Privacy Policy

Scope and Our Commitment to Privacy

Last Updated: July 24, 2026

Touchstone Security (“Touchstone,” “we,” “us,” or “our”) respects the privacy of visitors to our website and the clients, prospective clients, business partners, job applicants, and other individuals with whom we interact.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information in connection with:

• touchstonesecurity.com and any webpages that link to this Privacy Policy (collectively, the “Site”);
• contact, consultation, demonstration, and quote requests;
• email, telephone, SMS, and other business communications;
• marketing subscriptions, webinars, events, and similar activities; and
• employment inquiries and applications submitted directly to Touchstone.

This Privacy Policy generally applies when Touchstone determines why and how personal information will be processed.

It does not govern personal information that Touchstone processes solely on behalf of a client while providing managed security, consulting, incident-response, compliance, digital-forensics, cloud, or other professional services. That processing is governed by the applicable client agreement, Master Services Agreement, Statement of Work, Business Associate Agreement, Data Processing Addendum, or similar agreement. If there is a conflict concerning client-controlled data, the applicable client agreement will control.

We may update this Privacy Policy periodically. When we do, we will revise the “Last Updated” date above. We may provide additional notice when required by law or when changes materially affect how we process personal information.

Personal Information We Collect

The personal information we collect depends on how you interact with us.

Information You Provide

We may collect information that you provide when you:

• submit a contact, consultation, demonstration, or quote-request form;
• request information about our services;
• communicate with us by email, telephone, SMS, or another channel;
• subscribe to communications, register for a webinar, or participate in an event;
• submit an employment inquiry or job application; or
• otherwise provide information to us.

This information may include:

• name;
• business or personal email address;
• telephone or mobile number;
• company or organization name;
• job title or professional role;
• mailing address;
• communication preferences;
• the content of your request or correspondence;
• information included in a résumé, cover letter, or employment application; and
• other information you voluntarily provide.

Information Collected Automatically

When you use the Site, we and our service providers may automatically collect information such as:

• Internet Protocol address;
• browser type and version;
• device type and operating system;
• pages viewed and links selected;
• referring and exit pages;
• dates and times of visits;
• approximate geographic location derived from an IP address;
• cookie identifiers and similar technical identifiers; and
• information about Site performance, errors, and security events.

Some of this information may constitute personal information under applicable law.

Information from Other Sources

We may receive business contact information from referrals, business partners, event organizers, professional networking platforms, publicly available sources, and service providers. We may combine that information with information we already maintain when permitted by law.

Sensitive Information

The Site is not intended to collect Social Security numbers, government identification numbers, financial-account credentials, payment-card data, medical information, biometric identifiers, precise geolocation, or other sensitive personal information.

Please do not submit sensitive, confidential, regulated, security-related, government classified, or client-system information through a general website form or ordinary email unless Touchstone has instructed you to use an approved secure method.

How and Why We Use Personal Information

We may use personal information to:

• respond to inquiries and provide requested information;
• schedule consultations and communicate about potential or existing services;
• prepare proposals, quotes, contracts, and related business materials;
• deliver and support our services;
• operate, maintain, troubleshoot, secure, and improve the Site;
• understand Site usage and evaluate the effectiveness of our content;
• manage business relationships with clients, prospective clients, vendors, and partners;
• send newsletters, event information, security updates, and other marketing communications, subject to applicable consent requirements;
• manage SMS communications requested or authorized by you;
• evaluate employment inquiries and applications;
• detect, prevent, investigate, and respond to fraud, misuse, threats, vulnerabilities, and security incidents;
• establish, exercise, or defend legal claims;
• comply with contractual, legal, regulatory, and professional obligations; and
• complete a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction.

Where applicable law requires a legal basis for processing, we may rely on:

• your consent;
• performance of a contract or steps taken at your request before entering into a contract;
• our legitimate interests, including operating and protecting our business, communicating with business contacts, improving our services, and maintaining network and information security;
• compliance with legal obligations; and
• protection of the rights, safety, and interests of Touchstone, our clients, or others.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal will not affect processing that occurred before the withdrawal.

How We Disclose Personal Information

We may disclose personal information to the following categories of recipients for legitimate business purposes:

Service Providers and Contractors

We may disclose information to companies that provide services on our behalf, such as:

• website hosting and maintenance;
• form processing and spam prevention;
• email, telecommunications, and SMS delivery;
• customer-relationship management;
• analytics and Site-performance services;
• cloud storage and collaboration;
• recruiting and applicant-management services;
• security monitoring and incident response; and
• professional, administrative, and technical support.

These providers are authorized to process information only for the services they provide to us, subject to applicable contractual and legal obligations.

Professional Advisors

We may disclose information to attorneys, accountants, auditors, insurers, consultants, and other professional advisors when reasonably necessary.

Legal and Safety Disclosures

We may disclose information when we reasonably believe disclosure is necessary to:

• comply with law, regulation, subpoena, court order, or other legal process;
• respond to a lawful government or regulatory request;
• investigate or prevent fraud, misuse, security threats, or unlawful activity;
• protect the rights, property, systems, or safety of Touchstone, our clients, Site users, or others; or
• establish, exercise, or defend legal claims.

Business Transactions

Information may be disclosed or transferred in connection with an actual or proposed merger, acquisition, investment, financing, restructuring, bankruptcy, sale of assets, or similar transaction, subject to appropriate confidentiality protections.

At Your Direction

We may disclose information when you direct us to do so or provide consent.

Sales, Targeted Advertising, and Profiling

Touchstone does not sell personal information for monetary consideration.

Touchstone does not knowingly use personal information collected through the Site to make decisions that produce legal or similarly significant effects through automated profiling.

Certain analytics, advertising, embedded-content, or social-media technologies may be considered “sharing,” “targeted advertising,” or a “sale” under some state privacy laws even when no money is exchanged. Touchstone will provide any legally required notice or opt-out mechanism based on the technologies used on the Site and the laws applicable to Touchstone.

Cookies and Similar Technologies

The Site and our service providers may use cookies, pixels, scripts, local storage, log files, and similar technologies.

These technologies may be used to:

• provide essential Site functionality;
• remember preferences;
• protect forms and the Site against spam, fraud, and abuse;
• measure traffic and understand how visitors use the Site;
• diagnose errors and improve Site performance; and
• support advertising or marketing activities, where used and permitted.

Some cookies are necessary for the Site to function. Other cookies may be optional. Where required by law, we will request consent before placing or accessing nonessential cookies.

You may manage cookies through our cookie-management tool, when available, and through your browser settings. Blocking cookies may affect certain Site functions.

Browser-based “Do Not Track” signals are not interpreted consistently across the industry. Where required by applicable law, we will process recognized opt-out preference signals, such as Global Privacy Control, as legally required.

SMS and Telephone Communications

When you provide a mobile telephone number and consent to receive text messages, Touchstone may use that number to respond to your inquiry, schedule or confirm communications, provide requested information, or communicate regarding our business relationship.

Touchstone uses SMS/text messaging solely for non-marketing, transactional communications, such as scheduling and confirming appointments, providing requested information, and service, account, or security-related notices. Touchstone does not send marketing or promotional text messages.

Message frequency may vary. Message and data rates may apply. You may opt out of SMS communications at any time by replying STOP. You may reply HELP for assistance or contact us using the information in the Contact Us Section.

Consent to receive text messages is not a condition of purchasing goods or services.

We may use telecommunications service providers to deliver messages and maintain records of consent, message delivery, and opt-out requests. Mobile telephone numbers and SMS opt-in information will not be sold, rented, or disclosed to third parties or affiliates for their own marketing or promotional purposes. We may disclose this information to service providers that support delivery of Touchstone’s communications or as otherwise required by law.

Marketing Communications

Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide services, maintain business and security records, comply with legal and contractual obligations, resolve disputes, and enforce agreements.

Retention periods vary according to:

• the nature and sensitivity of the information;
• the purpose for which it was collected;
• the duration of a client, prospect, vendor, employment, or other business relationship;
• applicable contractual requirements;
• legal, regulatory, tax, accounting, insurance, and recordkeeping obligations;
• applicable limitation periods; and
• the need to investigate security events or protect legal rights.

When personal information is no longer reasonably required, we may delete it, deidentify it, or retain it in a securely restricted archive where deletion is not reasonably feasible.

Data Security

Touchstone uses administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, acquisition, loss, misuse, alteration, or disclosure.

Depending on the nature of the information and the systems involved, these safeguards may include:

• encryption in transit;
• access controls and authentication;
• security monitoring and logging;
• system and software maintenance;
• vendor-security measures;
• backup and recovery controls;
• workforce security and confidentiality requirements; and
• incident-response procedures.

No transmission, website, network, or storage system can be guaranteed to be completely secure. You should use caution when transmitting personal information electronically and should use a secure method when instructed by Touchstone.

If we identify a security incident involving personal information, we will investigate and provide notifications to affected individuals, clients, regulators, or others when required by applicable law or contract.

Privacy Rights and Choices

Depending on where you reside and whether a particular privacy law applies to Touchstone or the relevant processing, you may have rights concerning your personal information, including the right to:

• confirm whether we process your personal information;
• access or obtain a copy of personal information;
• correct inaccurate personal information;
• request deletion of personal information;
• obtain certain information in a portable format;
• opt out of the sale of personal information;
• opt out of targeted advertising;
• opt out of certain profiling;
• restrict or object to certain processing;
• withdraw consent; and
• appeal a decision concerning a privacy request.

You may submit a request by emailing privacy@touchstonesec.com, calling (551) 900-6050, or writing to us at the address in the Contact Us Section. Please describe the right you wish to exercise and the information or interaction involved.

We may need to verify your identity before completing a request. Verification may involve confirming information associated with your interaction with Touchstone. We will use information submitted for verification only to evaluate and respond to the request.

You may use an authorized agent where permitted by law. We may require evidence that the agent is authorized to act for you and may also verify your identity directly.

We will respond within the timeframe required by applicable law. Certain information may be exempt from a request, including information that we must retain to comply with law, protect security, complete a transaction, exercise legal rights, or fulfill contractual obligations.

We will not unlawfully discriminate against you for exercising an applicable privacy right.

Appeals

Where applicable law provides a right to appeal, you may appeal our decision by replying to our response or contacting us at privacy@touchstonesec.com with the subject line “Privacy Request Appeal.” Please explain why you believe the decision should be reconsidered.

California Residents

When the California Consumer Privacy Act applies to Touchstone or the relevant processing, California residents may have the rights described above, including rights to know, access, correct, delete, and opt out of the sale or sharing of personal information, subject to statutory exceptions.

Touchstone does not sell personal information for money and does not knowingly sell or share the personal information of individuals under 16 years of age.

New Jersey and Other U.S. State Residents

When applicable state privacy law applies to Touchstone or the relevant processing, residents may have rights to access, correct, delete, or obtain a portable copy of personal information and to opt out of sale, targeted advertising, or certain profiling, subject to applicable exceptions.

EEA, United Kingdom, and Switzerland

Where European data-protection law applies, individuals may have rights to access, correct, erase, restrict, object to processing, withdraw consent, and receive personal data in a portable format.

Individuals may also have the right to lodge a complaint with the data-protection authority in the jurisdiction where they live, work, or believe an infringement occurred.

Touchstone does not have an establishment in the European Economic Area, United Kingdom, or Switzerland, does not direct its Site or services specifically to individuals located there, and does not engage in regular and systematic monitoring of individuals in those jurisdictions. Touchstone’s processing of personal data originating from these jurisdictions is incidental to its primary business activities in the United States. On this basis, Touchstone has not appointed a representative under Article 27 of the GDPR or Article 27 of the UK GDPR.

International Processing and Transfers

Touchstone is based in the United States. Personal information may be processed and stored in the United States and in other countries where Touchstone’s service providers operate.

These countries may have privacy laws that differ from the laws in your jurisdiction. Where applicable law requires safeguards for an international transfer, Touchstone will use a legally recognized transfer mechanism or another permitted basis for the transfer.

Children’s Privacy

The Site is intended for businesses and professional audiences. It is not directed to children under 16, and Touchstone does not knowingly collect personal information from children under 16 through the Site.

If you believe a child has provided personal information to us, please contact us. We will review the report and delete the information when required.

Third-Party Websites and Services

The Site may link to or incorporate content from third-party websites, social-media platforms, scheduling services, maps, video providers, or other services.

Those third parties may collect information independently and process it under their own privacy policies. Touchstone is not responsible for the privacy, security, availability, or content of third-party websites or services.

Contact Us

This Privacy Policy is effective as of July 24, 2026. Questions, requests, or concerns regarding this Privacy Policy or Touchstone’s handling of personal information may be directed to:

Touchstone Security
2 Myrtle Ave, Suite 250
Allendale, NJ 07401
United States

Email: info@touchstonesec.com
Phone: (551) 900-6050