US Data Protection Policy

Effective date: 13 November 2026

1. Purpose and scope

This US Data Protection Policy (“Policy”) adds to our Privacy Policy. It explains how ANR Executive Consultants Inc (“ANR”, “we”, “us”) protects personal data collected through www.anrexecutives.com (the “Website”) and the privacy rights available to US residents. It is designed to meet, to the extent they apply to ANR, the New Jersey Data Privacy Act (N.J.S.A. 56:8-166.4 et seq.), the California Consumer Privacy Act as amended by the CPRA (“CCPA”), similar privacy laws in other US states, and New Jersey’s data breach notification law.

For the purposes of these laws, ANR is the controller (or “business”) that decides how and why your personal data is used. The service providers listed below act as our processors.

2. Personal data we collect, use and share

Over the past 12 months, and on an ongoing basis, the Website collects the categories of personal data below.

Sensitive data: the Website is not designed to collect sensitive data, such as health information, Social Security or other government ID numbers, financial account details, precise geolocation, or data about children. Please do not submit it through our forms. If you include it by mistake, we will use it only to respond to your request and will delete it where possible. We do not process sensitive data for any other purpose without your prior opt-in consent.

Health and client data: the Website does not collect protected health information. If you become a client, any employee benefits, payroll or HR data you share with ANR is governed by your engagement agreement and by the laws that apply to it, such as HIPAA (through a Business Associate Agreement where required) and the Gramm-Leach-Bliley Act. This Policy does not cover that data.

3. No sale, targeted advertising or profiling

• ANR does not sell personal data and has not sold it in the past 12 months.
• ANR does not share personal data for cross-context behavioural or targeted advertising.
• ANR does not use personal data for profiling or automated decision-making that produces legal or similarly significant effects.

We also treat a Global Privacy Control (GPC) or other recognised universal opt-out signal from your browser as a valid request to opt out. When we detect one, optional analytics cookies are not set.

4. Your privacy rights

Depending on your state of residence, and to the extent the relevant law applies to ANR, you have the right to:

• Confirm and access: confirm whether we process your personal data, and access it.
• Correct: correct inaccurate personal data.
• Delete: have your personal data deleted, subject to legal exceptions.
• Portability: receive a copy of your personal data in a portable, readily usable format.
• Opt out: opt out of the sale of personal data, targeted advertising and profiling. We do not do any of these, but you may still submit a request.
• Know: for California residents, know the categories of personal data collected, its sources, the purposes for collecting it, and the categories of third parties it is disclosed to (see Section 2).
• Withdraw consent at any time, for example by changing your cookie preferences or asking us to stop contacting you.
• Non-discrimination: you will not receive different treatment or service because you exercised any of these rights.

5. How to make a request

• Email info@anrexecutives.com with the subject line “US Privacy Request”, stating your name, state of residence and the right you want to exercise.
• Verification: to protect your data, we will verify your identity by matching the details you give with the information we hold. We may ask for more information only where needed.
• Authorised agents: you may use an authorised agent to submit a request for you. We may ask for proof of the agent’s authority and confirm your identity directly with you.
• Timing: we will respond within 45 days of receiving your request. If reasonably necessary, we may extend this by a further 45 days, and we will tell you if we do. Requests are free of charge, up to the limits allowed by law.

6. Appeals

If we decline to act on your request, we will explain why. You may appeal by replying to our decision, or by emailing info@anrexecutives.com with the subject line “Privacy Appeal”, within a reasonable time. We will respond in writing within the period required by law. If your appeal is denied, you may contact your state regulator: in New Jersey, the Division of Consumer Affairs in the Office of the Attorney General; in California, the California Privacy Protection Agency or the California Attorney General.

7. Data security and breach response

We use reasonable administrative, technical and physical safeguards suited to the nature of the data. These include HTTPS/SSL encryption in transit, access controls and multi-factor authentication on Website, hosting and email accounts, secure AWS hosting, regular software updates, and access limited to people who need it. Our processors are bound by contracts that require confidentiality, appropriate security and deletion or return of data at the end of the service.

If a security breach affects your personal information, we will notify you, and where required the New Jersey State Police or other authorities, without unreasonable delay and as required by N.J.S.A. 56:8-161 et seq. and other applicable state breach notification laws.

8. Data minimisation and retention

We collect only the personal data reasonably necessary for the purposes described in this Policy. Enquiry and meeting data that does not lead to an engagement is deleted or de-identified after 12 months from our last contact. Analytics data is kept for 14 months. Where we hold de-identified data, we take reasonable measures to make sure it cannot be re-identified, and we do not attempt to re-identify it.

9. Children and teens

The Website is intended for businesses and professionals. It is not directed at children under 13, and we do not knowingly collect their personal data, in line with the Children’s Online Privacy Protection Act (COPPA). We also do not knowingly process the personal data of anyone under 18 for targeted advertising or profiling.

10. Changes to this Policy

We will review this Policy at least once a year and update it when our practices or the law change. The latest version, with its effective date, will always be on the Website.

11. Contact us