Policies

Griffin Consulting & Design

griffinconsultanddesign.com

PRIVACY POLICY

Effective Date: April 29, 2026 | Last Updated: April 29, 2026

At a Glance — Key Points

•What we collect: Name, email, phone number, project details you provide, plus standard website usage data (IP address, browser type, pages visited).

•Why we collect it: To respond to your inquiries, provide interior design and consulting services, improve our website, and communicate with you.

•We do NOT sell your personal information.

•Your rights: You may request access to, correction of, or deletion of your personal data at any time.

•How to reach us: Contact us by email or phone (see Section 13) for any privacy-related questions.

•Data security: We use SSL/TLS encryption and reasonable safeguards to protect your information.

•Georgia law: We comply with Georgia's breach notification law (O.C.G.A. § 10-1-910 et seq.) and applicable federal laws.

1. Introduction

Griffin Consulting & Design ("we," "us," or "our") is an interior design and consulting business based in Savannah, Georgia, and operated by Allison Griffin. We are committed to protecting your privacy and handling your personal information with care and transparency.

This Privacy Policy explains how we collect, use, share, and protect information when you visit our website at griffinconsultanddesign.com or use any of our related services, including consultations, project communications, and contact forms.

This policy is designed to comply with applicable Georgia state laws — including Georgia's data breach notification requirements under O.C.G.A. § 10-1-910 through 10-1-912 — as

well as applicable federal laws. By using our website or services, you agree to the practices described in this policy.

2. Definitions

To help you understand this policy, here are key terms we use throughout:

Term

Definition

Personal Information

Any information that identifies or could reasonably be used to identify you as an individual, such as your name, email address, phone number, or mailing address.

Non-Personal Information

Information that does not directly identify you, such as aggregated website usage statistics, browser type, or general geographic region.

Cookies

Small data files placed on your device by a website. Cookies help websites remember your preferences and understand how visitors use the site.

Service Provider / Third Party

A company or individual that performs services on our behalf, such as website hosting, email delivery, or analytics. These parties only access your data as needed to provide their services.

Data Controller

The entity that determines the purposes and means of processing personal information. For data collected through our website and services, Griffin Consulting & Design is the Data Controller.

3. Information We Collect

3.1 Information You Provide Directly

When you reach out to us or use our services, you may voluntarily provide information such as:

•Your name

•Email address

•Phone number

•Mailing or project address

•Project details, design preferences, and related notes submitted through contact forms or consultations

3.2 Information Collected Automatically

When you visit our website, certain information is collected automatically, including:

•IP address

•Browser type and version

•Device type and operating system

•Pages visited, time spent on each page, and referring URLs

•Date and time of your visit

3.3 Cookies and Tracking Technologies

Our website may use cookies and similar tracking technologies to enhance your browsing experience and analyze site traffic. You can control cookie preferences through your browser settings. For more details, please refer to our Cookie Policy.

3.4 Information from Third Parties

In some cases, we may receive limited information about you from third-party sources, such as referral partners or social media platforms, if you interact with our content or are referred to us by another professional.

4. How We Use Your Information

We use the information we collect for the following purposes:

•Respond to inquiries: To reply to your questions, consultation requests, and contact form submissions.

•Provide services: To deliver interior design consulting, project management, and related professional services.

•Communicate about projects: To send updates, schedules, proposals, and other project-related correspondence.

•Improve our website: To analyze usage patterns and enhance website functionality, content, and user experience.

•Marketing communications: To send newsletters, promotions, or design inspiration — only with your prior consent. You may opt out at any time.

•Legal compliance: To comply with applicable laws, regulations, and legal processes.

•Security: To protect against fraud, unauthorized access, and other security threats.

5. Legal Basis for Processing

We process your personal information based on the following legal grounds:

•Consent: When you voluntarily submit information through our contact forms or subscribe to communications, you provide consent for us to use that information for the stated purpose.

•Contractual necessity: When processing is necessary to fulfill a design consulting agreement or provide services you have requested.

•Legitimate business interests: When processing is reasonably necessary for operating our business, improving our services, and maintaining website security — provided these interests do not override your rights.

•Legal compliance: When we are required to process data to comply with applicable laws or respond to lawful requests from public authorities.

6. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information only in the following limited circumstances:

•Service providers: We work with trusted third-party providers who assist with website hosting (GoDaddy), email services, and website analytics. These providers are contractually obligated to protect your information and may only use it to perform services on our behalf.

•Legal requirements: We may disclose your information if required to do so by law, regulation, or valid legal process, or in response to a lawful request by law enforcement or other government authorities.

•Business transfers: In the event of a merger, acquisition, or sale of business assets, your information may be transferred as part of that transaction. We will notify you of any such change.

•With your consent: We may share your information with other parties when you have given us explicit permission to do so.

Important: We do NOT sell your personal information to any third party, for any reason.

7. Data Retention

We retain your personal information only for as long as reasonably necessary to fulfill the purposes described in this policy. Specific retention periods depend on:

•The nature of the information and the purpose for which it was collected

•Whether there is an ongoing business relationship or active project

•Legal, regulatory, or contractual requirements that may mandate longer retention

•Whether the information is needed to resolve disputes or enforce agreements

When your information is no longer needed, we will securely delete or anonymize it. If you would like to request that your personal data be deleted, please contact us using the information in Section 13.

8. Your Rights Under Georgia and Applicable Law

While Georgia does not currently have a comprehensive consumer data privacy statute, we believe in providing you with meaningful control over your personal information. We voluntarily extend the following rights to all users of our website and services:

•Right to access: You may request a copy of the personal information we hold about you.

•Right to correction: You may request that we correct any inaccurate or incomplete personal information.

•Right to deletion: You may request that we delete your personal information, subject to any legal obligations that require us to retain it.

•Right to opt out of data sales: We do not sell personal information. However, if our practices ever change, you will have the right to opt out.

•Right to non-discrimination: We will never discriminate against you for exercising any of your privacy rights. You will receive the same quality of service regardless.

How to Submit a Request

To exercise any of the rights listed above, please contact us by email using the contact information provided in Section 13. Please include your full name and a description of your request so we can verify your identity and respond appropriately.

We will acknowledge your request within 10 business days and aim to fulfill verified requests within 30 calendar days. If additional time is required, we will notify you of the reason and expected timeline.

9. Data Security

We take the security of your personal information seriously and implement reasonable administrative, technical, and physical safeguards to protect it. These measures include:

•SSL/TLS encryption: Our website uses Secure Sockets Layer (SSL) / Transport

Layer Security (TLS) encryption to protect data transmitted between your browser and our servers.

•Access controls: Access to personal information is limited to authorized individuals who need it to perform their job functions.

•Secure storage: Personal information is stored in secure environments with appropriate protections.

•Regular review: We periodically review our security practices and update them as needed to address new threats.

While we strive to protect your information, please be aware that no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to taking all reasonable steps to safeguard your data.

10. Third-Party Links

Our website may contain links to third-party websites, including social media platforms, vendor sites, and other external resources. These links are provided for your convenience and reference only.

We are not responsible for the privacy practices, content, or security of any third-party websites. We encourage you to review the privacy policy of any external site before providing your personal information.

11. Children's Privacy

Our website and services are not directed to children under the age of 13. We do not knowingly collect, solicit, or store personal information from children under 13.

If we become aware that we have inadvertently collected personal information from a child under 13, we will take prompt steps to delete that information. If you believe a child has provided us with personal information, please contact us immediately using the information in Section 13.

This practice is in accordance with the Children's Online Privacy Protection Act (COPPA).

12. Changes to This Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our practices, legal requirements, or business operations.

When we make changes, we will update the "Last Updated" date at the top of this

document. For significant changes, we may also notify you by posting a prominent notice on our website or, where appropriate, by email.

Your continued use of our website or services after any changes to this policy constitutes your acceptance of the updated terms. We encourage you to review this policy periodically.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Griffin Consulting & Design

Savannah, GA

Email: agriffindesign@gmail.com

Phone: (912) 441-4052

Website: griffinconsultanddesign.com

For privacy-related inquiries, please contact us using the information above. We will make every effort to address your concerns promptly and thoroughly.

14. Data Breach Notification

In the unlikely event of a data breach involving your personal information, we are committed to notifying affected individuals in the most expedient time possible and without unreasonable delay, consistent with Georgia's Personal Identity Protection Act (O.C.G.A. § 10-1-910 et seq.).

Our breach notification commitment includes:

•Timely notification: We will notify affected individuals as quickly as possible, and aim to do so within 72 hours of confirming the breach, unless a law enforcement agency determines that notification would compromise an active investigation.

•Method of notice: Notification will be provided by email, written letter, or, where circumstances require, by prominent notice on our website.

•Content of notice: Our notification will describe the nature of the breach, the types of information affected, the steps we are taking in response, and guidance on how you can protect yourself.

•Regulatory reporting: Where required by law, we will also notify the appropriate regulatory authorities.

© 2026 Griffin Consulting & Design. All rights reserved.

griffinconsultanddesign.com | Savannah, GA