Privacy Policy

Last Updated: July 9, 2026 | Version: 1.0

1. Who We Are

TMR System LLC (“we,” “our,” or “us”) is a mission-driven operations consulting firm based in Minnesota. We build operational infrastructure and audience intelligence for nonprofits, IGOs, and mission-driven organizations.

Contact: partners@tmrsystem.com

2. What Data We Collect

From Website Visitors (Lead Magnet Form)

When you submit our lead magnet form, we collect:

  • Name
  • Email address
  • Organization name
  • Any other information you choose to provide

Why: To follow up about our consulting services.

From Consulting Clients

When you engage TMR System for consulting work, we collect and process:

  • Contact information (name, email, phone, title)
  • Organizational data (nonprofit/IGO name, budget, structure, goals)
  • Project information (scope, timeline, deliverables, communications)
  • Financial data (engagement terms, invoicing details)
  • Any documents or materials you share as part of the engagement

Why: To deliver consulting services under a signed agreement.

3. How We Store Your Data

Lead Magnet Form Submissions

Form data is collected via Paperform (paperform.co), a US-based service. Your data is processed under Paperform’s terms. We may import your information into our project management system for follow-up. See Paperform’s privacy policy for details.

Client Data

All client engagement data is stored in OpenProject (OpenProject GmbH, Berlin, Germany), a self-hosted project management system. OpenProject is hosted on secure servers in Frankfurt, Germany, within the European Economic Area.

Key details:

  • Data is encrypted in transit (TLS 1.3) and at rest (AES-256)
  • OpenProject is GDPR-compliant with a Data Processing Agreement
  • Automatic daily backups are maintained
  • Access is restricted to authorized team members only

For European clients: Your data remains in the EU under German data protection law (GDPR). A Data Processing Agreement governs our handling of your information.

4. How We Use Your Data

We use your information to:

  • Respond to inquiries and follow up on consulting opportunities
  • Deliver consulting services you’ve engaged us for
  • Invoice for services rendered
  • Comply with legal and regulatory requirements
  • Improve our services (only in aggregated, non-identifiable form)

We do not:

  • Sell or share your data with third parties for marketing
  • Use your data for purposes other than those listed above without consent
  • Transfer data to the US or outside the EU without appropriate safeguards (for EU clients)

5. Data Retention

Lead Magnet Submissions: Retained for 2 years or until you unsubscribe, whichever is sooner.

Client Data: Retained for the duration of the engagement plus 3 years for recordkeeping (as required by federal grant compliance standards). You may request deletion earlier by contacting us in writing.

6. Your Rights

If you are in the EU: Under GDPR, you have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion (“right to be forgotten”)
  • Restrict processing
  • Data portability (receive your data in a structured format)
  • Lodge a complaint with your local data protection authority

To exercise these rights: Email partners@tmrsystem.com with your request. We will respond within 30 days.

If you are in California: Under CCPA, you have the right to know, delete, and opt-out of the sale of your personal information. We do not sell your data.

7. Third-Party Processors

We use the following third-party services to process your data:

Service Purpose Location
Paperform Lead form collection USA
OpenProject Client data management Frankfurt, Germany (EU)

All third-party processors have signed Data Processing Agreements or are covered by equivalent legal mechanisms (Standard Contractual Clauses, EU-US Data Privacy Framework).

8. Security

We take data security seriously. Our systems include:

  • Encryption in transit (TLS 1.3 minimum)
  • Encryption at rest (AES-256)
  • Multi-factor authentication for admin access
  • Regular backups and disaster recovery
  • Restricted access to authorized staff only

However, no system is completely secure. If we discover a breach involving your personal data, we will notify you within 72 hours as required by law.

9. Cookies

Our website does not use tracking cookies or analytics that require consent. We use minimal server logs for security and performance monitoring only.

10. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be posted here with a new “Last Updated” date. Your continued use of our website or services constitutes acceptance of any changes.

11. Contact Us

Questions about this policy or how we handle your data?

Email: partners@tmrsystem.com

⚠️ Legal Review Status: This policy is a draft and has not yet been reviewed by legal counsel (LegalCORPS). Do not publish until after legal review is complete.

Version History

v1.0 (July 9, 2026): Initial draft. Addresses lead form collection (Paperform), client data storage (OpenProject/Frankfurt), GDPR/CCPA rights, third-party processors, data retention, and security measures. Flagged for LegalCORPS review.