--- title: M&A Operating System Privacy policy --- [Skip to content](https://www.maoperatingsystem.com/privacy#main-content) ![MAOS-Logo-3](https://www.maoperatingsystem.com/hs-fs/hubfs/MAOS-Logo-3.png?width=334&height=127&name=MAOS-Logo-3.png) - [HOME](https://www.maoperatingsystem.com) - [CDO Advisory](https://www.maoperatingsystem.com/cdo-advisory) - [CIO Advisory](https://www.maoperatingsystem.com/cio-advisory) - [Resources](https://www.maoperatingsystem.com/articles) - [Repos](https://www.maoperatingsystem.com/repos) Open main navigation Close main navigation - [HOME](https://www.maoperatingsystem.com) - [CDO Advisory](https://www.maoperatingsystem.com/cdo-advisory) - [CIO Advisory](https://www.maoperatingsystem.com/cio-advisory) - [Resources](https://www.maoperatingsystem.com/articles) - [Repos](https://www.maoperatingsystem.com/repos) - [Contact us](https://www.maoperatingsystem.com/contact) [Contact us](https://www.maoperatingsystem.com/contact?hsLang=en) # Privacy Policy **M&A Operating System** **Effective Date:** October 8, 2026 **Last Updated:** October 8, 2026 ## 1. Introduction M&A Operating System LLC ("**M&A Operating System**," "**we**," "**us**," or "**our**") is a boutique management consulting firm providing Fractional Chief Information Officer (CIO), Fractional Chief Data Officer (CDO), Artificial Intelligence (AI), data strategy, data management, and data governance advisory services (collectively, the "**Services**"). This Privacy Policy explains how we collect, use, disclose, and safeguard information in two distinct contexts, which are addressed separately below because they involve different relationships, different data, and different legal bases: 1. **Client Engagements** — the delivery of our consulting Services to clients under a signed agreement (Section 2). 2. **Website, Marketing, and Social Media Activities** — our public-facing website, marketing communications, and social media presence (Section 3). If you have questions about this Policy, see Section 11 (Contact Us). ## 2. Client Engagements Information collected, processed, or exchanged in the course of a client engagement — including any data, documents, personal information of a client's employees or customers, or confidential business information shared with us in the performance of our Services — **is governed exclusively by the terms of the direct written agreement (e.g., a Master Services Agreement, Statement of Work, Consulting Agreement, or Non-Disclosure Agreement) executed between M&A Operating System and the client.** That contract — not this website Privacy Policy — controls matters including, as applicable: data ownership, confidentiality, data processing roles and responsibilities (including, where applicable, status as a data processor/service provider acting on a client's instructions under GDPR, CCPA/CPRA or similar law), permitted use, retention, security obligations, subcontractor/sub-processor use, cross-border transfer mechanisms, audit rights, and breach notification procedures. This Policy does not modify, supersede, or limit any data protection or confidentiality terms in a client contract. In the event of any conflict between this Policy and a client agreement with respect to engagement-related data, **the client agreement controls.** Prospective clients: information you provide to us before a contract is signed (e.g., during a sales conversation, proposal, or RFP response) is handled as described in Section 3 below, until and unless a signed agreement brings it under that agreement's own terms. ## 3. Website, Marketing, and Social Media Applications This section covers information practices for our public website at [www.maoperatingsystem.com](https://www.maoperatingsystem.com/?hsLang=en) (the "**Site**") and our related marketing and social media activity — distinct from the client engagement data described in Section 2. ### 3.1 The limited set of tools we use To operate our Site and promote M&A Operating System, we use a limited set of third-party marketing, customer relationship management (CRM), and analytics platforms, including: - **HubSpot** — our website hosting, content management, email marketing, and CRM platform. HubSpot also provides us with website analytics (e.g., page views, traffic sources, approximate geographic location derived from IP address, device/browser type, and on-site behavior) and, where you submit a form, stores the information you provide. - **LinkedIn** — for our company page, organic posts, and any sponsored/advertising content, including LinkedIn's own analytics on post engagement and, where applicable, LinkedIn's conversion tracking for visitors who arrive at our Site from LinkedIn. - **Other similar marketing, analytics, or social media platforms** that we may use from time to time to promote our Services or measure the effectiveness of our marketing (for example, other social media company pages, scheduling tools, or web analytics providers). We will update this Policy as our tool set changes materially. Each of these providers operates under its own privacy policy and terms, which govern their own handling of data collected through their platforms. We encourage you to review HubSpot's and LinkedIn's privacy policies directly for details on their own data practices: - HubSpot Privacy Policy: [https://legal.hubspot.com/privacy-policy](https://legal.hubspot.com/privacy-policy) - LinkedIn Privacy Policy: [https://www.linkedin.com/legal/privacy-policy](https://www.linkedin.com/legal/privacy-policy) ### 3.2 Analytics and engagement tracking We use the analytics capabilities built into the tools above to understand how visitors find and use our Site — for example, which articles are read, how visitors navigate the Site, which marketing channels drive traffic, and general engagement trends. This information is used in aggregate or pseudonymous form to improve our content, understand what resonates with our audience, and measure the effectiveness of our marketing, and is not used to build an individually-identifying profile of a visitor unless that visitor has separately identified themselves to us (see Section 3.3). These tools use cookies, web beacons, tracking pixels (including HubSpot's tracking code and, where applicable, the LinkedIn Insight Tag), and similar technologies to collect this engagement data. **By visiting [www.maoperatingsystem.com](https://www.maoperatingsystem.com/?hsLang=en), you acknowledge and agree to this tracking, consistent with general web analytics best practices.** If you do not wish to be tracked in this way, you may use your browser's cookie controls, ad-blocking or tracking-prevention features, or opt-out mechanisms offered directly by the tools listed above (e.g., HubSpot's and LinkedIn's own cookie/opt-out settings), to limit or disable this tracking. This Site and our client base are intended for and directed at visitors in the United States. ### 3.3 Personal information we collect directly We do not seek to collect personal information about Site visitors beyond standard analytics unless you choose to provide it to us directly. We collect personal information such as your name, email address, company, job title, or phone number only when you: - Fill out a form on our Site (e.g., a contact form, newsletter sign-up, or content download form); - Email, message, or otherwise directly contact us or one of our representatives; or - Engage with us directly through a sales conversation, event, meeting, or similar direct interaction. Information you provide in this way is used to respond to your inquiry, provide information you've requested, follow up regarding our Services, and, where you've consented, send you marketing communications (from which you may unsubscribe at any time via the link in any such email or by contacting us per Section 11). We obtain this information directly from you. We do not purchase personal information about Site visitors from third-party data brokers, or compile it from outside sources. ### 3.4 We do not sell or share your personal information **M&A Operating System does not sell or share any personal information collected through this Site, and does not use it for cross-context behavioral advertising, as those terms are defined under applicable law (including the CCPA/CPRA).** The only parties that receive personal information are: - The third-party platforms described in Section 3.1 (HubSpot, LinkedIn, and similar tools), which act solely as our service providers — processing information only to provide the hosting, CRM, analytics, and marketing functions described above, and not for their own independent purposes; - Service providers who assist us in operating our business (e.g., IT support), under confidentiality obligations; and - Where required by law, regulation, legal process, or to protect our rights or the safety of others. ## 4. Information We Collect — Summary | Category | Collected when | Examples | | --- | --- | --- | | Engagement/analytics data | Always, when you visit the Site | Pages viewed, referral source, approximate location, device/browser, on-site behavior | | Contact/identity data | Only if you provide it | Name, email, company, job title, phone number, message content | | Client engagement data | Only under a signed client contract | Governed entirely by Section 2, not this Policy | ## 5. How We Use Information We use website/marketing information described in Section 3 to: operate and improve the Site; respond to inquiries; deliver requested content or newsletters; measure and improve our marketing; and, where you've opted in, send marketing communications about our Services, insights, or events. ## 6. Data Retention We retain website/marketing personal information for as long as reasonably necessary for the purposes described in this Policy, or as required by law, after which it is deleted or anonymized. Analytics data retained by our third-party tools is subject to those providers' own retention settings and policies. ## 7. Your Privacy Rights (U.S. Residents) M&A Operating System's Site and Services are directed at visitors and clients located in the United States. Depending on your state of residence, you may have rights under applicable state privacy law — such as the California Consumer Privacy Act/California Privacy Rights Act (CCPA/CPRA) and the growing number of other state privacy laws, which continue to take effect and expand each year — to know what personal information we have collected about you, and to request its deletion or correction. As stated in Section 3.4, we do not sell or share personal information, so no opt-out mechanism for that is needed, provided the operational confirmation in Section 3.2 holds true. To exercise any of these rights with respect to website/marketing information, contact us using the details in Section 11. We will verify your request before acting on it. \[Counsel should confirm which specific state frameworks currently apply given actual visitor/client geography, and should separately confirm whether any applicable state law requires disclosing if personal data is used to train AI/machine-learning models - relevant given M&A Operating System's own AI advisory work, even though no visitor data is in fact used for that purpose today.\] Rights with respect to client engagement data are addressed under the relevant client contract per Section 2, not through this Section 7. ## 8. Data Security We use commercially reasonable administrative, technical, and organizational safeguards designed to protect information from unauthorized access, use, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. ## 9. Children's Privacy Our Site and Services are directed at business professionals and are not intended for, nor directed at, children. We do not knowingly collect personal information from children. ## 10. Changes to This Policy We may update this Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. The "Last Updated" date above reflects the most recent revision. Material changes will be reflected by posting the updated Policy on this page. ## 11. Contact Us Questions about this Privacy Policy, or requests regarding your personal information, may be directed to us using the contact form at the bottom of this page, or at: [Contact Us](https://www.maoperatingsystem.com/contact?hsLang=en) --- [![MAOS-Logo-3](https://www.maoperatingsystem.com/hs-fs/hubfs/MAOS-Logo-3.png?width=334&height=127&name=MAOS-Logo-3.png "MAOS-Logo-3")](https://www.maoperatingsystem.com/?hsLang=en) [linkedin-in icon](https://www.linkedin.com/company/ma-operating-system) - [HOME](https://www.maoperatingsystem.com) - Services - [CDO Advisory](https://www.maoperatingsystem.com/cdo-advisory) - [Data Management First](https://www.maoperatingsystem.com/cdo-advisory-dmf) - [CIO Advisory](https://www.maoperatingsystem.com/cio-advisory) - [Resources](https://www.maoperatingsystem.com/articles) - [Contact Us](https://www.maoperatingsystem.com/contact) - [About Us](https://www.maoperatingsystem.com/bios) - [Partners](https://www.maoperatingsystem.com/partners) - Tools - [Digital Strategy Survey](https://www.maoperatingsystem.com/survey.maoperatingystem.com) - [Privacy](https://www.maoperatingsystem.com/privacy) Copyright © 2026, M&A Operating System