Privacy Policy

1. Scope of This Policy

This Privacy Policy applies to personal data that we collect:

• Through the Services, including when a user creates or claims a business profile, subscribes to platform features, searches for procurement opportunities or RFPs, uploads business credentials, or otherwise interacts with the platform.
• In communications with us, including email, chat, web forms, support requests, and other electronic communications.
• Through cookies, pixels, logs, analytics tools, and similar automated technologies used in connection with the Services.
• From publicly available government procurement and certification databases and related public sources, including NYC Open Data, the NYC SBS Connect Directory, the NYS M/WBE Directory, the NYC City Record Online procurement database, and similar NYC/NYS public procurement or certification sources.

This Privacy Policy does not apply to personal data collected by third-party websites, platforms, applications, or services that are not controlled by ConnectSBE, even if they link to or are accessible from the Services. We may provide additional or different notices for specific features, services, or activities where appropriate.

2. Children and Minors

The Services are intended for business and professional users and are not directed to children under 18. We do not knowingly collect personal data from children under 18. If we learn that we have collected personal data from a child under 18, we will delete that information as required by applicable law.

3. Personal Data We Collect

"Personal data" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an identifiable individual or household. The categories of personal data we may collect or process include:

• Account and contact information: such as name, business name, mailing address, email address, phone number, username, and account login information.
• Business profile and professional information: such as business name, industry, certification status, ownership or certification categories, capability statements, past performance records, goods or services offered, service areas, procurement interests, and business credentials.
• Public-source profile data: such as information obtained from public NYC/NYS certification, procurement, vendor, or RFP databases, including business contact details, certification status, public registration information, and publicly available capability or profile information.
• Payment and transaction information: if paid features are enabled, such as subscription status, purchase history, payment confirmation information, and limited payment-related information processed through our payment processor, Stripe.
• Device, usage, and technical information: such as IP address, device identifiers, browser type, operating system, logs, access times, referring pages, pages viewed, search activity, and interactions with the Services.
• Location information: such as general location inferred from IP address, user-provided service areas, business location, or regions associated with public procurement or certification records. We do not currently intend to collect precise geolocation information unless separately disclosed and consented to where required.
• Communications and support information: such as messages, support requests, email correspondence, profile correction requests, rights requests, and related communications.
• Marketing preferences and consent records: such as email preferences, opt-outs, unsubscribe records, suppression-list entries, and records of privacy choices.
• Sensitive personal data: to the extent included in public source records or voluntarily provided by users, such as MWBE certification status, certification classifications, demographic classifications associated with business certifications, or government-issued identification information submitted for account, compliance, or verification purposes.

We do not intend to collect biometric data, health data, precise geolocation, children’s data, employee/job applicant data, or closed-circuit surveillance data through the Services unless a separate notice is provided and required consent is obtained.

4. How We Collect Personal Data

A. Information You Provide

We collect personal data directly from you when you create or update an account, claim or correct a business profile, subscribe to Services, search for opportunities, upload business credentials, submit support requests, communicate with us, or otherwise provide information through the Services.

B. Information Collected Automatically

As you interact with the Services, we may automatically collect device, usage, log, and analytics information through cookies, web beacons, pixels, server logs, analytics tools, and similar technologies. These technologies help us operate the Services, maintain security, measure usage, improve performance, remember preferences, and understand how users interact with platform features.

C. Information from Public Government Sources and Service Providers

We obtain business profile and procurement information from public government sources, including public certification directories, public procurement/RFP databases, public vendor listings, and other public NYC/NYS datasets relevant to business procurement certification, including but not limited to MWBE certification and public contracting opportunities. We may also receive personal data from service providers that support our business, including hosting providers, analytics providers, email platforms, customer support tools, payment processors, security providers, and compliance vendors.

5. How We Use Personal Data

We use personal data for the following purposes:

• To provide, operate, maintain, and improve the Services.
• To create, display, update, correct, and manage business profiles.
• To help users identify relevant procurement opportunities, RFPs, government contracts, certification-related information, and qualified vendor connections.
• To allow businesses to claim, correct, supplement, or request removal of profile information.
• To process subscriptions, payments, account activity, billing, and related transactions if paid features are enabled.
• To communicate with users regarding accounts, profiles, procurement alerts, platform updates, support requests, policy updates, and administrative matters.
• To send marketing or promotional communications where permitted by law and subject to available opt-out rights.
• To personalize user experience, recommendations, search results, and platform functionality.
• To analyze Services usage, troubleshoot issues, test features, conduct research, create aggregated or deidentified data, and improve platform performance.
• To protect the Services, prevent fraud, secure accounts, detect abuse, enforce our terms, and comply with legal obligations.
• To comply with court orders, laws, legal processes, government requests, and regulatory obligations.
• For any other purpose disclosed at the time of collection or with consent where required.

We may use artificial intelligence, machine learning, or automated tools to support platform functionality, such as matching businesses with relevant opportunities, classifying procurement listings, improving search, generating recommendations, and assisting with the creation of business content such as capability statements and profile descriptions. We do not use your personal data to train our AI or machine learning models, and we do not share your personal data with third parties for the purpose of training their models. We do not use personal data for legally significant automated decisions without appropriate notice and rights where required by law.

6. How We Disclose Personal Data

We may disclose personal data as described below:

• Registered platform users: We may make business profile information available to registered users searching for qualified businesses, procurement opportunities, vendors, agencies, or business partners. This may include business contact details, certification status, capability statements, service areas, and past performance information. Users may request correction, restriction, or removal of certain profile information as described below.
• Service providers and contractors: We may disclose personal data to vendors that perform services for us, such as hosting, analytics, payment processing, email delivery, customer support, security, fraud prevention, data management, and compliance support. These providers are authorized to use personal data only as necessary to provide services to us or as otherwise permitted by law.
• Government, legal, and compliance disclosures: We may disclose personal data to comply with law, legal process, court orders, subpoenas, government or regulatory requests, or to protect legal rights, safety, security, property, and the integrity of the Services.
• Corporate transactions: We may disclose or transfer personal data in connection with a merger, acquisition, financing, reorganization, bankruptcy, asset sale, or similar business transaction.
• With consent or at your direction: We may disclose personal data when you authorize or direct us to do so, including when you voluntarily provide profile content for publication or sharing through the Services.

We may disclose aggregated, deidentified, or statistical information that does not reasonably identify an individual without restriction, subject to applicable law.

7. Cookies, Analytics, Advertising, and Tracking Choices

We may use cookies, web beacons, pixels, analytics tools, and similar technologies to operate the Services, improve performance, remember preferences, evaluate usage, and support marketing or advertising activities. Some third-party providers may collect information about your device or online activity when you interact with the Services.

You can control cookies through your browser settings and, where available, through account settings or preference tools provided through the Services. If you disable cookies or similar technologies, some Services may not function properly. Depending on your state of residence and applicable law, you may have the right to opt out of targeted advertising, profiling, or sale/sharing of personal data. You may submit such requests using the methods described in Section 10.

8. Marketing Communications

We may send email or other electronic communications about the Services, including updates, procurement alerts, account notices, and promotional messages. Users may unsubscribe from marketing communications using the unsubscribe link in the email or by contacting us at support@connectsbe.com. We may continue to send non-promotional messages, such as account, security, legal, billing, or transactional notices.

9. Sensitive Personal Data

Certain information processed by the Services may be considered sensitive personal data under some privacy laws, including demographic or certification-related classifications associated with business procurement certification, including but not limited to MWBE status, government-issued identification information submitted for verification, or other sensitive information voluntarily provided by users. We process sensitive personal data only as reasonably necessary to provide the Services, comply with law, support business profile functionality, or as otherwise disclosed and permitted by applicable law.

Where applicable law requires consent or provides the right to limit, restrict, or opt out of sensitive-data processing, users may exercise those rights using the methods described in Section 10.

10. Your Privacy Rights and Choices

Depending on your state of residence and applicable law, you may have some or all of the following rights regarding your personal data:

• Right to know or access the personal data we process about you.
• Right to receive certain personal data in a portable format, where required by law.
• Right to correct inaccurate personal data.
• Right to delete personal data, subject to legal exceptions.
• Right to opt out of sale, sharing, targeted advertising, or certain profiling, where applicable.
• Right to limit or restrict certain sensitive personal data processing, where applicable.
• Right to withdraw consent where processing is based on consent.
• Right to appeal a denied rights request where applicable law provides an appeal right.

To exercise privacy rights, submit a request by email to support@connectsbe.com or, where available, through your account settings. To appeal a rights-request decision, contact us at support@connectsbe.com with the subject line "Rights Request Appeal" and describe the basis for your appeal.

We may need to verify your identity or authority before fulfilling a request. Authorized agents may submit requests where permitted by law, but we may require proof of authorization and identity verification. We will respond within the time required by applicable law. The exact rights available to you and our obligations may vary depending on your state of residence, our legal status under applicable privacy laws, and applicable statutory exceptions.

11. Public Profile Correction, Restriction, and Removal Requests

Because ConnectSBE uses public-source business profile information, a business or individual associated with a business profile may request correction, supplementation, restriction, or removal of profile information by contacting us at support@connectsbe.com. We may retain certain information as necessary to document requests, prevent re-publication of removed information, comply with legal obligations, maintain suppression records, or preserve security and integrity of the Services.

Official government source records may continue to display information independently of ConnectSBE. Requests to correct or remove information from official government databases must be directed to the relevant government agency or source operator.

12. Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal data from unauthorized access, use, alteration, disclosure, or destruction. No website, platform, system, or method of transmission is completely secure. Users are responsible for maintaining the confidentiality of account credentials and for using appropriate security measures when interacting with the Services.

13. Data Retention

We retain personal data for as long as reasonably necessary to provide the Services, maintain business records, comply with legal obligations, resolve disputes, enforce agreements, maintain security, prevent fraud or abuse, honor opt-out and suppression requests, and fulfill the purposes described in this Privacy Policy. Retention periods may vary depending on the nature of the information, the purpose for processing, legal requirements, and operational needs. When personal data is no longer needed, we delete, deidentify, or otherwise dispose of it in accordance with applicable law and our retention practices.

14. International Data Transfers

ConnectSBE is based in the United States, and the Services are intended for users in the United States. If personal data is accessed or processed outside the state or country where it was collected, we will take steps required by applicable law to protect the information.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date above indicates when this Privacy Policy was last revised. We will provide notice of material changes as required by law, which may include posting the updated policy through the Services or sending notice through other appropriate channels.