, access, correction, deletion, restriction or portability; object to processing; withdraw consent; or challenge qualifying automated decisions. Rights have conditions and exceptions. Withdrawal does not invalidate earlier lawful processing. You may object to direct marketing at any time.
Use support@compliance.network to make a request. We may request proportionate verification of identity or representative authority. We will respond within applicable deadlines, explain any permitted refusal or extension, and provide information about available review or complaint routes. Requests are ordinarily free; any fee or refusal must be legally permitted. We will not unlawfully discriminate or retaliate for exercising privacy rights.
European Economic Area and United Kingdom
Where the GDPR or UK GDPR applies, rights include access, rectification, erasure, restriction, objection and portability subject to their conditions. You may object to processing based on legitimate interests and complain to the competent supervisory authority; UK complaints may be made to the Information Commissioner’s Office at ico.org.uk. Responses generally follow a one-month deadline, with a permitted extension where applicable and timely notice.
Argentina
Where Law 25.326 applies, you may request access, correction, updating or deletion. Access is available without charge at intervals of at least six months, or more frequently upon a legitimate interest. Access requests are answered within ten calendar days; correction, updating and deletion requests within five business days, subject to applicable exceptions. The Agencia de Acceso a la Información Pública supervises the law and receives complaints concerning noncompliance: argentina.gob.ar/aaip.
Brazil
Where the LGPD applies, rights include confirmation, access, correction, portability subject to regulation, information about sharing and consent, and anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed information. Consent may be revoked, with deletion subject to lawful retention exceptions. You may request review of decisions based solely on automated processing that affect your interests and complain to the ANPD at gov.br/anpd. Applicable LGPD response requirements govern requests.
Additional Regional Protections
Uruguay
Where Law 18.331 applies, you may request access, rectification, updating, inclusion or deletion of personal information. Access is ordinarily free every six months, with applicable exceptions for a legitimate interest. Applicable access and correction requests follow a five-business-day deadline. You may complain to the Unidad Reguladora y de Control de Datos Personales at gub.uy/unidad-reguladora-control-datos-personales. International disclosures must satisfy Uruguay’s applicable transfer requirements.
Australia
Where the Privacy Act 1988 and Australian Privacy Principles apply, you may request access to and correction of personal information by contacting support@compliance.network. To complain, describe the concern and the outcome sought. We will acknowledge the complaint, investigate the relevant handling and provide a written response, ordinarily within 30 days. If unresolved, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.
Overseas handling can include the United States and Argentina as described above. Before disclosure to an overseas recipient, the applicable Australian requirements must be addressed, including reasonable steps to ensure appropriate handling where required by APP 8. Access, correction, complaint and other rights are subject to applicable legal exceptions.
Canada and the United States
Where Canadian privacy law applies, you may request access and correction, challenge compliance and withdraw consent subject to lawful limitations. Complaints may be made to the applicable federal or provincial privacy authority; the federal office is at priv.gc.ca.
Where applicable US state privacy law grants rights, these may include access, correction, deletion, portability and opt-outs concerning sale, certain advertising disclosures or qualifying profiling, as well as authorized-agent requests, appeals and limits on certain sensitive-information uses. Rights and applicability vary by state. Any required state-specific disclosures and opt-out mechanisms supplement this policy; this general notice does not replace them.
Other jurisdictions and updates
Rights under other applicable national or local laws remain available. Contact us to direct a request to the responsible company. We will update this policy when practices change and provide additional notice or obtain consent where required. A revision does not itself authorize a new use of previously collected information.