Legal
Privacy policy
Who we are
PeakBeyond (peakbeyond.com) is operated by Peak Beyond, LLC, 435 Merchant Walk Square, Suite 300-132, Charlottesville, VA 22902. We are the data controller (the “business”, under US state laws) for the personal data described here: what visitors give us on this website, and how the website is used.
This website has no accounts and no sign-in. It collects personal data only through the contact form, the privacy request form and the visit statistics described below.
Visiting our website
When you contact us
The contact form asks for your name and email address, and optionally your company, phone number and what you'd like help with, plus your message. We use it only to reply to you and to arrange any conversation you ask for. Your message is emailed to us and isn't stored on the website. When you send it, we email you a short confirmation that we received it; that email contains only your first name and the topic you chose, never your message. We check that your email address's domain exists (a public DNS lookup) so we can reply, and to keep spam out we briefly keep one-way codes made from your IP address and your email address (never the addresses themselves) to limit how many messages one network or one address can send.
Visit statistics
We count visits with Vercel Web Analytics, a service of our hosting provider, Vercel, which acts as our processor. It records the page you viewed (without anything after a “?” or “#” in its address), the website that referred you, your device type, operating system and browser, and your country, which it derives from your IP address. It uses no cookies and stores nothing on your device: visits are told apart by a code made from the request, which is discarded after 24 hours, so a visitor can't be followed from one day to the next. We see only aggregated totals, and the statistics are used for nothing else and shared with no one else. The script is served from our own website and doesn't load at all when your browser sends a privacy signal or you switch statistics off below.
Client success stories and testimonials
Our success stories describe work we have done for our clients, with their agreement. Where we quote someone from a client, we publish their name, their organization and what they said, only with their permission. Pictures on a success story come from the client's own website. To have a quote or picture removed, contact us and we will take it down.
Privacy requests
If you make a privacy request, what you send (your name, email address, where you live and the details of the request) is emailed to us and kept in our email to handle it and to show we answered it. It isn't stored on the website. We email you a short acknowledgement with a reference number and the date we'll answer by.
Why we use it and our legal bases
- To answer your inquiry — replying to a contact-form message. (Steps you ask for before any contract, and our legitimate interest in responding to people who contact us.)
- To keep the site secure — spam and abuse prevention and rate limiting. (Legitimate interests in securing our systems.)
- To understand how the site is used — the visit statistics above. (Legitimate interests; you can opt out at any time.)
- To show our work — publishing client success stories and the testimonials of people who agreed to be quoted. (Consent, which you can withdraw at any time.)
- To meet legal obligations — responding to privacy requests and keeping records of those responses.
We do not sell personal data, share it for cross-context behavioral advertising, use it for targeted advertising or profiling, or make automated decisions that produce legal or similarly significant effects. We don't collect sensitive personal data.
International transfers
We and our providers are based mainly in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, transfers of your data rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and, where a provider is certified, the EU–US Data Privacy Framework and its UK and Swiss extensions.
How long we keep it
- Contact-form messages — in our email for as long as we're discussing your inquiry or working together, and no longer than three years after our last contact.
- Anti-spam codes — up to 24 hours.
- Visit statistics — the code that tells visits apart, 24 hours; the aggregated totals, for the reporting period Vercel keeps them.
- Privacy requests — in our email for 24 months after we answer, so we can show we answered it.
Your rights
Depending on where you live, you have the right to:
- Know and access what personal data we hold about you and get a copy, including in a portable, machine-readable format;
- Correct data that is inaccurate;
- Delete your data;
- Object to or restrict how we use it, including our visit statistics;
- Opt out of the sale or sharing of personal data, targeted advertising and profiling — we do none of these;
- Withdraw consent where we rely on it — for a published testimonial, for instance;
- Not be discriminated against for using any of these rights;
- Complain to a data protection authority — in the UK the Information Commissioner's Office, in the EU the authority where you live or work.
US state privacy notice (including California)
This section adds to the rest of the policy for residents of California (CCPA as amended by the CPRA) and of other states with consumer privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia.
In the past twelve months we have collected the categories of personal information below. We have not sold or shared (for cross-context behavioral advertising) personal information, including of anyone under 16, and we don't use or disclose sensitive personal information.
| Category | What we hold | Source | Why | Disclosed to | Kept |
|---|---|---|---|---|---|
| Identifiers | Name, email address, phone number (if you give it) | You | Replying to you; handling your request | Service providers above | See “How long we keep it” |
| Professional information | Company name, if you give it; for people quoted in a success story, their name, organization and what they said | You; your organization | Replying to you; showing our work (with permission) | Service providers above; the public, for published testimonials | As for identifiers; testimonials until permission is withdrawn |
| Internet or network activity | Pages viewed on our site and the referring website, counted without cookies | Your browser | Understanding how the site is used | Vercel, as our service provider | Aggregated statistics, for Vercel’s reporting period |
| Approximate location | Country, derived from your IP address (not precise location) | Our hosting provider | Understanding where visitors come from | Vercel, as our service provider | Aggregated statistics, for Vercel’s reporting period |
| Device information | Device type, operating system and browser | Your browser | Understanding how the site is used | Vercel, as our service provider | Aggregated statistics, for Vercel’s reporting period |
| Content of communications | What you write in the contact form or a privacy request | You | Replying to you; handling your request | Service providers above | See “How long we keep it” |
How we verify requests. We match the email address you give us to the data we hold and may ask you to confirm a code we send there. For deletion or copies of data we may ask for one more detail we already have. We never ask for more than we need.
Authorized agents. Someone you have authorized may make a request for you; we will ask for your signed permission and may confirm your identity with you directly.
Response times. We confirm a request within 10 business days and answer within 30 days (the stricter GDPR deadline; US state laws allow 45), and tell you if we need an extension where the law allows one.
Appeals. If we decline your request, you can appeal by replying to our answer with the word “Appeal”. Someone who wasn't involved in the first decision will review it and reply within 45 days, or sooner where your state requires. If you disagree with the outcome, you can contact your state's Attorney General.
Make a privacy request
Use this form, or email us: . You'll get a reference number and the date we'll answer by.
Children
Our website is for businesses and isn't directed to children. We don't knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
Security
The website has no accounts or passwords, and the forms store nothing on it: messages and requests are emailed to us. All traffic is encrypted in transit (HTTPS only), and a strict Content Security Policy keeps any third-party code off the site. The anti-spam codes are one-way, so they can't be turned back into an address.
No service can promise perfect security, but if a breach affects your personal data we will notify you and the relevant regulator as the law requires.
Changes and contact
For questions about this policy or your data, email us: , or use the form above.
If we change this policy we will update the version and date above.