Privacy Policy

Symmetry IT Consultants, INC (“Symmetry IT,” “Symmetry,” “we,” “us,” or “our”) respects the privacy and security of the information entrusted to us.

This Privacy Policy explains how we collect, use, disclose, protect, and retain personal information in connection with our website, managed IT services, cybersecurity services, consulting services, help desk and technical support, professional services, artificial intelligence and automation solutions, and other services we provide.

This Policy applies to information collected through symmetrytech.com, communications with Symmetry IT, and information we collect for our own business purposes.

When Symmetry IT processes information contained within a client’s systems or environment while providing services to that client, Symmetry IT generally acts as a service provider, processor, or business associate on behalf of the client. In those circumstances, the client determines how the information is collected and used, and our processing is governed by our agreement with that client, applicable data processing agreements, Business Associate Agreements, and applicable law.

1. Information We Collect

The information we collect depends on how you interact with Symmetry IT and the services we provide.

Information You Provide to Us

We may collect information you voluntarily provide, including:

• Name
• Business name
• Job title
• Business address
• Email address
• Telephone or mobile number
• Information submitted through website forms
• Support requests and help desk tickets
• Communications sent by email, telephone, SMS, Microsoft Teams, web chat, or other communication platforms
• Account and billing information
• Information contained in requests for proposals, contracts, service agreements, or other business documents
• Feedback and survey responses
• Information provided when registering for events, requesting information, or scheduling consultations

Information Collected Through Our Website

When you visit our website, we or our service providers may collect certain technical information, depending on your privacy and cookie preferences, including:

• Internet Protocol address
• Browser type and version
• Device type and operating system
• Referring website
• Pages viewed
• Date and time of access
• Approximate geographic location derived from an IP address
• Website interaction and performance information
• Cookie and similar technology identifiers

Where required, analytics or other non-essential tracking technologies are activated only after appropriate consent.

Information Collected in Providing Managed IT and Technology Services

Because Symmetry IT provides managed technology and cybersecurity services, our personnel and systems may process information associated with our clients' technology environments.

This information may include:

• Usernames and business account identifiers
• Employee names and contact information
• Device names and identifiers
• IP addresses and MAC addresses
• Network configuration information
• Hardware and software inventories
• Operating system information
• Application information
• Authentication and access information
• System and application logs
• Firewall, network, endpoint, email, and cybersecurity telemetry
• Security alerts and incident information
• Backup and recovery information
• Configuration files
• Technical documentation
• Help desk tickets
• Remote support session information
• Email metadata
• Files or information provided during troubleshooting
• Audit logs
• Vulnerability information
• System performance information
• Cloud service information
• Identity and access management information

Depending on the services being performed, our personnel may temporarily view files, communications, application data, or other information within a client's environment when reasonably necessary to troubleshoot, secure, maintain, recover, migrate, or support that environment.

We do not use Client Data for unrelated purposes.

2. Client Data

“Client Data” means information that Symmetry IT receives, accesses, stores, transmits, or otherwise processes on behalf of a client while providing services.

Examples may include information stored in:

• Client servers
• Workstations and mobile devices
• Microsoft 365 or other cloud environments
• Email systems
• Backup systems
• Security platforms
• Property management systems
• Healthcare applications
• Business applications
• Networks and firewalls
• File storage systems
• Client databases
• Other systems managed or supported by Symmetry IT

For Client Data, the client generally acts as the data controller or business, and Symmetry IT acts as a processor or service provider.

We process Client Data only as reasonably necessary to:

• Provide contracted services
• Maintain and support client systems
• Monitor technology environments
• Detect and respond to cybersecurity threats
• Troubleshoot technical issues
• Manage backups and disaster recovery
• Administer systems and accounts
• Perform migrations and implementations
• Provide consulting and professional services
• Meet contractual requirements
• Protect the client, Symmetry IT, and others from security threats
• Comply with applicable law

Client Data remains subject to the client's instructions and applicable contractual agreements.

Individuals seeking access to, correction of, or deletion of information contained within a client's environment should ordinarily direct the request to the applicable client. When required, Symmetry IT will reasonably assist clients in responding to such requests.

3. Healthcare Information and HIPAA

Symmetry IT provides technology services to healthcare organizations.

When Symmetry IT provides services involving Protected Health Information (“PHI”) and qualifies as a Business Associate under the Health Insurance Portability and Accountability Act (“HIPAA”), our handling of PHI is governed by HIPAA, applicable regulations, and the Business Associate Agreement (“BAA”) between Symmetry IT and the applicable Covered Entity or Business Associate.

We may create, receive, maintain, or transmit PHI only as permitted by the applicable BAA and applicable law.

Where there is a conflict between this Privacy Policy and an applicable BAA regarding PHI, the terms of the BAA and applicable law control.

Healthcare patients seeking to exercise rights concerning medical information maintained by a Symmetry IT healthcare client should contact that healthcare provider or organization directly.

4. How We Use Personal Information

We may use personal information for legitimate business purposes including:

• Providing managed IT and cybersecurity services
• Providing consulting and professional services
• Providing technical support
• Responding to inquiries
• Managing client relationships
• Creating and administering accounts
• Authenticating users
• Troubleshooting technology problems
• Monitoring systems and networks
• Detecting cybersecurity threats
• Preventing fraud, misuse, or unauthorized access
• Conducting vulnerability and security assessments
• Providing backup and disaster recovery services
• Maintaining business records
• Processing payments and invoices
• Managing contracts
• Communicating about services
• Scheduling appointments and projects
• Improving our services
• Developing new services and technology solutions
• Measuring website performance
• Conducting analytics where permitted
• Training and supporting our workforce
• Maintaining quality and service standards
• Complying with legal and regulatory requirements
• Establishing, exercising, or defending legal claims
• Protecting the rights, property, and security of Symmetry IT, our clients, and others

We seek to limit the collection and use of personal information to information reasonably necessary for the purposes for which it is collected.

5. Artificial Intelligence and Automation Services

Symmetry IT may provide artificial intelligence, workflow automation, application development, integrations, and related consulting services.

Where AI or automation technologies process Client Data, the processing will be governed by the applicable client agreement and any applicable data processing terms.

We do not use Client Data to train public artificial intelligence models unless the client has expressly authorized such use.

When third-party AI services are used in delivering a client solution, we seek to configure and use those services in accordance with the applicable client agreement, security requirements, and available privacy controls.

Clients are responsible for determining whether their proposed use of an AI or automated system is appropriate for their business, regulatory obligations, and intended use.

6. How We Disclose Information

We do not sell personal information for monetary compensation.

We may disclose information to third parties when reasonably necessary to operate our business or provide services.

These parties may include:

• Cloud hosting providers
• Data center providers
• Managed technology platforms
• Remote monitoring and management providers
• Cybersecurity vendors
• Endpoint security providers
• Security operations centers
• Backup and disaster recovery providers
• Email security providers
• Telecommunications providers
• Internet service providers
• Software vendors
• Microsoft and other cloud service providers
• Payment processors
• Accounting and professional advisers
• Insurance providers
• Contractors and subcontractors
• Consultants
• Legal counsel
• Auditors
• Regulatory authorities
• Law enforcement or government agencies when legally required

Service providers that process information on our behalf are expected to use information only as necessary to provide their services and to maintain appropriate safeguards.

Where required, contractual privacy and security obligations are imposed on service providers and subcontractors.

7. No Sale of Personal Information

Symmetry IT does not sell personal information for monetary compensation.

We also do not knowingly sell sensitive personal information.

If our practices change in a manner that creates an opt-out right under applicable privacy law, we will update this Policy and provide the required method for exercising that right.

8. Cybersecurity Monitoring

As part of our managed cybersecurity and IT services, Symmetry IT may use automated systems to collect, correlate, and analyze security and operational information.

This may include:

• Authentication activity
• Login attempts
• Network traffic information
• Endpoint events
• Malware detections
• Application activity
• Email security events
• Firewall events
• DNS activity
• Vulnerability information
• User and entity behavior associated with cybersecurity threats
• Security alerts
• Indicators of compromise

This information is used to protect client systems, investigate suspicious activity, detect security threats, respond to incidents, and maintain system reliability.

Cybersecurity monitoring is performed according to the scope of services agreed upon with the applicable client.

9. Privileged and Administrative Access

Providing managed technology services sometimes requires Symmetry IT personnel to maintain or use administrative or privileged access to client systems.

We seek to limit privileged access to authorized personnel and business purposes and use administrative access only when reasonably necessary to provide services, investigate problems, protect systems, or meet contractual obligations.

Where appropriate, Symmetry IT may use technical controls such as multi-factor authentication, privileged access management, logging, monitoring, role-based access, or other safeguards.

10. Cookies and Similar Technologies

Our website may use cookies, local storage, pixels (including Meta Pixel when configured), analytics technologies, or similar technologies.

These technologies may be used to:

• Maintain website functionality
• Remember user preferences
• Maintain accessibility settings
• Protect the website against abuse
• Understand website performance
• Measure website traffic and usage
• Improve website content

Where required by applicable law or our website configuration, non-essential analytics or advertising technologies, including Meta Pixel when configured, will not be activated until the visitor provides the required consent.

You may be able to change your preferences through the privacy or cookie controls available on our website.

You may also configure your browser to block or delete cookies. Blocking certain technologies may affect website functionality.

11. Communications and SMS

If you provide a telephone or mobile number to Symmetry IT, we may use it to communicate with you regarding:

• Support requests
• Service notifications
• Appointments
• Projects
• Security incidents
• Account matters
• Requested information
• Other communications related to our business relationship

Message and data rates may apply to SMS communications.

You may reply STOP to an automated SMS message to opt out of future automated messages from that messaging program. You may reply HELP for assistance where supported.

We do not sell mobile telephone numbers or SMS consent information to third parties for their own marketing purposes.

We may disclose information to telecommunications providers and messaging platforms as necessary to deliver communications.

12. Marketing Communications

We may use business contact information to communicate with existing or prospective clients about services that may be relevant to their organizations where permitted by law.

You may unsubscribe from marketing emails by using the unsubscribe instructions contained in the communication or by contacting us.

Opting out of marketing communications does not prevent us from sending transactional, security, support, billing, or service-related communications.

13. Data Security

Symmetry IT uses administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, destruction, or misuse.

Depending on the circumstances, safeguards may include:

• Access controls
• Multi-factor authentication
• Endpoint protection
• Security monitoring
• Encryption
• Network security controls
• Backup systems
• Vulnerability management
• Logging and auditing
• Security policies and procedures
• Employee security training
• Vendor security requirements
• Incident response procedures
• Privileged access controls

No information system, network, transmission method, or storage system can be guaranteed to be completely secure. Accordingly, we cannot guarantee the absolute security of information.

14. Data Retention

We retain personal information for as long as reasonably necessary to:

• Provide services
• Maintain client relationships
• Fulfill contractual obligations
• Meet legal or regulatory requirements
• Maintain business and financial records
• Resolve disputes
• Enforce agreements
• Detect and investigate security incidents
• Maintain backups and business continuity
• Establish or defend legal claims

Retention periods vary depending on the type of information, applicable contractual requirements, legal obligations, and operational needs.

Client Data is retained according to the applicable client agreement, service configuration, backup policies, and legal requirements.

Following termination of services, Client Data may remain temporarily within backups, security logs, archives, or other systems until removed through normal retention and deletion processes, unless a different period is required by contract or law.

15. Security Incidents and Data Breaches

Symmetry IT maintains processes intended to identify, investigate, contain, and respond to security incidents.

If a security incident involving personal information requires notification under applicable law or contract, Symmetry IT will provide or assist with the required notifications as applicable to its role.

When Symmetry IT processes information on behalf of a client, incident reporting obligations may also be governed by the client's service agreement, Data Processing Agreement, Business Associate Agreement, or other applicable agreement.

16. Legal Requirements and Protection of Rights

We may preserve, use, or disclose information when we reasonably believe doing so is necessary to:

• Comply with applicable law
• Respond to a subpoena, court order, warrant, or other lawful process
• Respond to lawful requests from government authorities
• Investigate fraud or illegal activity
• Investigate cybersecurity incidents
• Enforce our agreements
• Protect our legal rights
• Protect the safety or security of our clients, employees, systems, or others

Where legally permitted and appropriate, we may seek to limit requests for information that we believe are excessive or inconsistent with applicable law.

17. Business Transfers

If Symmetry IT is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction, information may be disclosed or transferred as part of that transaction.

Any successor organization will remain subject to applicable privacy and contractual obligations concerning transferred personal information.

18. Privacy Rights

Depending on where you reside and applicable law, you may have rights regarding personal information that Symmetry IT controls.

These rights may include the right to:

• Confirm whether we process your personal information
• Request access to personal information
• Request correction of inaccurate personal information
• Request deletion of personal information
• Obtain a portable copy of certain information
• Restrict certain processing
• Object to certain processing
• Withdraw consent where processing is based on consent
• Opt out of certain sales, targeted advertising, or profiling where applicable
• Appeal certain decisions concerning privacy requests
• Receive equal service and treatment when exercising applicable privacy rights

These rights are subject to applicable exceptions and legal requirements.

To exercise a privacy right, contact:

privacy@symmetrytech.com

We may need to verify your identity before fulfilling a request.

Authorized agents may submit requests where permitted by applicable law. We may request documentation showing the agent's authority.

We will respond within the period required by applicable law.

If we deny a request and applicable law provides a right to appeal, you may submit an appeal by emailing privacy@symmetrytech.com and identifying the request as a “Privacy Request Appeal.”

Client-Controlled Information

If your request relates to information Symmetry IT processes on behalf of one of our clients, we may direct your request to that client.

Because the client controls that information, the client is generally responsible for deciding how the request should be handled.

19. California Privacy Rights

California residents may have additional rights under the California Consumer Privacy Act and California Privacy Rights Act where those laws apply.

Depending on applicability and available exemptions, these may include rights to:

• Know what personal information is collected
• Access personal information
• Correct inaccurate personal information
• Delete certain personal information
• Obtain information concerning categories of disclosures
• Opt out of the sale or sharing of personal information
• Limit certain uses of sensitive personal information
• Receive equal service for exercising privacy rights

Symmetry IT does not sell personal information for monetary compensation.

Requests may be submitted to privacy@symmetrytech.com or by calling 1-888-847-0018.

Nothing in this section is intended to provide rights beyond those provided by applicable law.

20. Florida Privacy Rights

Florida residents may have privacy rights under applicable Florida law.

Where applicable, these may include rights concerning access, correction, deletion, portability, and certain forms of data processing.

Requests may be submitted to privacy@symmetrytech.com.

Symmetry IT also maintains security practices designed to protect personal information in accordance with applicable Florida data protection and breach notification requirements.

21. Other U.S. State Privacy Rights

Residents of other U.S. states may have additional privacy rights under applicable state consumer privacy laws.

Where such laws apply to Symmetry IT and to the information involved, we will process requests in accordance with applicable requirements.

You may submit a request to privacy@symmetrytech.com.

22. European Economic Area, United Kingdom, and Switzerland

Where the European Union General Data Protection Regulation, United Kingdom GDPR, Swiss data protection law, or similar privacy requirements apply, individuals may have additional rights concerning their personal data.

Depending on the circumstances, our legal basis for processing may include:

• Performance of a contract
• Legitimate business interests
• Compliance with legal obligations
• Protection of legal rights
• Consent

Applicable rights may include:

• Access
• Correction
• Erasure
• Restriction of processing
• Objection to processing
• Data portability
• Withdrawal of consent
• The right to lodge a complaint with an applicable supervisory authority

Where Symmetry IT processes personal data on behalf of a client, Symmetry IT acts as a processor and the client generally acts as the controller.

Where required for international transfers of personal information, Symmetry IT and its service providers may use legally recognized transfer mechanisms or contractual safeguards.

23. Children's Privacy

Symmetry IT provides business-to-business technology services.

Our website and services are not intended for children under 13, and we do not knowingly collect personal information directly from children under 13 through our website.

If we learn that personal information was collected directly from a child in violation of applicable law, we will take appropriate steps to delete or otherwise address the information.

This provision does not apply to information contained in Client Data that Symmetry IT processes on behalf of a client. The applicable client is responsible for determining the lawful basis for collecting such information.

24. Third-Party Websites and Services

Our website and services may contain links to or integrations with websites, applications, platforms, and services operated by third parties.

Symmetry IT is not responsible for the independent privacy practices of third parties acting outside their role as our service providers.

We encourage users to review the privacy policies of third-party services before providing information to them.

25. Data Processing Agreements

Clients subject to specific privacy or regulatory requirements may enter into a Data Processing Agreement or other privacy addendum with Symmetry IT.

Where applicable, such agreements may address:

• Processing instructions
• Confidentiality
• Security requirements
• Subprocessors
• International transfers
• Data subject requests
• Incident notification
• Audit requirements
• Data return and deletion
• Regulatory obligations

If there is a conflict between this Privacy Policy and a signed Data Processing Agreement governing Client Data, the signed agreement controls with respect to that Client Data.

26. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, or privacy practices.

The current version will be posted on our website with the