Sweep & Co Digital Privacy Policy

Effective Date: 7/31/25 Last Updated: 1/14/26

1. Introduction

Sweep & Co ("we," "us," or "our") is a brand and strategy agency serving B2B clients in healthcare and healthtech markets across North America, the United Kingdom, the European Union and Switzerland.

We respect the privacy of our clients, partners and prospects and are committed to handling business contact data with transparency, integrity and care. This policy outlines how we collect, process and protect your data in accordance with applicable privacy laws and best practices.

2. Scope and Applicability

This Privacy Policy applies to personal and business contact data that we collect through:

• Contact forms, newsletter sign-ups and intake submissions on our website

• Email communication and outbound outreach

• CRM and marketing platforms

• Event participation and webinar registrations

• Social platforms like LinkedIn

• Analytics and website performance tracking

We do not collect sensitive personal, consumer or health-related data. All data processed pertains to professional interactions in a business context.

3. Types of Data We Collect

We may collect the following categories of data:

• Professional identifiers: Full name, title, company name, work email and phone number

• Organizational details: Company size, sector, location and job function

• Interaction data: Emails opened, links clicked and website form submissions

• Technical data: Browser type, IP address, referring URL and cookie identifiers

We collect only what is necessary for relevant business purposes.

4. How We Use Your Data

We use your professional data to:

• Respond to service inquiries and requests

• Send relevant marketing communications and newsletters (opt-out always available)

• Share insights, reports and event invites

• Personalize outreach and improve relevance

• Deliver service projects as part of client engagements

• Analyze the performance of campaigns and website activity

5. Legal Basis for Processing (GDPR / UK GDPR / Canada PIPEDA)

Depending on your jurisdiction, we rely on the following lawful bases:

• Legitimate interests (e.g., business development, marketing to relevant professionals)

• Consent (where required by law or for newsletters, form opt-ins and cookie preferences)

• Contractual necessity (e.g., proposal, onboarding and project delivery)

• Legal compliance (e.g., data rights management and audits)

Sweep & Co does not use your data for profiling or automated decision-making.

6. Data Sharing and International Transfers

We do not sell or rent data. We may share your data with:

• Cloud and SaaS service providers: Google Workspace, HubSpot and Wix

• Proprietary tools: nunNEO (brand intelligence and data collection)

• Marketing and social platforms: LinkedIn Ads and related scheduling tools

• Form and workflow providers: Tally and Zapier

• Compliance services: DataRep for GDPR representation

• Legal or regulatory bodies, if legally required

All providers are bound by confidentiality and process data under strict contractual safeguards. If data is transferred outside the EU/UK/Switzerland, we rely on Standard Contractual Clauses (SCCs) and vendor compliance frameworks.

7. GDPR/UK GDPR/FADP Representative

As required under Article 27 of the EU and UK GDPR and Swiss FADP, Sweep & Co has appointed DataRep as our representative.

To contact DataRep: https://www.datarep.com

Choose your local office or contact via the web form to submit inquiries related to personal data or data rights.

8. AI Tools and Automated Processing

Sweep & Co operates as an AI-first consultancy and uses AI and automation tools to improve operational efficiency and deliver client services. These include:

• nunNEO – Our proprietary AI brand intelligence engine for data collection and analysis

• Claude (Anthropic) – AI-assisted strategy, content development and client deliverables

• Additional AI tools – Used internally for research, optimization and content generation

We also use industry-standard platforms for project management, design collaboration and social media scheduling.

These tools may process business contact data in structured workflows (e.g., newsletter lists and project forms). We do not use AI to make automated decisions about individuals. Any content generated via AI is reviewed and approved by humans before being used. No client data is used to train AI models.

All third-party tools used comply with data protection obligations under GDPR, PIPEDA and U.S. standards.

9. Data Retention

We retain data only as long as necessary for its intended purpose, typically:

• Up to 24 months for inactive contacts

• For the duration of client projects and legal obligations

• Immediately removed upon request or opt-out

We conduct periodic data reviews and system cleanups to avoid unnecessary retention.

10. Your Rights

Depending on your jurisdiction (EU, UK, CH, CA or U.S. states like CA or CO), you may have the right to:

• Request access to your data

• Correct inaccuracies

• Withdraw consent or unsubscribe

• Request deletion ("right to be forgotten")

• Restrict or object to processing

• File a complaint with a supervisory authority

To exercise your rights, contact: privacy@sweepandco.com

11. Cookies and Tracking

This Cookie Policy explains how Sweep & Co uses cookies and similar technologies to enhance your experience.

11.1 What Are Cookies?

Cookies are small data files stored on your browser or device that help us recognize returning visitors and analyze behavior.

11.2 What Cookies We Use

• Essential cookies – To enable secure site functionality

• Analytics cookies – Google Analytics and Metricool to monitor traffic and performance

• Marketing cookies – LinkedIn Ads tracking for remarketing and performance

11.3 Consent Mechanism

For users in the EU, UK and Switzerland:

• A cookie banner appears on first visit, allowing acceptance or customization of tracking preferences

• You may update consent at any time using our cookie settings link

11.4 How to Manage Cookies

You can clear or block cookies via your browser settings or opt out of analytics cookies via tools like:

• Google Analytics Opt-Out Add-on

• Your Online Choices (EU)

11.5 Data Collected via Cookies

No personally sensitive data is collected via cookies. We may capture anonymized or aggregated technical information like:

• Browser type

• IP address

• Session duration

• Device and location metadata (non-identifiable)

11.6 Cookie Policy Updates

We may periodically revise this policy. Updates will be reflected on this page.

11.7 Cookie-Related Contact

Email us at privacy@sweepandco.com if you have concerns or would like to request deletion of cookie-collected data.

12. Security Measures

Sweep & Co takes data security seriously and uses the following safeguards:

• Encrypted storage and 2FA across core platforms

• Role-based access to client and project data

• Data minimization and encryption

• Vendor reviews and contracts for data processors

• Incident response procedures (under development for SOC 2 alignment)

We are actively working toward SOC 2 self-certification (Type I) through structured documentation, internal audits and platform-based controls.

13. Policy Updates

We may revise this policy periodically to reflect changes in laws, tools or data practices. All updates will be posted here with a new "Last Updated" date.

14. Contact Us

Sweep & Co LLC 68 Harrison Street STE605 Boston, MA 02111 United States

Email: privacy@sweepandco.com