--- title: "Privacy policy" description: "Read the AssistBPO privacy policy: what personal data we process, why we hold it and your rights under US law, UK GDPR, PIPEDA and Australian rules." url: https://assistbpo.com/privacy/ updated: 2026-09-18 publisher: AssistBPO (SS Support Network LLC) language: en-US --- # Privacy policy The AssistBPO privacy policy explains how AssistBPO and SS Support Network LLC collect, use, share and protect personal information for website visitors, prospects, clients, the people our assistants speak to on a client's behalf, and job applicants in the United States, United Kingdom, European Union, Canada and Australia. Updated September 2026 ## Who we are AssistBPO is the virtual assistant and remote staffing division of SS Support Network LLC, a business process outsourcing company registered in Vancouver, Washington, USA, with a second office in Pakistan. In this policy “we”, “us” and “our” mean SS Support Network LLC, including the AssistBPO division. Our sister brands, SS Support Network (healthcare), TransportBPO (ground transportation) and LedgerBPO (accounting and billing), are divisions of the same company and share management and systems. This policy explains what personal information we collect through assistbpo.com and our sales and recruiting processes, how we use it, who we share it with, and the rights you have. It applies to website visitors, people who contact us, prospective and current clients, and job applicants. ## When we act for a client When an assistant answers a client’s phones, works in a client’s CRM or help desk, replies to a client’s customers or processes records on a client’s instructions, the client is the controller (or “business” under US state privacy laws) and we are the processor (or “service provider”). The callers, customers, patients, leads and suppliers we deal with on a client’s behalf are the client’s contacts, and the client’s own privacy notice covers them. That processing is governed by the client’s contract with us and by our data processing agreement, summarized on the [DPA page](https://assistbpo.com/dpa/). If you have spoken to an assistant who was acting for one of our clients and want to exercise your rights, contact the business you were dealing with. If you contact us instead, we will pass your request to them and help them answer it. This policy covers the information we control ourselves. ## What information do we collect? We collect information in three ways: you give it to us, we collect it automatically, or a client gives it to us as part of an engagement. Information you give us includes your name, work email, phone number, company name, country and industry, the desks, hours and tools you are interested in, and anything you type into a form, email, chat or WhatsApp message. If you book a call, we receive the booking details you enter. If you call our demo line, we receive your number and what you say on the call. If you apply for a job, we receive your CV, work history, contact details, test results and interview notes. Information we collect automatically includes your IP address, device and browser type, pages viewed, referring page, approximate location derived from your IP address, and interaction data such as clicks and scroll depth. Some of this is collected by the analytics and advertising tools described in the cookies section, and only after you consent where consent is required. Information a client gives us includes the names and contact details of the client’s staff and the personal information held in the systems the client asks us to work in: customer, caller, patient, lead and supplier records, messages, bookings, tickets and call recordings made in the client’s phone platform. We process that information only as instructed by the client. Our calculators, planners and the hours planner run in your browser. The figures you enter are not sent to us unless you type them into a contact or staffing-plan form. ## How we use information and our lawful bases We use personal information to respond to enquiries and staffing-plan requests, to run discovery and demo calls, to set up and deliver services under a contract, to send service communications, to run and improve the website, to measure marketing, to send our monthly email to people who have subscribed, to recruit staff, to meet legal, tax and accounting obligations, and to protect our systems and rights. Where UK GDPR or EU GDPR applies, we rely on the following lawful bases. Performance of a contract, or steps taken before entering one, covers staffing plans, onboarding and service delivery. Legitimate interests cover website security, basic analytics, business-to-business follow-up with work contacts who have enquired, and record keeping, balanced against your rights. Consent covers non-essential cookies, advertising tags, marketing emails to individuals where consent is required, and the monthly email. Legal obligation covers tax, accounting, employment, anti-fraud and regulatory record keeping. We do not use personal information for automated decisions that produce legal or similarly significant effects. We do not sell personal information. ## Cookies and consent We use Google Tag Manager to load measurement tags. Google Analytics 4 measures site usage. Microsoft Clarity records anonymized session interactions such as clicks and scrolling. The LinkedIn Insight Tag and the Meta Pixel measure the results of our advertising and may be used to build audiences. When you first visit, our consent banner offers three choices: essential only, analytics only, or accept all. Analytics tags load only after you choose analytics or accept all, and advertising tags load only after you choose accept all. Until you choose, Google Consent Mode keeps analytics and advertising storage denied. Strictly necessary cookies, such as the one that remembers your consent choice and the token that protects our forms from spam, load without consent. You can change or withdraw your choice at any time using the cookie settings link in the footer, and a withdrawal takes effect immediately. Each tool has its own privacy documentation and retention settings. Our Google Analytics 4 data retention is set to 14 months. ## Marketing messages The Handoff is our monthly email: one delegation playbook a month, sent only to people who have subscribed. Every issue carries an unsubscribe link, and unsubscribing takes effect at once. If you enquire about our services we may follow up by email or phone about that enquiry. Tell us to stop at any time and we will. We do not send marketing text messages without consent, and we do not make marketing calls to numbers on a do-not-call register. ## Call recording Calls with our team may be recorded for training and accuracy: the demo line, discovery calls where we say so, and calls handled on client desks inside the client’s phone platform. Where a call is recorded, a notice is given at the start that follows the rules of your country and state, and you can ask for recording to be turned off. Recordings made on a client’s desk belong to the client and are kept under the client’s retention rules. ## Who do we share information with? We share personal information with the people and companies that help us run the business, and only to the extent needed. Our staff in the United States and at our second office in Pakistan access information to deliver services, answer enquiries and recruit. Access is limited to the people assigned to your account or application. Our sister brands SS Support Network, TransportBPO and LedgerBPO share management, systems and staff with AssistBPO and may access information for the same purposes described here. Service providers host our website and email, protect our forms, book calls, run our client and lead portal, and deliver analytics and advertising tools: Hostinger for hosting and email; Google for Google Analytics 4 and Google Tag Manager; Microsoft for Clarity; LinkedIn and Meta for advertising measurement, loaded only with your consent; Calendly for call booking; Cloudflare Turnstile for form protection; and the telephony platforms that carry our demo line and client desks. Leads and client records are held in the SS Support Network client portal, which we operate ourselves. Each provider is bound by contract to use information only for the services it provides to us. The full list with locations is in the sub-processor schedule available on request. Professional advisers, insurers, regulators, courts and law enforcement receive information where the law requires it or where we need to establish or defend legal claims. If the business is sold or restructured, information may transfer to the new owner under the same protections. ## International transfers We are based in the United States and operate a second office in Pakistan. Information from the UK, the EU, Canada and Australia is therefore transferred to and processed in those two countries. For transfers from the UK, we use the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. For transfers from the EU, we use the EU Standard Contractual Clauses with the same assessment. Copies are available on request. For information from Australia, we disclose personal information to our second office in Pakistan and to US service providers under Australian Privacy Principle 8. We take reasonable steps, including contractual terms and the security measures below, so that recipients handle information in line with the Australian Privacy Principles. For information from Canada, we remain accountable under PIPEDA for information transferred to our offices and providers outside Canada, and we use contractual protections to achieve a comparable level of protection. For information from Quebec, we carry out a privacy impact assessment before transferring information outside Quebec, as required by Law 25, and we have designated a person in charge of the protection of personal information: our Chief Operating Officer, reachable at [privacy@assistbpo.com](mailto:privacy@assistbpo.com). ## How long do we keep it? Enquiry and staffing-plan records, including demo-line recordings and call-request details, are kept for 24 months after our last contact, unless you become a client. Client account records are kept for the life of the contract and then for the period required by tax and accounting law, which is typically seven years in the US and six years in the UK. Personal information we process on a client’s instructions lives in the client’s own systems; anything we hold is returned or deleted at the end of the engagement in line with the DPA. Job applications are kept for 12 months after the role closes unless you ask us to keep them longer or shorter. Subscriber details for the monthly email are kept until you unsubscribe. Analytics data is kept according to each tool’s retention setting. Backups are overwritten on a rolling schedule of 30 days. ## How we protect information We apply the same controls to our own systems that we apply to client desks. Multi-factor authentication is required on every account. Access follows least privilege, with staff seeing only the accounts assigned to them, and logins are logged. Data is encrypted in transit and at rest. Staff are employees of the group, background checked, trained in confidentiality every year and, for healthcare work, HIPAA trained. They work from our offices on managed devices with no local storage of client data. We sign an NDA for each client and a business associate agreement for US healthcare clients. Assistants never take or store card numbers. We maintain an incident response plan and test it. The full control list is on the [security page](https://assistbpo.com/security/). No method of transmission or storage is completely secure. If a breach affects your information and the law requires notice, we will notify you and the relevant regulator within the required timeframe. ## What are your rights, and how do you use them? You can ask us for a copy of your personal information, ask us to correct it, ask us to delete it, object to or restrict certain processing, ask for a portable copy, and withdraw consent where processing relies on consent. We respond within the time the applicable law allows, usually one month, and we may ask for proof of identity first. We will not treat you differently for exercising your rights. ### United States If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and how we use and share it, to delete it, to correct it, to opt out of sale or sharing, to limit the use of sensitive personal information, and to be free from discrimination. We do not sell personal information. Advertising tags may count as “sharing” under California law; they load only if you choose accept all, and you can opt out at any time through the cookie settings link or by emailing [privacy@assistbpo.com](mailto:privacy@assistbpo.com). We honor opt-out preference signals such as Global Privacy Control where our consent tool detects them. Residents of other states with privacy laws have comparable rights and can use the contact below to exercise them. You may appoint an authorized agent to act for you. ### United Kingdom and European Union Under UK GDPR and EU GDPR you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner’s Office at ico.org.uk. In the EU, it is the authority in the member state where you live or work. We would rather hear from you first so we can put things right. Where Article 27 requires a representative in the UK or the EU, the contact details are available from [privacy@assistbpo.com](mailto:privacy@assistbpo.com). ### Canada Under PIPEDA you can ask what personal information we hold about you, how it is used and who it has been disclosed to, and ask for corrections. You can complain to the Office of the Privacy Commissioner of Canada. In Quebec, Law 25 gives you additional rights, including the right to know when information is transferred outside Quebec, and you can complain to the Commission d’accès à l’information. ### Australia Under the Privacy Act 1988 and the Australian Privacy Principles you can ask for access to and correction of your personal information. If you are unhappy with our response, you can complain to the Office of the Australian Information Commissioner. We are subject to the Notifiable Data Breaches scheme for Australian information we hold. ## Children Our website and services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, contact us and we will delete it. ## Changes to this policy We review this policy at least once a year and whenever our practices or the law change. The date at the top shows the latest version. Material changes will be noted on the website, and where required we will ask for your consent again. ## Contact Privacy questions, rights requests and complaints: [privacy@assistbpo.com](mailto:privacy@assistbpo.com). Phone: +1-657-777-0006. Post: SS Support Network LLC, Vancouver, Washington, USA. ## On this page 1. Who we are 2. When we act for a client 3. What information do we collect? 4. How we use information and our lawful bases 5. Cookies and consent 6. Marketing messages 7. Call recording 8. Who do we share information with? 9. International transfers 10. How long do we keep it? 11. How we protect information 12. What are your rights, and how do you use them? 13. Children 14. Changes to this policy 15. Contact --- Source: https://assistbpo.com/privacy/ · Contact: https://assistbpo.com/contact/ · Full site map for agents: https://assistbpo.com/llms.txt