Privacy Policy

Who We Are

This website is operated by KHCshop LLC, a company registered at 440 E 100 N, Nephi - 84648-1512, United States (US). The brand is presented on this website under the developer name KHC Shop, and that same name appears on the small tools, notes and printed bench cards we hand to clients during a session. Throughout this policy the terms we, us and our refer to KHCshop LLC, and the terms you and your refer to any visitor, enquirer, client contact or recipient of our services.

We are a computer integrated systems design studio. Our work joins hardware, data and people so that they behave as one construction, and our bench in Nephi is where that work happens. Privacy matters at a bench of this size because we handle small amounts of information very carefully and we treat every note as if it belongs to us. This document describes that care in plain language.

If you have a question that this policy does not answer, you can write to shop@khcshop.hair or call +16318107949 during bench hours. A person who works at the bench will read the message. It does not go into a queue that nobody watches.

Scope of This Policy

This policy covers the information we collect through this website, through email and telephone contact about our services, and through the ordinary running of a client engagement. It does not cover information that a client asks us to process on their behalf inside their own systems, which is handled under the written agreement that governs that engagement and is described in the section titled Information in Client Engagements.

The policy does not apply to third party websites that you may reach from ours, nor to any product or service that has its own separate privacy notice. We do not control those destinations and we cannot make promises about how they treat your data. Read their notices before you share anything sensitive with them.

This website is intended for an audience of professional and business users. It is not directed at young children and we do not knowingly design any part of it for them. Please see the section on Privacy for Children for the details of that position.

Information We Collect

We keep collection narrow on purpose. The categories below describe everything we normally handle through this website and through early enquiries.

Information you give us directly

• Your name and the name of your organisation.
• Your email address and, if you supply it, your telephone number.
• The subject and contents of any message you send through the contact form or by email.
• Any files, diagrams or notes you choose to attach to a message.
• Notes we take during a drawstring desk session or a call, including the names of project contacts.

Information collected automatically

• Standard web server records such as the requested page, the date and time of the request, the response status and the referring address.
• The type of browser and operating system reported by your device.
• A truncated or anonymised network address used for security and abuse prevention.

Information we do not seek

We do not ask for payment card numbers through this website. We do not ask for government identification numbers, medical records, biometric data or credentials to your production systems in an initial message. If a conversation appears to need any of those, we will set up an appropriate channel before anything is exchanged, and we will explain why it is needed.

Where Information Comes From

Most of what we hold comes from you. You type it into the contact form, you send it in an email, or you say it during a call and we write it down. Some information arrives from your colleagues when a project introduces us to a wider team, and some arrives from public sources such as a company website when we prepare for a first conversation.

A small amount of information is generated by the website itself as pages are served. This is the ordinary traffic record that any web server produces, and we describe how it is used in the section on website logs.

We do not buy contact lists or enrichment data from brokers. If we hold your name it is because you or a colleague put it in front of us in the course of a real conversation.

How We Use Information

We use information for a short list of purposes that are directly connected to running a systems bench.

• To answer your enquiry and to arrange a first conversation.
• To prepare for a session by reading the materials you send.
• To deliver, support and document the work described in a client agreement.
• To keep a written record of decisions so that the bench and the client share one account of what was agreed.
• To send administrative notes about a live project, such as a summary after a lacing check evening.
• To protect the website and the bench from fraud, abuse and security incidents.
• To meet accounting, tax and record keeping duties that apply to a registered company.

We do not use information for automated profiling, we do not sell it, and we do not rent it. We do not use client work as promotional material without a specific written permission that names the material in question.

Our Legal Bases

Where the law requires us to identify a legal basis for processing, we rely on the following grounds.

• Contract, when processing is necessary to answer a request you have made or to deliver a service you have engaged.
• Legitimate interests, when processing is necessary to run a secure and honest business, provided those interests are not outweighed by your rights.
• Legal obligation, when a record must be kept or a request must be honoured under applicable law.
• Consent, when we ask for a specific permission such as the use of a project name in a case note. You may withdraw that consent at any time.

When we rely on legitimate interests we think carefully about the balance before we act, and we keep the category of information as narrow as the purpose allows.

Cookies and Similar Technologies

This website is deliberately simple. It does not set advertising cookies, it does not run a third party tracking pixel and it does not build a profile of your browsing across other sites. A small cookie or local storage entry may be used to remember a basic interface choice such as whether a mobile menu was left open.

Server software may place a short lived session identifier to keep responses consistent while a page loads. That identifier is not used to recognise you on a later visit and it is not shared with any advertising network.

If we introduce a new cookie for a genuine functional reason, we will describe it here before it goes live. You can always block or delete cookies through your browser settings. The site will continue to work for reading and for sending a contact message, although some small conveniences may behave differently.

When We Share Information

We share information only when there is a clear reason and only to the minimum extent needed. The normal situations are listed below.

• With your own team, when you have introduced us to colleagues and the conversation clearly involves them.
• With a service provider that hosts our email or website, under a written agreement that limits what they may do with the data.
• With an accountant or legal adviser, when a record is needed to meet a professional or statutory duty.
• With a public authority, when the law compels disclosure and we are satisfied that the request is valid.
• With a successor organisation, if the business is ever transferred, subject to the same protections described here.

We do not sell personal information. We do not share contact lists with marketing partners. We do not publish client names without a specific written permission. If a request for information comes from someone who is not clearly entitled to it, we decline and explain why.

Service Providers

Like most small businesses we rely on a handful of providers: an email host, a website host, a domain registrar and an accounting tool. Each of these providers processes a limited set of information on our instruction. We choose providers that publish a clear privacy commitment and that apply reasonable security to their systems.

Before a provider receives any information from us we consider what it will actually see. A domain registrar never sees a client message. An email host sees the message but not the systems it describes. An accounting tool sees an invoice but not the technical content of a project. We keep the flow of information as narrow as the work allows.

If a provider is involved in a security incident that touches our information, we will assess the impact, notify affected people where the law requires it, and record what we learned so the bench improves.

How Long We Keep Information

We keep information only for as long as it serves the purpose for which it was gathered, or for as long as the law requires a record to exist.

• Enquiries that do not become engagements are normally removed within twelve months.
• Project correspondence is kept for the length of the engagement and for a short review period afterwards.
• Handover records and runbooks are kept for as long as the client needs them, and the client also holds their own copy.
• Financial records are kept for the period required by applicable tax and company law.
• Web server logs are kept briefly for security review and then discarded.

When a retention period ends we delete the information or reduce it to an aggregated form that no longer identifies a person. We do not keep a copy in a forgotten folder just in case. If you ask us to delete something sooner and there is no legal duty to keep it, we will do so and confirm in writing.

How We Protect Information

Security at a small bench is mostly about discipline. Messages are held in accounts that require strong passwords and a second factor. Devices are kept current with security updates and are encrypted at rest. Access to a client project is limited to the people actually working on it, and that circle is deliberately small.

We keep written notes for the pouch of truth because memory is not reliable, but we do not write down credentials. Secrets live in a dedicated password manager and are shared through that tool rather than in email. When a secret must travel, we use a time limited share rather than a plain attachment.

No system is perfectly secure and we will not pretend otherwise. If an incident occurs we will investigate promptly, take steps to contain it, tell affected people honestly, and revise our practice so the same seam does not tear twice.

Website Logs

Our web server records the page requested, the time of the request, the response status and the software identification reported by the browser. It also records a shortened network address. These records are used to keep the site available, to diagnose faults and to spot abusive traffic such as automated scraping or repeated failed requests.

We do not combine these records with contact form content to build a profile of an individual visitor. We do not use them to serve advertising. Access to the logs is limited to the person who maintains the site, and the records are deleted on a short cycle.

Contact Forms and Email

The contact form on this website works by handing your message to your own email program so that you can send it to shop@khcshop.hair. The website itself does not store the message. Once you press send in your email program the message travels to our mailbox, where it is treated like any other business correspondence.

We read every message. We reply from a real mailbox, not an automated queue. If you later ask us to delete an enquiry that did not become a project, we will remove it and confirm that we have done so. If a message contains something you would rather not have in email, tell us and we will arrange a different channel.

Email is not a sealed letter. A message can be misaddressed or intercepted, so please do not send secrets, identification documents or credentials in an initial email. A short description of the problem is always enough to begin.

Information in Client Engagements

During a project we may see information that belongs to a client and that concerns the client customers or staff. In that situation the client is the controller of the information and KHCshop LLC acts on written instruction. We process that information only to deliver the work, we do not use it for our own purposes and we return or delete it at the end of the engagement.

Where a project requires access to a live system we prefer to receive a limited account rather than a master account. We keep access named to an individual, we remove it when the person leaves the project, and we record the removal. If the client needs an audit trail of our access, we will cooperate with that requirement.

Questions about project data should be sent first to the client contact named in the agreement, because that person speaks for the controller. We will support them with whatever records we hold.

International Transfers

We are based in the United States and our normal processing happens there. Some service providers may store data in other countries. When that happens we rely on the safeguards that the provider has put in place, such as standard contractual terms, and we review those safeguards before a provider is used for anything sensitive.

If you are writing from outside the United States you should know that your message will be processed in the United States under United States law. We take reasonable steps to protect the information in transit and at rest, and we will answer questions about a specific provider on request.

Your Privacy Rights

Depending on where you live, you may have some or all of the following rights.

• The right to know whether we hold information about you and to receive a copy.
• The right to correct information that is wrong or incomplete.
• The right to ask us to delete information that we no longer need.
• The right to ask us to restrict how we use information while a question is being resolved.
• The right to object to processing that relies on our legitimate interests.
• The right to receive information you gave us in a portable format.
• The right to withdraw consent where processing is based on consent.
• The right to complain to a supervisory authority in your region.

These rights are not absolute. A legal duty to keep a record may override a deletion request, and the rights of another person may limit what we can disclose. When a request cannot be met in full we will explain the reason in plain language rather than hiding behind a form letter.

Exercising Your Rights

Write to shop@khcshop.hair and say what you would like us to do. You can also call +16318107949 if you prefer to speak with someone. There is no charge for a normal request and we do not require you to use a particular form.

We will confirm that we have received the request and we will normally respond within thirty days. If the situation is unusually complex we will tell you why and give a realistic date. To protect you, we may ask a short question that only you could answer before we disclose or delete anything. We will never ask for a password.

If you are not satisfied with our response you may ask us to review the decision. You may also raise the matter with the privacy authority in your jurisdiction. We would rather hear from you first so that we can put the seam right.

Privacy for Children

This website and our services are meant for businesses and professional users. We do not knowingly collect information from a child under the age of thirteen, and we do not direct advertising or profiling at children. If you believe that a child has sent us information, please contact us and we will delete it promptly.

Where a client project genuinely involves a service used by families, we require the client to confirm that they hold the necessary permissions and that their own notices are in place. We do not make those decisions on a client behalf.

Third Party Links

Our pages may link to a vendor, a standards body or a reference article that is useful for understanding the work. Those destinations have their own practices. A link is not an endorsement of everything on the page it points to, and it is certainly not a promise about privacy.

If you follow a link and are asked for information, check the destination first. If you believe a link on our site leads somewhere harmful or misleading, tell us and we will review it.

Changes to This Policy

We update this policy when our practice changes, when a provider changes, or when the law asks for something new. The effective date at the top of the page is the date of the current version. If the change is significant we will describe it in a short note at the top for a period before the policy becomes the ordinary reference again.

We keep earlier versions on file. If you need to see a previous version for a contract or a dispute, write to us and we will provide it. We do not rewrite history quietly, because a policy that changes without a trace cannot be trusted.

How to Reach Us

For anything related to privacy, including a request to access, correct or delete information, write to shop@khcshop.hair or call +16318107949. The company address is KHCshop LLC, 440 E 100 N, Nephi - 84648-1512, United States (US).

We are a small bench and we like direct conversation. A clear note about the question gets a clear answer faster than a formal complaint. Thank you for reading this policy and for trusting us with the information you choose to share.