Privacy policy

The short version

Who we are

Balance Business Group, LLC ("BBG", "we", "us") is a Minnesota company providing IT asset disposition (ITAD) services — data center decommissioning, equipment removal, certified data destruction, recycling and remarketing — and Disaster Recovery as a Service (DRaaS). Our offices are in Minneapolis, Minnesota and Dunedin, Florida.

For privacy purposes, BBG is the "controller" (or "business") for information about our own customers, prospects, and website visitors. For data that lives on equipment or systems you engage us to handle, BBG acts as your "processor" (or "service provider"): we handle it only on your instructions and only to do the job you hired us for.

What we collect

Information you give us

When you fill out our contact form, book a meeting, email or call us, request a quote, or become a client, we collect what you provide. Typically that is:

• Your name, job title, and company
• Work email address, phone number, and mailing address
• What you're asking about — for example, the site address, rack or device counts, timing, and any constraints you tell us about
• Contract, invoicing, and payment details once you become a client (we do not store full payment card numbers; our payment processor handles those)
• The contents of our correspondence with you

Information we collect during a project

To do the work and document it, we record details about the equipment we handle: make, model, serial numbers, asset tags, rack location, condition, and disposition (resold, recycled, destroyed). We also record who signed the pickup manifest and the certificates of destruction, and when. These records are the chain of custody your auditors will ask for, and we treat them as part of your project file.

Information collected automatically on the website

Like most websites, ours logs basic technical information: IP address, browser and device type, operating system, the pages you view, how long you stay, and the site that referred you. Some of this comes from our web server and some from Google Analytics, which only runs after you accept analytics cookies (see Cookies and site tools).

Data on equipment you give us

This is the part of our business where privacy matters most, so it gets its own section.

• We don't look. Our technicians do not access, read, copy, or use any data stored on drives, servers, workstations, phones, or other devices in our custody. Our procedures, our training, and our certifications prohibit it.
• It's destroyed, not "erased." Storage media is either physically shredded or sanitized using methods that meet NIST SP 800-88 guidelines, on site at your facility or at ours, depending on the scope you chose. Media is tracked by serial number from the moment it leaves your rack until it is destroyed.
• You get proof. We issue a certificate of destruction listing every serial number, the method used, and the date. We keep a copy in your project file so it can be reissued if you ever need it.
• Nothing is resold with data on it. Equipment that goes to our remarketing channels has already had its storage destroyed or sanitized and verified. If a device can't be reliably sanitized, its storage is shredded.
• Your instructions govern. If your contract, industry, or regulator requires a specific method, witness, or timeline, we follow it. Tell us at the walkthrough and it goes in the scope.

Our handling of this data is audited under our ISO 27001, NAID AAA, and R2 certifications, and we operate as a HIPAA business associate for healthcare clients when a business associate agreement is in place.

How we use information

We use the information described above to:

• Respond to your questions and requests
• Schedule walkthroughs, scope projects, and prepare quotes
• Perform the services you hire us for and document them
• Invoice, collect payment, and administer BBG Technical Dollars credits
• Send you service updates, reports, certificates, and reminders about your projects
• Tell you about services we think are relevant to your business (you can opt out; see Email and marketing)
• Understand how our website is used so we can improve it
• Keep our systems secure and detect fraud or misuse
• Meet legal, tax, certification, and audit obligations

Where a law asks us to name a legal basis, ours are: performing a contract with you or taking steps at your request before one; our legitimate interests in running, protecting, and promoting our business; compliance with legal obligations; and your consent, where we ask for it (for example, analytics cookies).

Who we share it with

We share personal information only when we need to, and only with parties bound to protect it. We never sell it.

• Service providers that help us run the business. Examples: Microsoft 365 (email, calendar, and the booking tool on our site), Formspree (delivers contact-form submissions to our inbox), Google (analytics, reCAPTCHA spam protection, and web fonts), our accounting and payment processors, and our IT and security vendors. They may only use your information to provide their service to us.
• Downstream recycling and remarketing partners. Equipment that leaves our custody for recycling or resale goes to R2-certified or equivalently vetted partners. They receive equipment records (make, model, serial number), not your personal information, and never any data from the devices — that has already been destroyed.
• Your MSP or IT partner. If an MSP or other partner engaged us on your behalf, we share project records, reports, and certificates with them as the party managing the work.
• Legal and safety. We may disclose information if required by law, subpoena, or court order, or to protect the rights, property, or safety of BBG, our clients, or others.
• Business transfers. If BBG is involved in a merger, acquisition, or sale of assets, information may transfer to the new owner under the same commitments in this policy.

Cookies and site tools

Here is exactly what runs on bbg-mn.com and what each thing stores.

You can also block or delete cookies in your browser settings, and opt out of Google Analytics everywhere with Google's browser add-on. We do not respond to "Do Not Track" browser signals because there is no industry standard for them, but we honor Global Privacy Control signals as an opt-out of analytics where your browser sends one.

Email and marketing

We market to businesses, not consumers. That means you may hear from us at a work email address if we believe our services are relevant to your organization, even if you haven't contacted us first. Every marketing email we send:

• Comes from a real person at BBG with a real reply address
• Identifies BBG clearly and includes our physical address
• Includes a way to opt out, which we honor promptly and permanently

To stop marketing email at any time, reply "unsubscribe" to any message, or email kevinw@bbg-mn.com. Opting out of marketing does not stop service emails about a project you have with us — invoices, reports, certificates, and scheduling.

We do not buy consumer marketing lists, and we do not use your information for targeted advertising on other websites.

How long we keep it

• Inquiries that don't become projects: up to two years from our last contact, so we can pick the conversation back up if you return, then deleted.
• Client account and contract records: for the life of the relationship and for seven years afterward, to meet tax, accounting, and contract obligations.
• Chain-of-custody records and certificates of destruction: at least seven years, or longer if your contract or regulator requires it. These exist to protect you in an audit, so we err on the side of keeping them.
• Website analytics: Google Analytics data is retained for 14 months, then deleted automatically.
• Marketing contacts: until you opt out or we determine the contact is no longer relevant. Opt-out records are kept permanently so we don't email you again.

When we delete information, we use the same standards we apply to client media: secure deletion for electronic records and shredding for paper.

How we protect it

We hold ISO 27001 certification for information security management, NAID AAA certification for secure destruction, R2 certification for responsible recycling, and we comply with HIPAA as a business associate. In practice that means:

• Access to client and project records is limited to staff who need it for their job
• Systems are protected with multi-factor authentication, encryption in transit and at rest, and monitored backups (we run the same DRaaS platform we sell)
• Equipment in our custody is stored in access-controlled, monitored space and tracked by serial number
• Staff are background-checked and trained on data handling, and our processes are audited by outside certifiers on a recurring schedule
• We maintain an incident response plan. If a breach affects your personal information, we will notify you without unreasonable delay and in any case within the timeframe required by applicable law

No system is perfectly secure, and we won't claim ours is. If you believe you have found a security problem on our website or in our services, please email kevinw@bbg-mn.com so we can act on it.

Your rights and choices

Regardless of where you live, you can ask us to:

• Tell you what personal information we hold about you and where it came from
• Correct anything that's wrong or out of date
• Delete your personal information, unless we're legally required to keep it (for example, an invoice or a certificate of destruction)
• Give you a copy of your information in a usable format
• Limit how we use it, or object to a particular use
• Stop marketing communications

Residents of states with comprehensive privacy laws — including Minnesota, California, Virginia, Colorado, Connecticut, Texas, Oregon, and others — have these rights under statute, along with the right not to be treated differently for exercising them and, where applicable, the right to appeal our decision on a request. Because we do not sell personal information or use it for targeted advertising or profiling with legal effects, there is nothing to opt out of on those fronts, but you can still ask us to confirm that.

Individuals in the UK, EU, or EEA have equivalent rights under the GDPR and may also lodge a complaint with their local supervisory authority.

Children

Our website and services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we'll delete it.

Changes to this policy

We'll update this page when our practices or the law change, and we'll change the effective date at the top when we do. If a change materially affects how we handle information you've already given us, we'll tell existing clients directly by email before it takes effect.

Contact us

Questions, requests, or concerns about privacy go to our Data Protection Officer: