PRIVACY POLICY 1. Who We Are and How to Contact Us Elevate Events & Marketing LLC, trading as Elevate, is a live event and brand-experience production agency based in Albuquerque, New Mexico, United States. We design and execute in-person events, brand experiences, content creation programmes, social media management and paid social advertising campaigns for clients across the United States and in New Mexico on site. Our registered office is 1209 Mountain Road PL NE Ste R, Albuquerque, New Mexico 87110, United States. If you have questions about this privacy policy, how we handle your data or to exercise a privacy right, contact us at info@elevatemktevents.com. Our website is https://elevatemktevents.com. 2. Information We Collect We collect information in the following categories: Contact Form Submissions When you submit the contact form on our website, we collect the information you provide, which includes your name, email address and message. This information is collected only when you voluntarily complete and submit the form. Server Access Logs Our web hosting provider records standard server access logs when you visit our website. These logs include your Internet Protocol address (IP address), the date and time of your request, the web page you requested, your browser type and operating system (user agent string) and other standard HTTP request and response headers. These logs are created automatically and are not linked to your identity unless you submit the contact form or otherwise identify yourself to us. Local Device Storage Our website uses only two strictly necessary preferences stored in your browser's localStorage on your own device. These are first-party storage entries only and are not transmitted to any server. The two items stored are: your preferred language selection (stored as 'preferred-lang') and your cookie consent choice (stored as 'cookie-consent'). Both remain only on your device and are not used for tracking, profiling or any purpose other than to maintain your stated preferences when you return to the website. No Cookies Our website does not set any cookies. All storage is limited to the two localStorage entries described above. No Third-Party Data Collection Our website does not use analytics tools, advertising pixels, Meta pixels, Google Analytics, social media tracking pixels or any third-party tracking, profiling or analytics services. We do not embed third-party content, widgets or scripts designed to collect your data. No Payment Data We do not collect payment information on our website. Payments for services are arranged separately in direct communication with clients. 3. How We Use Your Information We use the information we collect for the following purposes: Contact Form Responses and Enquiry Handling When you submit the contact form, we use your name, email address and message to respond to your enquiry, to provide you with information about our services, to follow up on your request and to determine whether we can assist you. We use this information to communicate with you regarding your potential engagement with us and to send you relevant marketing communications about our services if you have consented to receive them or if you have previously engaged with us and we reasonably consider the communication to be related to that engagement. Website Administration and Technical Maintenance We use server access logs (including your IP address and user agent information) to administer our website, diagnose technical problems, perform system maintenance and troubleshooting and to track website usage patterns for the purpose of maintaining and improving our website's performance and security. We also use this information to detect and prevent fraud, abuse and unauthorised access to our systems. Compliance and Legal Obligation We may use information we hold, including your IP address and the content of messages, to comply with legal obligations, to cooperate with law enforcement, to enforce our legal rights or to respond to legal process. In these circumstances, we will use the minimum information necessary to satisfy the legal requirement. Communication Preference Administration We use your email address and the cookie-consent preference stored on your device to manage your communication preferences and to respect your choices about receiving marketing messages from us. Service Improvement We use aggregate patterns observed in server access logs (never linked to individual identities) to understand how visitors interact with our website and to improve our website's design, functionality, security and user experience. This analysis does not identify you personally. 4. Legal Bases for Processing Under GDPR We process personal data only where we have a lawful basis to do so under the General Data Protection Regulation (GDPR) (EU 2016/679). The lawful bases we rely upon are: Performance of Contract We process your name, email address and message when you submit the contact form to perform or prepare to enter into a contract with you. Processing is necessary to respond to your enquiry and to determine whether we can provide services to you. This is our lawful basis for using your contact form information. Legitimate Interests We process server access logs (IP address, user agent, request details and other HTTP headers) on the basis of our legitimate interests in maintaining our website's security, integrity and performance; diagnosing technical faults; detecting fraud and abuse; and understanding aggregate usage patterns to improve our services. We have carefully balanced these legitimate interests against your privacy rights and conclude that our interests are not overridden by your reasonable expectations or fundamental rights, particularly because (a) the processing is necessary for essential website operations, (b) you have no reasonable expectation of privacy in standard HTTP header information submitted to a web server, (c) we do not use this data for profiling, targeting or any purpose other than technical administration and (d) the data is retained only for a limited period and is not matched to your identity unless you voluntarily identify yourself. Compliance with Legal Obligation We process information to comply with applicable laws, court orders, government requests and legal obligations, including laws in New Mexico, federal laws in the United States and, where applicable to our visitors, laws in their jurisdiction of residence. This is our lawful basis for disclosure and use when required by law. Consent Where we send marketing communications to visitors from the United Kingdom or European Union who have not previously engaged with us, we rely on your prior express consent. We obtain this consent through an opt-in process before adding your email address to any mailing list or sending you marketing communications. You may withdraw your consent at any time by using the unsubscribe link in any marketing email or by contacting us. 5. Cookies and Local Device Storage Our website does not use cookies. We store only two strictly necessary preferences in your browser's localStorage, which is a form of first-party device storage that persists only on your own device and is never transmitted to any server. The two localStorage entries we use are: - 'preferred-lang': stores your choice of language for viewing our website content. - 'cookie-consent': stores your choice regarding cookie consent and tracking preferences. Both entries are strictly necessary to provide you with a personalised experience and to respect your stated preferences. They are not used for tracking, profiling, analytics, advertising or any purpose other than to maintain your preferences. They are stored only on your device and under your control. You can clear these entries at any time by clearing your browser's localStorage or deleting your browsing data. For more detailed information about our approach to storage, device preferences and consent, please see our Cookie Policy at https://elevatemktevents.com/cookie-policy. 6. Third-Party Services, Data Processors and Disclosure We do not use any third-party analytics services, advertising networks, advertising pixels, Meta tracking pixels, Google Analytics, social media tracking tools or any form of cross-context behavioural advertising or profiling service. Recipients of Your Data Your personal data may be disclosed to the following categories of recipient: Web Hosting and Server Infrastructure Provider Your contact form submission, email address and server access logs are processed by our web hosting provider to deliver our website, send your contact form submission to our email address, store and manage our email systems and maintain our web servers. Your web hosting provider is a data processor acting under contract to us and is required to process your data only on our instructions and in accordance with data protection laws. The web hosting provider may be located in the United States. Email and Mail Services Your contact form submission and email address are processed by our email service provider to deliver messages sent through our contact form and to manage incoming and outgoing emails. This provider is a data processor under contract to us and is required to process your data only on our instructions. Professional Advisers We may disclose your information to our lawyers, accountants, auditors and other professional advisers who provide services to us in confidence and in their capacity as data processors or joint controllers. These advisers are required to use your information only for the purpose of providing their service to us and must comply with data protection laws. Compliance and Law Enforcement We may disclose your information if required by law, court order, government authority or law enforcement; to enforce or protect our legal rights; to prevent fraud, abuse or harm; or to comply with legal obligations in any applicable jurisdiction. No Sale or Sharing of Personal Information Elevate does not sell, share, rent or disclose your personal information to third parties for their own marketing, advertising or commercial purposes, and does not engage in cross-context behavioural advertising. 7. Data Retention We retain personal information only for as long as necessary to achieve the purpose for which it was collected, or as required by law. Contact Form Submissions We retain your name, email address and message for a period of three years from the date of submission. If you become a client, your contact form submission and all subsequent communications are retained for the duration of your engagement with us plus three years after the engagement ends (or as required by law for financial, tax or other compliance purposes). Server Access Logs Server access logs containing IP addresses, user agent information and HTTP request details are retained by our hosting provider for a period of 30 days. After 30 days, these logs are automatically deleted. In cases where we detect fraud, abuse or a security incident, specific log entries may be retained for up to 12 months to support investigation, prosecution or prevention of further harm. Local Device Storage The localStorage entries (preferred-lang and cookie-consent) remain on your device only for as long as you retain them. You may delete them at any time by clearing your browser's localStorage. We retain no record of these preferences on our servers. Email Communications If you subscribe to marketing communications, we retain your email address and engagement records (open and click events, if available to us through standard email systems) for as long as you remain subscribed and are not opted out. We delete your email address and all associated engagement records within 30 days of you unsubscribing or asking us to delete your data. 8. International Data Transfers and Safeguards Our web hosting infrastructure, mail services and business operations are located in the United States. If you are a resident of the United Kingdom, European Union or a jurisdiction outside the United States, your personal data will be transferred from your country to the United States when you use our website or submit a contact form. The United States has not been granted a data adequacy decision by the European Commission or by the competent authorities of the United Kingdom. We rely on the Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46(2)(c) of the GDPR as our lawful mechanism for transferring your data to the United States. Our web hosting provider, mail service provider and any other US-based data processor has adopted the Standard Contractual Clauses in its data processing agreement with us. The United States does not provide an equivalent level of data protection to that guaranteed in the European Union or United Kingdom, particularly in relation to government access to personal data. By using our website and submitting your contact form, you acknowledge this transfer and accept the terms of our privacy policy. You retain all of your rights under the GDPR and UK GDPR (as applicable to you) notwithstanding the transfer. If you object to the transfer of your personal data to the United States, you should not submit your contact information through our website. If you have already submitted information and wish to withdraw your consent to transfer, please contact us immediately at info@elevatemktevents.com. 9. Your Privacy Rights Your rights under the General Data Protection Regulation (GDPR) If you are a resident of the European Union or a country with equivalent data protection law, and your data is processed by Elevate, you have the following rights: Right of Access (Data Subject Access Request) You have the right to request confirmation of whether we hold your personal data and to request a copy of that data. We will provide you with your data in a structured, commonly used and machine-readable format. Right to Rectification You have the right to request that we correct any inaccurate personal data we hold about you or to complete any incomplete data. Right to Erasure (Right to be Forgotten) You have the right to request that we delete your personal data, subject to limited exceptions (for example, where we are required by law to retain it, or where we need to retain it to defend a legal claim). We will consider your request and inform you of our decision, including any lawful reason we may have for retaining the data. Right to Restrict Processing You have the right to request that we restrict or suspend our processing of your personal data while we consider a complaint, rectify inaccurate data or establish the lawful basis for processing. Right to Data Portability You have the right to request that we provide your personal data in a portable format and to transmit it to another controller without hindrance. Right to Object You have the right to object to our processing of your personal data on the basis of our legitimate interests, including for marketing purposes. If you object, we will cease processing your data for that purpose unless we can demonstrate an overriding legitimate interest or legal obligation. Right to Withdraw Consent Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before you withdrew your consent. Right to Lodge a Complaint with a Supervisory Authority You have the right to lodge a complaint with the data protection authority or supervisory authority in your country of residence or the European Union member state in which you work or in which an alleged breach occurred. In the EU, this is your national data protection authority. In the United Kingdom, this is the Information Commissioner's Office (ICO). Your Rights Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) If you are a resident of California, the following rights apply to you under California Civil Code Section 1798.100 and onwards: Right to Know You have the right to request that we disclose to you the categories and specific pieces of personal information we have collected about you in the past 12 months, the source of that information, the business or commercial purpose for collection and the categories of third parties to whom we have disclosed it. Right to Delete You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (for example, where retention is necessary to complete the transaction for which we collected the information, to comply with law or to enable us to exercise our legal rights). Right to Correct You have the right to request that we correct any inaccurate personal information we hold about you. Right to Opt Out of Sale or Sharing of Personal Information You have the right to opt out of the sale or sharing of your personal information. Elevate does not sell or share your personal information for cross-context behavioural advertising purposes. This right is not applicable because we do not engage in these practices. However, you may still submit a request to confirm this, and we will respond to confirm that we do not sell or share your data. Right to Limit Use and Disclosure of Sensitive Personal Information You have the right to limit our use and disclosure of sensitive personal information (as defined by the CPRA) to only the purposes necessary to provide the services you request or to perform the reasonably expected services or transactions. We do not intentionally collect sensitive personal information (including social security numbers, financial account numbers with access credentials, precise geolocation or health data). If you believe we have collected sensitive information, you may request limitation of its use. Right to Non-Discrimination You have the right not to be discriminated against for exercising your privacy rights. We will not deny you access to our services, charge you a different price or provide a different quality of service because you have exercised any CCPA or CPRA right. Authorised Agent If you are a California resident, you may authorise an agent to submit a privacy request on your behalf. Your agent must provide proof of authorisation. Your Rights Under State Privacy Laws of Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Other US States If you are a resident of Colorado, Connecticut, Virginia, Utah, Texas, Oregon or any other US state that has enacted a comprehensive privacy statute, you have rights substantially similar to those described above, which may include: the right to know what personal information we collect; the right to delete your personal information; the right to correct inaccurate information; the right to obtain a portable copy of your information; the right to opt out of targeted advertising and cross-context behavioural advertising; the right to limit processing of sensitive data; and the right not to be discriminated against for exercising your privacy rights. Elevate does not sell or share personal information for cross-context behavioural advertising or targeted advertising purposes. These rights are not applicable to you in the context of our practices because we do not engage in behavioural advertising or profiling. We will interpret and respect your privacy rights under your applicable state law. If you are resident in a state not named above but which has a comprehensive state privacy law, the same principles apply. 10. How to Exercise a Privacy Right and Our Response Window To exercise any of the rights described in Section 9 above, please contact us by email at info@elevatemktevents.com with the subject line "Privacy Request" or "Data Subject Access Request." In your request, please clearly state: - which right you are exercising (for example, "Right to Access," "Right to Delete," "Right to Correct," "Right to Opt Out"); - the type of personal information you are referring to; - your contact information; and - any other details necessary to locate your information. To help us verify your identity and locate your data, please provide details such as the email address you used to submit a contact form, the approximate date of submission and any other identifying information you can provide. If your request is unclear or we cannot verify your identity, we may ask you to provide additional information or clarification. Response Window and Timeline Under the GDPR, we will respond to your request within 30 calendar days of receipt. Under the California CCPA/CPRA, we will respond within 45 calendar days. Under other US state privacy laws, we will respond within the timeframe specified by that state's law (typically 30 to 45 days). In some cases, if your request is complex or we have received a high volume of requests, we may request an additional 30-45 days to respond and will notify you of the extension. We will communicate our response to you at the email address you provided in your request. If you requested access to your data, we will provide it in a structured, commonly used and machine-readable format (for example, a CSV file or PDF document) at no charge. Verification and Identity Confirmation We may ask you to confirm your identity before we process your request, particularly for requests to delete, correct or access sensitive information. This is necessary to prevent unauthorised access to or disclosure of your personal information. No Charge for Requests We will not charge you a fee to exercise a privacy right, except in limited circumstances where requests are manifestly unfounded or excessive (for example, where you have submitted identical requests repeatedly in a short timeframe). If we determine that a fee is appropriate, we will inform you of the cost before processing your request. Right to Appeal and Escalation If we deny your request, we will provide you with a written explanation of the reason for the denial and any grounds for appeal. You have the right to appeal a denial of your privacy right by contacting us again with additional information or by lodging a complaint with the relevant data protection authority or supervisory authority in your jurisdiction. 11. Data Security We implement and maintain reasonable security measures designed to protect personal information from unauthorised access, alteration, disclosure or destruction. Our security measures include: Encryption in Transit All communication between your browser and our website is encrypted using HTTPS (TLS/SSL encryption). This means your contact form submission, including your name, email address and message, is encrypted as it travels from your device to our servers. Secure Server Infrastructure Our web hosting provider maintains physical and virtual security measures to protect our servers, including firewalls, intrusion detection systems, access controls and regular security monitoring. Access Controls Access to your personal information is restricted to our team members and our data processors (web hosting provider, mail service provider and professional advisers) who need to access it to perform their functions. All such persons are bound by confidentiality obligations and are required to process your data in accordance with this privacy policy and applicable data protection laws. Server Access Logs Server logs are stored on our hosting provider's secure infrastructure and are automatically deleted after 30 days (except in cases of suspected abuse or fraud, where logs may be retained for up to 12 months). No Third-Party Trackers or Analytics Because we do not use third-party analytics, advertising pixels, tracking pixels or other third-party services, you are not exposed to additional security risks from these integrations. This reduces your exposure to data breaches at third parties. Email Communication Messages you submit through our contact form are transmitted to our email server via encrypted protocols. Your email address is stored on secure mail servers and is protected by authentication and access controls. Limitations of Security While we implement reasonable security measures, no data transmission over the Internet or storage method is completely secure. We cannot guarantee absolute security of your personal data. You use our website and submit personal information at your own risk. However, we commit to maintaining appropriate security standards and to notifying you of any data breach that affects your personal information and is required to be reported under applicable law. 12. Children's Privacy Our website and services are not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover that we have collected personal information from a child under 13 without parental consent, we will delete that information immediately. If you are a parent or guardian and believe your child has submitted information to us, please contact us immediately at info@elevatemktevents.com. Under the Children's Online Privacy Protection Act (COPPA), if you are a parent or guardian and we have collected personal information from your child, you have the right to review the information, to request that we delete it and to refuse further collection or use of your child's information. For visitors aged 13 and above, we do not treat age as a factor in our privacy practices, except where required by law. 13. Changes to This Privacy Policy We may update this privacy policy from time to time to reflect changes in our data practices, changes in applicable law or other factors. We will post the updated privacy policy on our website and will update the effective date shown at the bottom of this policy. If we make material changes to this privacy policy that significantly alter how we use your personal information, we will notify you by email at the address you provided to us, or by posting a prominent notice on our website before the change takes effect. Your continued use of our website and services after we post changes to this privacy policy constitutes your acceptance of the updated policy. If you do not agree with any changes we make, you should stop using our website and contact us if you wish to exercise your privacy rights. 14. Effective Date This privacy policy is effective as of 5 September 2026. Last Updated: 5 September 2026 For questions about this privacy policy, contact us at info@elevatemktevents.com.