Confidentiality and Data Security Policy

BARTONFREE ("BARTONFREE", "we", "us", or "our") handles client documents and information as a core part of its work, and we take the confidentiality and security of that information seriously. This Policy explains how we treat confidential information, the safeguards we apply, and the shared responsibilities that keep your data protected. It should be read together with our Privacy Policy.

1. What we treat as confidential

We treat as confidential all non-public information you share with us in connection with an engagement, including your documents, files, business records, folder structures, internal processes, and any information that a reasonable person would understand to be confidential. Confidential information does not include information that is already public through no fault of ours, information you have made public, or information we are required to disclose by law.

2. How we use confidential information

We use confidential information solely to provide the services you have engaged us to perform. We do not use your information for unrelated purposes, and we do not sell, rent, or trade it. Access to your information is limited to those who need it to carry out the work.

3. Organizational safeguards

We apply practical measures to protect confidential information, including limiting access on a need-to-know basis, using unique credentials, and keeping our working tools current. We handle client documents within the platforms you designate wherever possible, so that your information remains within systems you control rather than being unnecessarily duplicated.

4. Technical safeguards

We take reasonable technical steps to protect information in transit and at rest, consistent with the capabilities of the platforms in use. These steps may include the use of secure connections, access controls, and reputable, well-maintained software. Because much of our work occurs within third-party platforms, the technical protections available also depend on the security features those platforms provide.

5. Access and confidentiality within our team

Anyone working on our behalf is required to maintain the confidentiality of your information and to use it only for the purposes of your engagement. These confidentiality obligations continue even after a particular engagement or working relationship ends.

6. Third-party platforms and service providers

Where we rely on third-party platforms and service providers, we choose reputable providers and use them in a manner consistent with this Policy. However, those providers maintain their own security practices, which we do not control. We encourage you to understand and configure the security settings of the platforms where your documents are stored.

7. Your responsibilities

Data security is a shared responsibility. You are responsible for managing who has access to your systems, for granting and revoking access appropriately, for using strong credentials, and for maintaining independent backups of your documents. Promptly informing us of any change in the people authorized to work with your files helps us keep your information secure.

8. Incident response

If we become aware of a security incident that affects your confidential information and is within our area of responsibility, we will take reasonable steps to investigate and address it, and we will notify you where appropriate and as required by applicable law. Prompt cooperation between us in such a situation helps limit any impact.

9. Retention and deletion

We keep confidential information only as long as necessary to provide the services and to meet our legal and business obligations. When information is no longer needed, we take reasonable steps to delete or return it. Our approach to retention and deletion is described more fully in our Document Retention and Deletion Policy.

10. Limits of our safeguards

While we apply reasonable safeguards, no system of security is perfect, and we cannot guarantee absolute protection against every possible threat. This Policy describes our commitments and practices, but it does not create a warranty of complete security. Our overall liability is governed by our Terms and Conditions and Service Agreement.

11. Changes to this Policy

We may update this Confidentiality and Data Security Policy from time to time. Changes will be reflected by the "Last updated" date above. We encourage you to review this Policy periodically.