Private Policy

TTHIRD-PARTY WEBSITES AND SOCIAL MEDIA

Our website and Services may contain links to third-party websites, social media platforms, and external services. These links are provided for your convenience and information. This Privacy Policy does not apply to those third-party websites, platforms, or services, and we are not responsible for their content, privacy practices, or terms of use.

We encourage you to review the privacy policies and terms of use of any third-party websites or platforms you visit. We do not endorse or have control over the practices of third parties, and we are not responsible for how they collect, use, or share your information.

Additionally, our website may include social media buttons or widgets (such as Facebook, Twitter, Instagram, LinkedIn, or YouTube icons) that link to our social media profiles or allow you to share content. When you interact with these buttons or widgets, the social media platform may collect information about your visit to our website and may associate it with your social media account. Your interactions with social media platforms are governed by their privacy policies and terms of service, not by this Privacy Policy.

 HOW DOES ZONABRUSH PAINTING PROTECT YOUR INFORMATION?

Protecting our customers' information is a fundamental priority for ZonaBrush Painting. We implement and maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized access, disclosure, or misuse.

Technical Safeguards

Encryption: We use industry-standard encryption protocols (such as TLS/SSL with 256-bit encryption) to protect data transmitted between your device and our servers. Sensitive information (such as payment details) is encrypted during transmission

Secure Servers: Our servers and databases are hosted in secure facilities with restricted access, fire protection, and environmental controls

Data Encryption at Rest: We use encryption to protect sensitive data stored on our systems, including customer information, payment details, and business records

Firewalls and Intrusion Detection: We deploy firewalls, intrusion detection systems, and other security technologies to protect our networks and systems from unauthorized access and cyber threats

Regular Security Updates: We apply security patches and software updates promptly to address vulnerabilities and protect against emerging threats

Administrative Safeguards

Access Controls: Access to personal information is restricted to authorized employees, contractors, and service providers who have a legitimate business need to access the information. Access is granted based on the principle of least privilege

Authentication: We require strong passwords, multi-factor authentication, and unique user credentials for access to sensitive systems and data

Employee Training: All employees and contractors receive training on privacy, data security, and safe handling of personal information. Training includes awareness of phishing, social engineering, and other security threats

Background Checks: Where appropriate, we conduct background checks on employees and contractors who have access to sensitive information

Confidentiality Agreements: Employees and contractors are required to sign confidentiality agreements and comply with our data protection policies

Physical Safeguards

Secure Facilities: Physical access to our offices and data storage facilities is restricted to authorized personnel. We use access controls, surveillance cameras, and visitor logs to monitor access

Secure Disposal: We securely dispose of physical records containing personal information by shredding, pulping, or incinerating documents when they are no longer needed

Incident Response and Breach Notification

Despite our security measures, no system can be completely secure, and we cannot guarantee absolute protection of your information. In the event of a data breach or security incident, we have an incident response plan in place that includes:

Identifying and containing the incident

Assessing the scope and impact of the breach

Notifying affected individuals and relevant authorities as required by law

Taking steps to remediate vulnerabilities and prevent future incidents

Documenting the incident and our response for compliance and improvement purposes

If we become aware of a security breach that affects your personal information, we will notify you in accordance with applicable laws and regulations. Notification may be provided via email, postal mail, telephone, or prominent notice on our website, as appropriate.

Limitations of Security

While we strive to protect your personal information, please be aware that:

No security measures are perfect or impenetrable

Data transmission over the internet is not completely secure, and we cannot guarantee the security of information transmitted to or from our website

You are responsible for maintaining the confidentiality of your account credentials, passwords, and any other security information

We encourage you to take steps to protect your own information, such as using strong passwords, enabling multi-factor authentication, keeping your software up to date, and being cautious about phishing emails and suspicious links.

DATA RETENTION

We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, or as required or permitted by law. Retention periods vary depending on the type of information, the nature of our relationship with you, and legal, regulatory, or business requirements.

General Retention Periods

Customer Inquiries and Contact Information: Retained for up to three (3) years after the last interaction, unless you request deletion earlier or unless we have a legal or business reason to retain the information longer

Account and Service Data: Retained for the duration of our business relationship with you and for a reasonable period thereafter to respond to inquiries, provide warranty services, maintain business records, and satisfy legal obligations. If you close your account or terminate our services, we will delete or anonymize your data unless we are required to retain it for legal, regulatory, or legitimate business purposes

Transaction, Billing, and Payment Records: Retained for at least seven (7) years to comply with accounting, tax, and audit requirements, or as otherwise required by law

Project and Service Records: Retained for up to seven (7) years or longer as needed to fulfill warranty obligations, respond to disputes, and maintain business records

Marketing and Communications Data: If you have opted in to receive marketing communications, we will retain your contact information until you opt out or unsubscribe. After you opt out, we will retain a record of your opt-out request to ensure we do not send you marketing communications in the future

IT Support Logs and Session Data: Retained for up to twelve (12) months for troubleshooting, quality control, security audits, and compliance. Logs related to security incidents may be retained longer if needed for investigations or legal proceedings

Website Analytics and Cookies: Retained for up to two (2) years, subject to your browser settings and cookie preferences

SMS/Text Messaging Records: Retained for up to one (1) year following the last interaction

Audio Recordings of Customer Service Calls: Retained for up to twelve (12) months for quality assurance, training, dispute resolution, and compliance purposes

Secure Deletion

When personal information is no longer required, we take reasonable steps to securely delete or anonymize it. Secure deletion methods include:

Overwriting data on electronic storage devices

Degaussing or physically destroying storage media

Shredding, pulping, or incinerating physical documents

Anonymizing data so that it can no longer be linked to you

Legal and Regulatory Requirements

In some cases, we may be required to retain certain information for longer periods to comply with legal or regulatory requirements, such as:

Tax and accounting records (typically retained for seven years or longer)

Records related to legal disputes, investigations, or litigation

Records required by industry regulations or contractual obligations

If you have questions about how long we retain your information or how we dispose of it, please contact us.

CHILDREN'S PRIVACY (COPPA)

Our products, services, and website are not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent. If we become aware that a child under 13 has provided us with personal information without parental consent, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately using the information in the "Contact Us" section, and we will take appropriate action.

Before collecting information from a child under 13, we would provide parents with notice describing our data practices and obtain verifiable parental consent through methods recognized by the Children's Online Privacy Protection Act (COPPA), such as:

* Signed consent form submitted by mail or electronically

* Credit card transaction or other payment method to verify identity

* Video call or in-person meeting to verify identity

INTERNATIONAL TRANSFERS

Our servers and many of our service providers are located in the United States. If you are located outside the United States, your personal information may be transferred to and processed in the United States or other countries where privacy laws may differ from those in your jurisdiction.

By using our Services or providing us with your information, you consent to the transfer of your information to the United States and other countries for processing as described in this Privacy Policy.

Safeguards for International Transfers

Where required by the General Data Protection Regulation (GDPR), UK GDPR, or other applicable laws, we implement appropriate safeguards to ensure adequate protection of personal information transferred internationally. These safeguards may include:

Using Standard Contractual Clauses approved by the European Commission or UK authorities

Relying on adequacy decisions issued by the European Commission or UK authorities

Participating in data privacy frameworks such as the EU-U.S. Data Privacy Framework or other recognized frameworks

If we participate in the EU-U.S. Data Privacy Framework or similar frameworks, we will adhere to the principles of such frameworks, including purpose limitation, choice, data accuracy, security, transparency, individual rights, and restrictions on onward transfers.

 LEGAL BASES FOR PROCESSING (GDPR AND INTERNATIONAL USERS)

For residents of the European Economic Area (EEA), United Kingdom, or other jurisdictions requiring a lawful basis for processing personal information, we rely on one or more of the following legal bases:

Contractual Necessity

We process personal information to perform our contract with you (such as providing painting and drywall services) or to take steps at your request before entering into a contract (such as providing a quote or estimate).

Legitimate Interests

We have a legitimate interest in operating, securing, and improving our services, communicating with customers, conducting business operations, preventing fraud, protecting our rights, and achieving other business objectives, provided that such interests are not overridden by your rights and freedoms.

Consent

We rely on your consent to:

Send marketing communications (where consent is required)

Deploy non-essential cookies and tracking technologies

Process sensitive personal information (where applicable)

Engage in certain AI, profiling, or automated decision-making activities

You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

Legal Obligation

We process personal information to comply with legal or regulatory obligations, such as tax, accounting, and reporting requirements, or to respond to legal requests from authorities.

Vital Interests

We may process personal information to protect your vital interests or the vital interests of others in emergency situations.

 YOUR RIGHTS AND CHOICES

Your privacy rights depend on your place of residence. This section summarizes the key rights provided by U.S. state privacy laws and international data protection laws. We will not discriminate against you for exercising any of these rights.

1. California Consumer Rights (CCPA/CPRA)

California residents have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: You may request that we disclose the following information collected in the 12 months preceding your request:

Categories of personal information we have collected about you

Categories of sources from which such personal information was collected

Business or commercial purposes for collecting, selling, or sharing your personal information

Categories of personal information that we sold, shared, or disclosed for a business purpose

Categories of third parties to whom your personal information was sold, shared, or disclosed

You may also request specific pieces of personal information we have collected about you.

Right to Access / Copy: You have the right to request a copy of the personal information we have collected about you.

Right to Delete: You have the right to request that we delete the personal information we have collected from or about you, subject to certain exceptions (such as completing transactions, detecting security incidents, complying with legal obligations, or exercising free speech rights).

Right to Correct: You have the right to request that we correct inaccurate personal information we maintain about you.

Right to Opt Out of Sale or Sharing: You have the right to request that we stop selling your personal information or sharing it for cross-context behavioral advertising. We honor Global Privacy Control (GPC) and other recognized opt-out preference signals.

Right to Limit Use of Sensitive Personal Information: California law provides the right to limit the use and disclosure of sensitive personal information to what is necessary to provide services or as otherwise permitted by law. We do not use sensitive personal information for purposes beyond those described in this Privacy Policy.

Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights. This means we will not deny you goods or services, charge you different prices or rates, or provide you with a different level or quality of goods or services solely because you exercised your CCPA/CPRA rights.

CCPA Required Disclosure re Minors' Personal Information: We do not knowingly sell or share the personal information of California residents under 16 years of age without consent.

CalOPPA Do Not Track Disclosure: We recognize "Do Not Track" (DNT) signals and Global Privacy Control (GPC) signals as described in this Privacy Policy.

California Shine the Light: California residents may request information about our disclosures of personal information to third parties for their direct marketing purposes. To make such a request, please contact us using the information in the "Contact Us" section.

2. Virginia, Colorado, Connecticut, Utah, Texas, Delaware, Florida, Montana, Maryland, Minnesota, New Jersey, New Hampshire, Nebraska, Iowa, Oregon, and Other U.S. State Privacy Laws

Residents of states with comprehensive privacy laws have similar rights, including:

Right to Confirm: The right to confirm whether we are processing your personal information.

Right to Access / Copy: The right to access or request a copy of the personal information we have collected from you.

Right to Delete: The right to request deletion of the personal information we have collected from or about you, subject to certain exceptions.

Right to Correct: The right to request that we correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of processing.

Right to Portability: The right to receive your personal information in a portable and usable format (where technically feasible).

Right to Opt Out: The right to opt out of:

Sale of personal information (as defined under applicable state law)

Targeted advertising (processing your personal information for targeted advertising purposes)

Profiling for decisions producing legal or similarly significant effects

Right to Appeal: If we refuse to take action on your request, you have the right to appeal our decision. You may also contact your state's attorney general if your appeal is denied.

Controllers under these state laws must limit data collection to what is reasonably necessary and proportionate for the stated purposes and implement reasonable security measures. We aim to respond to requests within 45 days, extendable by another 45 days when reasonably necessary.

3. GDPR and UK GDPR Rights (EEA/UK Residents)

If you are in the European Economic Area (EEA) or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) or UK GDPR:

Right to Be Informed: The right to be informed about how we use your personal information (as described in this Privacy Policy).

Right of Access: The right to access your personal information and receive a copy.

Right to Rectification: The right to request correction of inaccurate or incomplete personal information.

Right to Erasure: The right to request deletion of your personal information when it is no longer needed or when we have no lawful basis for processing it.

Right to Restrict Processing: The right to request that we restrict processing of your personal information under certain circumstances (such as when you contest the accuracy of the information or object to processing).

Right to Data Portability: The right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit it to another controller.

Right to Object: The right to object to processing of your personal information based on legitimate interests or for direct marketing purposes.

Right Not to Be Subject to Automated Decision-Making: The right not to be subject to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects on you, unless such processing is necessary for a contract, authorized by law, or based on your explicit consent.

We respond to GDPR requests within one month, extendable by two additional months when necessary due to the complexity or number of requests. You also have the right to lodge a complaint with your local data protection authority if you believe we have not complied with applicable data protection laws.

4. Exercising Your Rights

To exercise any of the rights described above, please contact us using the methods provided in the "Contact Us" section. When submitting a request, please provide enough information to allow us to verify your identity and locate your records. We may require:

Two or more pieces of personal information (such as name, email address, phone number, or address)

Proof of identity (such as a government-issued ID, utility bill, or other documentation)

Answers to security questions or verification codes sent to your email or phone

If you use an authorized agent to submit a request on your behalf, the agent must provide written permission from you indicating that they are authorized to act on your behalf. We may also require you to verify your identity directly with us or confirm that you provided the agent with permission to submit the request.

5. Opt-Out Preference Signals

An opt-out preference signal is sent by a platform, technology, or mechanism on behalf of consumers to communicate a consumer's choice to opt out of the sale and sharing of personal information for cross-context behavioral advertising, without requiring individualized requests to each business.

We recognize the Global Privacy Control (GPC) signal for residents of California, Colorado, Connecticut, Delaware, Montana, Maryland, Minnesota, Nebraska, New Jersey, New Hampshire, and Oregon. The GPC signal is recognized at the browser level, meaning it applies only to the specific browser from which the signal is sent and only to identifiers associated with that browser. If you use multiple browsers or devices, you will need to enable the GPC signal on each browser or device.

For more information about opt-out preference signals and how to enable them, visit the Global Privacy Control website at https://globalprivacycontrol.org.

6. Verification of Requests

To protect your privacy and security, we will take steps to verify your identity before processing your request. The verification process may vary depending on the nature of your request and the information you have provided to us. If we are unable to verify your identity with the degree of certainty required, we will notify you and explain the basis for our inability to fulfill the request.

7. When We Do Not Act on a Request—Appeal Process

In some cases, we may not be able to act on your request (for example, if we are required by law to retain the information, if the request is manifestly unfounded or excessive, or if an exception applies). When this occurs, we will explain our reasons for not taking action.

Under some state laws, you have the right to appeal our decision by contacting us within a specified time period (typically 30 days) after receiving our response. We will provide additional details about how to appeal in our response to your request.

 ACCESSIBILITY

ZonaBrush Painting is committed to ensuring that our website and communications are accessible to individuals with disabilities. We strive to comply with applicable accessibility standards, including the Web Content Accessibility Guidelines (WCAG) and Section 508 of the Rehabilitation Act.

If you encounter accessibility barriers on our website or need assistance accessing information, please contact us using the information in the "Contact Us" section, and we will work to provide the information or services you need in an accessible format.

 CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make changes, we will:

Post the updated Privacy Policy on our website with a new "Effective Date"

Notify you of material changes via email, prominent notice on our website, or other appropriate means

Provide you with an opportunity to review the updated Privacy Policy before it takes effect (where required by law)

Unless stated otherwise, the current version of this Privacy Policy applies to all personal information we hold about you. We encourage you to review this Privacy Policy regularly to stay informed about how we collect, use, and protect your information.

By continuing to use our Services or interact with us after changes to this Privacy Policy take effect, you acknowledge and agree to the updated Privacy Policy. If you do not agree to the changes, you should discontinue use of our Services and contact us to discuss your options, including exercising your rights to delete or correct your information.

 CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, or if you wish to exercise your privacy rights, please contact us:

ZonaBrush Painting Inc.

Email: [email protected]

Phone: (480) 420-9088 (call or text)

Mail: PO Box 318, Laveen, AZ 85339

When contacting us, please provide enough information to identify yourself and describe the nature of your inquiry or request. We will respond to your inquiry as promptly as possible.

END OF PRIVACY POLICY