Privacy Policy
This policy explains what ascendworksnow.com does with personal information. It is deliberately specific: everything below describes behaviour that exists in this website’s code, not a generic template.
Effective date: [EFFECTIVE DATE — set on publication] · Last updated: [LAST UPDATED — set on publication]
Draft — pending legal review. This document has not been reviewed or approved by an attorney. It describes the site’s actual data handling as verified in the codebase, but it contains unresolved placeholders and must not be published, linked from marketing material, or relied on as a legal notice until counsel has signed it off.
Open items for counsel
Delete this box before publication. Each item is something the drafter could not verify from the codebase and did not invent.
- Legal entity.The site footer reads “AscendWorksNow Inc.” but the registered name, entity type, and business address were not confirmed. Every occurrence of [LEGAL ENTITY] and [REGISTERED ADDRESS] needs filling.
- Careers application form. The apply form at /careers displays “Application Received” but transmits nothing — its inputs have no
nameattributes and its submit handler only runs a timer (src/components/sections/CareersClient.tsx). This policy therefore says nothing about processing applications. Either wire the form up and extend this policy, or change the form so it does not tell applicants their data was received. - Host access logs. The site is served by a third-party Apache host. Hosts normally keep request logs containing IP addresses, but the provider’s retention period was not verified. Confirm it and complete the retention section.
- Mailbox retention. Enquiry emails sit in a mailbox indefinitely unless someone deletes them. A real retention period needs to be chosen and actually applied.
- EU/UK exposure. Whether the GDPR section applies, and whether an Article 27 representative is required, is a legal judgement — not made here.
1. Who this policy covers
This policy applies to the public website at ascendworksnow.com, operated by [LEGAL ENTITY] (“AscendWorksNow”, “we”, “us”), of [REGISTERED ADDRESS].
It does not cover information we handle inside a client engagement. Data we process on behalf of a client, or inside a client’s ServiceNow instance, is governed by the contract and data processing terms for that engagement, not by this page.
2. Information we collect
There is exactly one way this website collects personal information: the contact and enquiry forms. If you never submit a form, we never learn who you are.
Information you give us through a form
First and last name
Required. Used to address the reply.
Work email address
Required. Used to reply to your enquiry.
Company name
Required. Used to route and qualify the enquiry.
Your message
Required. Free text you choose to write.
Job title
Optional.
Phone number
Optional.
Industry
Optional. Chosen from a fixed list.
Primary service, project scope, timeline
Optional. Chosen from fixed lists.
Enquiry type
Set automatically by the form you used.
The page you submitted from
The path only (for example /services/servicenow), so we know what you were reading.
Your IP address
Recorded by the server that receives the form and included in the enquiry email.
Submission timestamp
UTC date and time of the submission.
The forms also contain a hidden field that is invisible to people and only ever filled in by automated bots. If it is filled in, the submission is silently discarded. It collects nothing about you.
Information collected automatically
The website itself performs no automatic collection — it is a set of pre-rendered static pages with no tracking code. As with any website, the server that delivers those pages receives your IP address and browser user-agent in order to respond at all, and our hosting provider may retain standard access logs containing that information under its own policies and for its own security purposes. [HOST LOG RETENTION — confirm with the hosting provider.]
3. What we do not do
This list is not aspirational. Each statement is a description of how the site is currently built.
We set no cookies of any kind — first-party or third-party.
We run no analytics: no Google Analytics, no Google Tag Manager, no Meta Pixel, no LinkedIn Insight Tag, no Hotjar, no session recording, no heatmaps.
We run no advertising or retargeting pixels and build no advertising profiles.
We do not sell or share personal information, and we do not receive money or other value for it.
We operate no user accounts, no logins, and no database — there is nothing to create an account in.
We do not use automated decision-making or profiling on your information.
4. Why we use it
We use what you submit for one purpose: to read your enquiry and respond to it, and to carry on the business conversation that follows if you want one. We also use the IP address attached to a submission to limit how many times the form can be submitted from one address in an hour, which is what stops the form being abused to send spam.
We do not add you to a marketing list on the basis of a contact-form submission, because no such list is connected to this website.
Lawful bases (for visitors in the EU/UK)
Where the UK GDPR or EU GDPR applies, we rely on: your request, as steps taken at your request before entering into a contract (Article 6(1)(b)), for responding to your enquiry; and our legitimate interests (Article 6(1)(f)) in operating a business website securely and preventing abuse of the contact form. [GDPR APPLICABILITY — confirm with counsel.]
5. Where your information goes
When you submit a form, the contents are formatted into a plain-text email and sent to aaron@ascendworksnow.com. Nothing is written to a database, because the site does not have one. The enquiry email includes the fields you filled in, the page you submitted from, the submission time in UTC, and the IP address the submission came from.
The only other thing stored on the server is the rate-limit counter. It lives in the server’s temporary directory, is named after a one-way hash of your IP address rather than the address itself, and contains nothing but a short list of submission timestamps. Entries older than one hour are ignored and the file is subject to normal temporary-file cleanup.
If the form cannot reach the server — for example if you are offline — the site offers you a pre-filled email link instead. In that case nothing is transmitted to us at all: the details you typed are handed to your own email program, and you decide whether to send them.
6. Third parties
We do not sell, rent, or trade personal information. The following third parties are nevertheless involved in running the site, and you should know about them.
Our web host and email provider
The site is served from third-party hosting, and enquiry emails are delivered and stored by a third-party mail provider. Both can technically access the content passing through them. [NAME THE HOSTING AND MAIL PROVIDERS — and confirm whether a data processing agreement is in place.]
Unsplash (images.unsplash.com)
Some article and insight images are loaded directly from Unsplash rather than from our own servers. Your browser requests those files from Unsplash, which means Unsplash receives your IP address, your user-agent, and the address of the page you were viewing. This is the only third-party host your browser contacts while using this site. We receive nothing back from Unsplash about you.
Fonts are served by us, not by Google
The site uses two Google-licensed typefaces, but the font files are downloaded at build time and served from ascendworksnow.com. Your browser does not contact Google to render this site, and Google does not receive your IP address from it.
Links out to other sites
Some pages link to third-party sites such as ServiceNow newsrooms and partner sites. Following a link takes you out of our control and into theirs; their privacy practices are their own.
We may also disclose information where the law requires it — for example in response to a lawful request from a public authority — or where it is necessary to establish, exercise, or defend legal claims.
7. How long we keep it
Rate-limit records expire within one hour of the submission they record and hold no readable identifier. Enquiry emails remain in the recipient mailbox until they are deleted; we retain them for [RETENTION PERIOD — choose and enforce a period] and delete them afterwards unless a business relationship, a contract, or a legal obligation requires us to keep them longer. Server access logs are retained by our hosting provider under its own schedule. [HOST LOG RETENTION — confirm.]
8. Security
Measures actually in place on this website include: HTTPS for all traffic with HTTP requests redirected and HSTS enforced; a strict Content-Security-Policy that prevents the site from sending your data to any other host; framing and MIME-sniffing protections; a restrictive permissions policy that blocks camera, microphone, geolocation, and payment APIs; rate limiting and bot filtering on the contact form; and sanitisation of submitted values before they are placed in an email so the form cannot be turned into a relay for spam. There is no database and no user account system, so there is no store of credentials to compromise.
AscendWorksNow states elsewhere on this site that it holds SOC 2 Type II certification. That certification concerns the firm’s delivery operations. [SOC 2 SCOPE — confirm with counsel whether the report covers this public website before relying on it here.] No security measure is perfect, and we cannot guarantee the security of information transmitted over the internet.
Please do not send confidential, regulated, or sensitive information — protected health information, financial account numbers, government identifiers, or client data — through this website’s forms. They are not built for it.
9. Your rights
California residents (CCPA/CPRA)
If you are a California resident you have the right to know what personal information we have collected about you and how we used it; to request deletion of it; to request correction of inaccurate information; and not to be discriminated against for exercising these rights.
In the twelve months before this policy’s effective date, the categories of personal information this website collected were identifiers (name, email address, phone number, IP address), professional or employment-related information (company, job title), and the contents of your message. All of it came directly from you, except your IP address, which comes from your connection. We have not sold or shared personal information, and we do not collect sensitive personal information as that term is defined by the CPRA. Because we neither sell nor share personal information, there is no “Do Not Sell or Share My Personal Information” link on this site.
EU and UK visitors (GDPR)
Where the GDPR applies, you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, and to receive it in a portable form. Where we rely on legitimate interests, you may object at any time. You may also lodge a complaint with your local supervisory authority.
How to exercise a right
Email aaron@ascendworksnow.com. Because we hold nothing but emails you sent us, the usual answer to an access request is a copy of those emails, and the usual answer to a deletion request is that we delete them. We will need enough information to find your submission — typically the email address you used. You may use an authorised agent; we may ask for proof of their authority. We aim to respond within 45 days (CCPA/CPRA) or one month (GDPR).
10. International transfers
We are a United States business and the information you send us is received and stored in the United States. If you are writing to us from outside the United States, you are sending your information there. [TRANSFER MECHANISM — if EU/UK personal data is in scope, confirm with counsel whether standard contractual clauses or another mechanism is required.]
11. Children
This is a business-to-business website. It is not directed at children, we do not knowingly collect personal information from anyone under [MINIMUM AGE — 13 under COPPA, 16 if EU visitors are in scope; confirm with counsel], and no part of the site is designed to appeal to children. If you believe a child has sent us personal information, email aaron@ascendworksnow.com and we will delete it.
12. Changes to this policy
If we change how this website handles personal information, we will update this page and change the “last updated” date above. Material changes will be summarised at the top of the page. Because the site keeps no contact list, we cannot notify you individually.
13. Contact us
For any privacy question, request, or complaint, write to aaron@ascendworksnow.com.
[LEGAL ENTITY] · [REGISTERED ADDRESS]
See also our Cookie Policy and Terms of Service.