Privacy Policy

This policy explains what personal information we collect through ecomecho.us, why we collect it, how long we keep it and what you can ask us to do with it. We have tried to write it in plain English. If anything is unclear, email us and we will explain it.

1. Who we are

EcomEcho LLC
447 Broadway, 2nd Floor
New York, NY 10013, United States
info@ecomecho.us

We decide why and how the personal information described below is used. Under the EU and UK General Data Protection Regulation that makes us the data controller.

2. Who this policy is for

It covers anyone who visits this website, wherever they are. We work with brands in the United States and in Europe, so this policy is written to meet the GDPR for visitors in the European Economic Area and the United Kingdom, and the CCPA/CPRA for residents of California. If you are somewhere else, the same practices apply to you.

3. What we collect

Information you give us

If you fill in the contact form, we receive the full name, email address, website, the type of help you are looking for, and whatever you write in the message field. If you email us directly we receive your email address and the content of your message.

Only you decide what goes in the message field. Please do not send us special categories of data — health, political opinions, and so on. We do not need them and we do not want them.

Information collected automatically

• Server logs. Our hosting provider records the IP address, browser, operating system, pages requested and the date and time of each request. This happens for every website and is needed to serve pages and to spot attacks.
• Cookies and similar technologies. Described in full in our Cookie Policy. Nothing other than strictly necessary cookies is set unless you agree to it first.

4. Why we use it, and on what legal basis

Under the GDPR we must have a lawful reason for each use. These are ours:

• To answer you. When you contact us we use your details to reply and to discuss working together. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b)).
• To keep the site running and secure. Server logs, protection against abuse and attacks. Legal basis: our legitimate interest in keeping the site available and safe (Article 6(1)(f)).
• To understand how the site is used. Analytics, so we know which pages people actually read. Legal basis: your consent (Article 6(1)(a)). No analytics runs before you give it, and you can withdraw it at any time.
• To show our ads to people who have visited us. Advertising and measurement tools. Legal basis: your consent (Article 6(1)(a)), withdrawable at any time.
• To meet legal and accounting obligations. Where the law requires us to keep records. Legal basis: compliance with a legal obligation (Article 6(1)(c)).

We do not make automated decisions that produce legal effects about you, and we do not profile you to decide whether to work with you.

5. How long we keep it

• Contact form messages and emails: 24 months from our last exchange with you. After that they are deleted. If we start working together, the information becomes part of the client relationship and is kept for as long as the law requires us to keep business records.
• Server logs: for the period set by our hosting provider, normally a few weeks, then overwritten.
• Cookies: each one has its own lifetime, listed in the Cookie Policy. Your consent choice is remembered for 6 months, after which we ask again.

6. Who else sees it

We do not sell your personal information, and we never will. We share it only with the suppliers we need to run the business:

• Our web hosting provider, which stores the site and the messages sent through the form.
• Google Ireland Ltd / Google LLC, for website analytics — only with your consent.
• Meta Platforms Ireland Ltd / Meta Platforms Inc., for advertising and measurement — only with your consent.
• Our email provider, which carries the messages you send us.
• Professional advisers and authorities, where we are legally required to disclose something.

Each of these acts on our instructions under a written agreement, or as an independent controller for their own part of the processing, as is the case with Google and Meta for the cookies you consent to.

7. Information leaving Europe

EcomEcho LLC is a United States company, so if you contact us from the European Economic Area or the United Kingdom your information is handled in the United States. The same is true of Google and Meta.

The United States does not have an adequacy decision that covers every company. Where a recipient is certified under the EU–U.S. Data Privacy Framework — Google and Meta both are — transfers rely on that certification. Otherwise we rely on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards in place by emailing info@ecomecho.us.

8. Your rights

If the GDPR applies to you, you have the right to:

• Access the personal information we hold about you, and get a copy of it.
• Correct anything inaccurate or incomplete.
• Erase it, where there is no good reason for us to keep it.
• Restrict how we use it while a question about it is resolved.
• Object to uses based on our legitimate interest.
• Receive it in a portable format and have it sent to someone else.
• Withdraw consent at any time, for anything based on consent. Withdrawing it does not undo what was done while it was valid.

Write to info@ecomecho.us and we will reply within one month. We do not charge for this. If you think we have handled your information badly, please tell us first so we can fix it — but you are entitled to complain directly to the data protection authority of the country where you live.

9. If you live in California

Under the CCPA as amended by the CPRA you may ask us what categories of personal information we have collected about you, where it came from, why we collected it and who we shared it with; ask for a copy; ask us to delete it; and ask us to correct it. You may not be treated differently for exercising any of these rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are defined by California law — except to the extent that the advertising cookies described in the Cookie Policy are considered "sharing", which only ever happens if you opt in through the cookie banner. You can switch that off at any time using the cookie settings link in the footer.

10. How we protect it

The site is served over HTTPS. Access to the messages you send us is limited to the people at EcomEcho who need to read them. No system is perfectly secure, so we cannot promise absolute safety, but if a breach ever puts your rights at serious risk we will tell you and the relevant authority within the deadlines the law sets.

11. Children

This site is aimed at businesses. We do not knowingly collect information from anyone under 16. If you believe a child has sent us personal information, email us and we will delete it.

12. Changes to this policy

If we change how we handle personal information we will update this page and change the date at the top. If the change is significant we will say so clearly rather than hoping you notice.

13. Contact

Questions, requests or complaints about this policy:
info@ecomecho.us
EcomEcho LLC, 447 Broadway, 2nd Floor, New York, NY 10013, United States