Privacy Policy and Data Protection Guide

Last Updated: October 26, 2026

For Prima Systems (“company/we/our/us”), the privacy and confidentiality of the information is of paramount importance. This policy explains who we are, why and how we process personal information and, if you are the subject of any of the personal information concerned, what privacy rights you have and how to get in touch with us, if you need to. This Privacy Notice explains how we collect, use, disclose, retain and protect personal information and describes the privacy rights available to individuals under applicable privacy and data protection laws. This Privacy Notice has been developed taking into consideration applicable privacy and data protection laws, including but not limited to the General Data Protection Regulation (GDPR), UK GDPR. For the purposes of this Privacy Notice, references to “Personal Information” include “Personal Data” as defined under the GDPR and UK GDPR.

We reserve the right to amend this Privacy Notice from time to time. The date of the latest revision will be indicated by the “Last Updated” date at the beginning of this page.

What sort of personal information about you do we process?

We may process personal information, when voluntarily provided by users or automatically through website interactions. Personal information relating to you that we process may include:

Identifiers such as a real name and/or alias;
Email address;
Internet protocol address;
Phone number;
Or other similar identifiers.

Personal information does not include the following:

Publicly available information from government records;
Deidentified or aggregated consumer information;
Information excluded from the CCPA’s scope, such as Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA).

Information we do not collect – Children

We do not knowingly collect personal information from children under the age of 16. We encourage parents and legal guardians to monitor their children’s internet usage and instruct their children to never provide information on other websites without their permission. If we become aware that a child under 16 has provided us with personal information without parental consent, we take immediate steps to delete such information.

Cookies and Similar Technologies

We use cookies and similar technologies on our website to support essential website functionality, remember visitor preferences, understand how visitors use our website, measure website performance and, where applicable, support marketing and advertising activities.

These technologies may include necessary technologies required for the operation of the website and optional technologies used for preferences, analytics, marketing or other purposes, depending on the features available on the website.

Where consent is required by applicable law, non-essential cookies and similar technologies will only be activated after the relevant consent has been obtained. Visitors can accept all optional cookies, reject non-essential cookies or manage their preferences through the cookie consent mechanism provided on our website.

Visitors can change or withdraw their consent at any time through the Cookie Settings control available on the website.

Advertising and remarketing cookies may track your activity on our website and across other websites to build interest‑based profiles and deliver targeted advertising. These technologies are provided by third‑party advertising networks and are activated only after you give explicit opt‑in consent. You may withdraw your consent at any time through our cookie settings. All advertising providers are assessed under our information security risk management and third‑party assessment framework.

Further information about the cookies and similar technologies used on our website, including their purposes, relevant third-party providers and applicable storage or retention periods, is provided in our Cookie Policy and through the cookie preference mechanism. The technologies used may vary depending on the website features accessed and the configuration in place.

What do we do with your personal information?

We process your personal information for the following purposes:

To provide and maintain our service(s), including monitor the usage of our service;
To analyze website usage, measure website performance, and improve our website, services and user experience, including through analytics technologies and, where applicable, advertising or remarketing activities, subject to any consent requirements under applicable law;
To manage and administer our relationships with customers, suppliers or other users of our services;
To contact you by email, telephone calls, SMS, or other equivalent forms of electronic communication;
To keep our website and other systems safe and secure;
We do not sell your personal information.

Legal Basis for Processing

Where required by applicable data protection laws, including GDPR and UK GDPR, we process personal information based on one or more lawful grounds, including:

Consent, where required by applicable law;
Performance of a contract;
Compliance with legal obligations;
Legitimate business interests, including information security, fraud prevention, business continuity, responding to enquiries, and management of business relationships.

Where we use cookies or similar technologies that require consent under applicable law, we obtain the relevant consent before activating those technologies. Visitors can change or withdraw their consent through the Cookie Settings control available on our website. For other processing activities, we rely on the applicable lawful basis, as appropriate to the purpose of processing.

Where personal information is required to enter into a contract or respond to a request, failure to provide such information may prevent us from fulfilling the requested service.

Third-Party Website Technologies

We may use third-party technologies and service providers to support website functionality, booking services, security, analytics, performance, translation, embedded maps and other website features. Depending on the technology and service used, these providers may process technical and usage information, such as Internet Protocol (IP) address, browser or device information, page URLs, website interaction data and other technical information.

Where third-party technologies involve the storage of information on, or access to information from, a visitor’s device, we apply the consent and other requirements of applicable law. Where these technologies involve the processing of personal information, we take appropriate measures to ensure that such processing is managed in accordance with applicable privacy and data protection requirements.

Where these technologies collect or process personal information, their use is subject to applicable privacy and data protection requirements, relevant consent obligations, and our established information security risk management and control framework.

Data Controller Activities

We act as a Data Controller when collecting and processing personal information directly from website visitors, prospective customers, suppliers, vendors, business contacts, employees, job applicants, and other individuals who interact directly with us.

In such circumstances, we determine the purposes and means of processing personal information in accordance with applicable legal, regulatory and contractual requirements.

When We Act as a Data Processor

We may, in certain circumstances, process personal information on behalf of our clients while acting as a Data Processor.

In such cases:

Our clients act as Data Controllers;
We process personal information only on documented instructions from the relevant Controller;
We do not determine the purposes or means of processing;
We do not use client data for its own purposes.

We process personal information only for the purposes defined by the relevant client and in accordance with applicable contractual obligations. If you are a data subject whose information is processed by us on behalf of one of our clients, you should contact the relevant client directly regarding privacy rights requests.

Mandatory Disclosures

We may disclose your personal information when we believe in good faith that disclosure is required by law, regulation or legal process, or if we have a good faith belief that disclosure is reasonably necessary to (1) investigate and prevent measures against suspected or actual illegal activities or to cooperate with public and government authorities; (3) protect and defend ourselves against any third-party claims or allegations; (4) maintain the security or integrity of the our services; or (5) safeguard the rights and safety of the company, its workforce and others. This also includes compliance with subpoenas, court orders, or government requests.

Data Retention

We retain your personal information only for as long as is necessary for the purposes set out in this Privacy Notice. We will retain and use your personal information to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws). This applies solely to the categories listed above.

International Data Transfers

We operate a global delivery model and may process personal information through affiliated entities and service locations in different jurisdictions.

Where personal information is transferred outside the European Economic Area (EEA) or the United Kingdom, such transfers are carried out in accordance with applicable data protection laws and appropriate safeguards, including:

EU Standard Contractual Clauses (SCCs);
UK International Data Transfer Addendum (where applicable);
Contractual confidentiality obligations;
Technical and organizational security measures.

We apply supplementary technical and organizational safeguards, including access controls, encryption, endpoint protection, monitoring controls, and confidentiality obligations to protect personal information transferred internationally.

We may also conduct Transfer Impact Assessments (TIAs) where required to evaluate risks associated with international data transfers and determine whether supplementary safeguards are necessary.

User Rights (California Consumer Privacy Act)

If you are a California resident, you have the following rights in relation to personal information we process:

To be notified which categories of personal information are being collected and the purposes for which the personal information is being used.
To request that we disclose information to you about our collection, use, or disclosure of personal information.
To request the deletion of your personal information, subject to certain exceptions.
Not to be discriminated against for exercising any of your consumer’s rights.
To opt out of any sale of personal data (Note: we do not sell personal data/information).
You may request that any incorrect personal information about you that we are processing be rectified.
In certain circumstances (normally where the personal information has been provided by you and it is no longer necessary for us to continue to process it), you may be entitled to request that we erase the personal information concerned.
Where we are processing personal information relating to you on the basis of your prior consent to that processing, you may withdraw your consent to processing, after which we shall stop the processing concerned.

Additional Rights Available Under GDPR and UK GDPR

Where applicable under GDPR and UK GDPR, individuals may also have the following rights:

Right of access to personal information being processed about them;
Right to rectification of inaccurate or incomplete personal information;
Right to erasure (“right to be forgotten”) of personal information in certain circumstances;
Right to restrict processing;
Right to object to processing;
Right to data portability;
Right to withdraw consent at any time where processing is based on consent;
Right to lodge a complaint with a competent supervisory authority.

Individuals located within the European Union may lodge a complaint with the competent supervisory authority in their Member State.

Individuals located within the United Kingdom may lodge a complaint with the Information Commissioner’s Office (ICO).

Where we act solely as a Data Processor, privacy rights requests may be referred to the relevant Data Controller for response.

Adherence to ISO 27001

In order to ensure the security of your personal information, we follow the rigorous standards set out by the ISO 27001 for information security management. It signifies our commitment to ensure the confidentiality, integrity and availability of this website visitor’s information. Being holder of ISO 27001 certification, we have implemented a comprehensive information security management system that includes risk assessment, regular audits and continuous improvement processes. By adhering to this certification, we demonstrate our commitment to maintaining the highest level of security for your information.

Technical and Organizational Safeguards

We maintain technical and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction.

Such safeguards include, where applicable:

Role-based access controls and least privilege principles;
Multi-factor authentication (MFA);
Endpoint protection and device encryption;
Access logging and monitoring;
Secure transmission controls;
Confidentiality obligations for personnel;
Incident response and breach management procedures.

We regularly review and update our security and privacy controls based on operational, contractual, and regulatory requirements.

HIPAA Exclusion

This website does not collect or process Protected Health Information (PHI) as defined under Health Insurance Portability and Accountability Act (HIPAA). Any HIPAA covered data is excluded from this policy and handled separately under applicable regulations.

Personal Information Breaches

We maintain a documented incident response and breach management process.

Where required by applicable law or contractual obligations, personal information breaches will be assessed, managed, investigated, and reported in accordance with regulatory requirements and contractual commitments.

Where we act as a Data Processor, any personal information breach affecting client data will be notified to the relevant Data Controller without undue delay and in accordance with applicable contractual and regulatory obligations.

Contact Information and Exercising Your Privacy Rights:

For privacy-related enquiries, requests, complaints, or to exercise any of the rights described in this Privacy Notice, individuals may contact us using the details below:

Privacy & Data Protection Enquiries
compliance@primasystems.net

General Enquiries
info@primasystems.net

Prima Systems LLC
100 Enterprise Drive, Suite 301
Rockaway, New Jersey 07866
United States

To help us process your request efficiently, please:

Provide sufficient information that allows us to reasonably verify your identity or authority to make the request;
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Only you, or a person authorized to act on your behalf where permitted by applicable law, may submit a verifiable request relating to your personal information.

We cannot respond to your request or provide requested information unless we are able to:

Verify your identity or authority to make the request; and
Confirm that the personal information relates to you.

We will respond to privacy rights requests within the timeframes required by applicable laws and regulations. Where permitted by law, response periods may be extended where requests are particularly complex, numerous, or require additional verification.

For example:

For individuals located in California, we will generally respond within 45 days of receiving a verifiable request. Where reasonably necessary, this period may be extended by an additional 45 days, and the individual will be informed accordingly. In accordance with applicable California privacy requirements, any disclosures provided in response to a verifiable request will generally cover the 12-month period preceding the request unless otherwise required by law.
For individuals located within the European Union or the United Kingdom, we will generally respond within one month (30 calendar days) of receiving a valid request. Where requests are particularly complex or numerous, this period may be extended by up to an additional two months, and the individual will be informed of the reason for the extension.

Changes to this Privacy Notice

Any changes we make to this Privacy Notice will be posted on this page and, where appropriate, communicated to you by email. Please check this page periodically for updates.

Privacy Policy