Privacy policy.

1. Controller

XVI Group LLC, trading as Approved Consulting, is the controller of personal data collected through this website. Its registered address is 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States, stated here because data protection law requires a controller to be identifiable. Contact: contact@approved.consulting.

2. What we collect

We collect only what you send us. Through the contact form: your name, role, email address, telephone or messaging handle, company name, industry, indicative monthly volume, processing status, target markets and the description you choose to provide. Through correspondence: whatever you include in it.

We do not use advertising cookies, analytics cookies or tracking pixels on this site. No cookie is set by us for the purpose of profiling or advertising.

3. Why we use it

• To assess whether we can act on your enquiry and to reply to it.
• To carry out a conflict check before any introduction.
• To perform an engagement once an engagement letter is signed.
• To comply with legal, regulatory and record-keeping obligations.

Our legal bases are your consent when you submit the form, our legitimate interest in responding to business enquiries, the performance of a contract once engaged, and compliance with legal obligations.

4. Who sees it

Enquiry data is delivered to the firm through Cloudflare Workers and stored in Telegram and Airtable, which act as processors on our behalf. Where a mandate proceeds, and only with your knowledge, relevant information is shared with the acquirers, providers or institutions we approach on your behalf. We do not sell personal data, and we do not share it for advertising purposes.

5. International transfers

Our processors operate infrastructure in the United States and other jurisdictions. Where data originating in the European Economic Area or the United Kingdom is transferred, it is done under appropriate safeguards, including standard contractual clauses where applicable.

6. How long we keep it

Enquiries that do not lead to an engagement are retained for up to twenty-four months and then deleted. Records relating to an engagement are retained for the period required by applicable law and professional record-keeping obligations, and deleted afterwards.

7. Your rights

Depending on your jurisdiction you may have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time. Write to us at the address above and we will respond within one month. You may also complain to your local supervisory authority.

8. Security

The site is served over HTTPS with strict transport security. The contact form is protected by Cloudflare Turnstile and by server-side validation. Access to enquiry records is limited to the people at the firm who need it.

9. Children

This site is directed at businesses. We do not knowingly collect personal data from anyone under eighteen.

10. Changes

We may update this policy. The date above indicates when the current version took effect.