This Privacy Policy explains how Adaptavist Inc. collects, uses, stores and protects personal information when people visit this website, contact the instrument hall, or engage the engineering practice.
Adaptavist Inc. values the trust that people place in the practice when they share personal information with it. This Privacy Policy describes the information that the Company receives, the reasons the information is needed, the way it is handled while it remains in the possession of the Company, and the choices available to the people whose information it is. The policy applies to the website published at adaptavist.lat and to enquiries, appointments and correspondence that follow from a visit to that website.
This website is developed and operated by Adaptavist, the developer of the pages and the operator of the practice, on behalf of Adaptavist Inc. The developer maintains the text, the design and the small scripts that make the pages work, and answers for the way each page treats the people who read it. The Company designs self-aligning control systems, sensor fusion platforms and calibration environments, and the website exists to explain that work and to make it possible for prospective clients to begin a conversation with the engineering desk in Reston. Nothing on the website requires a visitor to identify themselves, and every form on the site is designed so that a visitor may choose to send a message through their own mail program rather than through a server owned by the Company.
This policy is written in plain language on purpose. Legal provisions that protect visitors are discussed in ordinary words so that a reader who is not a lawyer can still understand what the Company does with information and what a reader can ask the Company to do differently. Where the Company must use a term that has a specific legal meaning, the term is explained the first time it appears.
The Company is established in the United States and carries out its engineering work from an instrument hall in Reston, Virginia. The policy is intended to reflect the standards that the Company expects of itself as a professional services firm, including the standards that apply to technical consultancies working with commercial clients in scientific and industrial sectors.
The organisation responsible for the processing described in this policy is Adaptavist Inc. The registered business address is 12110 Sunset Hills Rd Ste 600, Reston - 20190-5916, United States (US). The Company may be reached by email at appointments@adaptavist.lat or by telephone at +18208422154 during the business hours stated on the contact page.
The Company operates within the professional, scientific and technical services sector, with a focus on computer integrated systems design and related engineering services. Its clients are typically organisations that operate machines, instruments or test environments where a stable and traceable reference is important. Personal information handled by the Company therefore usually relates to business contacts, technical staff at client organisations, suppliers and individuals who make enquiries through the website.
For the purposes of applicable data protection law, the Company acts as a controller when it decides why and how personal information is processed for its own business purposes, such as responding to an enquiry or administering a contract. Where a client supplies information about that client employees for the purpose of an engineering programme, the client generally remains responsible for that information and the Company acts on the instructions of the client as a processor or service provider.
Questions about this policy, about the identity of the controller for a particular activity, or about the role of the Company in a specific engagement may be directed to the contact address above. The Company welcomes questions of this kind because they allow the practice to explain its arrangements before a misunderstanding arises.
This policy applies to personal information that the Company collects through the website, through email and telephone contact, through appointments booked with the engineering desk, and through the ordinary conduct of client and supplier relationships. It applies regardless of how the information arrives, whether through a web form, a message composed in a visitor mail program, a telephone call, a business card exchanged at a trade event, or a signature block at the end of an email thread.
The policy does not apply to information that the Company processes on behalf of a client under a written contract where the client determines the purposes of processing. In those situations the client privacy notice governs the relationship between the client and the individuals concerned, and the Company handles the information only as the client directs. The policy also does not apply to websites operated by other organisations, even where the Company website contains a link to them.
Where the Company publishes technical documentation, calibration records or alignment reports, those documents may include the names of engineers or client representatives. The Company treats such names as personal information and applies the same standards of care to them as to any other personal information described in this policy. Records of this kind are normally retained for the period during which the platform remains in service, because they are needed to support future alignment work.
The policy is not a contract and does not create contractual rights beyond those that already exist under applicable law. It is a statement of practice. The Company reviews the statement regularly and updates it when its activities change, when technology changes, or when the law requires a different description of its conduct.
The Company collects only the information that is needed for the purpose at hand. In most cases that means a name, an email address, a telephone number, an organisation name and the content of a message. When a visitor chooses to send a message through the contact form, the form uses the visitor own mail program, so the message reaches the Company as an ordinary email and the Company receives only what the visitor chooses to include.
Directly provided information includes identification details such as name and job title, contact details such as email address and telephone number, organisational details such as employer name and department, and the substance of any enquiry. Where a visitor requests a survey visit, the Company may also receive site address details and the names of people who will meet the engineer on arrival.
Where a client engages the practice, the Company receives contract documents, purchase order references, invoicing details and the names of people authorised to approve work. The Company may also receive technical documents that happen to contain names, such as drawings with a reviewer block or test reports with an operator signature.
The web server that delivers this website may record routine technical information in its logs, including the internet protocol address of the connecting device, the browser type, the requested page, the referring page and the time of the request. These logs are used to keep the site available and to investigate faults or abuse. The Company does not use the logs to build profiles of individual visitors and does not attempt to identify a visitor from a log entry unless a security incident requires it.
The website does not include advertising trackers, social media pixels or third party behavioural analytics. Fonts are loaded from a public font service, which means the visitor browser contacts that service when a page is displayed and the service may receive the internet protocol address of the visitor as part of that request. No other remote resource is loaded by the pages of this website.
The Company may receive limited information about a contact from a mutual business associate, from a public company register, or from a trade event attendance list. When that happens the Company records the source so that the contact can be told where the information came from if the contact asks. The Company does not purchase contact lists from data brokers.
Most personal information reaches the Company because a person chooses to make contact. A prospective client writes to the appointments address, a supplier sends a quotation, a conference delegate asks a question after a talk. In each case the person is the source of the information and can decide how much to provide.
A smaller amount of information arrives through the routine operation of the website, as described in the previous section. This information is technical in nature and is not used to identify individuals except where a security or availability incident makes identification necessary.
In some engagements the Company receives information about a client team from the client itself. For example, a client may send a list of engineers who will attend a design review, or a contact sheet for a site visit. The Company expects the client to have a lawful basis for sharing those details and to have informed the individuals concerned. Where the Company notices that such a list appears to have been shared without notice, the Company raises the point with the client before using the list.
The Company does not obtain personal information through covert means, does not scrape contact details from other websites, and does not use purchased marketing lists. Where the Company wishes to contact a person whose details it does not hold, it uses a public business channel and explains how the details were found.
The Company processes personal information for a small number of clearly defined purposes. Each purpose is connected to the professional relationship between the Company and the person concerned, and the Company does not repurpose information for unrelated activities without a fresh notice.
Where the Company wishes to use information for a purpose that is not listed above, it explains the new purpose to the person concerned and, where the law requires it, asks for consent. The Company does not treat a general consent to receive correspondence as permission to use a person details for a different activity.
Where the General Data Protection Regulation or a similar framework applies, the Company relies on one of several legal bases for each processing activity. The basis chosen depends on the activity and on the relationship between the Company and the individual.
When a person asks for a quotation or commissions a programme, the Company processes the necessary information to take steps at the request of the person before entering a contract and to perform the contract once it is in place. This basis covers the exchange of technical documents, the arrangement of visits and the administration of invoices.
The Company relies on legitimate interests for activities such as responding to a business enquiry, keeping routine server logs, maintaining security, and following up on a professional relationship that already exists. Before relying on this basis the Company considers whether the individual would reasonably expect the processing and whether the interests of the individual outweigh those of the Company.
Some information must be processed because the law requires it, for example tax and accounting records or records connected with health and safety at a site visit. In these cases the Company keeps only what the obligation requires and retains it for the period the law specifies.
Where the Company relies on consent, for example for an optional newsletter, the consent is sought separately and can be withdrawn at any time. Withdrawal of consent does not affect processing that took place before the withdrawal and does not affect processing that relies on a different legal basis.
The Company does not operate a behavioural analytics platform on this website. It does not use tools that record mouse movement, session replay, heat maps or cross-site identifiers. The absence of these tools is deliberate, because the website exists to describe engineering work rather than to collect audience data.
The Company may review aggregate server statistics such as the number of requests for a page and the number of failed requests. These statistics are used to keep the site available and to decide which technical pages deserve further work. They are not combined with any other information and are not used to identify a visitor.
Where the Company publishes a page that is clearly popular with prospective clients, the Company may invest in expanding that page. This decision is based on aggregate counts rather than on the behaviour of any individual. A visitor who uses a browser privacy mode or a content blocker will still see the full content of the site.
The Company uses a small number of service providers to operate the website and the business. These providers act on written instructions and are not permitted to use information for their own purposes. The main categories are web hosting, email delivery, accounting and information technology support.
Hosting providers receive the technical information described in the section on automatically collected data. Email providers receive the content of messages exchanged with the Company, including attachments. Accounting providers receive invoicing and payment details. Information technology support providers may access systems where a fault must be diagnosed, and their access is limited to the systems required for the task.
The Company reviews the security arrangements of providers before engaging them and at reasonable intervals afterwards. Where a provider is located outside the United States, the Company checks that an appropriate transfer mechanism is in place as described in the section on international transfers.
A provider that suffers an incident affecting Company information is required to notify the Company without undue delay. The Company then assesses the incident and takes the steps described in the section on incident notification.
The Company is based in the United States and normally processes information within the country. Some service providers or client organisations may be located elsewhere, and in those cases information may cross a border. The Company takes steps to ensure that the transfer is lawful and that the information continues to receive an appropriate level of protection.
Where information is transferred from the European Economic Area, the United Kingdom or Switzerland, the Company relies on an adequacy decision where one exists, or on standard contractual clauses approved by the relevant authority. The Company may also rely on the necessity of the transfer for the performance of a contract with the individual, for example where a client engineer requests a call at a particular time zone.
Transfers are kept to the minimum needed for the purpose. The Company does not route routine correspondence through a country that has no connection with the engagement simply because a provider offers a lower price. A visitor who wishes to know which countries are involved in a specific engagement may ask the contact address and will receive a written answer.
The Company keeps personal information only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires. Retention periods are set by category rather than by a single blanket rule, because different kinds of information serve different purposes.
When a retention period ends, the information is deleted or anonymised. Where deletion is not immediately possible because information is held in a backup, the backup is isolated from ordinary use and is overwritten on its normal rotation. The Company does not keep information indefinitely on the principle that it might be useful one day.
The Company protects personal information with a combination of technical and organisational measures. The measures are chosen to match the sensitivity of the information and the risk of harm if it were lost, altered or disclosed. Because the Company handles engineering records rather than financial accounts or health records, the principal risks are unauthorised access to correspondence and loss of calibration records that support a client platform.
Technical measures include encrypted connections for the website, access controls on the systems that hold correspondence and records, regular software updates, and separation between the systems used for engineering work and the systems used for general office activity. Passwords are managed through a password manager and multi factor authentication is used for remote access.
Organisational measures include limiting access to the people who need it, requiring confidentiality commitments from staff and contractors, and keeping written procedures for the handling of client records. Engineers who visit client sites follow a short security briefing before travel, and devices that leave the instrument hall are encrypted.
No system is perfectly secure, and the Company does not claim otherwise. The measures described here are reviewed at least once a year and after any significant change in systems or personnel. A visitor who believes that information held by the Company has been compromised should contact the Company immediately using the details in the contact section.
Depending on where a person lives, the law may give that person a set of rights over personal information held by the Company. The Company honours these rights for everyone who asks, regardless of location, because the practice prefers a single standard to a patchwork of local rules.
Exercising a right does not usually involve a fee. The Company may ask for information that confirms identity before acting on a request, so that it does not disclose information to the wrong person. A request is normally answered within one month, and if the request is complex the Company explains the reason for any extension.
A request for access or correction should be sent to appointments@adaptavist.lat with enough detail for the Company to locate the record. Useful details include the name used in correspondence, the approximate date of contact, and the programme or platform concerned. The Company does not require a formal template and will help a requester identify the right record.
Where the Company holds information about a person in more than one system, the response draws together the relevant entries so that the requester sees a complete picture. Where part of the information concerns another person, the Company may redact that part, and it explains what has been redacted and why.
If a correction is not possible because the record must remain as originally made, for example a signed calibration report, the Company adds a note recording the correction requested. The original record and the note are kept together so that the history remains clear.
A person who is not satisfied with the response may ask for the decision to be reviewed by a senior member of the Company. The review is handled by someone who was not involved in the original decision, and the outcome is explained in writing.
This website describes professional engineering services and is not directed at children. The Company does not knowingly collect personal information from anyone under the age of sixteen through the website. If the Company becomes aware that such information has been received, it deletes the information promptly and does not use it for any purpose.
Where a site visit takes place at a facility that includes an educational programme, the Company may encounter young people in the area. In that case the Company follows the visitor rules of the facility and does not record names or images of young people without the consent of the responsible adult and the facility.
A parent or guardian who believes that a child has sent information to the Company may contact the appointments address and ask for the information to be removed. The Company will confirm removal in writing once it has verified the request.
The Company sends occasional technical notes to contacts who have asked to receive them. These notes describe developments in alignment practice, calibration technique or test rig design. They are not sent to purchased lists and they are not used to advertise unrelated products.
Every marketing message includes a way to stop receiving further messages. A request to stop is honoured promptly and is recorded so that the address is not added again by accident. Transactional messages, such as a confirmation of an appointment or an invoice, are not marketing and continue while the relationship requires them.
Where the law requires prior consent for marketing email, the Company asks for that consent separately and records when and how it was given. Consent may be withdrawn at any time by replying to a message or by writing to the appointments address.
The Company does not share an address with another organisation for that organisation own marketing. A service provider that sends email on behalf of the Company is bound by a written instruction that limits use of the address to the delivery of the message.
This website may contain links to other websites, for example a standards body, a component supplier or a professional association. The Company provides these links because they are useful to a technical reader, but it does not control the content or the privacy practices of the linked site.
A visitor who follows a link leaves the Company website and becomes subject to the privacy notice of the destination site. The Company encourages visitors to read that notice before providing personal information. The presence of a link does not mean that the Company endorses every practice of the destination site.
Where the Company embeds content from another service, which it currently does only for fonts as described earlier, the embed is chosen so that it does not track individual visitors beyond what the service learns from delivering the file. If the Company later embeds richer content, this policy will be updated and the page will make the embed clear.
The Company does not make decisions about individuals by automated means in a way that produces legal effects or similarly significant effects. Enquiries are read by a person, appointments are arranged by a person, and engineering work is planned by a person.
The control algorithms that the Company designs for client platforms do make automated decisions about the behaviour of a machine, such as how to distribute torque between actuators. Those algorithms act on sensor readings from the machine and not on personal information about people, so they fall outside the scope of this policy.
Where the Company uses software to sort or route correspondence, the sorting is reviewed by a person before any action is taken on an individual request. The Company does not score individuals or assign them a risk rating for the purpose of deciding whether to respond to an enquiry.
If the Company becomes aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, it notifies the relevant supervisory authority without undue delay and, where required, within seventy two hours of becoming aware. The notification describes the nature of the breach, the categories of information concerned, the likely consequences and the measures taken or proposed.
Where a breach is likely to result in a high risk to individuals, the Company also notifies the individuals concerned without undue delay. The notice is written in clear language and explains what happened, what the Company has done, and what the individual can do to reduce any risk.
The Company keeps a record of every incident, including incidents that do not require notification, so that patterns can be identified and the security measures improved. The record is reviewed by a senior member of the practice at least once a year.
The Company prefers to resolve concerns directly. A person who is unhappy with the way personal information has been handled may write to appointments@adaptavist.lat with a description of the concern. The Company acknowledges the message within five working days and aims to provide a substantive response within one month.
If the response does not resolve the concern, the person may ask for the matter to be escalated to a senior member of the practice who was not involved in the original handling. The escalation review considers the record, the applicable law and the expectations of the person concerned, and it ends with a written conclusion.
A person also has the right to complain to a supervisory authority in the country where that person lives or works, or where the alleged infringement took place. The Company does not penalise anyone for making a complaint and continues to provide its services while a complaint is under review.
The Company reviews this policy at least once a year and whenever a significant change occurs in its activities, its systems or the law. When a change is made, the date at the top of the page is updated so that a reader can see how current the text is.
Where a change materially affects the way information is used, the Company provides a clearer notice, for example a short statement on the homepage or a message to contacts who have asked to receive updates. The Company does not apply a materially different use to information already collected without a lawful basis for the change.
Previous versions of the policy are kept internally so that the Company can explain how a particular practice developed. A person who needs to see an earlier version may ask the contact address and the Company will provide it where it is appropriate to do so.
Questions about this policy, requests to exercise a right, and complaints should be sent to Adaptavist Inc. using the details below. The Company asks that messages about privacy include the word privacy in the subject line so that they reach the right person quickly.
Adaptavist Inc.
12110 Sunset Hills Rd Ste 600
Reston - 20190-5916
United States (US)
Email: appointments@adaptavist.lat
Phone: +18208422154
The instrument hall receives visitors by appointment. A person who wishes to discuss a privacy matter in person should arrange a time through the appointments address so that an appropriate member of the practice is available.
This policy should be read together with the Terms of Service, which describe the conditions under which the website and the engineering services are provided. The Terms of Service do not change the commitments made in this policy about personal information.