Effective date: September, 14, 2025

Tremaine & Associates, Inc. (“Tremaine,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what personal information we collect on tremaine.us (the “Website”), how we use and share it, and the choices you have. This Policy does not apply to third-party websites or services that we do not control, or to information collected offline unless stated otherwise. If you do not agree with this Policy, please do not use the Website.

Personal Information means any information that identifies, relates to, describes, or could reasonably be linked with an identifiable person.

1) What we collect

We collect information in three ways: you provide it, we collect it automatically, and we receive it from others.

A. Information you provide

• Contact details (name, email, phone, company, job title)
• Project details (site location, scope, timeline, documents you attach)
• Account/portal details (if applicable; username/password)
• Payment/billing info (if you pay us directly for services)
• Feedback and communications (emails, form submissions, calls)
• Applicant/employee information (résumé/CV, work history, education, references) Employee/applicant data may be covered by a separate notice: [link to Employee & Applicant Privacy Notice].

B. Information collected automatically

• Device and usage data: IP address, browser type, operating system, pages viewed, links clicked, referring/exit pages, date/time, and approximate location derived from IP.
• Cookies and similar tech: browser cookies, pixels, web beacons, and local storage used for operation, analytics, and (if enabled) marketing.

We may use Google Analytics to understand Website usage. Learn more here: https://policies.google.com/privacy. You can opt out by installing Google’s browser add-on: https://tools.google.com/dlpage/gaoptout or by managing your cookie settings.

C. Information from other sources

• Service providers and partners (e.g., job platforms, customer relationship tools)
• Public sources (e.g., professional profiles, business websites)

2) How we use personal information

We use your information to:

• Provide and operate the Website and our services
• Respond to inquiries, RFPs, and project requests
• Prepare proposals and contracts
• Schedule and perform surveys, monitoring, fieldwork, and reporting
• Communicate about services, updates, and administrative topics
• Process payments and manage accounts
• Improve the Website (analytics, debugging, security)
• Comply with laws, enforce terms, and protect our rights, users, and the public
• With your consent, for any other purpose we disclose at collection

3) How we share personal information

We may share information:

• With vendors/service providers who help us run the Website, process payments, host data, deliver communications, analytics, security, and IT support (bound by contractual confidentiality and use limits)
• With professional advisors (lawyers, auditors, insurers) under confidentiality
• For legal reasons (to comply with law, court orders, or lawful requests; to protect safety, rights, or property)
• Business transfers (merger, acquisition, financing, or sale of assets)
• Within our group (parents, subsidiaries, affiliates)
• With your direction or consent

We may share aggregated or de-identified information that cannot reasonably identify you.

4) Cookies and your choices

You can control cookies in your browser settings (blocking, deleting). Doing so may affect some Website features. If we use any advertising or cross-context behavioral cookies, you may opt out via the “Do Not Sell or Share My Personal Information” link (see Section 7).

5) Security

We use reasonable administrative, technical, and physical safeguards to protect personal information. No system is 100% secure. Transmission of data over the internet carries risk. If you have reason to believe your interaction with us is no longer secure, contact us immediately (see Section 12).

6) Retention

We keep personal information only as long as needed for the purposes in this Policy (for example, to provide services, meet legal/recordkeeping requirements, resolve disputes, and enforce contracts), then we delete or de-identify it in line with our retention practices.

7) California privacy rights (CCPA/CPRA)

This section applies to California residents and supplements this Policy.

A. Notice at collection (summary)

We may collect the following categories of personal information: identifiers, professional information, commercial information (if you pay us), internet/usage data, geolocation (coarse from IP), audio/visual (if you call and we record with notice), and in HR contexts, sensitive categories as permitted by law.
Purposes: see Section 2.
Retention: see Section 6.
Categories of recipients: see Section 3.
Sale/Share: We do not sell personal information for money. If we use advertising cookies, those disclosures may be deemed a “sale” or “share” under California law. You can opt out via the “Do Not Sell or Share My Personal Information” link and/or by enabling a Global Privacy Control (GPC) in your browser (we honor GPC).

B. Your CCPA/CPRA rights

Subject to certain limits, you may:

• Know/Access the categories and specific pieces of personal information we collected, used, sold, or shared
• Delete personal information
• Correct inaccurate personal information
• Opt out of sale/share of personal information (if applicable)
• Limit use/disclosure of Sensitive Personal Information (if applicable)
• Non-discrimination: We will not discriminate against you for exercising your rights

C. How to exercise California rights

Submit a request via [privacy email], [web form URL], or [toll-free number, if available]. We will verify your identity (e.g., email, phone, recent interaction details). You may use an authorized agent with proof of authorization and verification.

8) Other U.S. state privacy rights

If you are a resident of Colorado, Connecticut, Montana, Oregon, Texas, Utah, or Virginia, you may have rights to access, delete, correct, and opt out of targeted advertising, sale, and certain profiling. We do not engage in profiling that produces legal or similarly significant effects. To exercise rights, contact us as in Section 12. NOTICE TO TEXAS CONSUMERS: State law may consider certain disclosures of sensitive data a sale; you may opt out as above.

9) GDPR/UK GDPR (EEA/UK residents)

Legal bases

We process personal data under one or more of the following:

• Contract necessity (to provide services or take steps at your request)
• Legitimate interests (e.g., to improve services, secure the Website), not overridden by your rights
• Legal obligations
• Consent (for specific uses; you can withdraw consent at any time)

Your rights

You may have rights to access, rectify, erase, restrict, object, and data portability, and to lodge a complaint with your local supervisory authority. To exercise rights, contact us (Section 12).

International transfers

We may transfer personal data outside the EEA/UK (e.g., to the U.S.). Where required, we use approved safeguards (such as Standard Contractual Clauses).

10) Canada

If you are in Canada, you may have rights to access, correct, and withdraw consent (subject to legal/contractual limits). We send commercial electronic messages in line with CASL and will obtain consent where required. To exercise rights, contact us (Section 12).

11) Children’s privacy

The Website is not directed to children under 13 (or under 16 where applicable). We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us and we will delete it.

12) Your choices and how to contact us

Your choices

• Marketing emails: Unsubscribe using the link in the email or contact us.
• Analytics/advertising cookies: Manage browser settings and any cookie banner preferences; see Section 4.
• Opt-out signals: We honor Global Privacy Control (GPC) signals for sale/share opt-outs where required.

Contact us

For rights requests, please include your name, contact method, the nature of your request, and your state/country of residence. We may ask for additional information to verify your identity.

13) Third-party links

The Website may link to third-party sites or services. Their privacy practices are their own. Please review their policies.

14) Changes to this Policy

We may update this Policy from time to time. The “Effective date” at the top shows when it last changed. Material changes will be posted on this page. Your continued use of the Website means you accept the updated Policy.

15) Additional disclosures for HR, field, and project contexts

Some activities—such as job applications, employment, subcontractor onboarding, field safety, tribal consultation, permit compliance, and archive/museum transfers—involve additional data elements (e.g., emergency contacts, certifications, HAZWOPER, medical fitness notes provided voluntarily, and vehicle/site access details). Where required, we will provide context-specific notices at or before collection and limit use to the relevant purpose, subject to applicable law and recordkeeping rules.

California “Notice at Collection” — quick reference

Category of PI	Examples	Purpose	Sold/Shared?*	Recipients
Identifiers	Name, email, phone, IP	Provide services, respond, secure site	Shared for ads only if advertising cookies are enabled	Service providers; analytics; (ads, if enabled)
Professional info	Company, title, project role	Proposals, contracts, project delivery	No	Service providers; advisors
Commercial/billing	Payment details, invoices	Billing and accounting	No	Payment processors; accountants
Internet/usage	Pages viewed, clicks, IP, device	Analytics, security, improvement	Shared for ads only if advertising cookies are enabled	Analytics; (ads, if enabled)
Geolocation (coarse)	IP-based city/region	Fraud prevention, analytics	No	Service providers
Audio/visual (if recorded)	Voicemails/calls (with notice)	Support, quality, compliance	No	Service providers
Sensitive PI (limited; HR only)	Certifications, limited medical fitness notes (voluntary)	Safety, compliance	No	HR systems; safety admins

*We do not sell PI for money. “Share” refers to CPRA’s definition related to cross-context behavioral advertising. Opt out via the Do Not Sell or Share link and/or GPC.

Plain-English summary (non-binding)

We collect only what we need to run our Website and provide services, keep it as long as needed, protect it with reasonable safeguards, and share it only with trusted parties or when required by law. You can ask us to see, delete, or correct your data (depending on where you live), control cookies, and opt out of certain uses.