PRIVACY POLICY
Cynthia S Johnson HR Consulting
Effective Date: August 19, 2026
Cypress, Texas | Cynthia@Helpmybizcomply.com
Applicable Laws & Regulations
This Privacy Policy is designed to comply with the following laws and frameworks: the General Data Protection Regulation (GDPR); the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA); the Texas Data Privacy and Security Act (TDPSA); the California Online Privacy Protection Act (CalOPPA); the Children's Online Privacy Protection Act (COPPA); and applicable Twilio A2P 10DLC SMS messaging carrier registration requirements as of 2026.
TABLE OF CONTENTS
1. Introduction & Overview
2. Information We Collect
3. How We Collect Information
4. How We Use Your Information
5. Legal Basis for Processing (GDPR)
6. SMS / Text Message Communications — A2P Compliance (Twilio)
7. Cookies and Tracking Technologies
8. How We Share Your Information
9. Data Retention
10. Security Measures
11. Your Rights — CCPA / CPRA (California Residents)
12. Your Rights — Texas Residents (TDPSA)
13. Your Rights — GDPR / EEA Residents
14. Children's Privacy (COPPA)
15. Links to Third-Party Websites
16. Changes to This Policy
17. Contact Information / Data Subject Requests
SECTION 1 — INTRODUCTION & OVERVIEW
1.1 Who We Are
Cynthia S Johnson HR Consulting ("Company," "we," "us," or "our") is a human resources consulting firm headquartered in Cypress, Texas. We provide professional HR consulting services to businesses and individuals, including but not limited to HR strategy, employee relations, policy development, talent acquisition support, compliance guidance, onboarding solutions, and related professional services. We operate the website located at www.CynthiasJohnsonHR.com (the "Site") and conduct business communications through email, telephone, and SMS text messaging.
1.2 Scope of This Policy
This Privacy Policy describes how Cynthia S Johnson HR Consulting collects, uses, discloses, retains, and protects personal information obtained from individuals who: (a) visit our website; (b) submit inquiries, contact forms, or requests for services; (c) subscribe to our email newsletter or communications; (d) opt into SMS/text message communications; (e) engage us for HR consulting services; or (f) otherwise interact with us in a professional or commercial capacity.
This Policy applies to all personal information collected through digital channels, including our website, email, text messaging platforms, scheduling tools, and any other means by which you may provide personal information to us. It does not apply to the employment records of our consulting clients' employees, which are governed by separate data processing agreements and applicable employment law.
By using our Site or providing your personal information to us in any manner, you acknowledge that you have read and understood this Privacy Policy.
1.3 How to Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us using the information below:
● Business Name: Cynthia S Johnson HR Consulting
● Location: Cypress, Texas, United States
● Email:info@CynthiasJohnsonHR.com
● Website:www.CynthiasJohnsonHR.com
● Mailing Address: Cypress, TX, United States
We strive to respond to all privacy-related inquiries within thirty (30) business days and will make every reasonable effort to address your request promptly and completely.
SECTION 2 — INFORMATION WE COLLECT
We collect several categories of personal information depending on how you interact with our business and website. The categories below describe the types of information we may collect.
2.1 Personal Identifiers
We collect personal identifiers that you voluntarily provide or that are automatically generated through your use of our Site, including:
● Full name and preferred name
● Email address
● Phone number (including mobile/cell numbers)
● Mailing address and geographic location (city, state, ZIP code)
● Internet Protocol (IP) address
● Online identifiers such as browser type, device identifiers, and user agent strings
2.2 Professional and Employment Information
Because we operate as an HR consulting firm, we may collect employment-related and professional information that you voluntarily submit through contact forms, service inquiries, or in the course of receiving our consulting services, including:
● Job title, employer name, and industry
● Resume or curriculum vitae (CV) content, including work history, educational background, skills, and certifications
● Business needs, workforce challenges, and organizational details shared in consultation
● Professional references and contact information for business purposes
● Compensation information if shared voluntarily in the context of HR consulting services
2.3 Device and Usage Data
When you visit our Site, we and our third-party service providers may automatically collect certain technical and usage information, including:
● Browser type and version
● Operating system and device type
● Pages visited on our Site and time spent on each page
● Referring URL (the page that directed you to our Site)
● Clickstream data and navigation paths
● Date and time of your visit
● Geographic region inferred from IP address
2.4 Communications Data
We collect information contained in or related to any communications you have with us, including:
● Content of emails sent to or received from us
● Content and records of SMS/text message communications, including opt-in and opt-out records
● Notes or records from phone consultations
● Feedback, inquiries, and correspondence submitted through our website contact form
2.5 Payment Information
If you purchase consulting services or make a payment through our website or invoicing system, payment transactions are processed by trusted third-party payment processors. We do not collect, store, or have access to full credit or debit card numbers, bank account numbers, or other sensitive financial account credentials. We may retain limited transaction records, such as invoice amounts, payment dates, and transaction confirmation numbers, for accounting and legal compliance purposes.
2.6 Sensitive Personal Information (CCPA / TDPSA)
Under the California Consumer Privacy Act (CCPA) as amended by the CPRA, and under the Texas Data Privacy and Security Act (TDPSA), certain categories of personal information are designated as "sensitive personal information" and afforded heightened protection. We do not intentionally collect sensitive personal information as part of our standard business operations. However, in limited circumstances where sensitive personal information is shared with us voluntarily in the context of employment consulting (e.g., health accommodations, demographic information for DEI initiatives), we treat such information with the highest degree of care and limit its use strictly to the purpose for which it was provided. Categories of sensitive personal information under applicable law may include:
● Social Security number, driver's license number, or other government-issued identifiers (we do not collect these through our website)
● Racial or ethnic origin, religious beliefs, or union membership, if disclosed voluntarily in an HR consulting context
● Health, medical, or disability information, if shared voluntarily for accommodation planning
● Precise geolocation data (we do not collect precise geolocation)
● The contents of mail, email, or text messages, unless we are the intended recipient
We collect sensitive personal information only to the extent necessary to provide the specific service requested and do not use it for secondary purposes without your explicit consent.
SECTION 3 — HOW WE COLLECT INFORMATION
3.1 Directly from You
The primary means by which we collect personal information is directly from you when you choose to provide it. This includes:
● Contact and inquiry forms: When you complete a contact form on our website to request information, a consultation, or our services.
● Newsletter and email sign-ups: When you subscribe to receive our HR insights newsletter, updates, or promotional communications.
● SMS opt-in: When you provide your mobile phone number and consent to receive text messages from us, whether through a web form, an in-person sign-up, or a verbal opt-in confirmed in writing.
● Scheduling tools: When you book a consultation or appointment using our online scheduling platform.
● Resume or document uploads: When you submit a resume or other professional documents in connection with a service request.
● Direct email or phone communication: When you initiate correspondence with us via email or telephone.
3.2 Automatically — Cookies and Analytics
When you visit our Site, certain information is collected automatically through cookies, web beacons, pixels, session tracking technologies, and analytics tools. This includes device and usage data as described in Section 2.3. These technologies allow us to understand how visitors use our Site, measure the effectiveness of our communications, and improve our online presence. Please refer to Section 7 of this Policy for detailed information about cookies and tracking technologies, and how to manage them.
3.3 From Third Parties
We may receive personal information about you from third-party sources, including:
● Referrals: If a colleague, client, or partner refers you to our services and provides your basic contact information so that we may follow up.
● Professional networking platforms: If you engage with our presence on LinkedIn or other professional social networks, we may receive information consistent with those platforms' privacy settings.
● Social media platforms: If you interact with our content or advertising on platforms such as Facebook, Instagram, or LinkedIn, those platforms may share interaction data consistent with their own privacy policies and your account settings.
● Analytics and advertising partners: Third-party analytics services may provide aggregated or de-identified data about traffic patterns or campaign performance that helps us understand how our marketing efforts are working.
We do not purchase personal information from data brokers for marketing purposes.
SECTION 4 — HOW WE USE YOUR INFORMATION
We use the personal information we collect for the following business purposes:
4.1 Providing HR Consulting Services and Responding to Inquiries
The primary purpose for which we collect and use your personal information is to provide you with our professional HR consulting services and to respond to your questions, service inquiries, consultation requests, and general correspondence. This includes scheduling appointments, preparing proposals, delivering consulting engagements, and following up on service outcomes.
4.2 Sending Transactional and Marketing Communications
We use your contact information to send you transactional communications that are necessary to our service relationship, such as appointment confirmations, service updates, invoices, and receipts. With your consent, we also send marketing communications including our HR insights newsletter, service announcements, promotional offers, and educational content via email. If you have opted into SMS communications, we may also send you text messages as described in Section 6 of this Policy.
4.3 Processing Payments and Managing Appointments
We use your information to process payments for consulting services through our third-party payment processors, to generate and track invoices, and to manage appointment scheduling through our booking tools.
4.4 Improving Our Website and Service Offerings
We analyze usage data, website analytics, and client feedback to understand how our Site is used, identify areas for improvement, evaluate the effectiveness of our content and marketing campaigns, and develop new service offerings that better meet the needs of our clients.
4.5 Complying with Legal Obligations
We use and retain personal information as necessary to comply with applicable laws and regulations, including but not limited to tax reporting requirements, record-keeping obligations under employment and labor laws, and obligations imposed by data protection regulations including the GDPR, CCPA/CPRA, and TDPSA.
4.6 Preventing Fraud and Protecting Security
We use technical data including IP addresses, device identifiers, and access logs to detect, investigate, and prevent fraudulent activity, unauthorized access to our systems, and other potential security incidents. We also use information to verify the identity of individuals making data subject requests to protect against unauthorized disclosure of personal information.
SECTION 5 — LEGAL BASIS FOR PROCESSING (GDPR)
For individuals located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the processing of your personal information is governed by the General Data Protection Regulation (GDPR) and applicable national implementing legislation. We must have a valid legal basis for each purpose for which we process your personal data. The following legal bases apply to our processing activities:
5.1 Consent (Article 6(1)(a) GDPR)
Where you have given us your express, freely given, specific, informed, and unambiguous consent to process your personal data for a particular purpose, we rely on that consent as our legal basis. This applies, for example, to:
● Sending marketing emails or newsletters
● Sending promotional SMS/text messages
● Setting non-essential cookies on your device
● Processing sensitive personal data categories you voluntarily share
5.2 Contract Performance (Article 6(1)(b) GDPR)
We process personal data where it is necessary to enter into or perform a contract with you, or to take steps at your request prior to entering into a contract. This applies to processing activities related to delivering our HR consulting services, fulfilling service agreements, managing appointments, and processing payments.
5.3 Legitimate Interests (Article 6(1)(f) GDPR)
We process personal data where it is necessary for our legitimate business interests, provided those interests are not overridden by your privacy rights and freedoms. Our legitimate interests include improving our services and website, preventing fraud, ensuring the security of our systems and communications, and conducting direct marketing to existing clients where permitted. We conduct a legitimate interests assessment before relying on this basis to ensure the appropriate balance is maintained.
5.4 Legal Obligation (Article 6(1)(c) GDPR)
We process personal data where necessary to comply with a legal obligation to which we are subject, including applicable tax laws, employment regulations, anti-money laundering obligations, and orders of courts or regulatory authorities.
5.5 How to Withdraw Consent
Where we rely on consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of any processing carried out prior to withdrawal. You may withdraw your consent by:
● Clicking the "unsubscribe" link in any marketing email
● Replying STOP to any SMS/text message to opt out of text message communications
● Contacting us directly at info@CynthiasJohnsonHR.com
● Adjusting your cookie preferences through our website's cookie management tool
Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal, nor will it affect processing carried out on other legal bases.
SECTION 6 — SMS / TEXT MESSAGE COMMUNICATIONS — A2P COMPLIANCE (TWILIO)
Important SMS / Text Message Disclosure
6.1 Consent to Receive Text Messages
By providing your mobile phone number to Cynthia S Johnson HR Consulting and opting in to SMS/text message communications — whether through a web form, email confirmation, in-person sign-up, or any other affirmative opt-in mechanism — you expressly consent to receive recurring text messages from Cynthia S Johnson HR Consulting. Your consent to receive text messages is not required as a condition of purchasing any goods or services from us. Standard message and data rates may apply.
6.2 Types of Messages You May Receive
By opting in, you may receive text messages in the following categories:
• Appointment reminders: Reminders about scheduled consultations, meetings, or follow-up sessions.
• Service updates: Updates related to the status of ongoing HR consulting engagements or projects.
• Promotional messages: Offers, announcements, and promotions related to our HR consulting services, workshops, or events.
• Informational HR content: Educational messages, HR tips, compliance reminders, and industry updates relevant to HR professionals and business owners.
• Transactional messages: Billing notifications, document requests, and other messages necessary to the administration of your service engagement.
6.3 Message Frequency
Message frequency may vary depending on your engagement with our services and your communication preferences. You may receive up to several messages per month across the categories described above. Message frequency will generally reflect the active status of your service relationship with us.
6.4 Message and Data Rates
Message and data rates may apply. Standard messaging and data rates charged by your mobile carrier will apply to all text messages sent to and received from us. Cynthia S Johnson HR Consulting is not responsible for any charges assessed by your mobile carrier.
6.5 How to Opt Out (STOP)
You may opt out of receiving text messages from Cynthia S Johnson HR Consulting at any time by replying STOP to any text message you receive from us. After sending STOP, you will receive one final confirmation text message acknowledging that your opt-out request has been processed and that you will no longer receive messages from us. No further text messages will be sent to your number following the opt-out confirmation, except as may be required by law.
You may also opt out by contacting us at info@CynthiasJohnsonHR.com and requesting removal of your mobile number from our messaging list.
6.6 How to Get Help (HELP)
If you need assistance regarding our text message program, reply HELP to any text message received from us. You will receive a response message with information about our messaging program and contact details. You may also contact us directly at:
• Email:info@CynthiasJohnsonHR.com
• Website:www.CynthiasJohnsonHR.com
6.7 Privacy of Mobile Phone Numbers
We do not sell, rent, trade, or share your mobile phone number with third parties for their own marketing purposes. Your mobile phone number is used solely by Cynthia S Johnson HR Consulting for the purposes described in this Privacy Policy.
Opt-in data, including your mobile phone number and your record of consent, will not be shared with any third party for marketing purposes. This information may be shared only with our SMS service providers (including Twilio) solely for the purpose of delivering text messages on our behalf, and such providers are contractually prohibited from using your information for any other purpose.
6.8 Carrier Disclaimer
Mobile carriers are not liable for delayed or undelivered text messages. Delivery of text messages is subject to effective transmission from your mobile carrier, and Cynthia S Johnson HR Consulting is not responsible for messages that are delayed or not delivered due to carrier network issues, device compatibility, or other factors outside our control.
6.9 Supported Carriers
Our SMS messaging program is available to subscribers of all major United States wireless carriers, including but not limited to: AT&T, T-Mobile, Verizon, Sprint (T-Mobile), U.S. Cellular, Boost Mobile, Metro by T-Mobile, Cricket Wireless, and other regional and national carriers that support A2P 10DLC short code and long code messaging. Carrier support may vary. For questions about carrier compatibility, please contact your mobile carrier or contact us at info@CynthiasJohnsonHR.com.
6.10 Terms and Conditions
By opting into SMS communications, you agree to our Terms and Conditions, which govern your use of our messaging program. Our full Terms and Conditions are available on our website at www.CynthiasJohnsonHR.com/terms. This Privacy Policy is incorporated by reference into those Terms and Conditions.
6.11 How to Re-Subscribe After Opting Out
If you have previously opted out of SMS communications by texting STOP and wish to re-subscribe to receive text messages from Cynthia S Johnson HR Consulting, you may re-subscribe at any time by texting START or YES to the same number from which you previously received our messages, or by contacting us at info@CynthiasJohnsonHR.com to request re-enrollment. Upon re-subscribing, you will receive a confirmation text message and will resume receiving messages as described in this section.
SECTION 7 — COOKIES AND TRACKING TECHNOLOGIES
7.1 What Are Cookies
Cookies are small text files placed on your device (computer, smartphone, or tablet) by websites you visit. They are widely used to make websites function efficiently, to provide reporting information, and to help website owners and operators understand how users interact with their websites. Cookies may be "session cookies" (which expire when you close your browser) or "persistent cookies" (which remain on your device for a set period or until you delete them).
7.2 Types of Cookies We Use
Cookie Type
Purpose
Required?
Strictly Necessary / Essential
These cookies are essential for the basic operation of our website and cannot be disabled. They enable core functionality such as page navigation, form submission, and security features.
Yes — cannot be disabled
Functional / Preference
These cookies remember your preferences and settings (such as language, region, and form data) to provide a more personalized browsing experience.
Optional
Analytics / Performance
These cookies collect aggregated, anonymized data about how visitors use our website, such as pages visited, time spent, and navigation paths. This information helps us improve our website.
Optional
Marketing / Targeting
These cookies track your browsing activity across websites to enable targeted advertising and measure the effectiveness of our marketing campaigns. They may be set by us or by third-party advertising partners.
Optional — requires consent
7.3 Third-Party Cookies and Tracking Tools
Our website may use the following third-party analytics and marketing tools that set cookies or use similar tracking technologies:
● Google Analytics: Used to collect and analyze anonymous website usage data. Google Analytics uses cookies to track sessions, pages visited, and user behavior. Information collected by Google Analytics is subject to Google's Privacy Policy.
● Meta Pixel (Facebook Pixel): A tracking tool used to measure the effectiveness of our Facebook and Instagram advertising, and to build audiences for retargeting campaigns. The Meta Pixel is subject to Meta's Data Policy.
● Scheduling and booking tools: Third-party scheduling platforms (such as Calendly or similar tools) may set cookies when you use our appointment booking features.
● Email marketing platforms: Our email service provider may use tracking pixels to track email open rates and click-through activity.
We do not control the cookies or tracking technologies used by third parties, and their use is governed by the privacy policies of the respective third parties.
7.4 Cookie Consent and How to Manage Cookies
When you first visit our website, you may be presented with a cookie consent banner that allows you to accept or decline non-essential cookies. You may update your cookie preferences at any time through our website's cookie settings tool.
In addition, you can manage cookies directly through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling cookies may affect the functionality of our website and your ability to access certain features. Instructions for managing cookies in common browsers can be found at the respective browser's help documentation.
You may also opt out of interest-based advertising by visiting the Network Advertising Initiative opt-out page at www.networkadvertising.org/managing/opt_out.asp, or the Digital Advertising Alliance opt-out tool at www.aboutads.info/choices.
7.5 Do Not Track Signals
Some browsers offer a "Do Not Track" (DNT) setting that signals to websites that the user does not wish to be tracked. Because there is no uniform technical standard for recognizing or honoring DNT signals, our website does not currently respond to DNT browser signals in a manner that would alter the data we collect. However, you may use the cookie management options described in Section 7.4 to limit tracking on our Site. We will update this Policy if we implement a DNT response in the future.
SECTION 8 — HOW WE SHARE YOUR INFORMATION
We do not sell your personal information to third parties. We share personal information only in the limited circumstances described below.
8.1 Service Providers and Data Processors
We engage trusted third-party companies and individuals to perform services on our behalf and to assist us in operating our business. These service providers have access to personal information only to the extent necessary to perform their specific functions and are contractually obligated to protect your information and use it solely for the purposes we specify. Categories of service providers we use include:
● Website hosting and infrastructure: Companies that host our website and associated data on secure servers.
● Email marketing platforms: Services used to send newsletters, promotional communications, and transactional emails.
● SMS messaging platform: Twilio, Inc. and similar communication platforms used to deliver text messages on our behalf.
● Payment processors: Third-party payment processing companies that handle credit card and other payment transactions securely.
● Analytics providers: Services such as Google Analytics that help us understand website traffic and user behavior.
● Scheduling and appointment tools: Platforms used to enable clients to book consultations and appointments online.
● Customer relationship management (CRM) tools: Software used to manage client relationships and communications.
8.2 Business Transfers
In the event that Cynthia S Johnson HR Consulting undergoes a merger, acquisition, reorganization, sale of all or substantially all of its assets, or similar business transaction, personal information we hold may be transferred to the acquiring party or successor entity as part of that transaction. In such circumstances, we will notify affected individuals through a prominent notice on our website or by direct communication, and the acquiring entity will be required to honor the commitments made in this Privacy Policy or provide you with the opportunity to opt out of any material changes to your rights.
8.3 Legal Requirements and Law Enforcement
We may disclose personal information if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation, subpoena, court order, or other lawful government or regulatory request; (b) enforce our Terms and Conditions or other agreements; (c) protect the rights, property, or safety of Cynthia S Johnson HR Consulting, our clients, or the public; or (d) detect, prevent, or address fraud, security incidents, or technical issues.
8.4 With Your Consent
We may share your personal information with third parties for purposes not described in this Privacy Policy where you have provided explicit consent to such sharing. Any consent-based sharing will be described to you at the time your consent is requested.
8.5 We Do Not Sell Personal Information
Cynthia S Johnson HR Consulting does not sell, rent, trade, or otherwise make your personal information available to third parties in exchange for monetary compensation or other valuable consideration. We do not engage in data brokerage activities. California residents are further notified that we do not share personal information for cross-context behavioral advertising purposes without providing the right to opt out as required by the CCPA/CPRA. Texas residents are notified of their right to opt out of the sale of personal data and targeted advertising under the TDPSA, as described in Section 12 of this Policy.
SECTION 9 — DATA RETENTION
9.1 Retention Periods by Data Category
We retain personal information only for as long as is necessary to fulfill the purposes for which it was collected, to provide our services, and to comply with our legal and regulatory obligations. The following table describes our general data retention practices:
Data Category
Retention Period
Client contact information and service records
Duration of the client relationship plus seven (7) years, to comply with applicable recordkeeping requirements
Email communications and correspondence
Three (3) years from the last communication or end of the client relationship, whichever is later
SMS opt-in records and messaging logs
Four (4) years from the date of opt-in or last message, to comply with carrier and regulatory requirements
Payment and transaction records
Seven (7) years from the transaction date, in compliance with tax and accounting laws
Website analytics and usage data
Twenty-six (26) months, consistent with Google Analytics default data retention settings
Cookie and tracking data
As specified in cookie settings; non-essential cookies expire within twelve (12) months
Inquiry and contact form submissions (non-clients)
Two (2) years from the date of submission
Resume and employment-related submissions
Two (2) years unless incorporated into a client engagement, in which case the client record retention period applies
9.2 Criteria for Determining Retention Period
Where specific retention periods are not set out above, we determine appropriate retention periods based on the following criteria: (a) the nature and sensitivity of the personal information; (b) the purposes for which the information was collected and whether those purposes have been fulfilled; (c) applicable legal, regulatory, tax, or accounting requirements; (d) whether the information is needed to resolve potential disputes or enforce our agreements; and (e) the reasonable expectations of the individual whose information we hold.
9.3 How to Request Deletion
Subject to certain legal exceptions, you may request that we delete your personal information by contacting us at info@CynthiasJohnsonHR.com. Please see Section 11 (California Residents), Section 12 (Texas Residents), and Section 13 (EEA Residents) for the applicable procedures and limitations on deletion rights. Following a valid deletion request, we will delete or de-identify your personal information within forty-five (45) days, unless a legal exception applies, in which case we will notify you of the exception.
SECTION 10 — SECURITY MEASURES
10.1 Technical and Organizational Safeguards
We implement and maintain reasonable and appropriate technical and organizational security measures designed to protect your personal information against unauthorized access, disclosure, alteration, destruction, or loss. These measures include, but are not limited to:
● Transmission of data via Secure Sockets Layer (SSL) / Transport Layer Security (TLS) encryption
● Access controls limiting access to personal information to authorized personnel on a need-to-know basis
● Use of reputable and security-vetted third-party service providers with contractual data protection obligations
● Regular review of our data collection and storage practices
● Password protection and multi-factor authentication for internal system access where feasible
● Use of secure, cloud-based platforms for data storage and communications
10.2 Breach Notification Procedures
In the event of a security breach that compromises your personal information and triggers notification obligations under applicable law (including the Texas Identity Theft Enforcement and Protection Act, the CCPA/CPRA, and the GDPR), we will notify affected individuals and applicable regulatory authorities within the timeframes required by law. Notifications will be made via email, website notice, or other appropriate methods, and will describe the nature of the breach, the categories of information affected, and the steps we are taking to address the incident.
10.3 No Guarantee of Absolute Security
While we are committed to maintaining the security of your personal information, no method of data transmission over the internet and no method of electronic data storage is completely secure. We cannot guarantee the absolute security of your personal information. If you have reason to believe that your interaction with us is no longer secure, please notify us immediately at info@CynthiasJohnsonHR.com.
SECTION 11 — YOUR RIGHTS — CCPA / CPRA (CALIFORNIA RESIDENTS)
If you are a resident of the State of California, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), grants you specific rights regarding your personal information. This section describes those rights and how to exercise them.
11.1 Right to Know
You have the right to request that we disclose to you the specific pieces of personal information we have collected about you, the categories of personal information collected, the categories of sources from which it was collected, the business or commercial purposes for which it was collected, and the categories of third parties with whom it has been shared or disclosed.
11.2 Right to Delete
You have the right to request that we delete personal information we have collected about you, subject to certain exceptions permitted by law. Exceptions include situations where retention is necessary to complete a transaction, detect security incidents, comply with a legal obligation, or exercise free speech rights, among others.
11.3 Right to Correct
You have the right to request that we correct inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the purposes for which it is processed.
11.4 Right to Opt Out of Sale or Sharing
You have the right to direct us not to sell your personal information or share it for cross-context behavioral advertising purposes. As stated in Section 8.5 of this Policy, we do not sell personal information. However, you may exercise this right at any time by contacting us at info@CynthiasJohnsonHR.com.
11.5 Right to Limit Use of Sensitive Personal Information
Where we process sensitive personal information (as defined under CPRA), you have the right to direct us to limit such use to purposes that are necessary to provide the services you have requested, or as otherwise permitted by the CPRA. To exercise this right, please contact us at info@CynthiasJohnsonHR.com.
11.6 Right to Non-Discrimination
We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you goods or services, charge you different prices, provide you a different level of service quality, or suggest that you will receive a different level of service as a result of exercising your privacy rights.
11.7 How to Submit a Verifiable Consumer Request
To exercise your rights under the CCPA/CPRA, submit a verifiable consumer request by:
● Sending an email to info@CynthiasJohnsonHR.com with the subject line "California Privacy Request"
● Visiting our website at www.CynthiasJohnsonHR.com and submitting a data subject request form
To protect your privacy, we will need to verify your identity before processing your request. We will ask you to provide information that matches the information we have on file for you. We will not fulfill a request that we cannot verify. You may designate an authorized agent to submit a request on your behalf; the authorized agent must provide proof of your written authorization.
11.8 Response Timeframe
We will acknowledge receipt of your verifiable consumer request within ten (10) business days and will respond substantively within forty-five (45) calendar days of receipt. If we require additional time (up to an additional forty-five days), we will notify you of the reason for the extension and the expected response date.
SECTION 12 — YOUR RIGHTS — TEXAS RESIDENTS (TDPSA)
If you are a resident of the State of Texas, the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024, provides you with certain rights regarding your personal data. This section describes those rights and how to exercise them.
12.1 Rights Afforded Under the TDPSA
Texas residents have the following rights with respect to their personal data:
● Right to Access: You have the right to confirm whether we process your personal data and to access the personal data we hold about you.
● Right to Correct: You have the right to correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of processing.
● Right to Delete: You have the right to request deletion of personal data you have provided to us or that we have collected about you.
● Right to Data Portability: You have the right to obtain a copy of your personal data in a portable, technically feasible format that allows you to transmit the data to another entity, where applicable.
● Right to Opt Out of Targeted Advertising: You have the right to opt out of the processing of your personal data for targeted advertising purposes.
● Right to Opt Out of Sale of Personal Data: You have the right to opt out of the sale of your personal data. As stated herein, we do not sell personal data.
● Right to Opt Out of Profiling: You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.
12.2 How to Submit a Request
To exercise any of the rights described above, please submit a request to us by email at info@CynthiasJohnsonHR.com with the subject line "Texas Privacy Request," or through the data subject request form available at www.CynthiasJohnsonHR.com. We will respond to verified requests within forty-five (45) days of receipt. If additional time is needed, we will notify you and may extend the response period by an additional forty-five (45) days.
12.3 Right to Appeal a Denied Request
If we decline to take action on your request, we will notify you within forty-five (45) days and provide a written explanation of our reasons. You may appeal our decision by submitting a written appeal to info@CynthiasJohnsonHR.com within a reasonable period after receiving our decision. We will respond to your appeal within sixty (60) days of receipt and will inform you in writing of our decision and the reasons for it.
12.4 Texas Attorney General
If your appeal is denied, you have the right to submit a complaint to the Texas Attorney General. Information about submitting a complaint to the Texas Attorney General can be found at the Office of the Attorney General of Texas website at www.texasattorneygeneral.gov.
SECTION 13 — YOUR RIGHTS — GDPR / EEA RESIDENTS
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and applicable national data protection laws provide you with a comprehensive set of rights with respect to your personal data.
13.1 Rights Under the GDPR
● Right of Access (Article 15): You have the right to obtain confirmation of whether we process your personal data and to receive a copy of the personal data we hold about you, along with information about how it is used.
● Right to Rectification (Article 16): You have the right to request correction of inaccurate personal data and completion of incomplete personal data without undue delay.
● Right to Erasure / Right to Be Forgotten (Article 17): You have the right to request deletion of your personal data where there is no compelling reason for its continued processing, subject to applicable exceptions.
● Right to Restriction of Processing (Article 18): You have the right to request restriction of processing of your personal data in certain circumstances, such as when you contest the accuracy of data or when processing is unlawful but you prefer restriction to erasure.
● Right to Data Portability (Article 20): You have the right to receive personal data you have provided to us in a structured, commonly used, machine-readable format and to transmit it to another controller, where processing is based on consent or contract and is carried out by automated means.
● Right to Object (Article 21): You have the right to object at any time to the processing of your personal data based on legitimate interests, including for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately.
● Rights Related to Automated Decision-Making (Article 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. We do not engage in fully automated decision-making that produces such effects.
13.2 How to Lodge a Complaint
If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the relevant supervisory authority in your country of residence or establishment. In the European Union, you may contact the data protection authority of the EU member state where you reside. In the United Kingdom, the relevant supervisory authority is the Information Commissioner's Office (ICO). Contact details for EU supervisory authorities are available at the European Data Protection Board website at www.edpb.europa.eu.
13.3 Data Controller Contact Information
For the purposes of GDPR compliance, Cynthia S Johnson HR Consulting acts as the data controller for personal data collected from EEA, UK, and Swiss residents in connection with our website and services. You may contact the data controller at:
● Name: Cynthia S Johnson HR Consulting
● Email:info@CynthiasJohnsonHR.com
● Website:www.CynthiasJohnsonHR.com
● Location: Cypress, Texas, United States
13.4 International Data Transfers
Cynthia S Johnson HR Consulting is based in the United States. If you are located in the EEA, the UK, or Switzerland, your personal data will be transferred to and processed in the United States, which may not provide the same level of data protection as your home country. Where we transfer personal data internationally, we rely on appropriate legal transfer mechanisms, including Standard Contractual Clauses (SCCs) as approved by the European Commission, to ensure that your personal data receives an adequate level of protection. You may request a copy of the applicable transfer safeguards by contacting us at info@CynthiasJohnsonHR.com.
SECTION 14 — CHILDREN'S PRIVACY (COPPA)
14.1 Not Directed at Children Under 13
Our website and services are not directed at, intended for, or designed to attract children under the age of thirteen (13). Cynthia S Johnson HR Consulting offers professional HR consulting services intended for adults, business owners, and human resources professionals. We do not knowingly market our services to minors.
14.2 No Knowing Collection of Data from Children Under 13
We do not knowingly collect, use, share, or retain personal information from any person under the age of thirteen (13) without verifiable parental consent, as required by the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq. Our website does not include features designed to appeal to children, and we do not have actual knowledge that we have collected personal information from a child under thirteen.
14.3 How Parents Can Request Deletion
If you are a parent or legal guardian and you believe that we may have inadvertently collected personal information from a child under the age of thirteen, please contact us immediately at info@CynthiasJohnsonHR.com with the subject line "COPPA — Parental Request." Upon verification of your identity and relationship to the child, we will promptly review the matter and take steps to delete the information from our records. We will not use such information for any commercial purpose once we are aware of its source.
SECTION 15 — LINKS TO THIRD-PARTY WEBSITES
15.1 Disclaimer of Responsibility for External Sites
Our website may contain hyperlinks to third-party websites, social media platforms, scheduling tools, partner organizations, and other external resources for your convenience or informational purposes. These links do not constitute an endorsement by Cynthia S Johnson HR Consulting of the content, privacy practices, or policies of those third-party sites. Once you leave our website by clicking on a third-party link, your interaction is governed by the privacy policy and terms of use of that third-party website, not by this Privacy Policy. We have no control over, and accept no responsibility for, the content or privacy practices of any third-party website.
15.2 Recommendation to Review Third-Party Policies
We strongly encourage you to review the privacy policies of any third-party websites or services you visit through links on our Site, before providing any personal information to those third parties. If you have questions about a third-party's data practices, please contact that third party directly.
SECTION 16 — CHANGES TO THIS POLICY
16.1 How and When We Update This Policy
We review this Privacy Policy periodically and may update it from time to time to reflect changes in our business practices, applicable laws, regulatory requirements, or industry standards. We reserve the right to modify this Policy at any time at our sole discretion.
16.2 Notification of Changes
When we make changes to this Privacy Policy, we will update the "Effective Date" at the top of this document to reflect the date the revised Policy becomes effective. We will post the updated Privacy Policy on our website at www.CynthiasJohnsonHR.com. For material changes — meaning changes that significantly alter your rights or our obligations under this Policy — we will provide more prominent notice, which may include sending an email notification to the email address associated with your account or inquiry record, displaying a banner or pop-up notice on our website, or both. We encourage you to review this Privacy Policy periodically to stay informed of our current practices.
16.3 Continued Use Constitutes Acceptance
Your continued use of our website or services following the posting of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Privacy Policy, you should discontinue your use of our website and services and contact us to request deletion of your personal information where applicable.
SECTION 17 — CONTACT INFORMATION / DATA SUBJECT REQUESTS
For any questions, concerns, requests, complaints, or communications related to this Privacy Policy or our personal information practices, including requests to exercise your rights as a data subject under any applicable law, please contact us using the information below:
Business Name
Cynthia S Johnson HR Consulting
Location
Cypress, Texas, United States
Mailing Address
Cypress, TX, United States
Email Address
Website
Privacy Request Subject Line
Privacy Request — [Your Name and State of Residence]
When submitting a data subject request, please provide sufficient information to allow us to verify your identity and locate your records, and describe your request with reasonable specificity so that we can understand and respond appropriately. We will acknowledge receipt of all privacy-related requests promptly and respond within the timeframes required by applicable law.
Summary of Key Contact Actions
• To opt out of email marketing: Click "Unsubscribe" in any marketing email or email info@CynthiasJohnsonHR.com
• To opt out of SMS/text messages: Reply STOP to any text message
• To re-subscribe to SMS: Reply START or YES to our number
• To request access, correction, or deletion of personal data: Email info@CynthiasJohnsonHR.com
• To report a children's privacy concern: Email info@CynthiasJohnsonHR.com with subject "COPPA — Parental Request"
• To submit a GDPR complaint: Contact your local supervisory authority or email us
• To appeal a denied TDPSA request: Email info@CynthiasJohnsonHR.com
This Privacy Policy is effective as of August 19, 2026.
Cynthia S Johnson HR Consulting | Cypress, Texas | www.CynthiasJohnsonHR.com | info@www.CynthiasJohnsonHR.com
© 2026 Cynthia Johnson HR Consulting. All rights reserved. This document was last reviewed and updated on August 19, 2026.
This Privacy Policy is for informational purposes and does not constitute legal advice. Consult qualified legal counsel for jurisdiction-specific compliance guidance.