Privacy Policy

Last Updated: 10/12/2026

Introduction

Cordatus Resource Group, LLC (“Cordatus,” “we,” “us”) is a business operations consulting firm. We provide strategy and advisory, operations and process engineering, technology and automation, and managed services to businesses. We are based in Maryland, United States. Our mailing address is 1400 W. Lombard St Ste A, PMB 2144, Baltimore, MD 21223.

This Privacy Policy explains how we collect, use, share, and protect personal information when we act as the organization responsible for it. That includes visitors to our website, people we contact about our services, contacts at our clients and vendors, and people who apply to work with us.

When we perform services for a client, we often handle personal information on that client’s behalf, such as its employees’, customers’, or prospects’ information. In that role we act as the client’s service provider (or “processor”), and the client’s own privacy notice governs that information. The section “Information We Process on Behalf of Clients” explains how we handle it.

Data Protection Officer

We have appointed an internal Data Protection Officer to answer questions about this policy and handle privacy requests:

Waseem Kayani, Data Protection Officer
Cordatus Resource Group, LLC
1400 W. Lombard St Ste A, PMB 2144, Baltimore, MD 21223
privacy@cordatusrg.com
+1 (443) 698-1148

Information We Collect

We collect mostly business contact information. We do not seek sensitive personal information about the people described below.

Who	What we collect	Where it comes from
Website visitors	IP address, approximate location, browser and device type, pages viewed, referring site, recordings of how you interact with pages (clicks, scrolling, and page movement), and identifiers from analytics and advertising cookies and pixels	Automatically, through server logs, cookies, and pixels, including those of our analytics and advertising partners (see our Cookie Policy)
People who contact us	Name, job title, employer, business email and phone, and the content of your message, including website chat conversations	You, through our website forms, website chat, email, phone, or meetings
Prospective clients	Name, job title, employer, business email and phone, professional profile, and company information	Public sources such as company websites and LinkedIn, business data providers, and, when you visit our website, identification of your company from your IP address
Client and vendor contacts	Name, job title, employer, business contact details, communications, and billing information	You and your organization, in the course of our relationship
Job applicants	Name, contact details, CV, work history, education, and interview notes	You, your references, and recruiting platforms

How We Use Personal Information

We use personal information only for the purposes below. Where the GDPR or UK GDPR applies, each purpose rests on the legal basis shown.

Purpose	Legal basis
Providing our services, managing client and vendor relationships, and invoicing	Performance of a contract, or our legitimate interest in managing business relationships
Responding to inquiries, including through our website chat, and arranging meetings	Steps at your request before entering a contract, or our legitimate interest in responding
Business-to-business marketing and prospecting, including email and LinkedIn outreach and identifying companies that visit our website	Our legitimate interest in promoting our services to businesses, or your consent where the law requires it
Operating, securing, and improving our website	Our legitimate interest in a secure, functional website, or your consent for non-essential cookies
Recruiting and evaluating applicants	Steps at your request before entering a contract, or our legitimate interest in hiring
Meeting legal, tax, accounting, and regulatory obligations, and protecting our legal rights	Legal obligation, or our legitimate interest in protecting our rights

We do not make decisions about people based solely on automated processing that produce legal or similarly significant effects.

Website Chat

Our website includes a chat window provided by HighLevel (LeadConnector), the customer relationship management platform we use. Replies in the chat come only from an AI assistant. No person from Cordatus replies in the chat. The assistant answers questions; it does not make decisions about you.

The chat does not ask for your name, email address, or phone number. Anything you type, including personal details you choose to share, becomes part of the conversation. Your messages are processed by HighLevel and its AI service providers to generate replies, and the conversation is stored in our CRM. We use it to answer your questions and to improve the information the assistant provides. If you include your contact details and ask us to follow up, we may contact you.

The chat loads only if you accept Advertising cookies, and you can turn it off at any time, as described in our Cookie Policy.

Please do not share sensitive information in the chat, such as health information, financial account numbers, or government identification numbers.

Information We Process on Behalf of Clients

When we perform services for a client, we process personal information only on that client’s documented instructions and only to perform those services. Our contracts with clients, including our Master Service Agreement and, where applicable, a Data Processing Agreement, govern that processing.

For that information:

We do not use it for our own purposes, including our own analytics, marketing, or product development.
We do not sell or share it, and we do not combine it with personal information from other sources except as the client instructs and the law permits.
We return or delete it when our services end, as our contract with the client specifies.
Our sub-processors are listed on our Subprocessors page.

If you want to exercise privacy rights over information we hold for one of our clients, please contact that client directly. If you contact us instead, we will forward your request to the client and assist it in responding.

How We Share Personal Information

We do not sell personal information for money. We use Clay to identify the companies that visit our website, which involves sending visitors’ IP addresses to Clay and its identification providers. It identifies companies, not individual people, and runs only if you accept Advertising cookies. Under some US state privacy laws, this may count as “selling” or “sharing” personal information. You can opt out as described under Your Privacy Choices. Otherwise, we disclose personal information only to:

Service providers that support our business, under contracts that limit their use of it to the services they provide to us. These include providers of cloud productivity and file storage, data backup, password management, project management, customer relationship management and website chat, scheduling, business data and enrichment, email and marketing delivery, telephony and messaging, recruiting software, accounting software, website hosting, and IT management and security.
Professional advisers such as lawyers, accountants, auditors, and insurers, under duties of confidentiality.
Authorities and other parties where required by law, such as in response to a subpoena or court order, or where necessary to enforce our agreements or protect the rights, property, or safety of Cordatus, our clients, or others.
A successor organization, if we are involved in a merger, acquisition, or sale of assets, subject to this policy’s protections.
Others, with your consent or at your direction.

We may publish aggregated or de-identified information that cannot reasonably be linked to any individual.

Since our founding, we have received no government requests for personal information.

International Transfers

We are based in the United States, and our team works from the United States, the European Union, the United Kingdom, Colombia, and Pakistan. Our service providers store data mainly in the United States, and some store it in the European Union. Personal information may therefore be processed outside the country where you live.

When we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards. These are the European Commission’s Standard Contractual Clauses adopted in 2021, with the UK Addendum and Swiss adaptations where applicable, or a service provider’s certification under the EU-U.S. Data Privacy Framework. We protect personal information from Canada with the same measures wherever it is accessed.

To request information about these safeguards, contact privacy@cordatusrg.com.

How Long We Keep Personal Information

We keep personal information only as long as needed for the purpose we collected it, then delete or de-identify it.

Information	Retention period
Client and vendor contact and billing records	For the relationship, then 7 years to meet tax, accounting, and legal requirements
Prospect information	Until it is no longer relevant to our business, and no longer than 3 years after our last contact. If you opt out, we keep only what we need to honor your opt-out.
Website logs and analytics	13 months
Website chat conversations	13 months. If the conversation becomes part of a prospect or client relationship, the retention period for that relationship applies
Job applicant information	2 years after the application, unless you are hired or ask us to delete it sooner
Information we process for clients	As our contract with that client specifies, and returned or deleted when our services end

We may keep information longer where the law requires it or to resolve a dispute.

How We Protect Personal Information

We maintain an information security management system certified to ISO/IEC 27001:2022 for our business process outsourcing services in accounting, finance, IT services, digital marketing, recruiting, HR support, administration, and customer service. Our safeguards include multi-factor authentication, encrypted company devices, access limited to those who need it, security awareness training, and a documented incident response plan.

No system is completely secure. If we become aware of a breach affecting your personal information, we will notify you and the authorities where the law requires.

Your Privacy Rights

Depending on where you live, you may have the right to:

Know what personal information we hold about you, how we use it, and who we disclose it to, and receive a copy.
Correct inaccurate information.
Delete your information, subject to legal exceptions.
Object to or restrict our use of your information, including for direct marketing.
Receive your information in a portable format.
Withdraw consent you have given, without affecting earlier processing.
Opt out of the sale or sharing of personal information, targeted advertising, and certain profiling, under some US state laws.
Not be treated differently for exercising these rights.

Your Privacy Choices. To opt out of the sale or sharing of your personal information, use the Your Privacy Choices link in our website footer or our cookie settings, or email privacy@cordatusrg.com. We treat a Global Privacy Control signal from your browser as a valid opt-out for that browser. Because these opt-outs work through cookies, you may need to repeat them on each browser or device, or after clearing your cookies.

How to make a request. Email privacy@cordatusrg.com or write to our Data Protection Officer at the address above. We will verify your identity before acting, usually by confirming details we already hold. An authorized agent may act for you with your signed permission. We respond within the time the applicable law requires, generally 30 to 45 days, and at no charge.

Appeals and complaints. If we decline your request, you may appeal by replying to our decision, and we will review it. You may also raise a complaint with your local data protection authority, such as a supervisory authority in the EU, the UK Information Commissioner’s Office, the Office of the Privacy Commissioner of Canada, or the Commission d’accès à l’information du Québec.

Marketing Communications

We contact business professionals about services relevant to their roles, by email, phone, and LinkedIn. We follow applicable marketing laws, including the US CAN-SPAM Act and Canada’s Anti-Spam Legislation, which requires consent for most commercial electronic messages to Canadian recipients.

You can opt out at any time by using the unsubscribe link in our emails, replying to ask us to stop, or emailing privacy@cordatusrg.com. We will add you to our suppression list so we do not contact you again. We may still send messages needed to administer an existing business relationship, such as invoices.

Cookies

Our website uses cookies, scripts, and similar technologies, including Google Analytics and Microsoft Clarity for analytics, Clay’s website tracking, which identifies the companies that visit our site, and HighLevel’s website chat. Our “Book a Strategy Call” button opens Calendly’s website, where Calendly’s own cookie and privacy policies apply. We ask every visitor for consent before we set cookies or run tools that are not strictly necessary.

Our Cookie Policy explains which ones we use and how to accept or reject them.

Children

Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe we have, contact us and we will delete it.

Changes to This Policy

We update this policy when our practices change. We will post the updated version here with a new “Last updated” date, and notify clients of material changes.

Contact Us

For questions, concerns, or requests about your personal information:

Cordatus Resource Group, LLC

Attn: Data Protection Officer

1400 W. Lombard St Ste A, PMB 2144, Baltimore, MD 21223

privacy@cordatusrg.com