California Consumer Privacy Act (CCPA/CPRA) Notice Policy
Effective Date: January, 1, 2026
Purpose and Applicability
This California Consumer Privacy Act (CCPA/CPRA) Notice Policy describes how Afintrix Advisory Analytics LLC (“Afintrix,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information of California residents in accordance with the California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act of 2020 (CPRA).
Afintrix is an advisory, analytics, and governance firm providing structured oversight, compliance, and financial analysis support. This notice applies solely to personal information subject to the CCPA/CPRA and does not apply where statutory exemptions are applicable.
Scope of This Notice
This notice applies to personal information collected about California residents who are:
- Clients or prospective clients
- Website visitors or users of digital contact forms
- Vendors, contractors, or business partners
- Job applicants or current personnel, where applicable under CCPA/CPRA
This notice does not apply to information excluded from CCPA/CPRA coverage, including information subject to certain federal laws or professional regulatory exemptions, where applicable.
Categories of Personal Information Collected
Within the scope of its operations, Afintrix may collect the following categories of personal information, as defined under CCPA/CPRA:
- Identifiers: Name, mailing address, email address, telephone number, online identifiers, or similar identifiers periods
- Professional or Employment-Related Information: Job title, employer, professional credentials, or engagement-related contact details periods
- Financial Information: Limited financial or accounting data provided for analytical or compliance review purposes periods
- Internet or Network Activity: IP address, browser type, device information, and website interaction data periods
- Sensitive Personal Information: Information such as tax identification numbers or financial records, where required for engagement-related analysis periods
Personal information is collected directly from individuals, authorized representatives, or through lawful business interactions.
Purposes for Collection
Afintrix collects and uses personal information for legitimate business and operational purposes, including:
- Evaluating and managing engagements
- Providing oversight, compliance, analytical, and governance support
- Communicating with clients, vendors, and contacts
- Meeting legal, regulatory, and recordkeeping obligations
- Maintaining internal security and risk controls
- Responding to inquiries or requests
Personal information is not used for advertising profiling or automated decision-making.
Disclosure of Personal Information
Afintrix may disclose personal information for business purposes to:
- Service providers and vendors performing services on behalf of the firm
- Legal, regulatory, or governmental authorities where required by law
- Professional advisers supporting compliance or risk management functions
Afintrix does not sell personal information and does not share personal information for cross-context behavioral advertising.
Sensitive Personal Information
Sensitive personal information, as defined under CPRA, is collected only where necessary for lawful business purposes, compliance obligations, or engagement-specific requirements. Use of sensitive personal information is limited to permitted purposes under applicable law.
Data Retention
Personal information is retained only for as long as reasonably necessary to fulfill the purposes for which it was collected, including compliance with legal, regulatory, and operational requirements. Retention periods are governed by the Record Retention and Document Management Policy.
Consumer Rights Under CCPA/CPRA
California residents may have the right to:
- Request disclosure of the categories and specific pieces of personal information collected
- Request correction of inaccurate personal information
- Request deletion of personal information, subject to legal exceptions
- Limit the use of sensitive personal information, where applicable
- Receive equal service and pricing regardless of exercising privacy rights
Rights requests are subject to verification and applicable exemptions under CCPA/CPRA.
Submitting Requests
Requests to exercise CCPA/CPRA rights may be submitted using the contact methods provided on the Afintrix website. Afintrix will respond within the timeframes required by law.
Authorized agents may submit requests on behalf of consumers where proper authorization is provided.
Non-Discrimination
Afintrix does not discriminate against individuals for exercising rights under the CCPA/CPRA.
Security Measures
Afintrix maintains reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, or misuse.
Updates to This Notice
This notice may be updated periodically to reflect changes in law, regulatory guidance, or business practices. Updates will be posted with a revised effective date.
