Legal & Privacy Policy

Colvai LLC (“Colvai,” “we,” “us,” or “our”) is a management consulting and professional services firm headquartered in New York, New York, United States, serving clients across North America, Latin America, Europe, Asia, the Middle East, and Africa.

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you:

• visit or interact with colvai.ai or www.colvai.nyc and any associated subdomains (the “Site”);
• contact us, request a briefing, or submit an inquiry through the Site;
• apply for a role or express interest in working with us;
• subscribe to our insights, communications, or events; or
• otherwise engage with us as a prospective client, client contact, supplier, or partner representative.

For personal information we process on behalf of our clients in the course of delivering consulting, delivery, or training services, our client is generally the data controller and Colvai acts as a processor (or service provider). That processing is governed by the relevant engagement agreement and data processing agreement (DPA), not by this Policy. See Section 13.

1. Information you provide to us. This includes information you submit when you complete a contact or “Start a conversation” form, request a briefing, register for an event, subscribe to communications, apply for a position, or correspond with us: for example your name, job title, organization, business email address and phone number, country or market, and the content of your message, résumé/CV, or application materials.
2. Information we collect automatically. When you use the Site, we and our service providers may automatically collect technical and usage information through cookies and similar technologies, such as your IP address, device and browser type, operating system, referring and exit pages, pages viewed, links clicked, and the dates and times of your visits. See our Cookie Policy.
3. Information from other sources. We may receive information from third parties such as business contact and enrichment providers, professional networks, event partners, references you provide, and publicly available sources, where permitted by applicable law.

We do not seek to collect special categories of personal data (such as health, religion, or biometric data) through the Site. Please do not submit such information to us unless specifically requested in connection with a lawful purpose.

We use personal information for the following purposes, relying on the legal bases indicated (where the EU/UK GDPR or a similar framework applies):

• To respond to your inquiries and provide the information, briefings, or services you request — performance of a contract or steps taken at your request; our legitimate interests in responding to business inquiries.
• To establish, manage, and deliver client, supplier, and partner relationships: performance of a contract; legitimate interests in managing business relationships.
• To send insights, event invitations, and marketing communications about our services, where permitted: consent, where required; otherwise our legitimate interests in promoting our services to business contacts.
• To recruit and evaluate candidates for employment or engagement: steps taken at your request prior to entering a contract; legitimate interests in assessing suitability; consent where required.
• To operate, secure, maintain, and improve the Site and understand how it is used: legitimate interests in running and improving our business and securing our systems; consent for non-essential cookies where required.
• To comply with legal, regulatory, and professional obligations, and to establish, exercise, or defend legal claims: compliance with a legal obligation; legitimate interests in protecting our rights.

Where we rely on legitimate interests, we balance those interests against your rights and freedoms. You may object to such processing as described in Section 9.

We use cookies and similar technologies to operate the Site, remember your preferences, measure performance, and—where you consent—support analytics and marketing. You can control non-essential cookies through our cookie banner/preference center and your browser settings. For details, see the Cookie Policy.

We do not sell your personal information. We may share it with:

• Service providers and processors who perform services on our behalf (for example, website hosting, IT and security, analytics, email and CRM, event management, and recruitment platforms), under contractual obligations to protect it and use it only as instructed;
• Professional advisers such as auditors, lawyers, insurers, and accountants;
• Affiliates within the Colvai group, where applicable, for the purposes described in this Policy;
• Authorities, regulators, or other parties where necessary to comply with law, respond to lawful requests, enforce our terms, or protect the rights, safety, and property of Colvai, our clients, or others; and
• Acquirers or successors in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality protections.

Colvai operates internationally, and your information may be transferred to, stored in, or accessed from countries other than your own, including the United States, which may have different data-protection laws. Where we transfer personal information out of the EEA, the United Kingdom, the Gulf, or other regulated jurisdictions, we implement appropriate safeguards required by applicable law, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement/Addendum, transfers to jurisdictions deemed adequate, or other lawful transfer mechanisms. You may request information about these safeguards using the contact details in Section 15.

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, regulatory, or reporting requirements, and to establish, exercise, or defend legal claims. Retention periods vary by context, for example: inquiry and prospect records: e.g., 24–36 months from last contact; recruitment records for unsuccessful candidates: e.g., 6–12 months, or longer with consent; client and supplier relationship records: per contract and applicable limitation periods. When information is no longer needed, we delete or anonymize it.

We maintain administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration, appropriate to the nature of the information and the risks involved. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Depending on where you are located and the applicable law, you may have some or all of the following rights regarding your personal information. We will respond to verified requests as required by applicable law, and we will not discriminate against you for exercising your rights.

1. EEA and United Kingdom (GDPR / UK GDPR). You may have the right to access; to rectify; to erase; to restrict or object to processing (including objecting to direct marketing and to processing based on legitimate interests); to data portability; and to withdraw consent at any time (without affecting prior lawful processing). You also have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office).
2. United States — California and other states. If you are a California resident, you may have the right to know/access, to delete, to correct, and to opt out of the “sale” or “sharing” of personal information and certain targeted advertising, and the right to limit use of sensitive personal information, under the CCPA as amended by the CPRA. Residents of other U.S. states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, and others) may have comparable rights. We do not sell personal information or use it for cross-context behavioral advertising except as disclosed in our cookie settings, if at all. You may also designate an authorized agent to act on your behalf.
3. United Arab Emirates and Kingdom of Saudi Arabia. If you are located in the UAE or KSA, you may have rights under the applicable Personal Data Protection Law — including rights to access, correction, deletion, restriction, objection, and (in certain cases) portability, and to withdraw consent — subject to the conditions and exceptions of those laws.
4. How to exercise your rights. Submit a request using the details in Section 15. We may need to verify your identity before responding. You may exercise these rights free of charge, subject to legal limits on excessive or repetitive requests.

You can opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us at legal@colvai.ai. We may still send you non-promotional messages, such as responses to your inquiries or notices about our relationship with you.

The Site may link to third-party websites and services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. Please review their privacy notices before providing personal information.

The Site is intended for business and professional audiences and is not directed to children. We do not knowingly collect personal information from children through the Site. Where Colvai delivers education-related services that may involve minors’ data, such processing is performed on behalf of, and under agreements with, the relevant institution or client, with appropriate safeguards (see Section 13).

When we provide consulting, delivery, or training services, we may process personal information on behalf of our clients as a processor/service provider. That processing — including any data relating to our clients’ employees, customers, learners, or third parties — is governed by the applicable engagement agreement and data processing agreement, which set out the purposes, security measures, sub-processing terms, and data-subject request handling. This Privacy Policy does not govern that processing. Data subjects with questions about such data should contact the relevant client (controller); we will support our clients in responding as required.

We may update this Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. Where required by law, we will provide additional notice or obtain your consent. Your continued use of the Site after changes take effect constitutes acceptance of the updated Policy.

Data controller: Colvai LLC

Address: 98 Cuttermill Road, Suite 466, Great Neck 11021, NY, USA

Privacy contact / Data Protection contact: legal@colvai.ai

General contact: hq@colvai.ai

EU/EEA representative: eu@colvai.ai

UK representative: uk@colvai.ai