Privacy & Data Handling Policy

Effective Date: June 20th, 2026
Company: Momentum Data Solutions
Contact: the President of the Company, or its approved representative

1. Purpose

The President of the Company, or its approved representative is committed to protecting the confidentiality, integrity, and availability of the data we collect, process, transform, analyze, migrate, store, or transmit on behalf of our clients.

This Privacy and Data Handling Policy explains how we handle business data, personal information, confidential information, and sensitive information in connection with our data processing, extraction, transformation, reporting, migration, integration, and automation services.

2. Scope

This policy applies to data handled by the President of the Company, or its approved representative, including but not limited to:

• Client-provided files
• Spreadsheets, CSV files, PDFs, exports, reports, and system data
• Payroll, HR, finance, operational, vendor, customer, and implementation data
• Data received through secure file transfer, APIs, connectors, webhooks, cloud platforms, email-approved transfer methods, or client-authorized systems
• Data prepared for reporting, system migration, workflow automation, compliance review, or operational decision-making

3. Types of Data We May Process

Depending on the client engagement, the President of the Company, or its approved representative may process:

• Business contact information
• Employee or workforce data
• Payroll and compensation data
• HRIS, HCM, ERP, CRM, or vendor system data
• Financial or accounting data
• Benefits, eligibility, or administrative records
• Project files, implementation data, and reporting data
• Sensitive personal information, when authorized by the client
• Protected Health Information, if applicable and only under appropriate contractual safeguards

4. How We Use Client Data

The President of the Company, or its approved representative uses client data only for authorized business purposes, including:

• Extracting data from approved sources
• Cleaning, formatting, and standardizing records
• Mapping data between systems
• Removing duplicates and resolving inconsistencies
• Preparing data for migration, reporting, integration, or automation
• Validating data against business rules
• Supporting client-authorized implementation or operational workflows
• Providing project deliverables requested by the client

We do not sell client data. We do not use client data for unrelated marketing, resale, profiling, or unauthorized third-party disclosure.

5. Data Minimization

The President of the Company, or its approved representative seeks to limit data collection and processing to the information reasonably necessary to complete the authorized project or service.

When possible, clients are encouraged to remove unnecessary fields before providing files. Where appropriate, the President of the Company, or its approved representative may also recommend excluding, masking, redacting, or limiting sensitive data that is not required for the project objective.

6. Data Classification

The President of the Company, or its approved representative may classify data based on sensitivity, business impact, and handling requirements. Common classification categories may include:

• Public Data: Information approved for public release.
• Internal Data: Business information intended for internal company use.
• Confidential Data: Information that could create business, legal, financial, or operational risk if improperly disclosed.
• Restricted or Highly Sensitive Data: Information requiring elevated safeguards, such as payroll data, financial records, government identifiers, health-related data, PHI, ePHI, credentials, or other regulated information.

7. Access Control

Access to client data is limited to authorized personnel, contractors, or approved service providers who need access to perform assigned work.

Access should be based on role, project responsibility, and business need. Where appropriate, the President of the Company, or its approved representative may use authentication controls, access restrictions, secure storage locations, and approved transfer methods to reduce unauthorized access risk.

8. Security Safeguards

The President of the Company, or its approved representative uses reasonable administrative, technical, and physical safeguards designed to protect client data from unauthorized access, use, disclosure, alteration, loss, or destruction.

These safeguards may include:

• Secure file handling procedures
• Password protection and access controls
• Encryption where appropriate
• Secure transfer methods
• Limited access permissions
• Data validation and quality control steps
• Backup and recovery procedures where applicable
• Vendor and subcontractor review where applicable
• Incident response procedures

9. Data Retention

The President of the Company, or its approved representative retains client data only as long as necessary to complete the authorized service, satisfy contractual requirements, comply with legal obligations, resolve disputes, or support documented business purposes.

Upon project completion, expiration of the retention period, or client request, the President of the Company, or its approved representative may return, delete, archive, or securely dispose of client data in accordance with the applicable agreement.

10. Third-Party Service Providers

The President of the Company, or its approved representative may use approved third-party platforms, software, cloud services, or subcontractors to support service delivery.

When third-party providers are used, the President of the Company, or its approved representative will seek to use providers that support reasonable data protection practices. Where PHI/ePHI is involved, appropriate HIPAA-related agreements or contractual safeguards must be in place before the provider is permitted to access such information.

11. HIPAA and Regulated Data

If the President of the Company, or its approved representative receives, creates, maintains, or transmits Protected Health Information or electronic Protected Health Information on behalf of a HIPAA covered entity or business associate, the President of the Company, or its approved representative will handle such information only as permitted by the applicable agreement, Business Associate Agreement, law, or client instruction.

12. Incident Response

If the President of the Company, or its approved representative becomes aware of a suspected or confirmed security incident involving client data, the President of the Company, or its approved representative will take reasonable steps to investigate, contain, document, and address the incident.

If the incident involves regulated data, PHI, ePHI, or other legally protected information, the President of the Company, or its approved representative will follow applicable contractual, legal, and notification requirements.

13. Client Responsibilities

Clients are responsible for:

• Providing accurate and authorized data
• Identifying data that may be sensitive, regulated, confidential, or subject to special handling
• Ensuring they have the legal right to provide the data to the President of the Company, or its approved representative via encrypted file
• Notifying the President of the Company, or its approved representative of any special security, retention, regulatory, or contractual requirements
• Executing a Business Associate Agreement before PHI/ePHI is shared, if HIPAA applies

14. Changes to This Policy

The President of the Company, or its approved representative may update this policy from time to time to reflect changes in services, technology, legal requirements, or business practices. Questions about this policy may be directed to: compliance@momentumdatasolutions.com.