Privacy Policy

1. Who we are

GTO MPSX LLC is a computer integrated systems design practice. The Company operates a prototype bench where breadboard rigs are built, firmware images are flashed, signals are probed and design reviews are held. The Company is the data controller for the personal information described in this policy, which means it decides why and how that information is used.

The Company is registered and reachable at the following address, which is also the location of the bench:

The Company does not operate a separate data protection officer function because its team is small and its processing is limited. Enquiries about privacy are handled directly by the principal engineer, who can be reached using the email address above. A written request posted to the mailing address will also reach the correct person, though email is faster.

2. Scope of this policy

This policy covers personal information collected through the website, through email, through telephone calls and through the delivery of bench services. It also covers information that clients, suppliers, contractors and visitors provide in the course of an engagement, including schematics, part lists, meeting notes and correspondence.

The policy does not cover information that an unrelated company collects on its own website, even if that website is linked from ours. If a client shares a file hosted on a third party platform, the terms of that platform also apply. The Company has no control over those terms and encourages clients to read them before sending sensitive material.

The policy does not apply to information that has been fully anonymised so that no person can be identified from it. Aggregate technical statistics that cannot be tied back to a person fall outside the scope of privacy law and outside this policy.

3. Information we collect

The Company collects only the information it needs to answer a question, prepare an estimate, run a bench session or meet a legal obligation. The categories below describe what may be collected in practice.

Contact details

When a person writes through the contact form, by email or by telephone, the Company may record a name, an email address, a telephone number, a company name, a role and a postal address. These details are used to reply and to prepare a quotation. A person may choose to write from a general company mailbox rather than a personal one if that is preferred.

Project information

Bench work involves schematics, net lists, bills of materials, firmware images, photographs of a rig and written notes about a design. Some of this material may identify a person indirectly, for example when a document carries an author name or a signature block. The Company treats project material as confidential business information in addition to any privacy obligation.

Correspondence

Emails, messages, meeting notes and call logs are kept so that the Company can follow the history of an engagement. A short record of a telephone call may include the date, the parties and the subject discussed. The Company does not record telephone calls.

Technical information

The hosting environment may automatically log technical details such as the internet protocol address of a visitor, the browser type, the screen size category and the pages requested. These logs are used to keep the site available and secure. They are not used to build advertising profiles.

Billing information

Where an engagement proceeds, the Company may collect the billing contact, a purchase order reference and the payment details required by its accounting provider. The Company does not store full card numbers on its own systems. Payment is handled by a regulated provider, and only a reference and a status are retained.

4. How we collect information

Most information arrives directly from the person. A visitor may fill in the contact form, send an email or call the bench. A client may send drawings by email or hand them over during a session. The Company also receives information indirectly from the hosting provider in the form of server logs and from the accounting provider in the form of payment confirmations.

The contact form on this website does not transmit data to a server operated by the Company. Instead it prepares an email in the visitor own mail application, which the visitor then sends. This design keeps the visitor in control of what leaves their device, but it also means the Company only receives what the visitor chooses to send.

The Company does not buy contact lists and does not obtain personal information from data brokers. If a Company employee is introduced to a new contact by a mutual acquaintance, the Company records only the details that the introduction itself contains.

5. Lawful bases for processing

Where privacy law requires a lawful basis, the Company relies on the following grounds. First, processing is necessary to take steps before entering a contract and to perform a contract that has been agreed, for example to prepare an estimate or to deliver a bench session. Second, processing is necessary for the legitimate interests of the Company in running and improving a professional practice, provided those interests are not overridden by the rights of the individual.

Third, processing may be based on consent, for example when a visitor agrees to receive a newsletter or when a client agrees to a reference being published. Consent can be withdrawn at any time without affecting work already done. Fourth, processing may be necessary to comply with a legal obligation, such as keeping accounting records for the period required by tax law.

Where a lawful basis is not obvious, the Company prefers to ask rather than assume. A short email asking whether a particular use is acceptable is always cheaper than repairing a broken expectation.

6. How we use information

The Company uses personal information to reply to enquiries, to prepare estimates and statements of work, to schedule bench sessions, to deliver the services described on this website, to issue invoices and to keep the records that a professional practice is expected to keep.

• Answering questions sent through the contact form, by email or by telephone.
• Confirming a bench slot and sending the address and arrival notes.
• Reviewing a schematic, part list or other project material in order to prepare for a session.
• Producing bench notes, measurement captures and review records for the client.
• Issuing invoices, tracking payment and meeting accounting obligations.
• Maintaining the security and availability of the website and the bench network.
• Handling a complaint, a warranty question or a dispute.

The Company does not sell personal information. It does not rent contact lists. It does not use project material to train a public model or to produce marketing content without written permission from the client. Material sent for a bench session is used for that session and for the records described in this policy, and for nothing else.

7. Bench notes and design records

A bench note is the written record of a session. It lists what was connected, what was measured, what failed and what the next step should be. A bench note may contain the name of the engineer, the name of the client contact, the date, the equipment used and a description of the rig. It is written so that the session can be reproduced, and it is handed over at the end of the engagement.

Because a bench note can reveal the inner workings of a client design, the Company treats it as confidential business information. Access is limited to the engineers working on that engagement, to the accounting function for billing purposes and, where a legal obligation requires it, to professional advisers. Photographs taken at the bench are normally framed to show the rig rather than the people around it, and images of a person are taken only with that person knowing.

If a client asks the Company to destroy a bench record early, the Company will do so unless a legal or accounting rule requires the record to be kept. The request should be made in writing and will be confirmed in writing once the destruction is complete.

8. Cookies and local storage

This website is built from static pages and a small script. It does not set advertising cookies, it does not embed a third party tracking pixel and it does not run a session profiler. The script that supports the navigation, the scroll reveal behaviour and the contact form runs inside the visitor browser and does not send personal data to the Company.

The hosting environment may use a strictly necessary cookie to route requests and to protect the service against abuse. That cookie is used for the delivery of the page and for security, and it is not used to build a profile. A visitor who blocks all cookies in the browser will still be able to read every page of this website.

Local storage may be used by the browser itself for routine functions such as remembering a form field while a page is open. The Company does not write advertising identifiers to local storage and does not read local storage for marketing purposes.

9. How we share information

The Company shares personal information only when there is a clear reason and only to the extent needed. The categories of recipient are described below.

• Service providers who host the website, provide email, keep the accounting records or supply payment processing, each acting on written instructions.
• Professional advisers such as an accountant or a lawyer, where advice is required and the information is relevant to the question.
• A public authority, court or regulator, where the Company is legally required to respond and after checking that the request is valid.
• A successor entity in the unlikely event that the business is reorganised, merged or sold, subject to the same protections described here.
• Another party at the written request of the client, for example a contract manufacturer who needs a net list to quote a build.

The Company does not share project material with a competitor of the client. It does not publish photographs of a client rig without written permission. It does not disclose the identity of a client in a case study unless the client has agreed in writing to being named.

10. Service providers and processors

Like most small practices, the Company depends on a short list of providers. A hosting provider serves the pages. An email provider carries correspondence. An accounting provider keeps invoices and receipts. A payment provider processes card transactions. Each provider is chosen for reliability and is bound by terms that limit its use of the data it handles.

Where a provider acts as a processor, it may use personal information only to deliver the service to the Company and may not use it for its own marketing. The Company reviews these arrangements when they change and asks for clarification when a provider updates its terms in a way that affects confidentiality or retention.

A provider may be located outside the United States. In that case the Company takes reasonable steps to ensure that the transfer is covered by an appropriate safeguard, such as standard contractual clauses, before any personal information is sent.

11. International transfers

The Company operates from Springville, Utah, and most processing happens in the United States. Some service providers may store data in another country. When that happens, the Company relies on contractual safeguards and on the security practices of the provider, and it limits the information sent to what the service actually needs.

A client in another country who engages the Company should understand that project material will be handled in the United States. Where local law requires additional steps, such as a data processing agreement, the Company is willing to discuss and sign one before work begins. The Company will not begin a session that depends on personal data if the legal basis for the transfer is unclear.

12. How long we keep information

Retention is tied to purpose. Enquiries that do not become engagements are normally deleted within twelve months. Correspondence connected to an active engagement is kept for the duration of the work and for a reasonable period afterwards so that questions can be answered. Bench notes and handover folders are kept for six years from the end of the engagement, in line with the record keeping habits of a professional practice.

Accounting records are kept for the period required by tax law, which is currently seven years in the United States. Records connected to a legal claim may be kept until the claim is resolved and any appeal period has passed. Records that are no longer needed are deleted or anonymised, and the deletion is recorded in the internal register.

A person may ask for earlier deletion where the law allows it. The Company will explain any record that must be kept and why, and will delete everything else within a reasonable period.

13. How we protect information

The Company applies technical and organisational measures that are proportionate to a small practice handling valuable design material. Access to the bench network is limited to named engineers. Accounts use strong passwords and multi factor authentication. Devices are encrypted and kept updated. Project folders are shared through controlled links rather than open attachments where possible.

Physical security matters as much as digital security in a bench environment. The workshop is locked outside business hours. Visitor access is logged. Printed schematics are stored in a locked cabinet and shredded when no longer needed. A rig that contains a client prototype is covered at the end of the day and is not left in a public area.

No system is perfect. If a security incident affects personal information, the Company will investigate, contain the problem, notify affected parties without undue delay and report to a supervisory authority where the law requires it. A short incident note will explain what happened, what was affected and what the Company has changed as a result.

14. Your privacy rights

Depending on where a person lives, privacy law may give them the right to access the personal information the Company holds about them, to correct it, to delete it, to restrict or object to its use, to receive a portable copy and to withdraw consent where consent was the basis for processing. The Company honours these rights for everyone it deals with, regardless of location, as a matter of good practice.

To make a request, write to tech@gtompsx.buzz with enough detail to identify the relevant records. The Company will acknowledge the request within a few days and will respond within the period required by applicable law, normally thirty days. If the request is complex, the Company will explain why more time is needed and will keep the person informed.

The Company will not charge a fee for a routine request. It may ask for proof of identity where there is a genuine doubt about who is asking, but it will not demand excessive documentation. If a request is refused, the response will explain the reason and mention the right to complain to a supervisory authority.

15. Notice for California residents

California law gives residents specific rights over personal information. In the twelve months before the effective date of this policy, the Company has collected the categories described in section three: identifiers such as name and email, commercial information such as a project description, internet activity in the form of server logs and professional information such as a job title. The Company has not sold personal information and has not shared it for cross context behavioural advertising.

A California resident may request to know what has been collected, may request deletion, may request correction and may designate an authorised agent to act on their behalf. The Company will verify a request using information already on file and will not discriminate against a person for exercising a right. A request can be sent to tech@gtompsx.buzz or by post to the Springville address.

16. Privacy for children

This website and the bench services are intended for businesses and professional clients. They are not directed at children, and the Company does not knowingly collect personal information from a child under the age of thirteen. If the Company learns that such information has been received, it will delete it promptly.

A parent or guardian who believes that a child has sent personal information to the Company should write to tech@gtompsx.buzz so that the record can be removed. The Company will confirm the deletion once it is complete.

17. Marketing and communications

The Company does not run a bulk marketing programme. Occasional notes about bench availability or a new service may be sent to clients who have asked to receive them. Every note includes a simple way to stop receiving them, and a request to stop is honoured immediately.

A client who provides an email address for the purpose of an engagement will not be added to a newsletter automatically. Consent for marketing is separate from consent to be contacted about work, and the Company keeps the two apart.

18. Third party links

Pages on this website may link to a document hosted elsewhere, to a standards body or to a supplier catalogue. Those destinations are outside the control of the Company. A link is not an endorsement of the privacy practices of the destination, and a visitor should review the destination policy before submitting personal information there.

If a client shares a file through a third party service, the Company will download it to its own systems and will not keep using the external link once the material has been received. The external service may still keep its own copy according to its terms.

19. Automated decisions and profiling

The Company does not make automated decisions that produce legal or similarly significant effects on a person. Enquiries are read by a person, estimates are prepared by a person and bench sessions are scheduled by a person. There is no scoring engine and no advertising profile.

Simple automation is used for ordinary administration, such as a calendar reminder before a session or a filter that diverts obvious spam. These tools do not decide whether a person receives a service and do not create a profile that follows a person across the web.

20. Changes to this policy

The Company reviews this policy at least once a year and whenever a practice changes. When a change is material, the effective date at the top of the page is updated and a short summary of the change is prepared for clients with an active engagement. The current version is always available on this page.

A person who continues to use the website or the bench services after a change takes effect is treated as having accepted the updated policy. Anyone who disagrees with a change may contact the Company to discuss an alternative, and may ask for a copy of the earlier version for comparison.

21. Complaints and supervision

The Company would rather hear about a concern early than discover it later. A complaint should be sent to tech@gtompsx.buzz with the word privacy in the subject line and enough detail to identify the matter. The Company will acknowledge the complaint, investigate and reply in writing, normally within fifteen working days.

A person who is not satisfied with the response may complain to the supervisory authority in their country or state. The Company will cooperate with a lawful investigation and will not penalise a person for making a complaint in good faith.

22. How to contact us

Questions about this policy, requests to access or delete information and any other privacy matter can be sent to the Company using the details below. The bench telephone is answered during business hours, Monday to Friday, and email is monitored throughout the working week.

This policy is provided for transparency and does not create rights beyond those granted by applicable law. Where a translation is prepared for convenience, the English version remains the authoritative text.