Privacy policy.

Effective September 21, 2026

This Privacy Policy explains how Ascent Advisory Group, LLC ("Ascent," "we," "us" or "our") handles personal information when you visit our public website or contact us about our services. It explains your choices and how to reach us with a privacy request.

1. Who is responsible for your information

Ascent is a Maryland business based in the United States. We determine the purposes and means of processing information for this website and related business inquiries. Where data-protection law uses the term, we are the controller for that processing. Our contact details are in Section 12.

This policy covers visitors and people contacting us in the United States, United Kingdom, European Economic Area (EEA) and elsewhere, subject to applicable law. Client-directed processing in a services or C-OPS Command Center engagement is subject to the applicable service and data-processing arrangements and the responsible client's privacy notice. Employment, recruitment and authenticated product activities may require separate notices. Contact us if you need help identifying which notice or organisation is responsible for your information.

2. Information we collect and where it comes from

Contact details and correspondence

When you send an inquiry, we receive the name, company, work email, optional phone number, service interests and message you choose to provide. We may also receive this information from a colleague or representative contacting us on your behalf. Your email service may include normal message headers and attachments that you choose to send.

Website and device information

Our hosting and infrastructure providers process information such as your IP address, request time, requested page or resource, browser and device details, and error or security signals. Your browser supplies this information when it connects to the site. IP addresses and device identifiers are not inherently anonymous.

Optional analytics information

If you accept analytics, Google Analytics receives page and interaction information, browser and device characteristics, cookie identifiers and related technical information. Our custom analytics events exclude contact-field values and inquiry text. Analytics is explained in Section 4.

Privacy choices and requests

Your browser stores your analytics preference. If you make a privacy request, we receive the request, contact details, correspondence and any proportionate information needed to verify your identity or authority and respond.

Providing information for an inquiry is voluntary. Without sufficient contact details or information about your request, we may be unable to respond. Please keep an initial inquiry to business contact details and a general description of your needs. Do not send passwords, payment credentials, government identifiers, health or biometric information, employee files, children's information or confidential client records through public inquiry features.

How the contact tools work: when direct delivery is configured, the website sends your inquiry through our transactional email provider to info@ascentadvisoryllc.com after a Cloudflare Turnstile security check. The website processes the submission for delivery and does not store it in a database, object storage, or application logs. Our email provider and mailbox process the delivered message. If delivery fails, you can use an email link to contact us. We do not submit an unfinished form.

Scheduling: we use your role and reason for contacting us to decide whether to show the introductory calendar. We process these answers for that request and do not save them. If you open the calendar link, your browser connects to Microsoft Bookings in a new tab. Microsoft processes technical information and any appointment details you enter. You can close that tab without booking.

3. How we use information

We use contact information and correspondence to answer questions, understand requested services, arrange conversations and follow up on the inquiry. We use technical information to deliver the website, diagnose errors and address misuse. With your permission, we use analytics to understand page use and improve the website. We also process information as necessary to handle privacy requests, comply with legal obligations and establish, exercise or defend legal claims.

Sending an inquiry does not subscribe you to a marketing list. Analytics consent is optional and is not a condition of browsing or contacting us. This website does not make automated decisions with legal or similarly significant effects about employment, credit or access to services.

Where EEA or UK data-protection law applies, we rely on these legal grounds:

• Legitimate interests: responding to business inquiries, maintaining relevant correspondence, operating and securing the website, and protecting legal rights, balanced against the individual's rights and interests. An employee contacting us for their employer is not automatically personally a party to a contract with Ascent.
• Contractual necessity: taking steps you request before a contract with you personally, or performing that contract, where the processing is necessary for that purpose.
• Consent: optional analytics and any other processing for which we specifically ask for consent. You may withdraw it as explained below.
• Legal obligations: complying with duties that require relevant records, responses to requests or other processing.

4. Cookies, analytics and browser choices

Google Analytics 4 is optional. We ask before loading it. You can choose Decline analytics, accept analytics, or reopen Cookie preferences in the footer to change your choice. Declining does not prevent you from using the website.

Hosting and security providers also process technical requests needed to serve and protect the website. Optional analytics consent does not authorise unrelated advertising or additional uses of inquiry content. Our website tag disables Google signals and advertising personalisation.

Global Privacy Control (GPC): when your browser sends this signal, the site keeps optional analytics off, including where you previously accepted it. This applies to the browser or device sending the signal. It does not identify you or delete correspondence held about you. You may make a separate deletion or other request using Section 8.

Do Not Track: we do not respond separately to legacy Do Not Track headers. The analytics consent and GPC controls described here still apply. Browser controls may also block or remove cookies. A cookie's expiry does not determine how long a provider retains information on its servers.

5. Who receives information

We disclose information to personnel and providers who need it for the relevant inquiry or website function. Our current provider categories are:

• Hosting and infrastructure: Sites hosting and Cloudflare support website delivery, technical processing and security.
• Business communications: Microsoft 365 supports the email correspondence you send to Ascent. Microsoft Bookings provides the appointment calendar.
• Optional analytics: Google Analytics processes usage and related technical information after your consent.

We may also disclose relevant information to professional advisers, courts, regulators or other recipients where necessary to comply with a binding legal obligation or valid legal process, prevent fraud, protect rights or safety, or address a legal claim. A business restructuring may involve relevant records, subject to confidentiality and applicable data-protection requirements.

We do not offer website inquiry records for sale or use those inquiries to run targeted advertising. Optional analytics involves disclosure to Google as described in this policy. You can prevent that optional processing by declining analytics, withdrawing consent or enabling GPC.

Provider information is available from OpenAI, Cloudflare, Microsoft and Google. These providers' notices do not replace Ascent's responsibilities. Links to social networks, technology companies and other external websites take you to services with their own privacy practices.

6. International processing

Ascent is based in the United States. Website and inquiry information may be processed in the United States and in locations used by the providers identified above. Those countries' laws may differ from the laws where you live.

Where EEA or UK law restricts a transfer, the applicable transfer arrangement depends on the recipient and processing involved. Available mechanisms can include a relevant adequacy decision, EU standard contractual clauses, or the UK International Data Transfer Agreement or Addendum, together with any required assessment and additional safeguards. This policy does not represent that Ascent holds a transfer certification or that every provider uses the same mechanism.

Contact us for details of the recipient, applicable transfer arrangement and how to obtain relevant safeguards for your information. Visiting the website, sending an inquiry or accepting analytics does not waive your data-protection rights or provide blanket consent to international transfers. You can contact Ascent using Section 12. That contact is not identified as an appointed statutory representative or data-protection officer.

7. Retention and security

Retention depends on the information and its purpose. For inquiries, relevant factors include whether the conversation remains active and whether correspondence is needed for a resulting engagement or legal claim. Technical information is assessed against delivery, troubleshooting and security needs. Privacy-request records may be needed to document the request and response. Applicable recordkeeping duties, the sensitivity of the information and lawful preservation requirements also affect retention.

Browser storage periods are listed in Section 4. Provider records and backups may follow different retention cycles. Contact us about the retention or deletion of a particular record.

The public website uses HTTPS to protect information in transit. No website or transmission method can guarantee absolute security. Where an incident requires notification, the applicable law and any governing data agreement determine the required notices. Please contact us to arrange an appropriate method before sending sensitive or confidential operational records.

8. Your privacy rights and requests

Depending on the law that applies, you may have rights to confirm processing, access and obtain a copy of information, correct inaccuracies, request deletion, restrict processing, obtain information in a portable form, object to processing, or withdraw consent. You may also have rights concerning recipients, sensitive information, sale, targeted advertising and certain automated decisions. Conditions and exceptions differ, including for records required by law and the rights of others.

Email info@ascentadvisoryllc.com or write to the address in Section 12. Describe your request and how we can contact you. No account, particular subject line or prescribed form is required. An authorised agent may act where permitted, with appropriate proof of authority and any verification allowed by law.

We may request only the information proportionate to verifying identity, authority and the request. Please do not send an identity document unless we have explained why it is necessary and arranged an appropriate channel. We respond without undue delay and within the applicable legal period. Requests are normally free. Any lawful fee, refusal or extension will be explained as required. We do not unlawfully discriminate or retaliate because you exercise a privacy right.

United States residents

Federal and state rights apply according to their scope, thresholds and exceptions. Where applicable, they include access or confirmation, correction, deletion, portability, information about third-party disclosures, and opt-outs for sale, targeted advertising and profiling used for decisions with legal or similarly significant effects. Additional rights may apply to sensitive information.

For California residents, applicable rights also include knowing the categories and specific pieces of personal information collected, its sources and purposes, disclosures and recipients, opting out of sale or sharing, limiting certain uses of sensitive information, and non-discrimination. For Maryland residents, applicable rights include deletion of information provided by or obtained about you and obtaining the categories of third parties receiving your personal data, in addition to other rights described above.

U.S. request periods are commonly 45 days, subject to permitted extensions and any shorter applicable deadline. Where California rules require it, we acknowledge receipt within 10 business days. If you have an appeal right, reply to our decision or use the same privacy contact to explain why you disagree. We respond within the applicable appeal period, no later than 60 days where that period is permitted and sooner where required, and explain the relevant regulator complaint route. These channels also accept requests under narrower state privacy laws.

EEA and United Kingdom residents

Where EEA or UK law applies, you may exercise the rights described above, subject to that law. You may object at any time to direct marketing. Withdrawing consent does not affect processing that was lawful before withdrawal. Applicable law also provides safeguards for certain automated decisions.

We generally respond to rights requests within one calendar month. If a permitted extension is necessary because of complexity or the number of requests, we explain it within the initial period. Identity checks, clarification and other timing rules are applied only where the law governing the request permits them.

You may send a privacy complaint to our email or postal contact. Where UK law applies, we acknowledge a data-protection complaint within 30 days, investigate it, provide appropriate progress information and communicate the outcome without undue delay. This is separate from the deadline for an access or other rights request.

You can also complain to the UK Information Commissioner's Office or an EEA supervisory authority, including where you live, work or believe an infringement occurred. Nothing in this policy restricts a right to a judicial remedy.

9. Children and sensitive information

This business-services website is intended for adults and is not directed to children. Do not submit a child's personal information through its inquiry features. If you believe a child has provided information inappropriately, contact us so we can assess and address it, including deletion where required. Sensitive, employment, health, financial and other regulated records require appropriate service arrangements before they are connected or processed.

10. Client systems and AI features

This notice does not authorise access to a client's internal systems or use of client records for AI training. A C-OPS or other client engagement must identify the actual functions, data, roles, permissions and providers involved in the applicable service documentation. Where we process information on a client's instructions, we assist the responsible client as required by the data agreement and applicable law. Contact us before sending operational data so the appropriate privacy information and transfer method can be provided.

11. Changes and accessibility

The effective date identifies this policy. If our collection or use of information changes, we will update the relevant disclosures. Where additional notice or consent is legally required, that step will occur before the new processing begins. You may request an accessible copy using the contact details below.

12. Contact Ascent

For privacy questions, requests or complaints:
Ascent Advisory Group, LLC
18310 Montgomery Village Avenue, Suite 300
Gaithersburg, MD 20879
United States
Email: info@ascentadvisoryllc.com