Privacy Policy

Privacy Policy

Cydian Group · Business Growth & Risk Advisory

Effective date: October 12, 2026Last updated: October 12, 2026

This Privacy Policy describes our policies and procedures for collecting, using, and disclosing your information when you use our Services, and tells you about your privacy rights and how the law protects you. We use your personal information to provide and improve the Services. By using the Services, you agree to the collection and use of information as described in this Privacy Policy.

1. Who we are and what this policy covers

EK3 Enterprises, LLC dba Cydian Group ("Cydian Group," "we," "us," or "our") is a business headquartered in Jacksonville, Florida. This Privacy Policy explains how we collect, use, share, and protect personal information when you visit https://cydiangroup.com (the "Site"), contact us, sign up for our communications, or use our services (together, the "Services").

This policy applies to information collected online through the Site and offline when you interact with us directly. It does not cover third-party websites or services we link to, which have their own privacy policies.

If you do not agree with this policy, please do not use the Site.

Client data we process on behalf of a client under a services agreement is governed by that agreement and any data processing or business associate agreement, not this policy.

Key definitions

For the GDPR, Cydian Group is the data controller. For the CCPA/CPRA, "business" and "consumer" have the meanings given in that law.

2. Information we collect

We collect only the information we need to respond to you, deliver our Services, and run our business.

Sensitive information. We do not ask for Social Security numbers, health information, financial account numbers, biometric data, or other sensitive personal information through the Site. Please do not send it to us unless we specifically request it through a secure channel.

Mobile devices. When you visit the Site on a mobile device, we may also automatically collect your device type, a unique device identifier, your mobile operating system, and your mobile browser type.

3. How we use information

We use personal information to:

• Respond to inquiries and schedule consultations
• Provide, manage, and improve our Services, including assessments and deliverables
• Send invoices, process payments, and keep business records
• Send service notices, advisories, and other communications you request
• Send marketing emails and text messages, only as permitted by law and your choices (see Section 5)
• Analyze Site traffic and improve the Site
• Protect the security of our systems, prevent fraud, and enforce our terms
• Comply with legal, tax, and regulatory obligations

AI tools. We may use artificial intelligence tools, including from vetted third-party providers, to help summarize meetings, draft documents, or analyze information you share with us. We use business or enterprise versions configured so that your information is not used to train the provider's public models, and a person at Cydian Group reviews outputs before they are relied on. Where a meeting is recorded or transcribed, it is recorded only after the participants accept the recording notice the meeting platform displays. If you decline, the meeting is not recorded.

We do not use personal information for automated decisions that produce legal or similarly significant effects on you.

4. Cookies, analytics, and tracking

The Site uses cookies, pixels, and similar technologies to keep it working, remember your preferences, and understand how visitors use it. We use:

• Essential cookies needed for the Site and forms to function
• Analytics such as Google Analytics to measure traffic and usage
• Marketing and CRM tracking such as GoHighLevel to attribute form submissions and measure campaigns

You can block or delete cookies in your browser settings. Blocking some cookies may affect how the Site works. You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

Do Not Track. Some browsers send a "Do Not Track" signal. Because there is no uniform standard for these signals, the Site does not currently respond to them.

Global Privacy Control (GPC). Our website is built on a third-party platform that does not currently process Global Privacy Control signals automatically. We do not sell or share your personal information, so there is nothing for such a signal to opt out of. If you would like us to record an opt-out preference for you, contact us at the address below and we will apply it manually.

We do not knowingly allow third parties to collect personal information about your online activities across different websites over time through the Site, except through the analytics and advertising tools listed above.

Types of cookies we use

Cookies are either "session" cookies, deleted when you close your browser, or "persistent" cookies, which stay on your device until they expire or you delete them. Our pages and emails may also contain web beacons (pixel tags), which let us count visits and email opens.

Third-party tools on the Site

This table covers the tools that run on the Site itself. A current schedule of every third-party service we use, with a link to each provider’s privacy policy, is published at cydian.group/legal.

Opting out of interest-based ads

If the Site offers a "Privacy Preferences" or "Do Not Sell or Share My Personal Information" link, use it to change your cookie choices. You can also opt out through industry tools: the NAI opt-out, the DAA opt-out, and, in Europe, Your Online Choices. On mobile devices, use "Opt out of Ads Personalization" (Android) or "Limit Ad Tracking" / "Allow Apps to Request to Track" (iOS). Opt-outs are stored per browser, so repeat them on each browser and after clearing cookies.

5. Text messages and email

Text messages (SMS/MMS). If you give us your mobile number and check the consent box, you agree to receive text messages from Cydian Group about appointment reminders, service updates, advisories, and promotional offers. Our SMS Privacy Policy and SMS Terms are at cydian.group/legal. Consent is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. You can also email us at [email protected].

We send marketing texts only with your prior express written consent, as required by the federal Telephone Consumer Protection Act and the Florida Telephone Solicitation Act. We honor opt-out requests promptly and send texts only between 8:00 a.m. and 8:00 p.m. in your local time.

We do not sell, rent, or share your mobile number or SMS opt-in consent with third parties or affiliates for their marketing purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except service providers (such as our messaging platform and carriers) that deliver messages on our behalf.

Email. We send marketing emails in line with the federal CAN-SPAM Act. Every marketing email includes an unsubscribe link and our physical address. We process unsubscribe requests within 10 business days. We may still send you transactional or service emails about work we are doing for you.

6. How we share information

We do not sell your personal information for money, and we have not done so in the past 12 months.

We share personal information only with:

• Service providers that help us run our business, under contracts that limit their use of the data to serving us. These include website hosting, CRM and marketing automation (for example, GoHighLevel), email and productivity (for example, Microsoft 365), scheduling, accounting (for example, QuickBooks), payment processing (for example, Stripe), analytics, and AI tools. A current schedule of the third-party services we use, with a link to each provider’s privacy policy, is published at cydian.group/legal.
• Professional advisors such as attorneys, accountants, and insurers, under confidentiality duties.
• Partners you ask us to involve, such as a vendor or software provider on your project, with your direction.
• Legal and safety recipients when required by law, subpoena, or court order, or to protect our rights, property, or safety or that of others.
• A buyer or successor if we are involved in a merger, acquisition, or sale of assets, subject to this policy's protections.

We may share aggregated or de-identified information that cannot reasonably identify you. We will not try to re-identify it.

We may also share information:

• With affiliates, who must honor this policy
• With your consent, for any other purpose you approve

Legal disclosures. We may disclose personal information when we believe in good faith it is needed to comply with a legal obligation or a valid request from a court or government agency; protect the rights or property of Cydian Group; prevent or investigate wrongdoing in connection with the Site; protect the safety of users or the public; or protect against legal liability.

Business transfers. If personal information is transferred in a merger, acquisition, or asset sale, we will notify you before it becomes subject to a different privacy policy.

7. Security, retention, and breach notification

Security. We use reasonable administrative, technical, and physical safeguards to protect personal information, as required by the Florida Information Protection Act of 2014 (Fla. Stat. § 501.171). These include encryption in transit, multi-factor authentication, access limited to people who need it, and vetting of service providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Retention. We keep personal information only as long as needed for the purposes in this policy, then delete or de-identify it. Typical periods:

• Prospect and inquiry records: up to three years after last contact
• Client records, contracts, and invoices: seven years after the engagement ends, for tax and legal purposes
• Marketing preferences and opt-outs: as long as needed to honor your choice

Breach notification. If a data breach affects your personal information, we will notify you as required by law. Under Florida law, that is no later than 30 days after we determine a breach occurred, and we will notify the Florida Department of Legal Affairs when 500 or more Florida residents are affected. We will follow the notice rules of your state of residence where they apply.

8. Your privacy rights

We extend the following rights to all U.S. users, whether or not your state's law requires it. Residents of states with comprehensive privacy laws (including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia) may have these rights by law.

How to make a request. Email [email protected] with the subject "Privacy Request." We will verify your identity by matching information we already have, and we may ask an authorized agent for proof of authority. We respond within 45 days and will tell you if we need up to 45 more days.

Appeals. If we deny your request, you can appeal by replying to our decision with "Appeal." We will respond within 60 days. If you disagree with the result, you may contact your state Attorney General.

Florida residents. The Florida Digital Bill of Rights currently applies to companies with more than $1 billion in annual revenue that meet other criteria. Cydian Group does not meet those thresholds, but we honor the rights above for Florida residents voluntarily.

California residents. Under the California Online Privacy Protection Act, this policy describes the information we collect, who we share it with, how we respond to Do Not Track signals, and how you can review and correct your information. Under California's "Shine the Light" law (Cal. Civ. Code § 1798.83), you may ask whether we disclosed personal information to third parties for their direct marketing in the prior year. We do not.

Nevada residents. We do not sell covered information as defined in Nevada law (NRS 603A). You may still submit an opt-out request to [email protected].

California privacy notice (CCPA/CPRA)

This notice supplements this policy for California residents. Cydian Group may fall below the CCPA's thresholds, but we provide this notice voluntarily. The table lists the CCPA categories of personal information we have collected in the past 12 months. "Yes" means we may collect some examples in that category, not necessarily all of them.

Personal information does not include publicly available government records, de-identified or aggregated data, or data covered by sector laws such as HIPAA, the Fair Credit Reporting Act, or the Gramm-Leach-Bliley Act.

Sources. Directly from you (forms, emails, calls), automatically from your device (cookies), and from service providers that help us run the Site.

Recipients. Service providers, professional advisors, affiliates, and vendors you or your agent authorize. When we disclose information for a business purpose, the recipient is bound by contract to keep it confidential and use it only to perform that contract.

Sale or sharing. We do not sell personal information for money. If we use advertising cookies, categories A, F, and G may be considered "sold" or "shared" under the CCPA. We do not knowingly sell or share the personal information of consumers under 16.

Your California rights include the rights to know, access, correct, delete, opt out of sale or sharing, limit use of sensitive personal information, and not be discriminated against (Section 8 above). A "right to know" response covers the 12 months before we receive your request and includes the categories and specific pieces of information collected, their sources, our purposes, and the categories of recipients. We may deny a deletion request when we need the information to complete a transaction, keep our systems secure, fix errors, comply with the law (including the California Electronic Communications Privacy Act), or for internal uses reasonably aligned with your expectations.

Authorized agents. You may use an authorized agent, including one registered with the California Secretary of State. We will ask for proof of the agent's authority and may verify your identity directly.

Minors (Cal. Bus. & Prof. Code § 22581). California residents under 18 may ask us to remove content they posted publicly on the Site by emailing [email protected]. Removal may not be complete if others have copied the content.

Visitors from the EEA, UK, and Switzerland (GDPR)

The Site is aimed at U.S. businesses. If the GDPR applies to you, we process personal data on these legal bases: your consent; performance of a contract or steps before entering one; compliance with a legal obligation; protection of vital interests; tasks in the public interest; and our legitimate interests, such as running and securing the Site and marketing our services to businesses.

You have the right to access, correct, erase, and port your data; object to processing based on legitimate interests or for direct marketing; restrict processing; and withdraw consent at any time. To exercise these rights, contact [email protected]. We may ask you to verify your identity. You may also complain to your local data protection authority.

9. Other important information

Children. The Site and Services are for businesses and adults. We do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act, or from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

Users outside the United States. We are based in the U.S. and store information in the U.S. If you use the Site from another country, your information will be transferred to and processed in the U.S. and wherever our service providers operate, where data protection laws may differ from yours. We transfer personal information only where adequate safeguards, including security controls, are in place.

Links to other sites. The Site may link to third-party websites. We are not responsible for their privacy practices. Our client portal is operated by a third party, Autotask. Information you enter there, including your sign-in credentials, is governed by that provider’s privacy policy rather than this one.

Changes to this policy. We review this policy at least once a year. When we make changes, we will update the "Last updated" date above. If the changes are material, we will post a notice on the Site or email you before they take effect.

Contact us

EK3 Enterprises, LLC dba Cydian Group3609 Hendricks Avenue, Jacksonville, FL 32207Email: [email protected]