Privacy Policy

This notice describes the website operated under the Heron Operational Excellence trading name in Phoenix, Arizona, United States. Heron is not described here as an incorporated LLC. For privacy inquiries or rights requests, email info@heronopex.com.

For an inquiry, we may receive your name, work email, company, role, selected topic, message, and subsequent correspondence. The web form is not currently active; email is the available contact route. The prepared form will collect those fields when a verified service connection is enabled. Please do not send patient information, personal medical details, or confidential product, process, quality, or transaction information in an initial inquiry.

Available downloads do not require an email address. Sending an inquiry does not subscribe you to marketing. Contact information is needed to reply, but you do not have to provide information merely to read the website.

Hosting and security services may process IP addresses, browser and device information, requested pages, timestamps, and technical logs to deliver the site and prevent abuse. If you accept analytics, Google Analytics may process cookie identifiers, page visits, approximate location, device/browser details, and referral information. Do not put personal or confidential information in page URLs.

We use inquiry information to respond, assess potential engagements, and manage correspondence. Where EU or UK data protection law applies, ordinary business correspondence relies on our legitimate interests in communicating with potential clients; steps requested toward a contract with you personally may rely on the pre-contractual basis. Website delivery and proportionate security rely on our legitimate interests in operating and protecting the service. Processing required by an applicable legal obligation relies on that obligation.

Optional analytics relies on your consent. You can withdraw it through Cookie settings. Withdrawal does not affect processing that was lawful before withdrawal. We do not use contact inquiries for automated decisions producing legal or similarly significant effects.

OpenAI ChatGPT Sites provides the hosting platform, with Cloudflare infrastructure supporting delivery and security. Google Workspace is used for business email. Google Analytics is used only after analytics consent. These providers may process data on our behalf and, for some service/security purposes, under their own terms. We do not sell personal information or use website analytics for advertising personalization.

Formspree is the intended form service, but no live form account or endpoint is connected yet and this site does not currently send inquiries to it. Before enabling it, we will confirm its data terms, spam settings, recipient, and retention configuration and update this notice as needed. We may disclose information when legally required or to protect rights, security, or safety.

Analytics is off by default worldwide, including for EU, UK, and Swiss visitors. Until you choose Accept analytics, the website does not load the Google Analytics tag. Reject analytics leaves it off. Google Consent Mode v2 communicates the consent state when the tag is loaded; advertising storage, advertising user data, and advertising personalization remain denied.

Cookie settings is available in the footer on all pages. You can accept or reject analytics there at any time. Rejecting after acceptance disables analytics and reloads the page. We attempt to remove accessible Google Analytics cookies; you can also remove cookies in your browser. Your choice is stored on your device for up to 180 days. If browser storage is unavailable, choices may not persist.

Google Analytics may use _ga and _ga_* cookies after acceptance; we configure a 180-day cookie lifetime. Cloudflare may set essential security cookies such as __cf_bm, independently of analytics. Cookie duration is distinct from retention in a provider’s systems. Blocking security cookies may affect access.

When no current explicit choice is saved, this site treats an enabled Do Not Track or Global Privacy Control signal as a refusal of optional analytics. You can make a different explicit choice through Cookie settings. We do not use advertising trackers or sell/share information for cross-context behavioral advertising. External websites have their own signal-handling practices.

We retain inquiries that do not become client engagements for 12 months after the last contact, then delete them unless a specific legal obligation or dispute requires longer retention. If an inquiry becomes a client engagement, the relevant contract, legal obligations, and documented business needs determine retention of client records. A privacy request can be made at any time.

The cookie choice expires after 180 days and the configured analytics-cookie lifetime is 180 days. Hosting/security logs and analytics records have separate provider settings. Their account-level retention settings still require confirmation; this notice does not promise a provider deletion period that has not been verified.

Heron operates in the United States. Email, hosting, forms when enabled, and analytics when accepted can involve processing in the United States and other countries where providers operate. Those countries may have different privacy laws.

Where EU, UK, or Swiss law requires a transfer safeguard, an appropriate mechanism must be confirmed for the relevant provider and processing, such as an applicable adequacy decision or approved contractual clauses with necessary additional safeguards. Consent to cookies is not itself a substitute for these requirements. Provider-specific transfer arrangements are still being verified. Contact us before providing information subject to particular transfer or confidentiality requirements.

Subject to applicable conditions and exceptions, you may request access and a copy; correction; erasure; restriction; data portability where applicable; and object to processing based on legitimate interests. You may object to direct marketing at any time. You may withdraw consent and have rights concerning solely automated decisions with legal or similarly significant effects, including applicable rights to human intervention and to contest a decision.

You may complain to your local EU supervisory authority or the UK Information Commissioner’s Office. Swiss visitors may contact the Federal Data Protection and Information Commissioner. You do not have to contact Heron first. To exercise rights with Heron, email info@heronopex.com. We may request proportionate identity verification and will respond within applicable legal deadlines.

We use safeguards intended to protect information, but no internet service is completely secure. External sites and your email provider have their own privacy practices. We will revise the effective date when this notice changes materially.