Privacy Policy

1. Who We Are

2. Scope of This Policy

This Policy explains how we collect, use, disclose, and protect personal information when you:

• visit sigmanomics.com or any sub‑domain (the "Site");
• subscribe to our newsletters, alerts, or premium research;
• use our mobile applications;
• interact with us on social media;
• attend our events or webinars;
• contact us for support or inquiries;
• apply for employment with us.

3. What Personal Data We Collect

We do not knowingly collect or process sensitive personal information as defined under CPRA (e.g., precise geolocation, health data, race, or biometric identifiers).

4. Legal Bases for Processing (GDPR Art. 6)

5. How We Use Personal Data

• Provide, maintain, and improve the Site and our services
• Personalise content and remember your preferences
• Measure the effectiveness of articles and ad campaigns
• Send newsletters, market‑analysis updates, or promotional offers you request
• Detect, investigate, and prevent fraud or security incidents
• Comply with tax, accounting, and other legal requirements

6. Cookies, SDKs & Similar Technologies

We use:

• Essential cookies – required for core functionality (e.g., log‑in, load balancing).
• Analytics cookies (e.g., Google Analytics 4, self‑hosted Matomo) – help us understand traffic patterns.
• Advertising cookies (Google AdSense) – show relevant ads and limit repeat impressions.

You will be shown a Cookie Consent Banner on your first visit in the EEA, UK, or California. You can withdraw or modify consent at any time via the Cookie Settings link in the footer.

7. How We Share Personal Data

We do not sell personal information for money. We may "share" (as defined by CPRA) identifiers and internet activity with:

1. Advertising partners (e.g., Google, via AdSense) to serve ads.
2. Analytics providers (Google Analytics 4, Matomo) to measure Site performance.
3. Payment processors (Stripe, PayPal) for subscription billing.
4. Service vendors supporting IT hosting, email delivery, and customer support.
5. Authorities or legal counsel when required by law or to protect rights.

All vendors are bound by contracts that require GDPR‑compatible safeguards such as Standard Contractual Clauses (SCCs) or certification under the EU‑US Data Privacy Framework.

8. International Transfers

We host data on servers in the United States. When we transfer EEA/UK data outside those regions, we rely on SCCs or an adequacy mechanism (e.g., the EU‑US Data Privacy Framework) and implement supplementary safeguards such as encryption at rest and in transit.

9. Data Retention

We retain personal data only as long as necessary for the purposes described above:

• Account and subscription data – for the life of the account + 6 years (tax/audit).
• Cookie identifiers – 14 months (Google Analytics default) unless you delete/opt out sooner.
• Marketing consent records – 5 years or until consent is withdrawn.
• Server logs – up to 12 months for security analysis and diagnostics.

10. Your Rights

EU/UK Residents (GDPR)

• Access – obtain a copy of your data.
• Rectification – correct inaccurate data.
• Erasure – request deletion ("right to be forgotten").
• Restriction – limit processing in specific cases.
• Portability – receive data in machine‑readable format.
• Object – to processing based on legitimate interests or direct marketing.
• Withdraw consent – at any time without affecting prior processing.

California Residents (CPRA)

• Right to Know what personal information we collect, use, share.
• Right to Delete personal information.
• Right to Correct inaccurate personal information.
• Right to Opt‑Out of Sale/Sharing of personal information.
• Right to Limit Use/Disclosure of Sensitive PI (not applicable here).
• Right to Non‑Discrimination for exercising any CPRA rights.

11. Exercising Your Rights

• Email us at support@sigmanomics.com with "Privacy Request" in the subject line, or use the Privacy Webform linked in the footer.
• California residents may also call our toll‑free line: +1 (888) 555‑0199 or click "Do Not Sell or Share My Personal Information".
• We will verify your identity (e.g., via email confirmation or 2‑factor check) and respond within 30 days (GDPR) or 45 days (CPRA).

12. Security Measures

We employ ISO 27001‑aligned controls, including:

• TLS 1.3 encryption in transit; AES‑256 encryption at rest
• Firewalls, intrusion‑detection systems, and 24/7 monitoring
• Role‑based access control and multi‑factor authentication
• Annual penetration tests and vendor risk assessments

Despite these measures, no Internet transmission is 100% secure, and we cannot guarantee absolute security.

13. Children's Privacy

The Site is not directed to children under 16. We do not knowingly collect their personal data. If you believe a child has provided us information, contact support@sigmanomics.com and we will delete it promptly.