Our GDPR commitment.

1. Two roles, two sets of duties

2. Privacy built into every platform

GDPR asks for privacy by design and by default. Here's what that looks like in the platforms we build. Every line gets checked against proof before this page goes live.

1. Behavioral features stay off until a member opts in, and opting out takes effect right away.
2. Every platform has its own database. Member data is never combined or compared across clients.
3. Members can see, download, correct and delete their data, and withdraw consent, from their settings.
4. Every consent is recorded: who, what, which version and when.
5. Deletion reaches files, transcripts, summaries, search and backups on a set schedule.
6. No member data trains any AI model, and every vendor that touches member content has its training setting off.

3. A Data Processing Agreement with every client

Before a platform goes live, the owner and TNRM sign a Data Processing Agreement. It covers:

• Processing only on the owner's documented instructions
• A written duty of confidentiality for everyone at TNRM who can reach member data
• The security measures we keep in place
• Our subprocessors, with at least 14 days notice before we add or replace one
• Help answering member rights requests
• Notice to the owner within 48 hours of confirming an incident that affects their members
• Return and deletion of data when the work ends
• Audits, and Standard Contractual Clauses for international transfers

Clients can ask us for a copy before signing anything.

4. International transfers

Member data and our own records are processed in the United States. Where European Union, United Kingdom or Swiss law applies, we protect transfers with the Standard Contractual Clauses and the United Kingdom addendum.

5. Our subprocessors

These are the companies that may process member data on platforms we run. The exact list for each platform is in its Data Processing Agreement.

6. Your rights under GDPR

1. Access your data and get a copy.
2. Correct anything that's wrong.
3. Have your data deleted.
4. Limit how it's used, or object to it.
5. Take your data with you in a format you can use elsewhere.
6. Withdraw consent any time, without losing your membership.
7. Not be subject to decisions made only by automated systems that seriously affect you. We don't make any.
8. Complain to your data protection authority.

For this website, email team@tnrmconsulting.com. If you're a member of a platform we built, use the settings inside that platform or contact its owner. If your request reaches us, we pass it to the owner within 2 business days.

7. Our representative in Europe

We haven't appointed a representative in the European Union or the United Kingdom. If that changes, we'll name them here.

8. Questions

Email team@tnrmconsulting.com. A real person reads every message, and we answer within 30 days.