Privacy notice
Data should move only for a named purpose
This notice explains how IT Modality handles information submitted through its public website, consulting inquiries, Delivery Teams requests, professional applications, Academy forms, support conversations, and certificate verification.
ForPeople conducting policy, privacy, security, or access review
FocusControls, ownership, evidence, and review paths
The form determines the record
We collect the identity and contact details you provide, the organization or professional context needed to route a request, form answers, consent and preference records, correspondence, workflow status, security logs, and certificate identifiers. We do not ask for patient records, client secrets, government identifiers, financial-account credentials, or production credentials through public forms.
Purpose stays attached to the record
We use submitted information to answer and route inquiries, qualify a request, administer an application or course, operate The Rigors, issue and verify certificates, preserve correspondence, prevent abuse, maintain security, and meet documented legal or contractual duties. We do not sell personal information or use Academy performance to influence professional assessment or client selection.
Access follows role and purpose
Information is available to the IT Modality personnel and service providers who need it for the stated workflow. Engagement data follows the applicable agreement and approved environment. Cross-border handling, retention, deletion, and provider terms are reviewed for the system involved rather than inferred from this page.
Optional measurement excludes submitted content
IT Modality self-hosts Umami analytics. It does not load until a visitor explicitly allows analytics through the footer control. The site then sends only allowlisted routes, sanitized campaign tags, broad browser and device context, country-level location derived from the request, and named interaction or form-state events. Names, email addresses, form answers, free text, private query strings, cross-site identifiers, and session replay are excluded. The Cookie and Analytics Notice explains the current inventory and withdrawal control.
Keep what the record still requires
Retention follows the workflow, contractual record, security need, certificate-history requirement, and applicable legal duty. Self-hosted analytics records remain until an operator deletes them; analytics backups age out after 14 days. To request access, correction, deletion, or clarification, email hello@itmodality.com with enough context to locate the record. Identity verification may be required before a request is completed.
Controls match the data and system
We use role-based access, environment separation, logging, review, and incident procedures proportionate to each workflow. No internet transmission or storage system is risk-free; report a suspected issue through Trust and security.