Comprehensive Privacy Policy & Statutory Data Protection Protocol

1. Scope, Legal Identification of Controller & Core Architecture

1.1. Legal Entity & Controller Designation. The Data Controller responsible for the processing of Personal Data under Regulation (EU) 2016/679 (“GDPR”), the United Kingdom General Data Protection Regulation (“UK GDPR”), the Colorado Privacy Act, C.R.S. § 6-1-1301 et seq. (“CPA”), the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, Cal. Civ. Code § 1798.100 et seq. (“CCPA/CPRA”), and Virginia Consumer Data Protection Act, Va. Code Ann. § 59.1-575 et seq. (“VCDPA”), is August Casso, an independent cybersecurity researcher, systems architect, and technologist operating out of the City and County of Denver, State of Colorado, United States of America.

1.2. Scope of Applicability. This Policy governs all interactions across the primary domain aug.quest, any associated subdomains (including without limitation knowledge bases, technical wikis, client administration portals, and requisition systems), web applications, direct communications, and technical service engagements. It does not apply to third-party external websites linked from this resource; visitors are urged to review external third-party disclosures independently.

1.3. Privacy-by-Design and Radical Data Minimization. In direct adherence to Article 25 of the GDPR and C.R.S. § 6-1-1308, all information systems, software modules, and database schemas deployed by the Controller are engineered from initial inception under the doctrines of Privacy by Design and Privacy by Default. The collection of telemetry, user metrics, and identifying records is strictly restricted to the narrowest technical envelope essential for delivering requested software modules, authenticating authorized institutional access, and fulfilling contractual engagements.

2. Statutory Definitions & Interpretive Rules

For the purposes of this Policy, the following statutory terms shall have the respective meanings assigned below, construed harmoniously with applicable regulatory codes:

• “Personal Data” / “Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular natural person, consumer, household, or identified individual (consistent with GDPR Art. 4(1), CCPA/CPRA Cal. Civ. Code § 1798.140(v), and CPA C.R.S. § 6-1-1303(17)). It excludes publicly available information, lawfully obtained government records, and aggregated or de-identified data.
• “Data Subject” / “Consumer” means an identified or identifiable natural person who resides in any global jurisdiction, including the European Economic Area (EEA), United Kingdom (UK), Switzerland, or any State or Territory of the United States of America.
• “Processing” means any operation or set of operations performed on Personal Data or sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction (GDPR Art. 4(2)).
• “Data Processor” / “Service Provider” means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller pursuant to a binding contractual Data Processing Agreement (GDPR Art. 4(8); Cal. Civ. Code § 1798.140(ag)).
• “Sell”, “Selling”, or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer’s Personal Data to a third party for monetary or other valuable consideration (Cal. Civ. Code § 1798.140(ad); C.R.S. § 6-1-1303(23)).
• “Share” or “Sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a Consumer’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration (Cal. Civ. Code § 1798.140(ah)).
• “Cross-Context Behavioral Advertising” / “Targeted Advertising” means the targeting of advertising to a consumer based on the consumer’s personal data obtained from the consumer’s activity across businesses, distinctly branded websites, applications, or services (Cal. Civ. Code § 1798.140(k); C.R.S. § 6-1-1303(25)).
• “Biometric Data” & “Sensitive Data” means data generated by automatic measurements of an individual’s biological characteristics, genetic data, precise geolocation, financial credentials, health details, racial or ethnic origin, or religious beliefs (C.R.S. § 6-1-1303(24); GDPR Art. 9).

3. Inventory of Data Processed, Specific Purposes & Lawful Bases

3.1. Taxonomic Inventory. The Controller processes only the categories of Personal Data enumerated in the statutory taxonomy below. No hidden profiling, speculative harvesting, or unlisted data collection takes place.

3.2. Absolute Exclusion of Sensitive Data. The Controller does not seek, request, require, collect, or process any Sensitive Personal Data or Special Category Data as defined under GDPR Article 9, CCPA/CPRA Cal. Civ. Code § 1798.140(ae), or CPA C.R.S. § 6-1-1303(24), including racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, sex life or sexual orientation, or precise geographic tracking data.

4. Affirmative Non-Sale & Anti-Surveillance Covenants

4.1. Absolute Prohibition on Data Brokering and Sales. In compliance with California Civil Code § 1798.140(ad), Colorado Revised Statutes § 6-1-1303(23), and emerging consumer privacy statutes across all 50 U.S. states:

• We have never sold, rented, leased, licensed, or traded Personal Data to any third party, commercial broker, marketing syndicate, or telemetry aggregator for monetary or other valuable consideration.
• We will never sell, rent, lease, license, or trade Personal Data in the future under any commercial pretext or restructuring.
• We do not “share” Personal Data for cross-context behavioral advertising, personalized digital display marketing, or remarketing campaigns.

4.2. Total Absence of Commercial Tracking Pixels & Ad Beacons. The digital infrastructure supporting aug.quest contains:

• Zero Meta / Facebook Tracking Pixels or Graph API client telemetry beacons.
• Zero TikTok Pixels or ByteDance tracking libraries.
• Zero Google Analytics (GA4) / Google Tag Manager (GTM) behavioral tracking scripts or doubleclick advertising identifiers.
• Zero Cross-Site Fingerprinting Scripts (including canvas extraction, WebGL parameter scraping, or audio-context hardware fingerprinting).
• Zero Embedded Social Media Tracking Iframes that harvest non-consensual third-party session telemetry.

4.3. Prohibition of Automated Profiling. The Controller conducts zero automated decision-making, behavioral profiling, credit scoring, algorithmic discrimination, or automated predictive modeling within the meaning of GDPR Article 22 or Colorado Privacy Act C.R.S. § 6-1-1306(1)(a)(I).

5. Payment Infrastructure & PCI-DSS Level 1 Compliance

5.1. Direct Cryptographic Settlement Architecture. When clients or consumers purchase technical services, software modules, or research documentation through aug.quest, financial settlements are processed through direct API integration with Tier-1 certified Payment Service Providers (including Stripe, Inc. and domestic ACH direct banking rails).

5.2. Non-Transmission of Primary Account Numbers (PANs). Under no circumstances do raw credit card numbers, debit card numbers, expiration dates, or card verification values (CVV/CVC) touch, transit, or reside upon the servers or storage systems of aug.quest.

• All payment input fields operate via end-to-end TLS 1.3 encrypted iframes or hosted checkouts directly sandboxed within the Payment Card Industry Data Security Standard (PCI-DSS) Level 1 compliant infrastructure of the payment processor.
• The Controller receives exclusively tokenized transaction identifiers, payment authorization confirmations, invoice numbers, and card brand metadata (e.g., “Visa ending in 4012”) strictly necessary to reconcile accounts receivable and issue lawful tax receipts.

5.3. Third-Party Settlement Policies. Financial processing is subject to the independent privacy disclosures of the payment gateway, accessible directly via Stripe Privacy Center.

6. Cookies, Local Storage Objects & Telemetry Disclosures

6.1. Categorical Restriction to Strictly Necessary Operations. Pursuant to Directive 2002/58/EC as amended by Directive 2009/136/EC (“ePrivacy Directive”) and GDPR Article 5(3), cookies and HTML5 Local Storage objects deployed across aug.quest are restricted exclusively to Technical and Strictly Necessary operational functions:

6.2. Affirmative Recognition of Global Privacy Control (GPC) & Do-Not-Track (DNT). The systems of aug.quest are architected to inherently respect the Global Privacy Control (GPC) signal (conforming to Cal. Code Regs. tit. 11, § 7025 and C.R.S. § 6-1-1313) as well as legacy Do-Not-Track (DNT) browser headers. Because this site performs zero commercial tracking, sale, or cross-context advertising, our technical operations are natively in complete compliance with opt-out preferences across all clients without requiring manual configuration.

6.3. User Management of Browser Storage. Users retain complete technical control over local storage and cookies through standard client-side browser controls. Instructions for disabling or purging storage keys are available for Mozilla Firefox, Google Chrome, and Apple Safari.

7. Sub-Processors, Infrastructure & Vendor Governance

7.1. Vendor Governance & Data Processing Agreements (DPAs). The Controller maintains rigorous vendor screening standards. Personal Data is shared exclusively with designated, vetted Sub-Processors under formal Data Processing Agreements containing contractual guarantees required under GDPR Article 28 and U.S. state privacy mandates.

7.2. Independent Covenant. The Controller covenants that no Sub-Processor is authorized or permitted to retain, use, or disclose Personal Data for any commercial purpose other than the specific business purpose specified in our contractual agreements.

8. Law Enforcement, Constitutional Subpoena Protocol & Warrant Canary

8.1. Constitutional and Statutory Standards. The Controller operates within the jurisdiction of the State of Colorado and the United States of America. Any official request for data from civil litigants, law enforcement agencies, or regulatory authorities must meet the following mandatory thresholds:

• Judicial Process Requirement: We require a valid, domesticated subpoena, court order, or search warrant issued upon a showing of probable cause by a court of competent jurisdiction located in the State of Colorado or the United States District Court for the District of Colorado.
• Constitutional Scrutiny: Every legal demand is reviewed by competent legal counsel under the Fourth Amendment, First Amendment, and statutory protections of the Electronic Communications Privacy Act (18 U.S.C. §§ 2701–2712). Overbroad, defective, or procedurally improper demands are vigorously challenged or quashed.
• Notice to Data Subjects: Unless prohibited by a lawful, non-defective statutory non-disclosure order issued under 18 U.S.C. § 2705(b), the Controller will provide immediate written notice to affected individuals prior to disclosing any records.

9. Retention Schedules & Destruction Protocols

9.1. Storage Limitation Principle. Personal Data is retained strictly for the duration necessary to satisfy the underlying operational purposes for which it was collected, as mandated by GDPR Article 5(1)(e) and Colorado Revised Statutes § 6-1-1308(3).

9.2. Permanent Deletion Protocol. Deletion requests executed under GDPR Article 17, CCPA/CPRA Cal. Civ. Code § 1798.105, or CPA C.R.S. § 6-1-1306(1)(d) trigger an immediate, comprehensive database cascade purge removing all associated identifier records without intermediate quarantines or synthetic delay periods.

10. Technical and Organizational Security Measures (TOMs)

10.1. Security Architecture (GDPR Art. 32 / CPA § 6-1-1308). The Controller has instituted comprehensive Technical and Organizational Measures designed to guarantee a level of cybersecurity appropriate to the risk of processing:

• Transport Layer Encryption: All HTTP connections across aug.quest are strictly enforced over Transport Layer Security (TLS 1.3 preferred; TLS 1.2 minimum) utilizing strong elliptical curve cipher suites (ECDHE-ECDSA-AES256-GCM-SHA384). HTTP Strict Transport Security (HSTS) headers are broadcast with subdomains and preload flags enabled.
• Cryptographic Password Salting & Hashing: User account credentials are protected using high-iteration memory-hard hashing algorithms (Argon2id / bcrypt) with cryptographically random per-user salts. Plain-text passwords are never visible, logged, or transmittable by the Controller.
• Storage Encryption: Local operational backups and offline data archives are encapsulated in AES-256 encrypted containers utilizing strong multi-factor master passphrases.
• System Hardening & Principle of Least Privilege: Web servers utilize minimal attack surfaces, isolated process namespaces, disablement of root logins, non-standard SSH authentication ports protected by Ed25519 public key pairs, and automated rate-limiting firewalls.
• Incident Response & Breach Notification: In the extraordinary event of a confirmed security incident compromising the confidentiality or integrity of Personal Data, the Controller shall notify affected supervisory authorities and impacted data subjects within seventy-two (72) hours of becoming aware of the breach, in accordance with GDPR Articles 33 and 34 and Colorado Revised Statutes § 6-1-716.

11. International Data Transfers & Cross-Border Flows

11.1. Processing Within the United States. Personal Data processed by the Controller is stored and maintained within secure server infrastructure located physically inside the continental United States.

11.2. Safeguards for Cross-Border Transfers. If you access the Services from the European Economic Area (EEA), United Kingdom (UK), Switzerland, or other jurisdictions with comprehensive data protection regimes:

• You acknowledge that your Personal Data will be transferred to, stored, and processed in the United States.
• To the extent such transfers require statutory transfer mechanisms under GDPR Chapter V, the Controller relies on the European Commission’s Standard Contractual Clauses (SCCs) as established under Commission Implementing Decision (EU) 2021/914, supplemented by technical encryption-in-transit (TLS 1.3) and strict data minimization safeguards.

12. European Data Subject Rights (GDPR / UK GDPR)

12.1. Statutory Enumeration of Rights. Visitors residing within the European Union, European Economic Area, and United Kingdom enjoy extensive statutory rights under Articles 12 through 23 of the GDPR and UK GDPR:

• 12.1.1. Right of Access (Art. 15): You have the right to obtain confirmation as to whether Personal Data concerning you is being processed, and to receive a structured copy of that data along with statutory processing details.
• 12.1.2. Right to Rectification (Art. 16): You have the right to obtain without undue delay the correction of inaccurate Personal Data and the completion of incomplete records.
• 12.1.3. Right to Erasure / “Right to be Forgotten” (Art. 17): You have the absolute right to demand the permanent destruction of your Personal Data where it is no longer necessary for the purposes collected, where consent has been withdrawn, or where processing is unlawful.
• 12.1.4. Right to Restriction of Processing (Art. 18): You have the right to restrict our processing of your data while its accuracy is contested or where processing is unlawful but erasure is opposed.
• 12.1.5. Right to Data Portability (Art. 20): You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format (e.g., JSON or CSV) and to transmit that data to another controller without hindrance.
• 12.1.6. Right to Object (Art. 21): You have the absolute right to object at any time to the processing of your Personal Data based on legitimate interests (Art. 6(1)(f)).
• 12.1.7. Right to Withdraw Consent (Art. 7(3)): Where processing is founded upon consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.
• 12.1.8. Right to Lodge a Complaint (Art. 77): You have the right to lodge a formal complaint with an official Data Protection Supervisory Authority, particularly in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

13. United States State Consumer Rights (CPA, CCPA/CPRA, et al.)

13.1. Colorado Privacy Act (CPA) Disclosures (C.R.S. § 6-1-1301 et seq.). As an entity operating within Denver, Colorado, the Controller affords consumers the comprehensive statutory rights established under C.R.S. § 6-1-1306:

• Right of Access & Portability (C.R.S. § 6-1-1306(1)(b), (e)): The right to confirm whether the Controller processes your personal data and to access such data in a portable, readily usable format.
• Right to Correction (C.R.S. § 6-1-1306(1)(c)): The right to correct inaccuracies in your personal data.
• Right to Deletion (C.R.S. § 6-1-1306(1)(d)): The right to delete personal data concerning you.
• Right to Opt-Out of Processing (C.R.S. § 6-1-1306(1)(a)): The right to opt out of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. As noted in Article 4, the Controller engages in none of these activities.
• Statutory Appeal Mechanism (C.R.S. § 6-1-1306(3)): If the Controller denies your request within the statutory forty-five (45) day timeframe, you may file an appeal by emailing casso@aug.quest with the subject line "LEGAL APPEAL: DATA REQUEST". We will respond within forty-five (45) days. If your appeal is denied, you have the statutory right to contact the Colorado Attorney General directly via coag.gov.

13.2. California Consumer Privacy Act & CPRA Disclosures. Pursuant to Cal. Civ. Code § 1798.130:

• Right to Know & Access: You may request the categories and specific pieces of Personal Information collected over the preceding 12 months.
• Right to Delete: You may request the deletion of Personal Information collected directly from you.
• Right to Correct: You may request the correction of inaccurate Personal Information.
• Right to Non-Discrimination (Cal. Civ. Code § 1798.125): We will never discriminate against any consumer for exercising their CCPA/CPRA rights by denying goods, charging differential rates, or diminishing service quality.
• California “Shine the Light” Law (Cal. Civ. Code § 1798.83): California residents may request once per calendar year a list of third parties to whom personal information was disclosed for direct marketing purposes. The Controller makes zero disclosures for third-party direct marketing.

13.3. Other U.S. State Frameworks. Residents of Virginia (VCDPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), and other states possessing consumer data privacy enactments enjoy reciprocal rights of access, correction, deletion, and portability as outlined herein.

14. Protection of Minors (COPPA Compliance)

14.1. Strict Age Prohibitions. The Services provided across aug.quest are directed strictly to cybersecurity professionals, enterprise systems administrators, researchers, and adults aged eighteen (18) years or older.

14.2. COPPA Non-Collection. In strict compliance with the Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506 (“COPPA”) and the California Age-Appropriate Design Code Act, we do not knowingly solicit, collect, process, or maintain Personal Data from children under the age of thirteen (13), or minors under sixteen (16).

14.3. Immediate Purge Mandate. If the Controller learns that Personal Data of an individual under 16 has been transmitted or stored without verifiable parental consent, such data will be immediately and permanently purged from all active and backup databases. Parents or guardians may direct inquiries to casso@aug.quest.

15. Dispute Resolution, Binding Arbitration & Governing Law

15.1. Governing Law & Jurisdiction. This Policy, any dispute arising out of or related to our privacy practices, and all claims sounding in tort or contract shall be governed by, construed, and enforced in accordance with the substantive laws of the State of Colorado and applicable federal laws of the United States of America, without regard to conflict of laws principles.

15.2. Mandatory Informal Dispute Escalation. Prior to initiating any formal legal or arbitral proceeding, the parties agree to engage in good-faith informal negotiations for a period of not less than thirty (30) calendar days. Notice of dispute shall be transmitted via certified electronic mail to casso@aug.quest detailing the factual basis, statutory provisions implicated, and specific relief demanded.

15.3. Binding Individual Arbitration. Any unresolved controversy, claim, or dispute arising out of or relating to this Policy or our data protection practices shall be resolved exclusively through final and binding individual arbitration administered by Judicial Arbitration and Mediation Services (“JAMS”) or the American Arbitration Association (“AAA”) in Denver County, Colorado, before a single neutral arbitrator.

15.4. Class Action and Representative Proceeding Waiver. TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, ALL DISPUTES SHALL BE ADJUDICATED SOLELY ON AN INDIVIDUAL BASIS. NEITHER CONSUMER NOR CONTROLLER SHALL BE ENTITLED TO JOIN, CONSOLIDATE, OR PARTICIPATE AS A CLASS REPRESENTATIVE OR CLASS MEMBER IN ANY CLASS ACTION, PRIVATE ATTORNEY GENERAL PROCEEDING, OR REPRESENTATIVE LITIGATION.

15.5. Severability & Survival. If any provision, clause, or paragraph of this Protocol is adjudicated to be invalid, illegal, or unenforceable under applicable law by a court of competent jurisdiction, such invalidity shall not affect the validity or enforceability of the remaining portions, which shall remain in full force and effect.

16. Verifiable Consumer Request Procedures & Formal Contact

16.1. Procedures for Submitting Verifiable Inquiries. To exercise any statutory data subject right enumerated in Articles 12, 13, or 14 (including access, correction, data export, or permanent deletion), you or your legally authorized agent must submit a Verifiable Consumer Request via electronic mail:

16.2. Identity Verification Standards. In accordance with California Code of Regulations tit. 11, § 7062 and Colorado Privacy Act Rules 4 CCR 904-3 Rule 4.05, we must verify that the individual requesting data access or deletion is indeed the person whose data is in question. To verify your identity, we may request:

• Verification email confirmation from the exact business email address linked to the active invoice, portal account, or ticket record.
• Transaction reference or invoice identification tokens associated with prior purchases.
• Cryptographic signature verification utilizing the client’s registered public SSH/PGP key where applicable.

16.3. Statutory Response Timelines. The Controller will confirm receipt of your request within ten (10) business days and provide a substantive determination within forty-five (45) calendar days (for CPA, CCPA/CPRA, and other U.S. state requests) or within thirty (30) calendar days (for EU/UK GDPR requests). Where complex technical scoping requires an extension, we will notify you in writing within the initial window outlining the reasons for the extension (up to an additional 45 days).