Privacy policy

Last updated October 16, 2026

Rhymetec, LLC (“Rhymetec,” “we,” “us,” or “our”) respects your privacy and is committed to protecting Personal Information entrusted to us.


This Privacy Policy describes how Rhymetec collects, uses, discloses, stores, and otherwise processes Personal Information when you visit our websites, communicate with us, request or receive information about our services, attend our events, utilize our services, or otherwise interact with Rhymetec.


This Privacy Policy also describes the privacy rights and choices that may be available to you.
For purposes of this Privacy Policy, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identified or identifiable individual. Depending on applicable law, similar terms such as “personal data” may be used.

1. Scope

This Privacy Policy applies to Personal Information that Rhymetec processes in connection with:

  • Visiting Rhymetec’s websites, including Rhymetec.com
  • Utilizing the Rhymetec application and platform available at app.rhymetec.com
  • Interacting with Rhymetec in connection with our services where Rhymetec acts as a controller of Personal Information (together with the Websites and App, the “Rhymetec Offerings”).

A separate agreement governs the provision of Rhymetec’s services (the “Services”) to customers (the “MSA”). This Privacy Policy does not apply when Rhymetec collects personal information as a processor on behalf of a customer of the Services, nor to any third-party applications, software, products, or services that integrate with the Services (“Third-Party Services”), though it may reference those activities for purposes of clarity.


Data Processed on Behalf of Customers
Rhymetec provides cybersecurity, compliance, privacy, risk management, and related professional and managed services.


In providing these services, Rhymetec may process Personal Information on behalf of its customers. When Rhymetec processes Personal Information solely on behalf of a customer pursuant to the customer’s instructions, Rhymetec generally acts as a processor or service provider, and the customer is responsible for determining the purposes and means of processing.


Such processing is governed by the applicable customer agreement and, where applicable, Rhymetec’s Data Processing Agreement (“DPA”).


If you have a privacy request relating to Personal Information controlled by a Rhymetec customer, you should generally submit your request directly to that customer. Rhymetec will assist its customers with such requests as required by applicable law and contractual obligations.

2. Personal Information We Collect

The Personal Information we collect depends on how you interact with Rhymetec.

A. Information You Provide Directly

We may collect:

  • name;
  • business email address;
  • telephone number;
  • mailing or business address;
  • company name;
  • job title and professional information;
  • account or contact information;
  • information contained in communications with us;
  • information submitted through website forms, questionnaires, surveys, or requests for information;
  • information provided in connection with customer support;
  • event and webinar registration information; and
  • other information you choose to provide.

B. Information Collected Automatically

When you access our websites or online services, we may automatically collect certain information, including:

  • Internet Protocol (IP) address;
  • browser type and version;
  • device type and operating system;
  • authentication and session information;
  • language preferences and timezone;
  • referring URLs and sources;
  • approximate geographic location derived from IP address;
  • pages viewed;
  • links clicked;
  • date, duration, and time of access;
  • interactions with our websites;
  • advertising and campaign information, such as UTM parameters; and
  • cookie identifiers; and
  • other technical, diagnostic, and usage information.

We may collect this information through cookies, pixels, web beacons, log files, and similar technologies.

C. Information From Other Sources

We may obtain Personal Information from other sources, including:

  • our customers;
  • business partners;
  • service providers;
  • referral partners;
  • publicly available sources;
  • professional networking platforms;
  • marketing and sales platforms; and
  • event organizers.

3. How We Use Personal Information

We may process Personal Information to:

  • Provide, operate, maintain, and improve our services;
  • Communicate with customers, prospective customers, vendors, and partners;
  • Respond to inquiries and requests;
  • Provide customer support;
  • Manage customer and business relationships;
  • Prepare proposals and contracts;
  • Provide cybersecurity, compliance, privacy, risk management, and related services;
  • Register individuals for events, webinars, or other activities;
  • Send administrative and transactional communications;
  • Provide newsletters, marketing communications, and information about our services;
  • Personalize and improve our websites and communications;
  • Analyze website traffic and usage;
  • Conduct business analytics and internal reporting;
  • Maintain the security and integrity of our systems, networks, websites, and services;
  • Detect, investigate, and prevent fraud, abuse, security incidents, and other unlawful activities;
  • Manage vendors and business partners;
  • Comply with legal and regulatory requirements;
  • Establish, exercise, or defend legal claims;
  • Enforce our agreements, policies, and terms; and
  • Carry out other purposes disclosed at the time information is collected or with your consent.

Rhymetec may also aggregate, anonymize, or de-identify Personal Information so that it can no longer reasonably be associated with an identified or identifiable individual. We may use such information for legitimate business purposes, including analytics, research, service improvement, security, and business planning.

4. How We Disclose Personal Information

We may disclose Personal Information to the following categories of recipients.

Service Providers and Subprocessors

We may provide Personal Information to vendors and service providers that perform services on our behalf, including providers of:

We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our Services, when you participate in activities on the Services, or when you contact us.

Personal Information Provided by You:

  • cloud hosting and infrastructure;
  • information technology;
  • security;
  • customer relationship management;
  • communications;
  • email;
  • analytics;
  • marketing;
  • payment and accounting;
  • professional services; and
  • other business operations.

Where required, we enter into contractual arrangements requiring these parties to appropriately protect Personal Information. 

Rhymetec uses third-party service providers to support its business and Services. Where Rhymetec acts as a processor on behalf of a customer, information regarding Rhymetec’s subprocessors is available through our Trust Center.

Business Partners

We may disclose Personal Information to business partners when necessary to provide requested services, manage a relationship, conduct joint activities, or with your authorization.

Professional Advisors

We may disclose information to attorneys, accountants, auditors, insurers, consultants, and other professional advisors.

Legal and Regulatory Authorities

We may disclose Personal Information where we reasonably believe disclosure is necessary to:

  • comply with applicable law, regulation, legal process, or governmental request;
  • respond to lawful requests from public authorities;
  • protect the rights, property, security, or safety of Rhymetec, our customers, individuals, or others;
  • investigate or prevent fraud, security incidents, or illegal activity; or
  • establish, exercise, or defend legal claims.

Corporate Transactions

Personal Information may be disclosed or transferred in connection with an actual or proposed merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or other corporate transaction.

5. Cookies and Similar Technologies

Rhymetec and certain third parties may use cookies, pixels, web beacons, tags, and similar technologies to operate our websites, remember preferences, understand how visitors interact with our websites, measure website performance, maintain security, conduct analytics, and support marketing and advertising activities.

Some of these technologies may allow third parties to collect information about your activity on our websites and across other websites or online services. Depending on applicable law, the use of these technologies may constitute targeted advertising or the “sharing” of Personal Information for cross-context behavioral advertising.

Where required by applicable law, Rhymetec obtains consent before using non-essential cookies or similar technologies. You may manage your preferences or opt out of certain uses of these technologies through the cookie or privacy preference controls available on our website.

Where required by applicable law, Rhymetec also recognizes applicable browser-based opt-out preference signals, such as the Global Privacy Control (“GPC”).

Additional information about the cookies and similar technologies used by Rhymetec is available in our Cookie Policy.

6. Marketing Communications

We may send you information about Rhymetec’s services, events, publications, and other business-related content.

You may unsubscribe from marketing emails at any time by using the unsubscribe mechanism contained in the communication or by contacting us at [email protected].

Even if you opt out of marketing communications, we may continue sending non-marketing communications relating to an existing business relationship, transactions, security, legal matters, or services you have requested.

7. Retention

Rhymetec retains Personal Information for only as long as reasonably necessary for the purposes for which it was collected, including to provide services, maintain business and transactional records, comply with legal and regulatory obligations, resolve disputes, enforce agreements, and protect our legitimate business interests.

Retention periods may vary depending on the nature of the information, the purpose of processing, contractual requirements, legal requirements, and applicable limitation periods.

When Personal Information is no longer required, we will delete, anonymize, or otherwise securely dispose of it in accordance with our retention practices and applicable law.

8. Security

Rhymetec maintains administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, acquisition, disclosure, alteration, loss, destruction, or misuse.

These measures may include, as appropriate:

  • encryption;
  • identity and access management;
  • multifactor authentication;
  • least-privilege access;
  • security logging and monitoring;
  • vulnerability management;
  • endpoint and network security;
  • incident response procedures;
  • business continuity and disaster recovery measures;
  • personnel security and security awareness training;
  • vendor security management; and
  • periodic security assessments and testing.

No system or transmission method can be guaranteed to be completely secure, and we cannot guarantee absolute security.

9. International Data Transfers

Rhymetec is based in the United States, and Personal Information may be transferred to, stored in, or processed in the United States or other countries in which Rhymetec or its service providers operate.

Where required by applicable Data Protection Laws, Rhymetec uses appropriate mechanisms for international transfers of Personal Information.

These mechanisms may include:

  • Adequacy decisions or regulations;
  • The European Commission’s Standard Contractual Clauses;
  • The UK International Data Transfer Addendum;
  • Safeguards recognized under Swiss data protection law;
  • The EU-U.S. Data Privacy Framework;
  • The UK Extension to the EU-U.S. Data Privacy Framework;
  • The Swiss-U.S. Data Privacy Framework; or
  • Another lawful transfer mechanism recognized by applicable law.

Additional information regarding Rhymetec’s participation in the Data Privacy Framework is provided in Section 14 below.

You may contact [email protected] for additional information regarding the safeguards Rhymetec uses for international transfers of Personal Information and, where applicable, to request a copy of relevant safeguards.

10. European Economic Area, United Kingdom, and Switzerland

This Section applies to individuals whose Personal Information is subject to the GDPR, UK GDPR, Swiss Federal Act on Data Protection, or other applicable European data protection laws.

A. Controller

Where Rhymetec determines the purposes and means of processing Personal Information, Rhymetec acts as the controller of that Personal Information.

Where Rhymetec processes Personal Information on behalf of a customer pursuant to the customer’s instructions, Rhymetec acts as a processor and the applicable customer generally acts as the controller.

B. Legal Bases for Processing

Depending on the circumstances, Rhymetec may process Personal Information based on:

Contractual necessity. Processing may be necessary to enter into or perform a contract with you or the organization you represent.

Legitimate interests. We may process Personal Information where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. These interests may include operating and improving our business, providing customer service, securing our systems and services, preventing fraud, conducting business analytics, managing business relationships, and appropriate business-to-business marketing.

Legal obligations. We may process Personal Information where necessary to comply with applicable laws, regulations, court orders, or other legal obligations.

Consent. Where required or appropriate, we may process Personal Information based on your consent. You may withdraw consent at any time, without affecting the lawfulness of processing conducted before withdrawal.

Provision of Personal Information. In certain circumstances, providing Personal Information may be necessary for Rhymetec to enter into or perform a contract with you or the organization you represent, or to comply with applicable legal requirements. If required Personal Information is not provided, Rhymetec may be unable to provide certain services, respond to a request, establish or maintain a business relationship, or fulfill applicable contractual obligations.

Automated Decision-Making. Rhymetec does not currently engage in solely automated decision-making, including profiling, that produces legal effects concerning individuals or similarly significantly affects individuals, unless otherwise disclosed at the time the Personal Information is collected.

C. Your Rights

Subject to applicable law and applicable exceptions, you may have the right to:

  • Obtain confirmation as to whether we process your Personal Information;
  • Access your Personal Information;
  • Correct inaccurate or incomplete Personal Information;
  • Request deletion of your Personal Information;
  • Restrict processing;
  • Object to processing based on legitimate interests;
  • Object to direct marketing;
  • Receive certain Personal Information in a structured, commonly used, machine-readable format;
  • Request transfer of certain Personal Information to another organization;
  • Withdraw consent at any time where processing is based on consent; and
  • Lodge a complaint with an applicable supervisory authority.

You may submit a request by contacting [email protected].

We may take reasonable steps to verify your identity before fulfilling a request.

D. Complaints

Individuals in the EEA have the right to lodge a complaint with the data protection authority in the country where they live, work, or where an alleged violation occurred.

Individuals in the UK may lodge a complaint with the UK Information Commissioner’s Office (“ICO”).

Individuals in Switzerland may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (“FDPIC”).

We encourage you to contact us first at [email protected] so that we have an opportunity to address your concern.

11. United States Privacy Rights

Residents of certain U.S. states may have privacy rights under applicable state privacy laws.

Depending on your state of residence and the applicability of the relevant law, these rights may include the right to:

  • Confirm whether we process your Personal Information;
  • Access Personal Information;
  • Obtain a copy of Personal Information;
  • Correct inaccurate Personal Information;
  • Request deletion of Personal Information;
  • Opt out of certain processing for targeted advertising;
  • Opt out of the sale of Personal Information;
  • Opt out of certain forms of sharing of Personal Information;
  • Opt out of certain profiling activities;
  • Limit certain uses or disclosures of sensitive Personal Information; and
  • Appeal a decision relating to a privacy request.

To exercise an applicable privacy right, contact [email protected] or use any privacy preference mechanism made available on our website.

We may take reasonable steps to verify your identity before processing your request. Where permitted by applicable law, you may designate an authorized agent to submit a request on your behalf. We will not discriminate against you for exercising a privacy right provided by applicable law.

California Privacy Notice

California residents may have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”).

During the preceding 12 months, Rhymetec has collected categories of Personal Information that may include identifiers; internet or other electronic network activity information; professional or employment-related information; commercial information; and approximate geolocation information.

Rhymetec collects Personal Information from the sources described in Section 2 of this Privacy Policy and uses it for the business and commercial purposes described in Section 3. Rhymetec may disclose Personal Information to the categories of recipients described in Section 4.

Subject to applicable exceptions, California residents may have the right to request information regarding the categories and specific pieces of Personal Information Rhymetec has collected about them; the categories of sources from which the Personal Information was collected; the purposes for collecting, using, selling, or sharing Personal Information; and the categories of third parties to whom Personal Information has been disclosed, sold, or shared. California residents may also have rights to request correction or deletion of their Personal Information.

Sale and Sharing of Personal Information

Rhymetec does not sell Personal Information for monetary consideration. However, Rhymetec may use third-party analytics, advertising, or similar tracking technologies that result in the disclosure of identifiers, internet or other electronic network activity information, or similar information to third parties in a manner that may constitute “sharing” for cross-context behavioral advertising under the CCPA.

Accordingly, during the preceding 12 months, Rhymetec may have shared Personal Information for cross-context behavioral advertising as those terms are defined under the CCPA.

California residents have the right to opt out of the sale or sharing of their Personal Information. You may exercise this right through the privacy or cookie preference controls available on our website or by contacting [email protected].

Where required by applicable law, Rhymetec also recognizes and processes opt-out preference signals, such as the Global Privacy Control (“GPC”), as a request to opt out of the sale or sharing of Personal Information for the browser or device through which the signal is communicated.

Sensitive Personal Information

Rhymetec does not use or disclose Sensitive Personal Information for purposes that require Rhymetec to provide a right to limit such use or disclosure under the CCPA.

Personal Information of Minors

Rhymetec does not have actual knowledge that it sells or shares the Personal Information of consumers under 16 years of age.

12. Children's Privacy

Rhymetec’s websites and services are intended for businesses and professionals and are not directed to children.

We do not knowingly collect Personal Information from children under 13 through our websites. If we become aware that we have collected Personal Information from a child in violation of applicable law, we will take reasonable steps to delete it.

If you believe a child has provided Personal Information to Rhymetec, please contact [email protected].

13. Third-Party Websites and Services

Our websites may contain links to websites, applications, or services operated by third parties.

Rhymetec is not responsible for the privacy, security, or information practices of third parties. We encourage you to review the privacy notices of any third-party services you use.

14. U.S. Data Privacy Framework Supplemental Notice

This U.S. Data Privacy Framework Supplemental Notice applies to Personal Information transferred from the European Union (“EU”), European Economic Area (“EEA”), United Kingdom (“UK”), and Switzerland to the United States in reliance on the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”), as administered by the U.S. Department of Commerce.

A. Participation and Certification

Rhymetec, LLC complies with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce.

Rhymetec has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of Personal Information received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom and Gibraltar in reliance on the UK Extension to the EU-U.S. DPF.

Rhymetec has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of Personal Information received from Switzerland in reliance on the Swiss-U.S. DPF.

If there is any conflict between the terms of this Privacy Policy and the applicable DPF Principles, the applicable DPF Principles shall govern.

To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

B. Scope

Rhymetec’s DPF commitments apply to Personal Information received by Rhymetec in the United States from the EU/EEA, UK, and Switzerland in reliance on the applicable DPF.

Rhymetec will process such Personal Information in accordance with the applicable DPF Principles for as long as Rhymetec retains the information.

C. Notice, Purposes of Processing, and Disclosure

Rhymetec may collect, use, and otherwise process Personal Information covered by the DPF for the purposes described in this Privacy Policy, including to:

  • Provide and operate our services;
  • Communicate with customers and individuals;
  • Respond to requests and inquiries;
  • Maintain and support business relationships;
  • Provide cybersecurity, compliance, privacy, and related services;
  • Operate, secure, and improve our websites and services;
  • Conduct analytics and internal reporting;
  • Provide appropriate marketing communications;
  • Prevent fraud and security threats;
  • Comply with applicable legal requirements; and
  • Otherwise carry out purposes disclosed to individuals or authorized by them.

Rhymetec may disclose Personal Information covered by the DPF to the categories of third parties described in Section 4 of this Privacy Policy, including service providers and other third parties that assist us in providing our services and conducting our business.

D. Choice

Where required by the DPF Principles, Rhymetec provides individuals with the opportunity to opt out before Personal Information is:

  1. Disclosed to a non-agent third party; or
  2. Used for a purpose materially different from the purpose for which it was originally collected or subsequently authorized.

For Sensitive Personal Information, Rhymetec will obtain affirmative express consent where required by the DPF Principles before disclosing the information to a non-agent third party or using it for a materially different purpose.

Individuals may exercise applicable choices by contacting [email protected].

E. Accountability for Onward Transfers

Rhymetec complies with the DPF Principles regarding onward transfers of Personal Information.

When Rhymetec transfers Personal Information covered by the DPF to a third party acting as an agent on Rhymetec’s behalf, Rhymetec will take appropriate and reasonable steps to ensure the third party processes the Personal Information in a manner consistent with Rhymetec’s obligations under the DPF Principles.

Rhymetec remains responsible under the DPF Principles if an agent processes covered Personal Information in a manner inconsistent with the DPF Principles, unless Rhymetec proves that it is not responsible for the event giving rise to the damage.

F. Individual Rights

Individuals whose Personal Information is covered by the DPF have the right to access Personal Information about them that Rhymetec holds and, where appropriate, request that Rhymetec correct, amend, or delete Personal Information that is inaccurate or has been processed in violation of the DPF Principles.

Individuals may also exercise applicable choices regarding the use and disclosure of their Personal Information as described above.

Requests may be submitted to [email protected].

Rhymetec may take reasonable steps to verify an individual’s identity before fulfilling a request.

G. Questions and Complaints

In compliance with the DPF Principles, Rhymetec commits to resolving complaints regarding its collection, use, or processing of Personal Information received in reliance on the DPF.

Individuals in the EU/EEA, UK, or Switzerland with questions or complaints concerning Rhymetec’s DPF compliance should first contact:

Rhymetec, LLC
Email: [email protected]
Address: 50 W 29th St. New York, NY 10001, United States

Rhymetec will respond to DPF-related complaints within the period required by the DPF Principles.

H. Independent Recourse Mechanism

Rhymetec has committed to refer unresolved complaints concerning Personal Information covered by the DPF to JAMS, an independent dispute resolution provider.

If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information or to file a complaint. This service is provided at no cost to you.

I. Human Resources Data

With respect to Personal Information received from the EU/EEA, UK, or Switzerland in reliance on the DPF in the context of an employment relationship, Rhymetec commits to cooperate and comply with the advice of the competent EU data protection authorities, the UK Information Commissioner’s Office, and the Swiss Federal Data Protection and Information Commissioner, as applicable, with regard to unresolved complaints concerning Rhymetec’s handling of such Human Resources Data.

J. Binding Arbitration

Under certain conditions, individuals may invoke binding arbitration for complaints regarding DPF compliance that have not been resolved through other DPF mechanisms, as provided in Annex I to the DPF Principles.

K. Federal Trade Commission Oversight

Rhymetec is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission with respect to its compliance with the DPF.

L. Required Disclosures

Rhymetec may be required to disclose Personal Information received under the DPF in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

15. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technologies, legal requirements, or other factors.

When we update this Privacy Policy, we will revise the “Last Updated” date at the top of this Policy.

Where required by law, we will provide additional notice of material changes.

16. Contact Us

Questions, concerns, complaints, and privacy requests may be directed to:

Rhymetec, LLC

50 W 29th St.
New York, NY 10001
United States

Email: [email protected]

If your request concerns Personal Information that Rhymetec processes solely on behalf of one of its customers, please identify the relevant customer so that we can appropriately route or assist with your request.