Privacy Policy

1. Introduction and Scope

KC Tech & AV, LLC ("KC Tech & AV", "we", "us", or "our") is a commercial and industrial low-voltage contracting company based in Duluth, Georgia. This Privacy Policy governs the collection, use, storage, sharing, and protection of personal information through our business management platform at app.kctechav.com and our marketing website at kctechav.com (collectively the "Services").

The Platform serves three distinct user classes:

• Clients — companies and individuals who engage KC Tech & AV for project work and access a client portal.
• Field Subcontractors (1099 Contractors) — independent trade professionals who access a contractor portal.
• Internal Staff — employees and administrative personnel.

2. Information We Collect

2.1 Client Information

• Identity & Contact: Full legal name, business name, mailing and billing address, email, telephone.
• Project & Contract Data: Scope of work, project addresses, signed proposals, change orders.
• Financial Data: Invoice records, payment history, billing preferences. Payment card data is processed exclusively by Stripe and not stored on our servers.
• Communications: Portal messages and support inquiries.
• Usage Data: Log files, IP address, browser type, session duration, feature interactions.

2.2 Contractor Information

• Identity & Demographic: Full legal name, date of birth, home address, email, telephone.
• Tax & Compliance: SSN/TIN for IRS Form 1099-NEC reporting, W-9 documentation.
• Banking & Payment: ACH routing and account numbers for compensation. Stored encrypted and access-restricted.
• Licensing & Credentials: Trade licenses, insurance certificates, Georgia state registrations.
• Work Records: Work orders, deliverables, time records, and performance documentation.
• Emergency Contact: Name and telephone of a designated emergency contact.

2.3 Automatically Collected Information

• Server log data (IP address, timestamps, HTTP codes, referrer URLs, browser/device type)
• Session and preference cookies
• Device information (OS, identifiers, screen resolution, time zone)

2.4 Information We Do Not Collect

We do not intentionally collect biometric data, health or medical information, precise real-time geolocation, or data from individuals under 18. If you believe we have inadvertently collected such information, contact us immediately at the address in Section 14.

3. How We Use Your Information

3.1 Client Data

• Account management and authentication
• Service delivery: proposals, project management, deliverables
• Billing and payments via Stripe
• Customer communications and support
• Legal compliance and record-keeping
• Marketing: by creating an account you consent to receiving marketing communications. You may opt out at any time via the unsubscribe link in any email or by contacting us.

3.2 Contractor Data

• Onboarding, credentialing, and license verification
• Work assignment and project coordination
• Compensation, ACH disbursements, and IRS Form 1099-NEC issuance
• Tax reporting and legal compliance (minimum 4-year retention per IRS guidance)
• Platform security monitoring

4. How We Share Your Information

4.1 Service Providers

• Stripe, Inc. — payment processing (stripe.com/privacy)
• Hostinger International Ltd. — cloud hosting infrastructure
• Transactional email delivery services for invoices and notifications
• Accounting and tax software for financial recordkeeping

4.2 Legal Disclosures

We may disclose information when required by law, regulation, legal process, or to protect the rights, property, or safety of KC Tech & AV, our users, or the public — including mandatory IRS 1099-NEC reporting obligations.

4.3 What We Do Not Do

• We do not sell personal information to third parties.
• We do not share contractor SSN/TIN or banking information except as required for payroll and IRS compliance.
• We do not disclose client project information to competitors.

5. Legal Basis for Processing

• Contractual Necessity: Account creation, project execution, invoicing, contractor compensation.
• Legal Obligation: IRS 1099-NEC reporting, Georgia contractor regulations, tax record retention.
• Legitimate Interests: Fraud prevention, platform security, service improvement, and marketing to existing clients.
• Consent: Marketing communications to clients (withdrawable at any time).

6. Payment Card Data and Financial Security

KC Tech & AV uses Stripe, Inc. as its exclusive payment processor. All payment card transactions are handled by Stripe under PCI-DSS Level 1 compliance. We do not receive, store, process, or transmit full card numbers, CVV codes, or expiration dates on our servers.

Contractor ACH banking information is stored encrypted with access restricted to authorized administrative personnel and payroll processing systems.

7. Data Security

• Encryption in Transit: All data transmitted uses TLS 1.2 or higher (HTTPS).
• Encryption at Rest: Contractor tax identification numbers and banking information are encrypted at rest.
• Access Controls: Role-based access controls (RBAC) restrict data access by job function. Client data is accessible only by the client and authorized KC Tech & AV staff. Contractor sensitive data is access-restricted and audit-logged.
• Audit Logging: Access to sensitive data fields is logged.

In the event of a data breach, we will notify affected users in accordance with applicable law, including the Georgia Personal Identity Protection Act (O.C.G.A. § 10-1-910).

8. Cookies and Tracking Technologies

• Strictly Necessary Cookies: Session authentication — required for login. Cannot be disabled.
• Functional Cookies: Preference storage (time zone, display settings).
• Analytics Cookies: Aggregate usage data to improve the Platform.

You may control non-essential cookies through your browser settings. Disabling certain cookies may impair Platform functionality.

9. Data Retention

• Client Account Data: Duration of relationship + 7 years after last transaction.
• Contractor Tax Records (1099/W-9): Minimum 4 years following the applicable tax year (IRS Publication 15).
• Contractor Banking/ACH Data: Duration of active relationship + 3 years after final disbursement.
• Project and Deliverable Records: 7 years after project completion (Georgia construction law).
• Security and Access Logs: 1 year.
• Marketing Opt-Out Records: Retained indefinitely to honor your preference.

When information is no longer required, we securely delete or anonymize it.

10. Your Privacy Rights

10.1 Rights Available to All Users

• Right to Access — Request a copy of the personal information we hold about you.
• Right to Correction — Request correction of inaccurate or incomplete information.
• Right to Deletion — Request deletion, subject to legal retention obligations.
• Right to Restrict Processing — Request we limit how we use your information.
• Right to Object to Marketing — Opt out of marketing communications at any time.

10.2 California Residents (CCPA / CPRA)

California residents have additional rights including: Right to Know, Right to Delete, Right to Correct, Right to Opt-Out of Sale or Sharing, and Right to Non-Discrimination. We do not sell or share personal information as defined by CCPA. To exercise California rights, contact us using the information in Section 14. We will respond within 45 days.

10.3 How to Exercise Your Rights

Submit a written request through our Data Request Form or contact us directly at the address in Section 14. We will verify your identity before processing requests involving sensitive data and respond within 30 days.

11. Account Creation as Agreement to This Policy

Creating an account on the Platform constitutes your affirmative agreement to this Privacy Policy. For contractors, execution of any subcontractor agreement or W-9 submission confirms your understanding and consent to the use of your tax and financial information for payroll, tax reporting, and compliance. For clients, submission of a signed proposal or first payment confirms agreement to the marketing uses described in Section 3.1.

12. Third-Party Links and Services

The Platform may contain links to third-party websites. This Policy does not apply to any third-party service. We encourage you to review third parties' privacy policies before providing personal information.

13. Children's Privacy

The Services are intended solely for persons 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If you believe we have collected information from a minor, contact us immediately at the address in Section 14.

14. Contact Information

15. Changes to This Privacy Policy

We may update this Policy periodically. When we make material changes, we will update the "Last Reviewed" date, post the revised Policy on the Platform, and provide in-app or email notice for changes affecting how we use sensitive personal information. Continued use after the effective date constitutes acceptance of the changes.

16. Governing Law

This Privacy Policy is governed by the laws of the State of Georgia and applicable federal law. Any disputes arising under this Policy shall be subject to the exclusive jurisdiction of the state and federal courts located in Gwinnett County, Georgia.