Privacy Policy

F.E.P.O. LLC, trading as FEPO Services (“FEPO,” “we,” “us,” “our”), respects your privacy and is committed to handling personal information carefully, lawfully and transparently. This Privacy Policy explains what personal information we collect through feposervices.com and in the course of our business communications, how we use it, who we share it with, how we protect it, how long we keep it, and the rights you have over it.

Your use of our website is also governed by our Terms and Conditions.

1. Who we are and how to reach us

Controller: F.E.P.O. LLC, a limited liability company organized under the laws of Delaware.

Registered address: 16192 Coastal Highway, Lewes, Delaware, 19958

Privacy contact: lauren@feposervices.com

Telephone: 704.363.7890

For individuals in the European Economic Area or the United Kingdom, our representative for data protection purposes is not applicable.

2. Scope of this Policy

This Policy applies to personal information we collect and process as a controller — meaning where we determine why and how the information is used. That includes:

Visitors to feposervices.com, including anyone who submits our contact form or completes the Readiness Diagnostic.

Prospective clients, clients and their personnel, in the course of business development, correspondence and engagement administration.

Recipients of our publications and communications.

Suppliers, subcontractors and other business contacts.

What this Policy does not cover

Where FEPO processes personal information on behalf of a client in the course of a consulting engagement — for example, staff records, incident data, survey responses or guest information supplied to us so that we can perform our work — we act as a processor or service provider, not as a controller. In those circumstances the client determines the purposes of processing, and our handling of that information is governed by the engagement agreement and any accompanying data processing agreement, not by this Policy. If you are an individual whose information was supplied to us by a venue, employer or event organizer, please direct your request to that organization in the first instance. We will support them in responding.

This Policy also does not apply to third-party websites we link to. We are not responsible for the privacy practices of those sites.

3. Information we collect

3.1 Information you provide to us

3.2 Information collected automatically

When you visit our website we and our analytics provider automatically collect:

IP address, which may be truncated or anonymized before storage.

Browser type and version, operating system and device type.

Pages viewed, time spent, referring page and exit page.

Approximate geographic region derived from IP address. We do not collect precise geolocation.

Cookie and similar identifiers, as described in Section 6.

3.3 Information from other sources

We may receive limited business contact information from public professional networks, industry association directories, conference organizers, referrals and publicly available sources, for the purpose of business development in a professional capacity.

3.4 Information we do not collect

We do not seek and ask that you do not send us:

Sensitive personal information, including racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data, health information, sexual orientation or sex life, precise geolocation, or government identification numbers, except where we are legally required to collect a taxpayer identification number for payment purposes.

Payment card numbers by email or through our website. Payments are processed through a third-party payment provider and card details are not stored by us.

Confidential or security-sensitive material through our website or by unencrypted email. This includes vulnerability information, security assessments, floor plans, access-control detail, staffing deployment and incident data. Contact us and we will provide a secure method of transfer.

Information about children. Our website and services are directed to business professionals, not to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us at lauren@feposervices.com and we will delete it.

If sensitive information is sent to us unsolicited, we will delete it promptly unless we are legally required to retain it.

4. How we use personal information

We do not use personal information to make decisions about you by solely automated means that produce legal effects or similarly significant effects. The Readiness Diagnostic produces an indicative score based on answers you supply about your organization. It is informational, it is not a decision about any individual, and it has no legal or similarly significant effect. Its limitations are set out in our Terms and Conditions.

5. We do not sell your personal information

FEPO does not sell personal information, and does not share personal information for cross-context behavioral advertising or targeted advertising, as those terms are defined under United States state privacy laws. We have not sold or shared personal information for those purposes in the preceding twelve months, including the personal information of anyone we know to be under 16.

We do not use personal information for profiling in furtherance of decisions that produce legal or similarly significant effects.

6. Cookies and similar technologies

Cookies are small files placed on your device. We use the following categories:

We do not use advertising or retargeting cookies.

The current website does not set first-party cookies or load analytics, advertising, retargeting, or third-party embeds. If that changes, FEPO will update this Policy and provide any consent or preference controls required by law. You can manage cookies through your browser settings. Instructions for major browsers are available at https://allaboutcookies.org/how-to-manage-cookies.

Global Privacy Control and universal opt-out signals

We recognize and honor the Global Privacy Control (GPC) and other universal opt-out mechanisms required by applicable state law. Where your browser transmits such a signal, we treat it as a valid request to opt out of the sale or sharing of personal information and of targeted advertising, for that browser and device. Because we do not sell or share personal information, this signal does not change our practices, but it is honored and recorded.

7. When we share personal information

We share personal information only in the circumstances below, and only to the extent necessary.

7.1 Service providers and website infrastructure

We use a small number of vendors to operate our business — website hosting and development, email, analytics, file storage, scheduling, payment processing and professional services. Each is bound by contract to process personal information only on our documented instructions, to keep it confidential, to apply appropriate security measures, to notify us of any breach without undue delay, and to delete or return the information when the relationship ends.

Our website is developed and maintained by a third-party development partner and hosted on third-party infrastructure located in the United States. FEPO does not own or operate the underlying servers, network or platform. These providers may have incidental access to personal information submitted through the website in the course of operating and maintaining it. They are contractually restricted to processing that information only on our instructions and are not permitted to use it for any purpose of their own.

Our current providers are listed in Annex A. Where a new provider with access to personal information is introduced, Annex A is updated.

7.2 Professional advisers

Lawyers, accountants, insurers and auditors, where necessary and under a duty of confidentiality.

7.3 Legal and regulatory disclosure

We may disclose personal information where we are required to do so by law, court order, subpoena or a lawful request by a public authority, or where disclosure is necessary to establish, exercise or defend legal claims, to enforce our agreements, or to protect the rights, safety or property of FEPO, our clients or others. Where we are legally permitted to do so, we will notify the affected individual or client before disclosing.

7.4 Business transfer

If FEPO is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction. We will require the recipient to honor the commitments in this Policy, and we will notify affected individuals where required by law.

7.5 With your direction

Where you ask us to share information, or where sharing is an obvious part of what you have asked us to do.

8. How long we keep personal information

We keep personal information only as long as necessary for the purposes it was collected for, and to meet legal, tax, accounting, insurance and dispute-resolution requirements.

When a retention period ends, we delete the information or irreversibly anonymize it. Where deletion is not immediately possible — for example in secure backups — we isolate the information and protect it from further processing until deletion is possible.

9. How we protect personal information

We maintain administrative, technical and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration and destruction, proportionate to the sensitivity of the information and the risk involved. A fuller Information Security Statement is available on request and is provided as standard in any procurement process.

9.1 Access and authentication

Access is granted on the principle of least privilege, only for as long as a business need exists, and is reviewed at least annually.

Every user has a unique named account. Shared or generic accounts are not used for access to confidential information.

Multi-factor authentication is enforced on all business systems that support it.

Credentials are held in a password manager, are not reused across systems, and are never sent by email or message.

Access is revoked within 24 hours of a person ceasing to work with FEPO, and devices are recovered or remotely wiped.

9.2 Encryption and devices

Data in transit is protected using TLS 1.2 or higher. Data at rest is encrypted using AES-256 or equivalent.

Full-disk encryption is enabled on all devices used for FEPO work, with automatic screen lock and remote wipe available.

Operating systems and applications are kept on supported versions with security updates applied promptly, and endpoint protection software is installed and current.

Confidential material is exchanged through access-controlled file transfer rather than as email attachments.

Removable media is not used to transport client information.

9.3 Website and hosting

Because our website is built and hosted by third parties, we require the following of those providers by contract, verify them before launch, and review them at least annually:

HTTPS enforced sitewide with automatic redirection and HSTS.

Platform, content management system and components maintained on supported versions, with security updates applied promptly.

Administrative access limited to named accounts with multi-factor authentication. FEPO holds owner-level access to the hosting, domain and analytics accounts at all times.

Form submissions transmitted over TLS and protected against automated abuse.

Automated backups taken and retained separately from the production environment.

Security headers, including a content security policy, configured and reviewed.

No payment card data processed by the site. Any payments are handled by a PCI DSS compliant third-party provider and card numbers are never stored by FEPO or by the site.

We do not publish configuration detail about our infrastructure. That information is available to clients under confidentiality where a security assessment requires it.

9.4 Security-sensitive client information

FEPO's work produces material that describes how a venue protects itself. That category of information is handled to a higher standard than ordinary confidential information.

Vulnerability findings, physical security assessments, threat scenarios, credentialing detail, camera coverage, access-control configuration and staffing deployment are classified as security-sensitive on creation.

Access is restricted to named individuals with a demonstrated need to know.

This material is not stored on personal devices, personal accounts or consumer file-sharing services, and is not transmitted by unencrypted email.

Deliverables containing security-sensitive findings are watermarked, marked with a distribution restriction, and issued to a named recipient list agreed with the client in advance.

Photographs taken during site walkthroughs are treated as security-sensitive where they depict access points, control rooms, security infrastructure or restricted areas. They are transferred off the capturing device promptly and deleted from it.

Where a client designates material as Sensitive Security Information or an equivalent regulatory category, we handle it in accordance with that regime and the client's instructions.

On completion of an engagement, security-sensitive material is returned or destroyed at the client's direction, and a certificate of destruction is provided on request.

We do not use security-sensitive client material in marketing, case studies or published work in any form, including anonymized form, without the client's prior written consent.

9.5 Personnel, premises and continuity

All personnel and subcontractors are bound by written confidentiality obligations that survive the end of the relationship, complete security awareness training at least annually, and comply with client credentialing and screening requirements as a condition of site access.

Printed material containing confidential information is minimized, kept under the holder's control while in use, and cross-cut shredded when no longer needed.

Business data is backed up automatically, with backups encrypted and stored separately from primary systems. Restoration is tested at least annually.

9.6 Security incidents

We maintain a documented incident response procedure covering detection, triage, containment, eradication, recovery, notification and post-incident review. In the event of a personal data breach we will investigate promptly, take steps to contain and remediate it, and notify affected individuals, clients and regulators where and within the timeframes applicable law requires.

Where FEPO acts as a processor for a client, we will notify that client without undue delay and in any event within 72 hours of confirming an incident affecting their information, whether or not the full facts are yet established. Notification is not delayed pending complete information.

Report a suspected security issue to lauren@feposervices.com. We acknowledge reports within one business day. We welcome good-faith reports from security researchers and will not pursue legal action against anyone who reports a vulnerability responsibly, gives us reasonable time to remediate, and does not access, modify or exfiltrate data belonging to others.

No method of transmission or storage is completely secure. While we work to protect personal information using measures appropriate to its sensitivity and to the risk involved, we cannot guarantee absolute security.

10. International transfers

FEPO is based in the United States and personal information we collect is processed in the United States. If you are located in the European Economic Area, the United Kingdom, Switzerland or another jurisdiction with restrictions on international transfers, your information will be transferred to and processed in a country whose data protection laws may differ from those of your own.

Where we transfer personal information out of the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with any supplementary measures required following a transfer impact assessment. A copy of the relevant safeguards is available on request at lauren@feposervices.com

11. Your privacy rights

The rights available to you depend on where you live. We honor the rights below for all individuals wherever we are able to do so, regardless of residence, and we do not discriminate against anyone for exercising a privacy right — we will not deny services, charge different prices, or provide a different level of quality because you made a request.

11.1 Rights under United States state privacy laws

Depending on your state of residence, you may have the right to:

Know and access the personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties we disclose it to.

Obtain a copy of your personal information in a portable, readily usable format.

Correct inaccurate personal information.

Delete personal information we have collected from you, subject to exceptions permitted by law.

Opt out of the sale or sharing of personal information, and of targeted advertising and certain profiling. As stated in Section 5, we do not engage in these practices.

Limit the use and disclosure of sensitive personal information. As stated in Section 3.4, we do not collect it.

Appeal a decision we make about your request, and to contact your state attorney general if your appeal is denied.

Additional information for California residents

In the preceding twelve months we have collected the following categories of personal information as defined by the California Consumer Privacy Act: identifiers (name, email address, telephone number, IP address); commercial information (records of services enquired about or obtained); internet or other electronic network activity information (browsing and interaction with our website); professional or employment-related information (job title, employer); and inferences drawn from the above only to the limited extent described in Section 4. The sources, purposes and disclosure categories are set out in Sections 3, 4 and 7.

You may designate an authorized agent to make a request on your behalf. We will require written proof of the agent's authority and may require you to verify your identity directly with us.

11.2 Rights under the GDPR and UK GDPR

If you are in the EEA or the UK, you have the right to access, rectify, erase, restrict processing of, and port your personal information; to object to processing based on legitimate interests or carried out for direct marketing; and to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

You also have the right to lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office. We would appreciate the opportunity to address your concern first.

11.3 How to exercise your rights

Send your request to lauren@feposervices.com with enough detail for us to understand what you are asking for. You may also write to us at the address in Section 1.

Verification. We will take reasonable steps to verify your identity before acting, usually by confirming information we already hold or by corresponding with an email address already on file. We will not ask for more information than is necessary, and we will not use verification information for any other purpose.

Timing. We will acknowledge your request promptly and respond within 45 days where United States state law applies, or within one month where the GDPR or UK GDPR applies. Where a request is complex or where we receive several requests from you, we may extend that period as permitted by law and will tell you why.

Cost. Requests are free. We may charge a reasonable fee, or decline to act, only where a request is manifestly unfounded, excessive or repetitive, and we will explain our reasoning if we do.

Appeals. If we decline a request in whole or in part, you may appeal by replying to our response with the word APPEAL in the subject line. We will review the appeal and respond within 45 days with a written explanation of the outcome. If we deny the appeal, we will provide details of how to contact your state attorney general.

12. Marketing communications

We send professional communications only to business contacts who have requested them, who have engaged with us, or where we are otherwise permitted to do so by applicable law. Every message includes a one-click unsubscribe. Unsubscribing does not stop transactional or engagement-related correspondence.

13. Changes to this Policy

We may update this Policy to reflect changes in our practices or in the law. When we do, we will revise the “Last updated” date at the top. Where changes are material, we will provide prominent notice on our website and, where required by law or where we hold your contact details and the change materially affects you, we will notify you directly. Previous versions are available on request.

14. Contact and complaints

If you have a question or concern about how we handle personal information, contact us first at lauren@feposervices.com or 704.363.7890. We take every concern seriously and will respond substantively.

If you are not satisfied with our response, you may contact your state attorney general, your local data protection supervisory authority, or the UK Information Commissioner's Office, as applicable to you.

Annex A — Service providers and sub-processors

The providers below process personal information on our behalf. Each is engaged under terms requiring confidentiality, appropriate security measures and breach notification to FEPO without undue delay.

This Annex was last reviewed on August 10, 2026 and is reviewed at least annually.