Privacy Policy
Suite Enrich Co
Last Updated: June 2026 | Version 3.2
Suite Enrich Co, a Colorado S-Corporation doing business as "Suite Enrich" ("Suite Enrich," "we," "us," or "our"), is committed to transparency about how we collect, use, and disclose personal data. This Privacy Policy explains our data practices when you visit suiteenrich.com ("Website") or use the Suite Enrich AI platform and related services (the "Service").
This Policy applies to all users including Website visitors, Free/Beta users, SMB customers, and Enterprise customers, and is incorporated by reference into the Master Service Agreement ("MSA").
Geographic Availability. Suite Enrich AI is currently available only to users located in the United States or Australia. This service is not directed at individuals or organizations in the European Union, European Economic Area, or United Kingdom. We may expand availability to additional regions in the future.
1. Scope
This Privacy Policy applies to: (a) visitors to suiteenrich.com and associated subdomains; (b) users of the Suite Enrich AI Service; (c) customer representatives and Authorized Users; (d) individuals who communicate with us. This Policy does not apply to: (a) third-party websites linked from our Website or Service; (b) data independently collected and retained by Third-Party Data Providers acting as independent controllers (see Section 5).
2. Information We Collect
2.1 Account and Registration Data
When you create an account or subscribe to the Service, we collect: name, business email address, company name, job title, account credentials, and billing information (processed by our payment processor, Stripe). We also collect communications with our support and sales teams.
2.2 Customer-Submitted Data
When providing enrichment services, we process data submitted by Customers as a Data Processor under the DPA. This may include: contact names, business email addresses, company affiliations, job titles, and other professional information. Customers are the Data Controllers for this data and are responsible for ensuring lawful submission.
2.3 Enrichment Response Data
Enriched Data returned by the Service is derived from Third-Party Data Providers (one or more Third-Party Data Providers, whose identities are disclosed upon written request to support@suiteenrich.com) and AI processing. This data passes through our systems but is not stored long-term. Enriched Data is returned directly to the Customer's ERP environment.
2.4 Automatically Collected Technical Data
We automatically collect: IP address, device type and operating system, browser type and version, log files and timestamps, referring URLs, pages visited and time spent, usage metrics and Credit consumption data, and authentication events.
2.5 Cookie and Analytics Data
We collect data through cookies, Google Analytics, and similar technologies as described in Section 12.
3. How We Use Information and Data Sales Disclosure
We use information for: (a) providing and operating the Service; (b) authenticating users and enforcing security; (c) performing data enrichment on behalf of Customers; (d) AI-assisted processing including reporting, analytics, scoring, and automated insights; (e) managing Credits, usage, and subscriptions; (f) processing payments via Stripe; (g) communicating about accounts, support, and service updates; (h) improving Service performance and reliability; (i) analyzing Website traffic and usage patterns; (j) complying with legal obligations; (k) detecting and preventing fraud, abuse, and security incidents.
AI-assisted processing is probabilistic and may produce inaccurate or incomplete results. AI-generated output should not be treated as verified or authoritative without independent validation. Suite Enrich does not use Customer-submitted Personal Data to train AI models without Customer's express written consent.
3.1 California Data Broker Disclosure and Data Sales
Suite Enrich is registered (or in the process of registering) as a California data broker under Cal. Civ. Code §1798.99.80. As a data broker, Suite Enrich knowingly collects and transmits business contact information — including professional names, business email addresses, job titles, company affiliations, phone numbers, and professional history — from Third-Party Data Providers to its customers in exchange for subscription fees and credit purchases. This activity may constitute a "sale" or "sharing" of personal information under the California Consumer Privacy Act (CCPA/CPRA).
What we sell: Suite Enrich provides enriched B2B contact and company data to its business customers exclusively for B2B sales, marketing, business development, and recruiting outreach purposes. This data relates to individuals in their professional capacity only.
What we do NOT sell: We do not sell (a) sensitive personal information such as health data, financial data, SSNs, or biometric data; (b) personal information of individuals acting in a personal or household context; (c) personal information for cross-context behavioral advertising or targeted consumer advertising; or (d) data to foreign adversary countries as defined under the Protecting Americans' Data From Foreign Adversaries Act.
All data provided to customers is subject to license agreements restricting downstream use to B2B purposes only. Customers are contractually prohibited from using enriched data for FCRA-regulated purposes.
3.2 California Delete Act / DROP Platform
Pursuant to California's Delete Act (SB 362, AB 1824), beginning August 1, 2026, Suite Enrich will access the California Privacy Protection Agency's Data Rights Opt-out Platform (DROP) at least once every 45 days to retrieve consumer deletion requests. Suite Enrich will process all valid deletion requests within 45 days of retrieval. Consumers may submit deletion requests directly to Suite Enrich at support@suiteenrich.com or via our Privacy Choices page. Deletion requests result in suppression of the requesting individual's personal information from future enrichment outputs.
3.3 Do Not Sell or Share My Personal Information
California residents may opt out of the sale or sharing of their personal information at any time by: (a) visiting our Privacy Choices page; (b) contacting support@suiteenrich.com with subject line "Do Not Sell or Share — California"; or (c) using the Global Privacy Control (GPC) signal in your browser, which we honor as an opt-out. We will process opt-out requests within 15 business days.
4. Legal Bases for Processing (GDPR)
Where GDPR or UK GDPR applies, we process personal data based on: (a) Performance of a Contract — processing necessary to provide the Service; (b) Legitimate Interests — service operation, security, fraud prevention, and improvement; (c) Legal Obligations — compliance with applicable laws; (d) Consent — where required, which may be withdrawn at any time.
5. Data Enrichment and Third-Party Data Providers
5.1 How Enrichment Works
To provide enrichment, we transmit limited information (names, emails, company details) submitted by Customers to Third-Party Data Providers, which return matching professional and business information. We apply additional AI-based processing before returning results to Customers. Our current Third-Party Data Providers are disclosed upon written request to support@suiteenrich.com.
Suite Enrich is NOT a consumer reporting agency as defined under the Fair Credit Reporting Act (15 U.S.C. §1681a(f)). Enriched Data is not a consumer report and may not be used for credit eligibility, employment screening, insurance underwriting, tenant screening, housing decisions, or any FCRA-regulated purpose.
5.2 Third-Party Data Provider Roles
Third-Party Data Providers act in a dual capacity: (a) As Processors — retrieving data on our behalf under contractual obligations; (b) As Independent Controllers — maintaining their own data repositories, retaining queries and results, and using data for their own legitimate business purposes governed by their own privacy policies.
5.3 What Third-Party Data Providers May Do With Data
Third-Party Data Providers may: (a) retain search queries and retrieved data; (b) use retained data for data quality improvement, analytics, product development, and compliance; (c) make retained data available to their other customers; (d) govern retained data under their own privacy policies. Suite Enrich does not control Third-Party Data Provider retention or use. Contact support@suiteenrich.com for information about specific providers.
6. Data Sharing and Disclosure
We may share information with: (a) Service Providers and Sub-processors (cloud hosting, security, payment processing, AI processing) under contractual obligations — list available upon request; (b) Third-Party Data Providers as described in Section 5; (c) Legal Authorities when required by law or legal process; (d) Business Transfer recipients in connection with a merger, acquisition, or asset sale; (e) Professional Advisors as necessary.
We do not sell personal information for advertising. We do not transfer personal data to entities in Foreign Adversary Countries (China, Russia, Iran, North Korea) as designated under the Protecting Americans' Data From Foreign Adversaries Act (P.L. 118-50).
7. International Data Transfers
Personal data may be transferred to the United States (Oracle Cloud Infrastructure). Where required, we implement Standard Contractual Clauses (SCCs) pursuant to EU Commission Decision 2021/914, the UK International Data Transfer Addendum, and additional supplementary measures as necessary. We do not transfer personal data to Foreign Adversary Countries.
8. Data Retention
- Account Data: Duration of MSA plus 90 days post-termination, then deleted from active systems.
- Customer-Submitted Data: Processed transiently for enrichment; not stored long-term.
- Usage and Billing Data: Duration required to fulfill billing, accounting, and legal obligations (minimum 7 years for financial records).
- Technical/Log Data: Up to 12 months for security, troubleshooting, and operational purposes.
- Third-Party Data Provider Data: Governed by their own retention policies.
- California DELETE Act requests: Honored within 45 days of retrieval from the DROP platform.
Data subject to a legal hold will be retained until the hold is lifted regardless of standard retention schedules. Residual copies in automated backups are deleted within 6 months for personal data. Third-Party Data Providers may retain query parameters submitted through their APIs for internal purposes including monitoring, quality assurance, and security. These parameters are not shared with other clients of those providers.
9. Data Security
We implement reasonable technical and organizational safeguards, including: (a) encryption of data in transit (TLS 1.2+); (b) encryption of data at rest (AES-256); (c) access controls and role-based authentication; (d) tenant isolation in multi-tenant environments; (e) audit logging and monitoring; (f) API key hashing — no plaintext credential storage; (g) network security controls; (h) regular security assessments. See our Security Overview for current posture details. No system is completely secure and we cannot guarantee absolute security. Our Third-Party Data Providers may process data on servers located in the United States and the European Union, including Germany and Finland. All such providers maintain appropriate legal mechanisms for cross-border data transfers in compliance with applicable law.
10. Your Privacy Rights
10.1 GDPR Rights (EEA and UK)
You may have the right to: access, rectification, erasure, restriction, objection, data portability, consent withdrawal, and lodging a complaint with a supervisory authority.
10.2 CCPA/CPRA Rights (California)
You may have the right to: know what personal information is collected about you and how it is used; request deletion; correct inaccurate information; opt out of the sale or sharing of your personal information; and non-discrimination for exercising rights. As a registered California data broker, Suite Enrich is subject to the California Delete Act (SB 362) and processes consumer deletion requests via the CPPA's DROP platform. To exercise California rights, visit our Privacy Choices page or contact support@suiteenrich.com.
10.3 Colorado Privacy Act Rights
You may have the right to: access, correct, delete, obtain portable copies of, and opt out of certain processing of your personal information. The Colorado Privacy Act's B2B exemption (C.R.S. §6-1-1303(6)) may apply to data about you in your professional capacity.
10.4 Rights Regarding Third-Party Data Provider Data
For data held by Third-Party Data Providers: (a) we will facilitate requests where feasible; (b) providers may respond directly; (c) requests may be limited by legal or technical constraints; (d) deletion requests submitted via DROP will result in suppression from future enrichment outputs.
10.5 How to Exercise Your Rights
Contact support@suiteenrich.com or visit our Privacy Choices page. We will: (a) acknowledge your request within five (5) business days; (b) verify your identity through reasonable means (no verification required for opt-out requests); (c) respond within 45 days for CCPA/Colorado CPA requests, 30 days for GDPR requests (each extendable with notice).
10.6 Colorado Privacy Act Appeal Process
If you are a Colorado resident and we deny your privacy rights request, you have the right to appeal. Send a written request to support@suiteenrich.com with the subject line "CPA Appeal — [Your Name]" within 30 days of our denial. We will respond within 60 days. If we uphold the denial, we will provide information about filing a complaint with the Colorado Attorney General at coag.gov. This right is provided pursuant to C.R.S. §6-1-1306(1)(c).
11. Universal Opt-Out and Do Not Track
11.1 Colorado Universal Opt-Out Mechanism (Global Privacy Control)
In compliance with the Colorado Privacy Act (C.R.S. §6-1-1306(1)(d)(IV)), Suite Enrich honors the Global Privacy Control (GPC) browser signal as an opt-out of the sale or sharing of personal information for Colorado residents. We also voluntarily honor GPC signals for California residents as part of our data broker compliance. If your browser has GPC enabled, we will treat your visit as an opt-out of any processing that constitutes a sale or sharing of personal information.
11.2 Do Not Track
We do not currently respond to Do Not Track (DNT) browser signals. The GPC signal described above is the recognized Universal Opt-Out Mechanism under Colorado law.
12. Cookies and Tracking Technologies
- Essential Cookies: Required for Website and Service operation, authentication, and session management.
- Analytics Cookies (Google Analytics): Collects IP address (may be anonymized), browser type, pages visited, and time spent. Processed by Google per Google's Privacy Policy. Opt out at tools.google.com/dlpage/gaoptout.
- Functionality Cookies: Remember user preferences and settings.
- Performance Cookies: Monitor and improve Website and Service performance.
You may control or delete cookies through your browser settings. Colorado residents using a GPC-enabled browser will be treated as having opted out of any non-essential data collection that constitutes a sale or sharing of personal information under the CPA.
13. Children's Privacy
The Website and Service are not intended for children under 16. Authorized Users must be at least 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected such information, we will promptly delete it. Contact support@suiteenrich.com if you believe we have inadvertently collected information from a child.
14. Changes to This Privacy Policy
We may update this Policy to reflect changes in practices, technology, or legal requirements. Material changes will be posted with a revised "Last Updated" date and version number. Where required, we will provide additional notice via email or in-Service notification. Continued use after changes constitutes acceptance. Prior versions are available upon request.
15. Contact Us
For privacy questions, data subject requests, California data broker inquiries, or DELETE Act/DROP requests:
Email: support@suiteenrich.com
Privacy Choices: suiteenrich.com/privacy-choices
Security Overview: suiteenrich.com/security
Suite Enrich Co
6153 S Logan Pl
Centennial, CO 80121
16. Artificial Intelligence Governance (Colorado AI Act Disclosure)
In compliance with the Colorado Artificial Intelligence Act (SB 24-205, C.R.S. §6-1-1701 et seq.), effective June 30, 2026, Suite Enrich provides the following disclosures. See our dedicated AI Governance page for full details.
16.1 AI Systems Used
The Suite Enrich AI platform uses artificial intelligence, machine learning, and natural language processing to perform data enrichment, record matching, data normalization, analytics, reporting, and related features. These systems may function as "high-risk AI systems" under the Colorado AI Act if Customer uses Enriched Data in connection with consequential decisions (C.R.S. §6-1-1701(3)).
16.2 AI Risk Management
Suite Enrich has adopted the NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0) as its AI governance standard, which constitutes an affirmative defense under C.R.S. §6-1-1702/6-1-1703. Our program includes regular risk assessment, bias testing, human oversight protocols, and incident reporting procedures.
16.3 Discrimination Risk Management
Suite Enrich assesses the risk of algorithmic discrimination and has implemented: (a) regular bias testing of matching algorithms; (b) human review procedures for flagged results; (c) contractual restrictions prohibiting use of Enriched Data as the sole basis for consequential decisions without human oversight.
16.4 Contact for AI Governance
For questions about Suite Enrich's AI governance, AI Model Card requests, or to report AI-related discrimination concerns, contact support@suiteenrich.com or visit suiteenrich.com/ai-governance.
17. Australian Privacy Disclosures (Appendix A)
This section applies to individuals located in Australia and to Australian customers of Suite Enrich. It is provided in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
17.1 APP Entity Status
Suite Enrich Co is an APP entity bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs) by reason of carrying on business in Australia under section 5B(3) of the Privacy Act. Privacy inquiries from Australian individuals should be directed to support@suiteenrich.com.
17.2 Kinds of Personal Information Handled
Suite Enrich handles the following categories of personal information about Australian individuals: professional identity (full name, professional title, seniority level); business contact details (business email address, business telephone number, business address); employment information (current and previous employers, job history, industry, department); company affiliation (company name, company size, company location, company industry); professional online presence (LinkedIn profile URL, professional headline); and account and billing data for customers (name, billing email, company name, payment information processed by our payment processor).
Suite Enrich does not intentionally handle sensitive information as defined in the Privacy Act 1988 (Cth). Sensitive information categories are excluded from enrichment fields by design.
17.3 How Personal Information Is Collected
Direct collection: Suite Enrich collects personal information directly from individuals who create accounts, subscribe to the Service, or communicate with Suite Enrich; Customer representatives and Authorised Users; and website visitors to suiteenrich.com.
Indirect collection: Suite Enrich also collects personal information about individuals indirectly through the data enrichment process. When a Customer submits a record for enrichment, Suite Enrich queries external B2B professional data providers and returns matching professional information. These providers compile professional information from publicly available sources including professional networking platforms, company websites, and other public professional records. Individuals are notified of this indirect collection through this Privacy Policy (publicly accessible at suiteenrich.com/privacy), the Australian Customer Privacy Addendum accepted by each Australian customer, and Customers' own privacy notices. This notice is provided in accordance with APP 5.2 of the Privacy Act 1988 (Cth).
17.4 Purposes for Handling Personal Information
Suite Enrich handles Australian personal information to: provide B2B data enrichment services to Australian customers; manage accounts and customer relationships; process payments (billing data only); maintain service security, monitoring, and fraud prevention; improve the Service using anonymised, de-identified data; and comply with legal and regulatory obligations. Suite Enrich does not handle Australian personal information for direct marketing to individuals without their consent. Australian customers who use enriched data for their own direct marketing are responsible for compliance with the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth), and APP 7.
17.5 Overseas Recipients (APP 8 Disclosure)
In providing the Service, Suite Enrich discloses personal information about Australian individuals to overseas recipients in the following categories and countries. Suite Enrich has taken reasonable steps under APP 8.1 to ensure each recipient handles personal information consistently with the APPs. A full list of overseas recipients and sub-processors, including entity names and specific contractual safeguards, is available upon written request to support@suiteenrich.com.
| Recipient category | Countries / Regions |
|---|---|
| Cloud infrastructure and platform services | United States |
| B2B professional data providers | United States; servers also located in Germany, Finland, Georgia, and Lithuania |
| AI processing services | United States |
| Payment processing | United States |
| Workflow automation | United States |
Each overseas recipient is bound by contractual data protection obligations materially equivalent to the APPs. Where recipients process data within the European Union, they are additionally subject to the GDPR. Suite Enrich does not transfer Australian personal information to entities in Foreign Adversary Countries as designated under PADFAA. Note: section 16C of the Privacy Act may treat certain overseas recipient acts as acts of the disclosing Australian entity — Suite Enrich's contractual safeguards are designed to minimise this risk.
17.6 Data Retention
- Account and registration data: Duration of MSA plus 90 days post-termination, then deleted from active systems.
- Raw enrichment response payloads: Not retained in Suite Enrich systems. Enriched values are written directly to Customer's ERP environment.
- Query parameters submitted to external data providers: Retained by those providers for their internal monitoring, quality assurance, and security purposes. Not shared with those providers' other customers.
- Usage and billing data: Duration required by legal and accounting obligations (minimum 7 years for financial records).
- Technical and log data: Up to 12 months for security and operational purposes.
17.7 Security (APP 11 and APP 11.3)
Suite Enrich implements technical and organisational measures to protect Australian personal information against misuse, interference, loss, and unauthorised access, modification, or disclosure, in accordance with APP 11 and APP 11.3 (in force from 11 December 2024). Measures include encryption in transit and at rest, role-based access controls, multi-factor authentication, tenant isolation, network security controls, audit logging, and no long-term retention of raw enrichment payloads. See suiteenrich.com/security for details.
17.8 Notifiable Data Breaches
Suite Enrich is subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). If Suite Enrich has reasonable grounds to believe an eligible data breach has occurred affecting Australian personal information, Suite Enrich will assess the suspected breach within 30 days (section 26WH), notify the OAIC and affected individuals if confirmed (sections 26WK and 26WL), and notify affected customers within 24 to 48 hours of becoming aware of the incident.
17.9 Privacy Rights for Australian Individuals
Under the Privacy Act 1988 (Cth), Australian individuals have the right to request access to personal information Suite Enrich holds about them (APP 12) and to request correction of inaccurate information (APP 13). To exercise these rights, contact support@suiteenrich.com. We will respond within 30 days. For access to data held by external data providers, Suite Enrich will facilitate and provide relevant contact details within 5 business days. Because enriched personal information is written directly to the Customer's ERP environment and not retained in Suite Enrich's systems as raw data, access requests regarding enriched field values should in the first instance be directed to the Customer who used the Service.
17.10 Source of Enriched Data (APP 5.2(b))
Enriched professional information is sourced from external B2B professional data providers that compile publicly available professional information from sources including professional networking platforms, company websites, and other public professional records. If you wish to exercise privacy rights in relation to data held by Suite Enrich's external data providers, contact support@suiteenrich.com. Suite Enrich will provide you with the relevant provider contact details within 5 business days.
17.11 OAIC Complaint Pathway
Suite Enrich will acknowledge privacy complaints from Australian individuals within 5 business days and respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC): oaic.gov.au | 1300 363 992 | oaic.gov.au/privacy/privacy-complaints. The complaint process is set out in section 36 of the Privacy Act 1988 (Cth).
17.12 Automated Decision-Making (from December 2026)
From 10 December 2026, the Privacy Act 1988 (Cth) will require APP entities to disclose automated decision-making processes with significant effects on individuals in their privacy policies. Suite Enrich will update this section prior to that date. Australian customers who use enriched data or AI-generated outputs in automated processes affecting individuals should assess their own ADM disclosure obligations and update their privacy policies from December 2026.