Legal

Privacy Policy

Effective date: 4/15/2026 Last updated: 4/15/2026

1. Introduction and Scope

This Privacy Policy (“Policy”) describes how WRmachine, LLC, doing business as SureDispose (“SureDispose,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects your information when you access or use the website located at suredispose.com and any associated subdomains, affiliated websites, tools, content, and services operated by SureDispose (collectively, the “Service”).

This Policy applies to all visitors, users, and others who access the Service, whether or not they complete our interactive ITAD Readiness Assessment Tool (“Assessment Tool”) or provide personally identifiable information (“PII”). This Policy also describes our practices with respect to contact and audience data that we acquire from third-party data providers for marketing purposes, as described in Section 3.4. This Policy should be read together with our Terms of Service (available at suredispose.com/terms) and our Cookie Policy (available at suredispose.com/cookies).

By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with our data practices as described herein, you must not access or use the Service.

2. Business Model and Compensation Disclosure

IMPORTANT: HOW SUREDISPOSE GENERATES REVENUE. SureDispose is an independent advisory platform that generates revenue by selling Qualified Referral introductions to third-party IT asset disposition (“ITAD”) service providers (“Providers”). Providers compensate SureDispose for these introductions. The Service is free to users.

This referral compensation model means that certain personal information you provide may be shared with Providers as part of a Qualified Referral, but only with your explicit, affirmative consent as described in Section 5.3 of this Policy. For residents of California and other states with applicable privacy laws, this sharing may constitute a “sale” of personal information as defined under those laws. Your rights regarding such sale, including the right to opt out, are described in Section 9.

SureDispose also engages in certain advertising and audience-related activities that may constitute a “sale” or “sharing” of personal information under applicable state privacy laws, including the operation of advertising pixels on the Service and the use of acquired contact data for marketing audiences on third-party advertising platforms. These activities are described in Sections 3.4, 5.8, and 6, and are subject to your opt-out rights under Section 9.

SureDispose does not offer financial incentives (such as price differences, discounts, or premium features) for the collection, sale, or retention of personal information. The Service is provided at no cost to all users regardless of whether they consent to data sharing with Providers or to advertising-related uses of their data.

3. Information We Collect

3.1 Information You Provide Directly

Assessment Tool Responses. If you use the Assessment Tool, we collect the organizational and operational information you provide, including:

Industry classification and vertical (e.g., healthcare, financial services, government, education)
Regulatory environment and compliance requirements
Data sensitivity levels and classification
Equipment types, quantities, and inventory information
Geographic locations and facility information
Disposition timeline and urgency
Current ITAD practices and vendor relationships
Organizational size and structure

We collect each of these data elements because they are reasonably necessary to generate an accurate readiness score, produce compliance gap analysis, and match you with Providers whose certifications and capabilities align with your identified needs. We do not collect assessment data beyond what is required to deliver this core service.

Contact Information. At the point in the Assessment Tool where personalized results and Provider recommendations are generated, you may voluntarily provide contact information, including:

Full name
Job title and role
Organization name
Email address
Phone number

Providing contact information is voluntary but required to receive personalized results, Provider recommendations, and Qualified Referral services.

Other Communications. If you contact us directly (for example, via email, through a contact form, or in connection with a support inquiry), we collect the information you provide in those communications.

3.2 Information Collected Automatically

When you access or use the Service, we automatically collect certain information, including:

Device and Browser Information: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
Usage Data: Pages viewed, links clicked, time spent on pages, referring URL, and navigation paths within the Service.
Assessment Session Data: We assign a unique anonymous session identifier (a UUID stored in a cookie) to maintain your progress through the Assessment Tool across pages and visits. This identifier does not contain personally identifiable information unless and until you voluntarily provide contact information at the contact-capture stage of the Assessment Tool. During the anonymous stage, session data is stored locally on our servers and is not transmitted to our CRM platform or to any Provider.
Advertising and Analytics Data: Through advertising and analytics technologies deployed on the Service (such as Google Analytics, Google Ads conversion and remarketing tags, and the Meta Pixel), we and our advertising platform providers collect information about your visit and use that information to measure advertising effectiveness, attribute conversions, show you advertisements on other websites and apps (remarketing), and build marketing audiences. This activity constitutes “sharing” under CCPA/CPRA and may constitute a “sale” under certain state privacy laws. See Section 6 and our Cookie Policy for details.
Cookies and Similar Technologies: We use cookies, web beacons, pixels, tags, and similar tracking technologies as described in Section 6 and in our Cookie Policy (available at suredispose.com/cookies).

3.3 Sources of Information

We collect personal information from the following sources:

Directly from you: Information you provide through the Assessment Tool, contact forms, and communications with us.
Automatically from your device: Technical and usage information collected through cookies and similar technologies when you access the Service.
From third-party data providers: Contact and audience data acquired from third-party data providers for marketing purposes, as described in Section 3.4.
From advertising platforms: Information about advertising engagement (such as ad impressions, clicks, and conversions) from the advertising platforms where we run marketing campaigns.

3.4 Information Acquired from Third-Party Data Providers

SureDispose acquires contact and audience data from one or more third-party data providers for marketing purposes. We do not identify our specific data provider(s) in this Policy in order to protect information that SureDispose considers confidential and commercially sensitive, but we disclose the following information about this practice:

Categories of providers. The providers from whom we acquire data are third-party data providers and aggregators that maintain proprietary databases of business and consumer contact information.

Categories of data acquired. The data we acquire may include:

Identifiers (name, business email address, business phone number, business mailing address)
Professional or employment information (job title, seniority, department, employer name and domain, company size)
Industry classification (SIC and NAICS codes, company description)
Inferred interest or intent signals related to IT asset disposition and related services

How the provider collects the data. Based on the provider’s disclosures to us, the data we acquire is derived from sources that include: (a) co-registration networks, where individuals voluntarily submitted their contact information through partner website forms and consented to their information being shared; (b) publicly available sources, such as public business directories, company websites, and public business listings; and (c) verified offline records, such as property files, census data, and other official records used to corroborate and correct the online data. We rely on the provider’s representations that the data was lawfully collected with appropriate notice and consent.

How we use the acquired data. We use acquired data for the following purposes:

Building marketing audiences on third-party advertising platforms (such as Google Ads Customer Match and Meta Custom Audiences) using hashed identifiers
Creating “lookalike” or “similar” audiences for prospecting campaigns
Sending email marketing communications to business contacts who have not opted out, subject to applicable law
Identifying organizations that may benefit from the Service for account-based marketing

How we do not use the acquired data. We do not use acquired data to:

Populate Assessment Tool results, generate readiness scores, or produce Qualified Referrals
Make automated telephone calls or send automated text messages (we do not rely on co-registration consent as sufficient consent for automated calls or texts under the Telephone Consumer Protection Act)
Combine with sensitive personal information or with special categories of data

Your rights regarding acquired data. Acquired data is personal information subject to this Policy and to the state privacy rights described in Section 9. You may exercise your rights to access, delete, correct, or opt out of the sale or sharing of acquired data by contacting us as described in Section 14.

Provider identification upon request. SureDispose treats the identity of its data provider(s) as confidential commercial information. We will not name our data provider(s) in response to general inquiries. We will disclose the identity of our data provider(s) to the extent required by a valid legal process (such as a subpoena, civil investigative demand, court order, or similar compulsory process) issued by a court of competent jurisdiction or an authorized government authority, and in response to formal regulatory investigation or audit. Nothing in this paragraph limits SureDispose’s disclosure obligations under applicable law.

3.5 Information We Do Not Collect

The Assessment Tool is designed to collect organizational operational information about your ITAD needs. We do not collect, and you are prohibited from entering:

Protected health information (“PHI”) as defined by the Health Insurance Portability and Accountability Act (“HIPAA”)
Student education records as defined by the Family Educational Rights and Privacy Act (“FERPA”)
Social Security numbers, financial account numbers, or payment card data
Any other categories of specially regulated personal data

If you inadvertently enter any of the above categories of data, please contact us immediately at [email protected] so we can delete it.

4. How We Use Your Information

4.1 Service Delivery

To generate a personalized ITAD readiness score and compliance gap analysis based on your Assessment Tool responses
To match you with Providers whose certifications, geographic coverage, and vertical expertise align with your identified needs
To produce Qualified Referrals for Providers, which may include assessment responses and your contact information, subject to your consent as described in Section 5.3
To communicate with you regarding your assessment results and matched Provider information

4.2 Service Improvement

To analyze usage patterns, Assessment Tool completion rates, and content engagement to improve the Service
To improve Assessment Tool accuracy, scoring methodology, and content relevance
To develop new features, tools, and content

4.3 Marketing and Advertising

To measure the effectiveness of our advertising campaigns on third-party advertising platforms
To attribute Service conversions to specific advertising campaigns
To show advertisements for the Service on other websites and apps (remarketing)
To build marketing audiences on third-party advertising platforms (including Customer Match, Custom Audiences, and lookalike or similar audiences) using data described in Section 3.2 and acquired data described in Section 3.4
To send marketing communications about the Service to business contacts, subject to applicable law and to your opt-out rights described in Section 12

4.4 Communications

To respond to your inquiries and support requests
To send you service-related notices, including updates to these policies
To send you marketing communications, where permitted by applicable law and subject to your opt-out rights (see Section 12)

4.5 Legal and Compliance

To comply with applicable laws, regulations, legal processes, and governmental requests
To enforce our Terms of Service and protect our rights, privacy, safety, or property, and that of our users and the public
To detect, prevent, and address fraud, security issues, or technical problems

4.6 Aggregate and De-Identified Data

We may create aggregate or de-identified data from the information we collect. When we de-identify data, we: (a) implement technical safeguards that prohibit re-identification; (b) implement business processes that specifically prohibit re-identification; (c) implement business processes to prevent inadvertent release of de-identified data; and (d) make no attempt to re-identify the data. Aggregate and de-identified data that meets these standards is not personal information and may be used for any lawful purpose, including industry research, benchmarking, and content development.

5. How We Share Your Information

5.1 Third-Party Service Providers

We share information with third-party service providers who perform services on our behalf, including:

Customer Relationship Management (CRM): We use a third-party CRM platform to manage user contact information and referral pipeline activity.
Website Hosting and Infrastructure: We use third-party hosting providers to operate and maintain the Service.
Analytics: We use third-party analytics services to understand how users interact with the Service.
Email and Communications: We use third-party email service providers to send transactional and, where permitted, marketing communications.

These service providers are contractually obligated to use your information only for the purposes of providing services to us and in accordance with this Policy. We do not authorize them to use or disclose your information for their own purposes.

5.2 Assessment Tool — Anonymous Stage

During the initial stages of the Assessment Tool, before you provide contact information, your assessment responses are stored in association with an anonymous session identifier on our servers. During this anonymous stage, no personally identifiable information is shared with any third party, transmitted to our CRM platform, or transmitted to any Provider.

We share your personal information with Providers only after obtaining your explicit, affirmative consent. Before any data is transmitted to a Provider, SureDispose will:

Clearly identify which data elements will be shared
Clearly identify which Provider(s) or categories of Providers will receive the data
Obtain your affirmative consent through a clear action (such as clicking “Share My Results” or a substantially similar mechanism)
Provide you with the option to decline data sharing while retaining access to your assessment results

We do not use pre-checked boxes, passive acceptance, or bundled consent. Your consent to data sharing with Providers is always a separate, affirmative action.

Once your data has been shared with a Provider pursuant to your consent, that data becomes subject to the Provider’s own privacy policy and data practices. SureDispose cannot control and is not responsible for a Provider’s use, retention, or disclosure of your data after it has been shared.

You may revoke your consent to Provider data sharing at any time by contacting us at [email protected]. Upon receiving your revocation, we will cease sharing your personal information with Providers going forward. SureDispose cannot recall data that has already been transmitted to a Provider prior to your revocation; such data is subject to the Provider’s own privacy policies. After you revoke consent, SureDispose will not request that you re-authorize data sharing for at least twelve (12) months.

5.5 Legal Requirements and Protection of Rights

We may disclose your information if we believe in good faith that disclosure is necessary to:

Comply with applicable law, regulation, legal process, or governmental request
Enforce our Terms of Service or other agreements
Protect the rights, property, or safety of SureDispose, our users, or the public
Detect, prevent, or address fraud, security, or technical issues

5.6 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, asset sale, or similar transaction, your information may be transferred as part of the transaction. We will provide notice before your personal information becomes subject to a different privacy policy.

We may share your information in other ways not described above if you provide us with your specific consent to do so.

5.8 Advertising Platforms and Cross-Context Behavioral Advertising

We disclose certain personal information to third-party advertising platforms (including Google LLC, Meta Platforms, Inc., and, where enabled, LinkedIn Corporation) for the purposes described in Section 4.3, including conversion measurement, remarketing, and the building of marketing audiences. This disclosure occurs through two mechanisms:

On-site advertising technologies: The Google Ads conversion and remarketing tags and the Meta Pixel, deployed on the Service, transmit information about your visit (including IP address, device identifiers, pages viewed, and actions taken) to the applicable advertising platform. These technologies are subject to your consent through the cookie consent mechanism described in our Cookie Policy.
Uploaded marketing audiences: We may upload hashed contact identifiers (such as SHA-256 hashed email addresses and phone numbers) derived from data we have collected directly from you or acquired from third-party data providers (as described in Section 3.4) to third-party advertising platforms to build Customer Match, Custom Audiences, and similar-audience lists.

Under CCPA/CPRA and other state privacy laws, these activities constitute “sharing” of personal information for cross-context behavioral advertising and, under certain state laws, may constitute a “sale” of personal information. You have the right to opt out of these activities as described in Section 9, through our cookie preference center, by visiting suredispose.com/do-not-sell, or by transmitting a Global Privacy Control signal.

6. Cookies and Tracking Technologies

The Service uses cookies, pixels, tags, and similar tracking technologies for strictly necessary, functional, analytical, and marketing purposes. Our Cookie Policy (available at suredispose.com/cookies) provides detailed information about the specific technologies deployed on the Service, their providers, their purposes, retention periods, and how to manage, disable, or delete them.

We use a session identifier cookie to maintain your progress through the Assessment Tool. This cookie stores a universally unique identifier (UUID) that is assigned anonymously when you begin the assessment. The cookie does not contain your name, email address, or any other personally identifiable information. It is classified as strictly necessary for the functionality of the Assessment Tool and does not require separate consent under applicable cookie consent laws.

Where required by applicable law, we will obtain your consent before placing non-essential cookies (functional, analytical, and marketing cookies) on your device. The cookie consent banner presents “Accept All” and “Reject All” options with equal prominence, and a “Manage Preferences” option that opens a granular preference center. You may manage your cookie preferences at any time through the cookie preference center accessible from the “Cookie Settings” link in the footer of every page of the Service.

6.3 California Visitors — Affirmative Opt-In for Marketing Technologies

For visitors we identify as likely located in California, Marketing / Advertising Tracking Technologies are not activated until you affirmatively opt in through the cookie consent mechanism, as described in our Cookie Policy. If you transmit a Global Privacy Control signal, we will treat that signal as a valid and continuing opt-out of the sale and sharing of your personal information.

7. Categories of Personal Information Collected, Disclosed, and Sold or Shared

The following table summarizes the categories of personal information we have collected, disclosed for a business purpose, and sold or shared in the preceding twelve (12) months. Under certain state privacy laws, the transmission of personal information to Providers as part of Qualified Referrals (for which SureDispose receives compensation) and the disclosure of personal information to advertising platforms in connection with cross-context behavioral advertising may constitute a “sale” or “sharing” of personal information.

Category	Collected	Disclosed for Business Purpose	Sold / Shared
Identifiers (name, email, phone, IP, UUID, device identifiers)	Yes	Yes — service providers	Yes — Providers (with consent); Yes — advertising platforms (sharing for cross-context behavioral advertising)
Commercial Information (assessment responses, ITAD needs, equipment)	Yes	Yes — service providers	Yes — Providers (with consent)
Internet / Network Activity (browsing, pages viewed, tool interactions, advertising engagement)	Yes	Yes — analytics and advertising providers	Yes — advertising platforms (sharing for cross-context behavioral advertising)
Professional / Employment Information (title, org name, industry)	Yes (directly and from third-party data providers)	Yes — service providers	Yes — Providers (with consent); Yes — advertising platforms (for audience building)
Geolocation (approximate, from IP)	Yes	Yes — analytics and advertising providers	No
Inferences (readiness scores, gap analysis, Provider matching, audience affinity)	Yes	Yes — service providers	Yes — Providers (with consent)

We do not sell or share the personal information of consumers we know to be under the age of 16.

8. Data Retention

8.1 Retention Criteria

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, as described in this Policy, or as required by applicable law. We do not retain personal information longer than is reasonably necessary for its collected purpose.

When determining how long to retain specific categories of personal information, we consider the following criteria:

The nature and sensitivity of the data
The purposes for which the data was collected and whether those purposes can be achieved through other means
Applicable legal, regulatory, tax, accounting, and contractual obligations that may require retention for a specific period
The legitimate interests of SureDispose, including maintaining records of referral activity for operational and dispute resolution purposes
The potential risk of harm from unauthorized use or disclosure
Whether the data has been de-identified or aggregated such that it no longer constitutes personal information

Anonymous Session Data. Assessment Tool session data stored in association with an anonymous session identifier (without contact information) is retained for a limited period following the last session activity, after which it is automatically deleted.

Contact Information and Assessment Results. If you provide contact information through the Assessment Tool, your contact information and associated assessment results are retained for the duration of the user relationship and a reasonable period thereafter to fulfill the purposes described in this Policy.

Acquired Marketing Data. Contact and audience data acquired from third-party data providers (as described in Section 3.4) is retained for no longer than is reasonably necessary for the marketing purposes described in Section 4.3, and is refreshed, suppressed, or deleted in accordance with our data hygiene practices and applicable opt-out and deletion requests.

Referral and Transaction Records. Records of Qualified Referrals transmitted to Providers are retained for the period necessary to administer referral activities and satisfy applicable legal and contractual obligations.

Communications. Records of your communications with SureDispose (e.g., support inquiries, privacy rights requests, dispute notices) are retained for the period necessary to resolve the matter and satisfy applicable legal obligations.

Aggregate and De-Identified Data. Data that has been properly de-identified or aggregated in accordance with the standards described in Section 4.6 is no longer personal information and may be retained indefinitely.

8.2 Deletion

You may request deletion of your personal information by contacting us at [email protected]. Upon receiving a verified deletion request, SureDispose will delete your personal information within the timeframe required by applicable law, except to the extent that retention is permitted by a recognized exception (such as completing a transaction you requested, detecting security incidents, exercising free speech rights, complying with a legal obligation, or conducting internal uses reasonably aligned with your expectations).

SureDispose cannot compel deletion of data that has already been shared with a Provider pursuant to your consent. Upon request, we will inform you which Provider(s) received your data so that you may contact them directly regarding deletion.

8.3 Regular Review

We regularly review our data holdings and delete or de-identify personal information that is no longer necessary for the purposes for which it was collected.

9. Your Privacy Rights

9.1 Summary of Rights

Depending on your state of residence, you may have one or more of the following rights regarding your personal information:

Right to Know / Access: The right to know what personal information we have collected about you, including information acquired from third-party data providers, and to request a copy of that information.
Right to Delete: The right to request deletion of your personal information, subject to certain exceptions.
Right to Correct: The right to request correction of inaccurate personal information.
Right to Opt Out of Sale or Sharing: The right to opt out of the “sale” or “sharing” of your personal information, as those terms are defined under applicable state law.
Right to Opt Out of Targeted Advertising: The right to opt out of the processing of your personal information for targeted advertising or cross-context behavioral advertising purposes.
Right to Opt Out of Profiling: The right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.
Right to Data Portability: The right to receive your personal information in a portable, readily usable format.
Right to Non-Discrimination: The right not to be discriminated against for exercising your privacy rights.
Right to Appeal: If we deny your privacy request, you may have the right to appeal that decision.

9.2 California Residents (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code §§ 1798.100–1798.199.100).

Sale and Sharing Disclosure. SureDispose engages in activities that constitute a “sale” and “sharing” of personal information under CCPA/CPRA, including (a) the transmission of personal information to Providers as part of Qualified Referrals for which SureDispose receives monetary compensation, and (b) the disclosure of personal information to third-party advertising platforms for cross-context behavioral advertising purposes (including through the Google Ads conversion and remarketing tags, the Meta Pixel, and the upload of hashed marketing audiences).

Right to Opt Out. You may opt out of the sale and sharing of your personal information at any time. To exercise this right:

Visit our “Do Not Sell or Share My Personal Information” page at suredispose.com/do-not-sell
Click the “Do Not Sell or Share My Personal Information” link in the footer of every page of the Service
Transmit a Global Privacy Control signal through your browser
Submit a request by emailing [email protected] with the subject line “Opt Out of Sale”

Global Privacy Control (GPC). SureDispose honors Global Privacy Control signals. If your browser transmits a GPC signal, we will treat it as a valid opt-out request for the sale and sharing of personal information associated with that browser. When a GPC signal is detected, Marketing / Advertising Tracking Technologies will not be activated for that browser session, and data collected through any previously activated Marketing / Advertising Tracking Technology will not be transmitted to third-party advertising platforms. If you have previously consented to data sharing and your browser subsequently transmits a GPC signal, we will honor the GPC signal as a revocation of consent for future data sharing. If you later wish to re-authorize data sharing, you may do so through a separate, affirmative consent action.

Cross-Device and Cross-Context Opt-Out. When we receive a verified opt-out request, we propagate the opt-out across all identifiers we reasonably associate with you, to the extent technically feasible, including identifiers we may use to recognize you across devices or sessions.

Authorized Agents. You may designate an authorized agent to submit privacy requests on your behalf. Authorized agents must provide proof of authorization (such as a signed written authorization or a power of attorney). We may verify your identity directly even when an authorized agent submits a request.

Financial Incentives. SureDispose does not offer financial incentives for the collection, sale, or retention of personal information.

9.3 Minnesota Residents (MCDPA)

If you are a Minnesota resident, you have rights under the Minnesota Consumer Data Privacy Act (Minn. Stat. §§ 325M.10–325M.21), including the rights to access, correct, delete, and obtain a portable copy of your personal data. You also have the right to opt out of the sale of your personal data, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects. Minnesota requires that we honor universal opt-out mechanisms, including GPC signals. To exercise your rights, contact us using the information in Section 14. You may appeal a denial of your request.

9.4 Virginia Residents (VCDPA)

If you are a Virginia resident, you have rights under the Virginia Consumer Data Protection Act (Va. Code §§ 59.1-575–59.1-585), including the rights to access, correct, delete, and obtain a portable copy of your personal data. You also have the right to opt out of the sale of personal data, targeted advertising, and profiling. To exercise your rights, contact us using the information in Section 14. You may appeal a denial of your request by contacting us at [email protected].

9.5 Colorado Residents (CPA)

If you are a Colorado resident, you have rights under the Colorado Privacy Act (C.R.S. §§ 6-1-1301–6-1-1313), including the rights to access, correct, delete, and obtain a portable copy of your personal data. You also have the right to opt out of the sale of personal data, targeted advertising, and profiling. Colorado requires that we honor universal opt-out mechanisms, including GPC signals. To exercise your rights, contact us using the information in Section 14.

9.6 Connecticut Residents (CTDPA)

If you are a Connecticut resident, you have rights under the Connecticut Data Privacy Act (Conn. Gen. Stat. §§ 42-515–42-526), including the rights to access, correct, delete, and obtain a portable copy of your personal data. You also have the right to opt out of the sale of personal data, targeted advertising, and profiling. Connecticut requires that we honor universal opt-out mechanisms. To exercise your rights, contact us using the information in Section 14. You may appeal a denial of your request.

9.7 Texas Residents (TDPSA)

If you are a Texas resident, you have rights under the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code §§ 541.001–541.205), including the rights to access, correct, delete, and obtain a portable copy of your personal data. You also have the right to opt out of the sale of personal data, targeted advertising, and profiling. Texas requires that we honor universal opt-out mechanisms. To exercise your rights, contact us using the information in Section 14.

9.8 Oregon Residents (OCPA)

If you are an Oregon resident, you have rights under the Oregon Consumer Privacy Act, including the rights to access, correct, delete, and obtain a portable copy of your personal data, as well as opt-out rights for sale, targeted advertising, and profiling. Oregon also grants the right to obtain a list of specific third parties to whom the controller has disclosed personal data; SureDispose will respond to such requests in accordance with the statute. Oregon requires recognition of universal opt-out mechanisms. To exercise your rights, contact us using the information in Section 14.

9.9 Montana Residents (MCDPA)

If you are a Montana resident, you have rights under the Montana Consumer Data Privacy Act, including the rights to access, correct, delete, and obtain a portable copy of your personal data, as well as opt-out rights for sale, targeted advertising, and profiling. Montana requires recognition of universal opt-out mechanisms. To exercise your rights, contact us using the information in Section 14.

9.10 Delaware Residents (DPDPA)

If you are a Delaware resident, you have rights under the Delaware Personal Data Privacy Act, including the rights to access, correct, delete, and obtain a portable copy of your personal data, as well as opt-out rights for sale, targeted advertising, and profiling. Delaware requires recognition of universal opt-out mechanisms. To exercise your rights, contact us using the information in Section 14.

9.11 Maryland Residents (MODPA)

If you are a Maryland resident, you have rights under the Maryland Online Data Privacy Act (Md. Code Com. Law §§ 14-4701–14-4725), including the rights to access, correct, delete, and obtain a portable copy of your personal data. Maryland requires recognition of universal opt-out mechanisms. Maryland law imposes a strict data minimization standard requiring that data collection be reasonably necessary and proportionate to providing the specific service requested by the consumer. For Maryland visitors, SureDispose limits collection through Tracking Technologies to what is reasonably necessary to provide the Service and does not deploy Marketing / Advertising Tracking Technologies to the extent such deployment would exceed the data minimization standard. Maryland law prohibits the sale of sensitive data under any circumstances; SureDispose does not collect or sell sensitive data categories as defined by Maryland law. To exercise your rights, contact us using the information in Section 14.

9.12 Additional States

Residents of New Hampshire, New Jersey, Nebraska, Iowa, Indiana, Tennessee, Kentucky, Rhode Island, and any other state with a comprehensive consumer data privacy law in effect are entitled to the rights provided by their respective state laws. These generally include the rights to access, correct, delete, and obtain portable copies of personal data, as well as opt-out rights for sale of personal data. To exercise your rights under any applicable state law, contact us using the information in Section 14.

As additional state privacy laws take effect, SureDispose will comply with all applicable requirements and will update this Policy accordingly.

9.13 How to Exercise Your Rights

To exercise any of the privacy rights described in this Section, you may:

Email us at [email protected] with the subject line “Privacy Rights Request”
Visit suredispose.com/do-not-sell to opt out of sale and sharing
Transmit a Global Privacy Control signal through your browser (treated as an opt-out of sale and sharing)

Verification. We will verify your identity before fulfilling your request. Verification methods may include confirming information you previously provided to us, such as your email address and details from your assessment. If we cannot verify your identity to a reasonable degree of certainty, we may request additional information. We will not collect more personal information than necessary to verify your request.

Response Timing. We will respond to verified requests within the timeframe required by applicable law (generally forty-five (45) days from receipt, with extensions as permitted by applicable law). We will inform you if an extension is needed and the reason for the extension.

Appeal Process. If we deny your privacy request in whole or in part, we will explain the basis for the denial and inform you of your right to appeal. To appeal a denial, contact us at [email protected] with the subject line “Privacy Rights Appeal.” We will respond to appeals within the timeframe required by applicable law. If we deny your appeal, we will provide you with instructions for contacting your state’s attorney general or other applicable regulatory authority.

Non-Discrimination. We will not discriminate against you for exercising your privacy rights. We will not deny you goods or services, charge you different prices, provide a different level or quality of service, or suggest that you will receive a different level of service for exercising your rights.

10. Sensitive Data

We do not intentionally collect sensitive personal information as defined under applicable state privacy laws (including but not limited to racial or ethnic origin, religious beliefs, mental or physical health diagnoses, sexual orientation, citizenship or immigration status, genetic or biometric data, precise geolocation, or personal information collected from a known child). To the extent that any assessment response could be construed as sensitive data under any applicable law, we process such data only as reasonably necessary to provide the referral service you have requested and with your consent.

11. Data Security

SureDispose implements commercially reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, alteration, or destruction. These measures include:

Encryption of data in transit using industry-standard TLS/SSL protocols
Hashing (SHA-256 or equivalent) of identifiers transmitted to third-party advertising platforms for audience-matching purposes, as required by those platforms
Access controls limiting personnel access to personal information on a need-to-know basis
Regular review of data collection, storage, and processing practices
Contractual data protection obligations imposed on third-party service providers

No method of transmission over the Internet or method of electronic storage is completely secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security.

11.1 Data Breach Notification

In the event of a data breach affecting your personal information, SureDispose will comply with all applicable federal and state data breach notification laws, including the notification timelines and requirements of our state of incorporation and your state of residence. Nothing in this Policy limits, waives, or modifies SureDispose’s obligations under applicable data breach notification statutes.

12. Electronic Communications and Telephone Contact

If you provide your email address through the Assessment Tool or other contact mechanisms, we may send you service-related communications (such as assessment results, referral information, and policy updates) and, where permitted by applicable law, marketing communications about the Service.

You may opt out of marketing communications at any time by clicking the “unsubscribe” link included in each marketing email, or by contacting us at [email protected]. We will process your opt-out request within ten (10) business days, as required by the CAN-SPAM Act (15 U.S.C. §§ 7701–7713). Opting out of marketing communications does not affect your receipt of transactional or service-related communications.

Telephone and Text Messaging. SureDispose does not rely on co-registration consent obtained by third-party data providers as sufficient consent for automated telephone calls or text messages under the Telephone Consumer Protection Act (“TCPA”; 47 U.S.C. § 227) and its implementing regulations. If we or our agents contact you by telephone or text message using an automatic telephone dialing system, artificial or prerecorded voice, or any means requiring prior express written consent under the TCPA, we will obtain that consent directly from you through a compliant mechanism, and you may revoke that consent at any time by any reasonable means.

13. Children’s Privacy

The Service is designed for business professionals and is not directed to individuals under the age of 18. We do not knowingly collect personal information from individuals under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected], and we will take steps to delete such information.

14. Contact Information

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, please contact us at:

WRmachine, LLC (d/b/a SureDispose)

1309 Coffeen Avenue, Suite 15659

Sheridan, WY 82801

General Inquiries: [email protected]

Privacy Rights Requests: [email protected] (subject: “Privacy Rights Request”)

Opt-Out Requests: suredispose.com/do-not-sell

Privacy Rights Appeals: [email protected] (subject: “Privacy Rights Appeal”)

15. Sectoral Law Disclaimers

HIPAA. SureDispose does not access, store, process, or transmit protected health information (“PHI”) as defined by HIPAA (45 C.F.R. Parts 160, 164). The Assessment Tool collects organizational operational information about your ITAD needs, not patient health records. Providers recommended through the Service may be subject to HIPAA requirements; you are solely responsible for verifying Provider HIPAA compliance, including obtaining any necessary Business Associate Agreements, before engaging a Provider for ITAD services involving systems that store, process, or transmit PHI.

FERPA. SureDispose does not collect, store, or process student education records as defined by FERPA (20 U.S.C. § 1232g; 34 C.F.R. Part 99). You are solely responsible for verifying that any Provider recommended through the Service meets your institution’s FERPA compliance requirements.

GLBA. SureDispose does not provide financial, regulatory, or compliance advice. The Assessment Tool’s compliance guidance is general in nature and does not address institution-specific requirements under the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6809), the FACTA Disposal Rule (16 C.F.R. § 682), or the Sarbanes-Oxley Act. You are solely responsible for independently verifying that any Provider recommended through the Service meets your regulatory requirements.

16. De-Identified and Aggregate Information

SureDispose personnel who interact with the Service or user data in the ordinary course of business may develop general knowledge and expertise about ITAD industry trends, compliance patterns, and assessment methodologies. SureDispose may retain and use de-identified and aggregate insights derived from its operations, provided that such information:

Does not identify, and cannot reasonably be used to identify, any specific user or organization
Has not been systematically processed, stored, or derived through automated means in a manner that could be linked to a specific individual
Is subject to technical safeguards that prohibit re-identification
Is subject to business processes that prevent any attempt at re-identification

Nothing in this Section limits SureDispose’s obligations under applicable federal or state privacy laws, including the CCPA/CPRA, the MCDPA, or any other applicable data protection statute. De-identification is performed in accordance with the standards set forth in Cal. Civ. Code § 1798.140(m) and comparable provisions of other applicable state laws.

17. International Users

The Service is intended for users located in the United States. We do not target or intentionally collect personal information from individuals in the European Economic Area (“EEA”), the United Kingdom, or other jurisdictions outside the United States.

If you access the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, which may have different data protection standards than your home country. By using the Service, you consent to the transfer, processing, and storage of your information in the United States.

If you are located in a jurisdiction with comprehensive data protection requirements (such as the GDPR), please contact us at [email protected] before using the Service to discuss applicable requirements.

18. Changes to This Policy

SureDispose may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or business operations.

Non-Material Changes. We may make non-material changes (such as typographical corrections, formatting changes, or updates to contact information) at any time by posting the updated Policy on the Service and updating the “Last Updated” date.

Material Changes. If we make material changes to this Policy — including changes to how we collect, use, or share your personal information, or changes affecting your privacy rights — we will provide at least thirty (30) days’ advance notice via email to users who have provided contact information and post the updated Policy with a prominent notice. Where required by applicable law, we will obtain your consent before implementing material changes that expand our use of your previously collected personal information.

Your continued use of the Service after the effective date of any updated Policy constitutes your acceptance of the revised Policy. Prior versions of this Policy are available at suredispose.com/privacy/history.