PRIVACY POLICY

Effective Date: August 1, 2020

1. General Information

ThomasLeland LLC is referred to in this Privacy Policy as "ThomasLeland" or by "we," "us," and "our."

This Privacy Policy applies to all users of Internet websites published by ThomasLeland and to other individuals whose personal data (as defined below) is processed by ThomasLeland and its authorized processors. All such individuals are referred to in this Privacy as "you" and "your."  This Privacy Policy describes the types of personal data we may collect from you, how we collect it, how we use it, how we share or disclose it, how we store it, and your choices regarding the use and processing of your personal data.

As used in this policy, “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation).

2. Contact Information

ThomasLeland, LLC will control the use of personal data described in this Data Policy.  You may contact ThomasLeland, LLC at:

ThomasLeland LLC
2600 E Southlake Blvd
Suite 120 - 327
Southlake, TX 76092
[email protected]

Our representative in the European Union is:

ThomasLeland GDPR Representative

PL Mardyks
Paris, France

[email protected]

3. Personal Data We Collect and Purposes for which it is Used

A.    To enable you to purchase our products and services, we or our processors collect and process:

• Your first and last names
• your email address
• your payment information, including:
  • your credit card number, expiration date, and CVV code
  • your billing address

Billing information is processed by our e-commerce provider, with whom we maintain a data processing agreement that complies with GDPR Article 28.

Our legal bases under GDPR for processing this data include:

• you have given your consent to the processing for the specific purposes described (GDPR Article 6, Section 1(a))
• the processing is necessary for the performance of a contract to provide you with our goods or services (GDPR Article 6, Section 1(b))
• the processing is necessary for legitimate interests we pursue in operating our business and collecting payments (GDPR Article 6, Section 1(f))

B.     To provide you with information about our products and services, we collect and process:

• Your first and last names
• your email address

This information is processed by us or by one or more service platform providers, with whom we maintain a data processing agreement that complies with GDPR Article 28.

Our legal bases under GDPR for processing this data include:

• you have given your consent to the processing for the specific purposes described (GDPR Article 6, Section 1(a))

C.     To enable you to interact with our websites, apps, products and services, we or our service platform provider(s) may collect and process passwords, password hints, and similar security information needed for authentication and account access.  If you participate in an assessment, we may additionally collect and process gender, age range and nationality information as well as assessment results .

Our legal bases under the GDPR for processing this data include:

• the processing is necessary for the performance of a contract to provide you with our goods or services (GDPR Article 6, Section 1(b))
• the processing is necessary for legitimate interests we pursue in operating and improving our business, goods and services (GDPR Article 6, Section 1(f))

D.    To protect against and prevent fraud, legal claims, and liabilities; to manage risk exposure; to comply with applicable laws, regulations, and codes; to respond to subpoenas or to orders of a court or government agency; and to establish, exercise, or defend legal claims, including, without limitation, to protect our rights and/or property, we may collect and process required personal information.

Our legal bases under the GDPR for processing this data include:

• the processing is necessary for compliance with a legal obligation to which we are subject (GDPR Article 6, Section 1(c))
• the processing is necessary in order to protect your vital interests or those of another natural person (GDPR Article 6, Section 1(d))
• the processing is necessary for legitimate interests we pursue in operating our business and protecting the legal interests of ourselves and others we may be required to protect (GDPR Article 6, Section 1(f))

E.  To respond to your inquiries and requests, process and manage opt-out or unsubscribe request, and create and send non-marketing communications to you, we may collect and process your name, email address and other contact information.

Our legal bases for processing this data include:

• you have given your consent to the processing for the specific purposes described (GDPR Article 6, Section 1(a))
• the processing is necessary for the performance of a contract to provide you with our goods or services (GDPR Article 6, Section 1(b))
• the processing is necessary for legitimate interests we pursue in operating and improving our business, goods and services (GDPR Article 6, Section 1(f))

F. Cookies are small text files that may be placed on your device in order to measure traffic patterns, personalize content, control security and help make websites more useful.  Our websites do not set or use cookies.  Our service platform provider, Kajabi, does set and use cookies when it provides access to our products and services.  Specifically, Kajabi sets the following cookies:

For mor information on these cookies ad how you may manage them, you may click this link.

You are not required to provide us with any personal data we may request. However, if the requested information is necessary for us to provide any product, service or information requested by you, we will be unable to fulfill your request.

4. How We Share Personal Data

Your personal data will be accessible by our employees who require access for the purposes described above.

We do not share, sell, rent, or trade any personal data with third parties for any promotional purposes unrelated to our business or to our own products and services.

Contracted service providers are authorized to use and disclose personal data only as necessary to perform and provide the services for which they were engaged by us for the purposes described in this Privacy Policy.

Other parties we may share your personal data with include:

• governmental authorities pursuant to applicable laws or court process, or as we reasonably deem necessary to prevent harm, financial loss, fraud or illegal activity;
• the successor in interest to all or a portion of our business or assets; provided that should such a transfer occur, we will require such successor to agree in writing to use, protect, and maintain the security, integrity, and confidentiality of the transferred personal data in accordance with this Privacy Policy, as amended from time to time; and
• others pursuant to consent obtained from you.

5. Transfers of Personal Data to "Third Countries"

We or our contracted processors may transfer personal data that we or they collect from you to countries other than the one where you live.  Such countries may not have been determined by the European Commission to ensure an adequate level of protection for such data.  In those cases, we or our contracted processors will transfer personal data to the country only if appropriate safeguards are in place to protect the data. 

We rely on a number of means to transfer personal information in accordance with Chapter V of GDPR.  These include:

• Privacy Shield. We or our contracted processors may transfer, in accordance with GDPR Article 45, personal data to companies that have certified their compliance with the EU-U.S. or Swiss-U.S. Privacy Shield Frameworks.
• Standard data protection clauses. We or our contracted processors may, in accordance with GDPR Article 46, transfer personal data to recipients that have entered into the European Commission approved contract clauses for the transfer of personal data outside the European Economic Area.
• Other means. We may, in accordance with GDPR Articles 45 and 46, transfer personal data to recipients that are in a country the European Commission or a European data protection supervisory authority has confirmed, by decision, offers an adequate level of data protection, pursuant to an approved certification mechanism or code of conduct, together with binding enforcement commitments from the recipient to apply the appropriate safeguards, including as regards data subjects’ rights, or to processors which have committed to comply with binding corporate rules.

You can learn more information about these transfer mechanisms .

6. Criteria and Time Period for Retaining Personal Data

We will retain your personal data for a period of time consistent with the original purpose of its collection and no longer than reasonably necessary. We also may retain your personal data during the period of time needed for us to pursue our legitimate business interests, conduct audits, comply with our legal obligations, resolve disputes and enforce our agreements.

7. Rights Available to You

GDPR

If GDPR pertains to our processing of your personal data, you have several rights regarding our processing of the data. These rights include the right to request access to personal data (GDPR Article 15) to rectification of personal data (GDPR Article 16), to erasure of personal data / right to be forgotten (GDPR Article 17), to restrict processing of personal data (GDPR Article 18), to object to processing of personal data (GDPR Article 21), to data portability (GDPR Article 20), and the right to lodge a complaint with a supervisory authority. In cases where you have given us your consent to collect and use your personal data, you have the right to withdraw that consent at any time (without affecting the lawfulness of processing based on your consent before its withdrawal).

You may direct such requests to:

ThomasLeland, LLC
2600 E Southlake Blvd
Suite 120 - 327
Southlake, TX 76092
[email protected]

In cases where we process your data pursuant to your consent given via a web page form, you may withdraw that consent at any time by sending an email request to [email protected]

The following paragraphs provide more specific information about these rights:

The right to request access to personal data (GDPR Article 15)

You have the right to obtain confirmation from us to whether we process personal data about you, and access to the personal data and certain information about how and why we process your personal data.

The right to rectification of personal data (GDPR Article 16)

You have the right to rectification and/or completion if the personal data concerning you is incorrect or incomplete.

The right to be forgotten / Right to erasure (GDPR Article 17)

You have the right to obtain the erasure of your personal data where one of the following grounds applies:

• your personal data is no longer necessary in relation to the purpose for which they were collected or otherwise processed
• you withdraw consent and we have no other legal ground for the processing
• your personal data have been unlawfully processed
• your personal data has to be erased for compliance with a legal obligation
• your personal data is collected in the in relation to the offer of information society services referred to in GDPR Article 8 Section 1.

The right to restrict processing of your personal data (GDPR Article 18)

You have the right to restrict processing of your data under the following conditions:

• the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data
• your personal data have been unlawfully processed and you request the restriction of processing instead of deletion
• we no longer need the personal data for the purpose of the processing, but the personal data is required by you for the establishment, exercise or defense of legal claims
• if you have objected to processing pursuant to GDPR Article 21(1) and it has not been determined whether the legitimate grounds of us override those of you.

The right to object to processing of your personal data (GDPR Article 18)

You have the right to object to our processing of your personal data based on legitimate interests (GDPR Article 6 Section 1(f)) or for direct marketing purposes.

The right to data portability (GDPR Article 20)

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. Furthermore you have the right to transmit those data to another controller without hindrance from us, as far as:

• the processing is based on consent or on a contract pursuant to GDPR Article 6(1)(b)
• the processing is carried out by automated means.

The right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with the supervisory authority in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

8. How We Store Personal Data

Personal data is stored on servers and systems that are owned by us or by contractors engaged by us under written agreements which comply with this Privacy Policy.

We maintain appropriate technical, administrative and physical safeguards to protect personal data received or collected by us. We review, monitor and evaluate our privacy practices and protection systems on a regular basis.  

Notwithstanding the foregoing measures, transmissions over the Internet or a mobile network are not 100% secure and we do not guarantee the security of transmissions. We are not responsible for any errors by individuals in submitting personal data to us.

9. Anonymized Data

We may use, transfer, sell, and share aggregated, anonymous data, which does not include any personal data about you for any legal business purpose, such as analyzing usage trends, generating reports and insights on the relationships within the data as well as with other data sets, providing services on the basis of the data, or seeking compatible advertisers, sponsors, clients, and customers.

10. Children

We do not knowingly market our products or services to, and do not solicit or collect information from, children under the age provided by applicable law for giving consent. We may ask users for their age to ensure that we are not collecting information from unintended persons or to identify when additional steps may be necessary in connection with information collected from persons who have not reached the age of consent in the jurisdiction in which they reside. If you believe that we might have any personal data from or about a child who is not eligible to provide the necessary consent, please contact us at: [email protected]

11. Changes to this Privacy Policy

This policy may be amended from time to time, consistent with the requirements of any applicable laws. We will post the revised version on our website and update the "Effective" date above to reflect the date of the changes.