1. Who We Are
Sanctum Global [legal entity name and state of formation to be confirmed by counsel] is a discreet strategic advisory firm based in West Palm Beach, Florida, and a subsidiary of Spencer Pruitt. Throughout this Privacy Policy, "Sanctum," "we," "us," and "our" refer to Sanctum Global and, where the context requires, its parent company.
2. Scope of This Policy
This Privacy Policy applies to the Sanctum Global marketing website located at sanctumglobal.org (the "Site"). It describes how we collect, use, disclose, and protect personal information when you visit the Site, submit an inquiry through our contact form, or otherwise interact with us through the Site.
This Privacy Policy does not govern engagements with Sanctum Global. Once we accept a matter, that engagement is governed by a separate non-disclosure agreement and mandate agreement, which supersede the terms of this policy with respect to any engagement they cover.
3. Information We Collect
A. Information You Provide Directly
When you submit an inquiry through our contact form, we may collect your name, your organization (if provided), your email address, your phone number (if provided), and a description of the matter you would like us to consider.
B. Information Collected Automatically
When you visit the Site, we automatically collect limited technical and usage information through analytics tools and server logs, including device and browser data (browser type and version, operating system, device type), network data (IP address and approximate country or region), and usage data (pages viewed, navigation paths, referring URL, and the date and time of your visit).
We use Google Analytics 4 (GA4), loaded through Cloudflare Zaraz, a server-side tag management system. Analytics scripts run on the server rather than in your browser, which limits our reliance on client-side cookies.
C. Information from Third Parties
We do not purchase personal data from data brokers or third-party enrichment services for use in connection with the Site.
4. How We Use Your Information
We use the information described above to:
- Respond to and evaluate your inquiry
- Conduct vetting on prospective engagements
- Communicate with you about a potential engagement
- Secure and improve the Site
- Comply with applicable legal obligations
5. Cookies, Analytics & Tracking
Analytics
We use Google Analytics 4, loaded server-side through Cloudflare Zaraz, to understand in aggregate how the Site is used. GA4 may use a first-party cookie to distinguish unique visitors and sessions.
We also use Cloudflare Web Analytics, a cookieless tool that counts visits and measures page performance without storing anything on your device. It records the page visited, the referring page, browser and device type, approximate country, and how quickly the page loaded. It does not use cookies or local storage, does not fingerprint your browser, does not collect personal identifiers, and does not track you across sites. Because it stores nothing on your device and identifies no one, it runs for every visitor and is not affected by the consent choices described below. Cloudflare processes this data on our behalf; see Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/.
Essential & Security Cookies
We use Cloudflare Turnstile to protect our contact form from spam and automated abuse. Turnstile may set a security cookie and process limited technical data, such as IP address and browser characteristics, solely to verify that you are human. It is not used to track you across sites or for advertising. Because this cookie serves an essential security purpose, it cannot be disabled through consent preferences. See Cloudflare's privacy policy for more detail.
Managing Cookies & Consent
You can control cookies through your browser settings. You can also manage analytics consent directly on this Site using the "Cookie Preferences" and "Do Not Sell or Share My Personal Information" links in the footer.
Do Not Track & Global Privacy Control
There is no common industry standard for "Do Not Track," and the Site does not currently respond to DNT browser signals. We do honor Global Privacy Control (GPC) signals, treating a GPC signal as a valid opt-out request under applicable law.
6. How We Share Your Information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only in the following limited circumstances:
- Service providers: hosting, infrastructure, and cookieless visit and page-performance measurement (Cloudflare), and analytics (Google), each under contractual limits on their use of your data
- Vetted legal and operational partners, as necessary to act on your instructions in connection with a potential or actual engagement
- Legal compliance: where required by law, subpoena, court order, or government request, or to protect our rights, safety, or property
- Business transfers: in connection with a merger, acquisition, reorganization, or sale of assets
7. Data Retention
We retain personal information only as long as reasonably necessary. Contact form submissions and related correspondence are retained for up to [retention period, e.g., 24 to 36 months, to be confirmed by counsel] from your last interaction with us, after which they are deleted or anonymized. Analytics data is retained according to Google Analytics retention settings, configured for a maximum of 14 months.
8. Data Security
We maintain commercially reasonable technical and organizational measures to protect personal information, including encrypted transmission (TLS/HTTPS), access controls, and periodic security review. The Site is hosted on Cloudflare's global edge network, which provides DDoS protection and web application firewall filtering. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Information you share with us in connection with an actual engagement is additionally protected under the confidentiality terms of your non-disclosure agreement.
9. Your Rights & Choices
Depending on your location, you may have the right to access the personal information we hold about you, correct inaccurate information, request deletion of your information, withdraw consent, and opt out of non-essential analytics using the "Cookie Preferences" or "Do Not Sell or Share My Personal Information" links in the footer, or by sending a Global Privacy Control signal.
To exercise any of these rights, contact us at secured@sanctumglobal.org.
10. State-Specific Privacy Rights
California (CCPA/CPRA)
California residents have the right to know what personal information we collect, to request deletion, to opt out of the sale or sharing of personal information, and to be free from discrimination for exercising these rights. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We honor Global Privacy Control (GPC) signals as an opt-out preference signal.
To exercise these rights, use the "Do Not Sell or Share My Personal Information" link in our footer or contact us at secured@sanctumglobal.org.
Categories of Personal Information We Collect
In the past 12 months, we have collected the following categories of personal information, as defined under California law:
- Identifiers: name, email address, phone number, IP address
- Professional or organizational information: organization name, nature of the matter you describe to us
- Internet or network activity: pages viewed, navigation paths, referring URL
- Geolocation data: approximate country or region
Florida and Other U.S. States
Sanctum Global is based in Florida. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws may have similar rights of access, correction, deletion, and opt-out, and an appeal process is available where required by law.
Contact us at secured@sanctumglobal.org to exercise these rights.
11. International Visitors
Sanctum Global serves clients internationally, including in the United States, Europe (including the European Economic Area and the United Kingdom), the Middle East, and Latin America. This section describes how we handle personal information from visitors outside the United States.
Data Controller
For purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, the data controller of personal information collected through this Site is Sanctum Global [legal entity name and country or state of formation to be confirmed by counsel], a subsidiary of Spencer Pruitt.
Legal Bases for Processing
Where the GDPR or UK GDPR applies, we process personal information on one or more of the following legal bases: your consent; our legitimate interests in operating, securing, and improving the Site and in evaluating inquiries; steps taken at your request prior to entering into a contract; and compliance with our legal obligations.
International Data Transfers
Personal information you submit through this Site may be transferred to, and processed in, the United States and other countries whose data protection laws may differ from those of your home jurisdiction. Where required, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Agreement.
Your Rights Under GDPR / UK GDPR
If you are located in the EEA or the United Kingdom, you have the right to access, rectify, or erase your personal information, to restrict or object to our processing, to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection supervisory authority.
To exercise any of these rights, contact us at secured@sanctumglobal.org.
EU/UK Representative
[EU/UK representative to be appointed by counsel if required under Article 27 GDPR].
Other Jurisdictions
Visitors in other jurisdictions, for example under Brazil's Lei Geral de Proteção de Dados (LGPD) or the data protection regimes of the UAE, DIFC, or ADGM, may have additional rights. We will honor those rights as required by applicable law [scope to be confirmed by counsel].
12. Children's Privacy
The Site is not intended for, and we do not knowingly collect personal information from, children under the age of 16. If we learn that we have collected personal information from a child under 16, we will delete it.
13. Third-Party Links
This policy applies only to the Sanctum Global Site. The Site may contain links to third-party websites. We are not responsible for the privacy practices of those sites, and we encourage you to review their policies.
14. Changes to This Policy
We may update this policy from time to time. Material changes will be reflected in an updated "Last updated" date at the top of this page.
15. Contact Us
Questions about this policy, or requests to exercise your privacy rights, may be directed to:
Sanctum Global [legal entity name to be confirmed by counsel]
[full street address to be confirmed by counsel], West Palm Beach, Florida
Contact
Email: secured@sanctumglobal.org