Privacy Policy
Effective Date: September 1, 2026
This Privacy Policy explains how Scimitar Inc. ("Scimitar," "we," "us," or "our") collects, uses, discloses, and protects information in connection with your use of www.scimitar.com and related services (the "Site"). It does not apply to information we collect from clients under a separate services agreement, which is governed by that agreement.
If you are applying for a position with Scimitar, our Applicant Privacy Notice, not this Policy, governs how we handle your information.
Information We Collect
Information you provide directly: name, company, job title, email address, phone number, and message content when you fill out a contact form, request a consultation, subscribe to communications, or download a resource.
Information collected automatically: IP address, browser and device type, pages viewed, referring URLs, and similar usage data, collected via cookies and similar technologies. See our Cookie Policy for details.
Information collected offline: we may also collect information directly from you at conferences, industry events, meetings, and in phone or email conversations with our team, which we store in our CRM alongside information collected through the Site.
Information from third parties: we may receive limited information from business partners, data enrichment providers, or publicly available sources to supplement contact records in our CRM.
We do not intentionally collect sensitive personal information (such as health information, racial or ethnic origin, or similar categories) through the Site. Please do not include sensitive information in open-text fields, such as contact forms, unless specifically requested. (This does not apply to information collected through our recruiting process, which is governed by our Applicant Privacy Notice.)
How We Use Information
- To respond to inquiries and provide requested information about our services
- To operate, maintain, and improve the Site
- To identify and engage with industry experts, advisors, and potential collaborators relevant to our consulting work
- To send marketing communications, subject to your preferences (see Marketing Communications & Email Preferences)
- To maintain security and prevent misuse of the Site
- To comply with legal obligations
Automated Decision-Making
Scimitar does not use personal information to make decisions about you based solely on automated processing that produce legal or similarly significant effects. If we implement such a process in the future (for example, AI-assisted screening), we will provide affected individuals with meaningful information about the logic involved and the right to express their point of view, contest the decision, and request human review.
How We Share Information
We do not sell your personal information for money. We share personal information only as follows:
- With service providers that support our operations, for example our website and CRM platform, analytics providers, and, for job applicants, applicant-tracking and background-check vendors (see Applicant Privacy Notice)
- With professional advisors (legal, accounting) as needed
- To comply with law, legal process, or to protect rights, property, or safety
- In connection with a merger, financing, or acquisition involving Scimitar
QMS Readiness Assessment Tool
The Site offers an interactive QMS readiness assessment. Your responses are used only to generate your readiness summary and, if you ask to speak with a specialist, to support that conversation.
Providing your name and email is optional. We only ask for them if you would like a copy of your results emailed to you or would like a specialist to follow up. If you ask to speak with a specialist, the person who follows up with you will have access to your results. We may also review submissions on a limited basis to operate and improve the assessment and to check for the kind of sensitive information described below.
This assessment is designed to assess your quality practices at a general level. Please do not include protected health information, patient data, names of specific individuals, or other sensitive or regulated information in your answers.
Cookies and Tracking Technologies
The Site uses cookies and similar technologies for functionality, analytics, and (if applicable) advertising. Details on categories of cookies used and how to manage your preferences are in our Cookie Policy.
Data Retention
We retain personal information for as long as reasonably necessary for the purposes described in this Policy, or as required by law.
Your Privacy Rights
Depending on where you live, you may have rights to access, correct, delete, or restrict use of your personal information, and to opt out of certain sharing. See our State Privacy Notice (US Residents), GDPR / UK GDPR Notice, and Data Subject Rights Request for details on how to exercise these rights.
International Data Transfers
Scimitar is a United States company. We work with a limited number of clients located in the European Union and the United Kingdom, and your personal information may be processed and stored in the United States in connection with that work or your use of this Site. If you are located in the EEA or UK, see our GDPR / UK GDPR Notice for additional information.
Children's Privacy
The Site is intended for business audiences and is not directed to children. We do not knowingly collect personal information from anyone under 16.
Security
We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information. No method of transmission or storage is completely secure.
Third-Party Links
The Site may link to third-party websites. This Policy does not apply to those sites, and we encourage you to review their privacy practices.
Changes to This Policy
We may update this Policy from time to time. The "Effective date" above reflects the last revision. Material changes will be indicated on this page.
Contact Us
Questions about this Policy or your personal information: privacy@scimitar.com
Cookie Policy
Effective date: September 1, 2026
This Cookie Policy explains how Scimitar uses cookies and similar tracking technologies on www.scimitar.com, and how you can control them. It supplements our Privacy Policy.
What Are Cookies
Cookies are small text files placed on your device that help a site function, remember preferences, and understand how it is used.
Categories of Cookies We Use
- Strictly Necessary: required for the Site to function (e.g., security, load balancing); cannot be switched off
- Analytics / Performance: help us understand how visitors use the Site
- Functional: remember choices you make to enhance your experience
How We Obtain Your Consent
On your first visit, a cookie banner lets you accept or customize cookie categories other than Strictly Necessary cookies. Your choice is stored and can be changed at any time.
Managing Your Preferences
You can update your cookie choices at any time using the cookie preferences link in the Site footer, or through your browser settings, which allow you to block or delete cookies. Blocking Strictly Necessary cookies may affect Site functionality.
There is no industry standard for how browser “Do Not Track” signals should be interpreted by websites, so the Site does not currently respond to Do Not Track signals. Where required by law, we do honor Global Privacy Control (GPC) signals as a valid opt-out request.
Third-Party Cookies
Some cookies are placed by third parties that provide services on our behalf, such as website hosting, form processing, and analytics. We do not control these third parties' use of information beyond the services they provide to us.
Changes to This Policy
We may update this Cookie Policy as our use of cookies changes. Check the effective date above for the latest version.
Contact
Questions: privacy@scimitar.com
State Privacy Notice (U.S. Residents)
Effective date: September 1, 2026
This notice supplements our Privacy Policy and describes the rights available to residents of U.S. states with comprehensive consumer privacy laws.
Laws We Comply With
We comply with applicable U.S. state privacy laws to the extent they apply to Scimitar, including:
- California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA)
- Virginia Consumer Data Protection Act (VCDPA)
- Colorado Privacy Act (CPA)
- Connecticut Data Privacy Act (CTDPA)
- Utah Consumer Privacy Act (UCPA)
- Other state consumer privacy laws as they take effect and apply to us
Categories of Personal Information We Collect
- Identifiers (name, email, phone, IP address)
- Commercial information (services inquired about)
- Internet/network activity (Site usage data, via cookies)
- Professional information (job title, employer)
- Inferences drawn from the above for marketing purposes
How We Use and Disclose This Information
As described in our Privacy Policy, primarily to respond to inquiries, operate the Site, and send marketing communications. We disclose personal information to service providers that support these activities.
Sale or Sharing of Personal Information
We do not sell personal information for money, and we do not share personal information for cross-context behavioral advertising purposes.
Your Rights
- Right to know / access the personal information we hold about you
- Right to delete personal information, subject to exceptions
- Right to correct inaccurate personal information
- Right to opt out of sale or sharing of personal information
- Right to limit use of sensitive personal information
- Right to non-discrimination for exercising these rights
How to Exercise Your Rights
Submit a request by emailing privacy@scimitar.com. You may use an authorized agent to submit a request on your behalf.
Verification
To protect your information, we may need to verify your identity before completing certain requests, using information you have already provided to us.
Changes to This Notice
We may update this notice as applicable state privacy laws evolve.
GDPR / UK GDPR Notice
Effective date: September 1, 2026
Scope
This notice applies to individuals located in the European Economic Area (EEA) and the United Kingdom whose personal data we process in connection with the Site or Scimitar's work with clients located there.
Data Controller
Scimitar Inc. is the controller of personal data described in this notice.
Legal Bases for Processing
- Consent: for marketing communications you opt into
- Legitimate interests: for responding to inquiries, Site analytics, and business development activities such as engaging industry experts
- Contract: where processing is necessary to provide requested services
- Legal obligation: where required by law
Whenever we rely on legitimate interests as our legal basis, we first assess the adequacy, proportionality, and legitimacy of the processing activity against your interests and rights.
International Data Transfers
Personal data about you is processed directly by Scimitar in the United States. Where a client contract requires a specific transfer safeguard, such as Standard Contractual Clauses or the UK International Data Transfer Addendum, we will comply with that requirement.
Your Rights
- Right of access, rectification, and erasure
- Right to restrict or object to processing, including an unconditional right to object to direct marketing at any time
- Right to data portability
- Right to withdraw consent at any time
- Right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects; see the Automated Decision-Making section of our Privacy Policy
- Right to lodge a complaint with a supervisory authority
Retention
We retain personal data only as long as necessary for the purposes described in our Privacy Policy.
Changes to This Notice
We may update this notice from time to time.
Contact
Questions or rights requests: privacy@scimitar.com
Data Subject Rights Request
Effective date: September 1, 2026
Depending on where you live, you may have the right to access, correct, delete, or restrict use of your personal information, or to opt out of certain sharing. This section explains how to submit a request.
How to Submit a Request
Email privacy@scimitar.com with the subject line “Data Subject Rights Request,” specifying: the right you wish to exercise, your name and contact information, and enough detail for us to locate your information.
Verifying Your Identity
We may ask you to confirm information already on file to verify your identity before completing certain requests.
Response Timeframe
We aim to respond within 45 days for U.S. state law requests (extendable by 45 days where permitted) and within one month for GDPR/UK GDPR requests (extendable by two months for complex requests).
Authorized Agents
You may designate an authorized agent to submit a request on your behalf. We may require proof of the agent's authority and separately verify your identity.
Appeals
If we deny your request in whole or in part, you may appeal by emailing privacy@scimitar.com with the subject line “Notice of Appeal,” along with a copy of your original request and the reason you believe the decision should be reconsidered.
We will acknowledge your appeal within 10 business days and provide a written determination within 60 days of receipt. If we deny your appeal, we will explain why and, where applicable, tell you how to escalate further (e.g., to a state attorney general or data protection authority).
Contact
Questions about this process: privacy@scimitar.com
Marketing Communications & Email Preferences
Effective date: September 1, 2026
What We Send
With your consent or based on a business relationship, Scimitar may send marketing emails such as thought leadership (Perspectives), event invitations, and service updates.
EU/UK Recipients
If you are located in the EEA or UK, we send marketing emails only where you have opted in, consistent with applicable e-privacy and data protection law, rather than relying on an opt-out model. You can withdraw consent at any time using the methods below.
Managing Your Preferences
Every marketing email includes an unsubscribe link. You can also manage subscription types directly through our email preference center.
Processing Time
Opt-out requests are processed promptly and no later than required by applicable law (generally within 10 business days).
CAN-SPAM Compliance
Every marketing email identifies Scimitar as the sender, uses an accurate subject line, and includes our physical mailing address and a working unsubscribe mechanism, as required by the CAN-SPAM Act.
Transactional Communications
Service-related communications necessary to respond to a request you made (e.g., replying to a submitted form or emailing you a copy of your assessment results) are not marketing communications and are not subject to opt-out, even if they include an invitation to speak with a specialist about your results.
Changes to This Notice
We may update this notice from time to time to reflect changes in our communications practices.
Contact
Questions: privacy@scimitar.com