SCHEDULE A CALL

Personal Information Handling and Privacy

Privacy is a critical pillar of trust in every technology partnership. Realized Solutions (RSI) recognizes that clients must maintain strict control over how personal information is collected, used, stored, and disposed of—not only to meet regulatory obligations, but to uphold the expectations of customers, employees, partners, and stakeholders. The Privacy & Personal Information Handling policy provides a comprehensive, transparent explanation of RSI’s practices for managing personal data responsibly and consistently across the entire information lifecycle. This includes alignment with key privacy principles such as purpose limitation, data minimization, retention governance, access rights, and breach notification.

At the foundation of our privacy program is a commitment to handling personal information with care, clarity, and accountability. RSI begins by identifying the types of personal information that may be collected during service delivery, such as user account details, system access logs, client-provided records, or support‑related artifacts. Every item of personal information must have a clearly defined purpose rooted in service delivery, operational requirements, or compliance obligations. RSI strictly avoids collecting or using personal information beyond what is necessary, aligning with data minimization principles that reduce both operational and regulatory risk.

Purpose limitation guides how RSI processes personal information throughout all systems, workflows, and tools. If data is not required for a legitimate and documented operational purpose, it is not collected. If it is collected, it is used only for that purpose and handled in accordance with this policy. This disciplined approach ensures that privacy protections are not left to discretion; instead, they are integrated into the design of every system and process we manage. Clients benefit from a clear understanding of why their data—or their customers’ data—is processed, and can confidently demonstrate alignment to regulatory frameworks such as HIPAA, GLBA, or state-level privacy statutes as needed.

Storage and access governance form the next layer of protection. Personal information is stored only in secure environments that meet or exceed industry expectations for encryption, authentication, physical protection, and access control. Encryption is mandatory both at rest and in transit, ensuring that even if systems are accessed without authorization, the data remains unreadable. RSI applies strict, role-based access restrictions that ensure personal information is accessible only to individuals with a legitimate business requirement. Access is logged, monitored, and periodically reviewed to maintain least‑privilege enforcement.

Retention is a key area where organizations often face compliance gaps. Over-retention exposes businesses to unnecessary risk, while premature deletion may violate regulatory mandates or hinder operational needs. RSI’s retention schedules clearly define how long personal information may be kept and the justification for its retention. These schedules reflect contractual obligations, industry requirements, legal considerations, and business value. Information that no longer has a valid retention justification is securely deleted or destroyed using verified methods that prevent recovery. These practices provide a defensible retention strategy for clients who must demonstrate diligence during audits or regulatory assessments.

Privacy governance also includes honoring individuals’ rights to their personal information. Although RSI typically does not act as a controller of client personal data, we respect and support client-directed requests regarding access, correction, restriction, or deletion. When applicable, RSI assists clients in fulfilling their obligations to data subjects by providing necessary technical support or operational visibility. This partnership approach strengthens clients’ privacy programs and helps them maintain trust with their own users and customers.

Another critical component is managing data sharing and third-party access. RSI does not disclose personal information to unaffiliated third parties except when explicitly authorized by the client or required by law. When RSI engages subprocessors or integrated service providers, such as cloud platforms or specialized security tools, we conduct due diligence to ensure these partners maintain strong privacy practices. Vendor oversight is an essential part of reducing the risk of downstream exposure and is integrated into RSI’s broader vendor management program.

Incident management is closely tied to privacy. If personal information may have been improperly accessed, used, or disclosed, RSI’s Incident Response & Breach Notification processes activate immediately. These processes include containment, impact assessment, evidence preservation, communication protocols, and client notification procedures. Transparency is central—clients are informed promptly and supported through any legally required notifications or remediation steps. This level of readiness provides clients with confidence that RSI will act swiftly and responsibly in the event of a privacy issue.

Training and awareness ensure that privacy is not merely a procedural requirement but a lived organizational value. All RSI personnel receive regular training on privacy expectations, secure handling practices, sensitive-data workflows, and incident identification. This training emphasizes that privacy is not simply the responsibility of the security team—it is part of everyone’s daily responsibilities when interacting with personal information. A culture of awareness significantly reduces accidental disclosures and helps ensure that privacy is considered at every point of data interaction.

RSI’s Privacy & Personal Information Handling practices far exceed the informal or inconsistent approaches found in many MSPs or development shops. While smaller providers often rely on undocumented procedures or generic platform settings, RSI’s privacy program is structured, documented, and aligned with recognized governance models. Clients gain a partner who behaves like an extension of their internal compliance team—able to support audits, reduce risk, and demonstrate accountability in ways that strengthen their regulatory posture.

Ultimately, the Privacy & Personal Information Handling policy reflects RSI’s commitment to operating ethically, responsibly, and transparently. Clients trust us not only with their systems, but with the personal data of their employees, customers, or end users. This policy ensures that such information is handled rigorously, protected with care, and managed with maturity that enhances organizational trust. Through this program, RSI demonstrates its dedication to privacy as a strategic priority, not simply a regulatory requirement.

Trust Policies