1. Who We Are
Data Controller: Echo Collective LLC, 8 East 96th Street, New York, NY 10128, United States, operating as Better Societies.
Email: info@bettersocieties.world
We provide EU AI Act compliance assessment and advisory services to businesses across the EU and internationally. This policy explains how we collect, use, and protect personal data in connection with those services and this website.
2. What Personal Data We Collect
We collect only what we need to operate our services:
- Contact form submissions: name, business email, company name, country, role, and any notes you provide when requesting an assessment or discovery call.
- Email communications: content of emails you send to us and our replies.
- Calendar data: name and email when you book a call via Cal.com.
- Technical/analytics data: aggregate, server-side analytics only (page counts, referrer). We do not use client-side tracking pixels, fingerprinting, or third-party analytics scripts.
We do not collect sensitive personal data (health, financial, biometric, etc.) through this website.
3. Legal Basis for Processing (GDPR Art. 6)
- Legitimate interest (Art. 6(1)(f)): Outreach to business decision-makers at organisations subject to the EU AI Act, where we have a reasonable basis to believe our services are relevant to their compliance obligations. You may object at any time (see Section 7).
- Contract performance (Art. 6(1)(b)): Processing necessary to deliver assessment and advisory services you have engaged us for.
- Consent (Art. 6(1)(a)): Where we rely on consent (e.g. optional marketing), we obtain it explicitly and you may withdraw it at any time without affecting the lawfulness of prior processing.
- Legal obligation (Art. 6(1)(c)): Where processing is required to comply with applicable law.
4. How We Use Your Data
- To respond to enquiries and schedule discovery calls.
- To deliver compliance assessments and related advisory work.
- To send follow-up communications relevant to your compliance situation.
- To improve our services based on aggregate, non-identifiable usage patterns.
We do not sell your personal data. We do not share it with third parties for their own marketing purposes.
5. Third-Party Service Providers
We share data only with the following processors, under appropriate data processing agreements:
- Resend — transactional email delivery (your email address for sending assessment reports and follow-up communications).
- Cal.com — calendar booking (name and email when you schedule a call).
- Cloudflare — web infrastructure, DDoS protection, and security (may process IP addresses and technical metadata).
6. International Data Transfers
Echo Collective LLC is based in the United States. When we transfer personal data from the EEA to the US, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission, or other lawful transfer mechanisms. Where our processors operate outside the EEA, we ensure equivalent safeguards are in place.
7. Your Rights Under GDPR
If you are in the EEA or UK, you have the following rights:
- Access (Art. 15): Request a copy of the personal data we hold about you.
- Rectification (Art. 16): Request correction of inaccurate data.
- Erasure (Art. 17): Request deletion of your data, subject to our legal retention obligations.
- Restriction (Art. 18): Request that we limit processing of your data in certain circumstances.
- Portability (Art. 20): Receive your data in a structured, machine-readable format.
- Objection (Art. 21): Object to processing based on legitimate interest, including for direct marketing. We will stop unless we have compelling legitimate grounds.
- Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.
To exercise any of these rights, contact us at info@bettersocieties.world. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (e.g. the CNIL in France, BfDI in Germany, ICO in the UK).
8. Data Retention
We retain personal data for 24 months from the date of last interaction unless a longer retention period is required by law, or you ask us to delete it sooner. Assessment deliverables may be retained longer if required for our professional records obligations.
9. Cookies
This website uses no third-party tracking cookies. For full details, see our Cookie Policy.
10. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. All data in transit is encrypted via TLS. Access to personal data is restricted to personnel who need it to perform their duties.
11. Changes to This Policy
We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated directly to contacts where we hold an email address.
12. Contact & DPA Queries
For any privacy queries, data subject requests, or data processing agreement (DPA) enquiries:
Echo Collective LLC / Better Societies
8 East 96th Street, New York, NY 10128
info@bettersocieties.world