Privacy notice

1. Controller and contact

AeonLoop LLC, a limited liability company organized under the laws of the State of Illinois, United States, with its principal place of business in Chicago, Illinois, is the controller of personal data collected through this site.

For any privacy question, or to exercise any right described below, write to info@aeonloop.com with "Privacy" in the subject line. We have not appointed a data protection officer, as we are not required to do so.

2. What we collect

We collect only what you give us and the minimum our hosting provider needs to serve the site.

• Contact form. Your name, organization, email address, the capacity you selected, and the content of your message.
• Working paper request form. Your name, job title, organization, email address, telephone number if you provide one, city and country, organization type, how you heard about us, and any note you add.
• Technical data. Our hosting and content delivery provider processes your IP address, browser type, and requested URL in order to deliver the site and protect it from abuse. We do not use this data to identify you and we do not build profiles from it.

We do not knowingly collect personal data from anyone under the age of 16 through this site.

3. Cookies and similar technologies

This site sets one cookie, al_lang. It is a first-party cookie that records your choice of English or Spanish when you use the language switch in the navigation, so that the site does not repeatedly offer you a language you have already declined. It expires after one year and contains only a language code. It is strictly necessary to deliver the language preference you explicitly requested, and for that reason we do not ask for consent to set it.

We do not use advertising cookies, tracking pixels, device fingerprinting, cross-site tracking, session recording, or third-party analytics. Our web fonts are served from our own domain, so no font provider receives your IP address. If we introduce analytics in future we will use a privacy-preserving, cookieless tool and will update this notice before doing so.

Our hosting provider may set a short-lived cookie for security and load-balancing purposes. Such cookies are strictly necessary and are exempt from consent requirements.

4. Why we process it, and on what legal basis

For visitors in the European Economic Area and the United Kingdom, our legal bases under the GDPR and UK GDPR are as follows.

• Responding to your enquiry or request is necessary to take steps at your request prior to entering into a contract, or is in our legitimate interest in responding to people who contact us. Article 6(1)(b) and 6(1)(f).
• Sending you the working paper and following up once about it is in our legitimate interest in providing information you asked for and understanding who is interested in our work. Article 6(1)(f).
• Operating and securing the site is in our legitimate interest in keeping it available and free from abuse. Article 6(1)(f).
• Meeting legal, tax, and regulatory obligations where they apply. Article 6(1)(c).

We do not use your data for automated decision-making or profiling, and we do not process special categories of personal data through this site.

5. Marketing

We do not operate a marketing mailing list and we do not send newsletters from this site. If we contact you after you request the working paper, it will be an individual message about that request. You can ask us to stop at any time and we will.

6. Who we share it with

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not disclose it to advertisers or data brokers.

We use a small number of service providers who process personal data on our behalf under written terms: a website hosting and content delivery provider, a form handling provider that delivers form submissions to us by email, and our email provider. We may also disclose personal data to our professional advisers, or where required by law or to establish, exercise, or defend legal claims.

7. International transfers

AeonLoop is based in the United States, and our service providers are principally located there. If you are in the European Economic Area or the United Kingdom, your personal data will be transferred outside your jurisdiction. Where we rely on providers not covered by an adequacy decision, those transfers are made under the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable. You may request a copy of the relevant safeguards from the address in section 1.

8. How long we keep it

We keep contact form submissions and working paper requests for up to three years from our last substantive exchange with you, so that we can maintain a record of the correspondence and, in the case of the working paper, a record of who received it. Where an engagement follows, records are retained for the period required by our professional, contractual, and tax obligations. We delete or anonymize data once it is no longer needed for these purposes.

9. Your rights

If you are in the European Economic Area or the United Kingdom, you have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing including processing based on legitimate interests, and to receive your data in a portable format. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

If you are a California resident, you have the right under the CCPA as amended by the CPRA to know what personal information we have collected and the purposes for which we use it, to request deletion, to request correction, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, so no opt-out mechanism is required. We will not discriminate against you for exercising any right. Residents of other United States states with comparable privacy legislation have equivalent rights, and we apply the same process to all such requests.

To exercise any right, write to info@aeonloop.com. We will respond within one month for GDPR requests and within forty-five days for United States requests, and we may ask you for information sufficient to verify your identity. There is no charge unless a request is manifestly unfounded or excessive.

10. Complaints

If you are in the European Economic Area or the United Kingdom and you are not satisfied with how we have handled your personal data, you may lodge a complaint with your national supervisory authority, or with the Information Commissioner's Office in the United Kingdom. We would appreciate the chance to address your concern first.

11. Security

The site is served exclusively over HTTPS and applies standard security headers. We limit access to form submissions to the principals of the firm. No method of transmission or storage is completely secure, so we ask that you do not send confidential or sensitive information through this site.

12. Changes to this notice

We may update this notice from time to time. The current version is always posted here with its effective date. Where a change materially affects how we use personal data you have already given us, we will take reasonable steps to tell you.