Privacy Notice

Quick Reference

Where to find what:

This notice is from JADE Advisors LLC, a Delaware limited liability company with its principal office in Florida (“JADE Advisors,” “we,” or “us”). It applies to our marketing site at jade6c.com and to the SOS Stakeholder Capital Workbench at workbench.jade6c.com. It does not apply to third-party sites we link to.

1. What We Collect

1.1 What you give us

On the marketing site (jade6c.com): your email if you sign up for the newsletter, the messages you send through the contact form, and any information you choose to share when you reach out about speaking, workshops, or advisory services.

In the Workbench (workbench.jade6c.com): your name, your email, how you found us, and the access code or passphrase from the book. After you register, you also enter Your Content, meaning your stakeholder maps, dependency and replaceability scores, capital allocations, covenants, scenarios, and the outputs the Workbench generates from your inputs.

1.2 What we collect automatically

On both sites, we collect basic technical and usage information: IP address, approximate location from IP, browser, operating system, the pages you visit, the features you use, and error logs. The Workbench also logs your sessions so we can keep it secure and figure out where it is failing.

2. How We Use It

We use what we collect to:

• Run the marketing site and the Workbench;
• Authenticate you, manage your account, and protect against unauthorized access;
• Process Your Content so the Workbench gives you back what you put in;
• Send you service messages (account confirmation, security alerts, important updates), and marketing or product announcements you have asked for;
• Answer your questions and respond to feedback;
• Build de-identified or aggregated insights to improve the Workbench, develop industry benchmarks, and inform the SOS Methodology;
• Detect and prevent fraud, abuse, security incidents, and Terms violations; and
• Comply with the law and enforce our agreements.

3. Workbench-Specific: Your Work, Azure, and No AI

3.1 Where Your Content lives

The Workbench is a hosted web application. We process and store Your Content on our cloud infrastructure (currently Microsoft Azure) so the Workbench can give your work back to you when you log in. We are not running the Workbench in your browser only; the work itself is on our servers.

3.2 No AI training, no AI service

We do not use Your Content to train artificial-intelligence models. We do not transmit Your Content to any third-party large-language-model or generative-AI service. The Workbench today runs on rules-based logic, scoring, and conditional pathways we set.

If we ever want to add AI features, we will tell you, update the Terms, describe how the feature works at a high level, and ask you to accept the new Terms before that feature turns on. Section 7 of the Terms covers this.

3.3 Aggregated insights

We may build de-identified or aggregated data from how the Workbench is used. We use that aggregated data to make the Workbench better, develop industry benchmarks, and inform the SOS Methodology, including in published anonymized form. This aggregated data is not personal information.

4. Who We Share With

We do not sell or rent your personal information. We share information only when:

• Service providers run things for us. We use third parties to operate the Workbench, the marketing site, and our communications. Examples include cloud hosting (Microsoft Azure), software development (Directio), email delivery, error monitoring, and analytics. The current list is at jade6c.com/trust#subprocessors. We require service providers to handle your information only on our instructions and to keep it secure.
• The law requires it. We may disclose information if we have to comply with the law, respond to valid legal process, enforce our Terms, or protect the rights, property, or safety of JADE Advisors, our users, or the public.
• There is a corporate transaction. If JADE Advisors is involved in a merger, acquisition, financing, reorganization, or sale of all or substantially all of its assets, your information may transfer with the business. We will give you notice of any change of control or material change in handling.

5. How Long We Keep It

We keep your information only as long as we need it for the purposes in this notice or as long as the law requires.

• Marketing-site contact information: until you ask us to delete it or until your inquiry is resolved, whichever is longer.
• Newsletter or marketing email: until you unsubscribe.
• Workbench registration data: while your account is active and a reasonable period after, for record-keeping, security, and dispute resolution.
• Your Content: while your account is active. You can delete Your Content from inside the Workbench (where the feature exists) or by asking us. After account closure, we delete or de-identify Your Content within a reasonable period unless the law requires us to keep it.
• Diagnostic and usage data: only as long as we need it in identifiable form, after which we de-identify or aggregate it.
• De-identified or aggregated data: we may keep this indefinitely, including for benchmarks and methodology improvement.
• 24-month inactivity: if you do not log in for 24 months in a row, we may close your Workbench account and delete or anonymize associated information, with reasonable notice if we can.

6. How We Protect It

We use reasonable technical, administrative, and physical safeguards to protect your information from loss, misuse, unauthorized access, disclosure, alteration, and destruction. That includes encryption in transit, access controls, authentication, logging, and vendor due diligence. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

If we become aware of a security incident affecting your personal information, we will notify you and any applicable regulator within the timeframes required by law.

7. Where Your Information Lives

We run the Workbench from the United States and our service providers may also be in the United States or other countries. If you access our sites from outside the United States, including the EEA or the UK, your information will be transferred to and processed in the United States and other countries that may have different data-protection laws than your country.

7.1 EEA transfers

For transfers from the European Economic Area to the United States or other third countries that have not received an adequacy decision from the European Commission, we rely on the European Commission’s Standard Contractual Clauses (SCCs) under Implementing Decision (EU) 2021/914, with appropriate technical and organizational measures. You can ask us for a copy of the relevant SCCs using the contact details in Section 15.

7.2 UK transfers

For transfers from the United Kingdom, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs issued by the Information Commissioner’s Office, as applicable, with appropriate technical and organizational measures.

7.3 Other jurisdictions

Where we transfer information from another jurisdiction with data-export restrictions, we use the transfer mechanism that jurisdiction requires.

8. Cookies

We use cookies and similar technologies to operate the sites, keep you signed in to the Workbench, remember your preferences, and analyze usage.

• Strictly necessary: required for sign-in, session security, and basic functionality. These cannot be disabled without breaking the service.
• Functional: remember your preferences and settings.
• Analytics: help us understand how the sites are used so we can improve them. Where the EU or UK requires it, we ask for your consent before turning these on through a cookie banner.

You can control cookies in your browser settings. Disabling strictly necessary cookies will impair or prevent use of the Workbench. We do not currently respond to browser “Do Not Track” signals.

9. Your Rights

Depending on where you live, you have some or all of these rights regarding your personal information. Sections 10, 11, and 12 explain what is specific to California, other US states, and the EU and UK.

• Access: ask what we have about you and get a copy.
• Correction: ask us to fix information that is wrong or incomplete.
• Deletion: ask us to delete information, subject to exceptions in the law and our retention rules.
• Portability: ask for your information in a structured, machine-readable format.
• Objection: object to processing based on our legitimate interests, or to direct marketing.
• Restriction: ask us to restrict processing in certain circumstances.
• Withdraw consent: where we rely on consent, withdraw it without affecting prior processing.
• Email preferences: opt out of non-essential email any time. We will still send service messages.

To use any of these rights, contact us at privacy@jade6c.com or through Section 15. We will respond within the time the law requires. We may need to verify your identity before responding. We will not retaliate against you for using your rights.

10. California (CCPA / CPRA)

10.1 Why this section is here

This section gives California residents the rights and disclosures the California Consumer Privacy Act, as amended by the California Privacy Rights Act, asks for. We may not currently meet the formal CCPA thresholds (annual revenue over $25 million; processing of 100,000 or more California consumers or households; or 50% or more of revenue from selling or sharing personal information). We voluntarily honor these rights for all California residents using our sites.

10.2 Categories we collect

Mapped to the categories in Cal. Civ. Code § 1798.140:

10.3 We do not sell or share

We do not sell your personal information as defined under the CCPA. We do not share personal information for cross-context behavioral advertising. We have not done so in the past twelve months and we do not plan to.

10.4 Sensitive personal information

We do not collect Sensitive Personal Information (as defined in Cal. Civ. Code § 1798.140(ae)) other than account credentials, which we use only to authenticate you and run the Workbench. We do not use Sensitive Personal Information to infer characteristics about you, so the right-to-limit notice under CPRA Section 1798.121 does not apply.

10.5 Your California rights

• Right to Know: ask what categories and specific pieces of personal information we have, where they came from, why we collected them, and who we share them with.
• Right to Delete: ask us to delete your personal information, subject to exceptions.
• Right to Correct: ask us to correct inaccurate personal information.
• Right to Opt Out of Sale or Sharing: not applicable to us. We do not sell or share.
• Right to Limit Use of Sensitive Personal Information: not applicable. We do not use Sensitive Personal Information for the purposes that trigger this right.
• Right to Non-Discrimination: we will not retaliate against you for using these rights.

10.6 How to ask

Email privacy@jade6c.com with subject line “California Privacy Rights Request,” or use the contact details in Section 15. We will verify your identity and respond within 45 days, with one possible extension of 45 more days if needed. You can use an authorized agent in writing.

11. Other US States

Residents of these states have rights under their state privacy laws. We honor these rights for residents of all such states.

Most of these laws give residents the right to know, correct, delete, portability, and opt out of sale, targeted advertising, or profiling for decisions with significant legal or similar effects. We do not sell personal data, do not engage in targeted advertising, and do not use profiling for those decisions.

To use any of these rights, email privacy@jade6c.com with subject line “State Privacy Rights Request – [Your State]” or use the contact details in Section 15. We will respond within the time the law requires (generally 45 to 90 days depending on the state). We will not retaliate against you for using your rights.

12. EU and UK (GDPR / UK GDPR)

If you live in the European Economic Area or the United Kingdom, the EU GDPR and UK GDPR (and the UK Data Protection Act 2018) give you additional rights.

12.1 Why we are allowed to process your information

We rely on these legal bases (Article 6 of the GDPR / UK GDPR):

• Performance of a contract (Article 6(1)(b)): to give you access to and use of the Workbench under the Terms.
• Legitimate interests (Article 6(1)(f)): to operate, secure, and improve our sites; develop the SOS Methodology and benchmarks; prevent fraud and abuse; and protect our rights and others’, when those interests are not overridden by yours.
• Consent (Article 6(1)(a)): when we ask for it, including for non-essential cookies in places that require it. You can withdraw consent any time without affecting prior processing.
• Legal obligation (Article 6(1)(c)): to comply with the law and lawful requests.

We do not collect special categories of personal data (such as health information, racial or ethnic origin, religious beliefs) through our sites. Please do not enter that kind of information as User Content.

12.2 Your rights

• Access (Article 15): get confirmation that we process your data and a copy of it.
• Rectification (Article 16): correct inaccurate or incomplete data.
• Erasure (Article 17): ask for your data to be deleted, subject to exceptions.
• Restriction (Article 18): limit processing in specific circumstances.
• Portability (Article 20): receive your data in a structured, machine-readable format.
• Object (Article 21): object to processing based on legitimate interests or to direct marketing.
• Automated decisions (Article 22): not be subject to a decision based only on automated processing that produces legal effects or similarly significant effects. The Workbench does not make solely automated decisions of that kind. Outputs are advisory and need human judgment.
• Withdraw consent (Article 7(3)): at any time, where we relied on consent.
• Complain to a supervisory authority: EEA residents can contact their national data-protection authority. UK residents can contact the Information Commissioner’s Office (ICO) at ico.org.uk.

12.3 Controller and contact

For the GDPR and UK GDPR, the data controller is JADE Advisors LLC. To use your rights or ask a question, email privacy@jade6c.com or use Section 15. We will respond within one month, with up to two more months for complex or numerous requests, and we will tell you why if we need an extension.

12.4 EU and UK representatives

Today, JADE Advisors does not actively offer the Workbench in the EEA or the UK and has not appointed an Article 27 GDPR representative or a UK GDPR representative. If we begin to actively offer the Workbench in the EEA or the UK at a level that requires representatives, we will appoint them and update this notice with their contact details. EEA and UK residents can contact us directly using the details in Section 15.

13. Children

Our sites are not directed to children under 18 and we do not knowingly collect personal information from anyone under 18. If you think a child has given us personal information, contact us in Section 15 and we will take steps to delete it.

14. Changes to This Notice

We may update this notice. For material changes, we will update the Effective Date and Version, and we will tell you through the Workbench, by email, or another reasonable way. Continued use after the change means you accept it. If a change requires opt-in consent under the law, we will ask before turning the change on. You can find earlier versions on request.

15. Contact Us

Questions about this notice, or to use your rights:

• Email: privacy@jade6c.com
• Mail: JADE Advisors LLC, 1690 S. Congress Ave, Suite 100, Delray Beach, FL 33445
• Web: jade6c.com  |  workbench.jade6c.com
• Trust Center: jade6c.com/trust

We respond within the time the law requires.