Privacy Policy

Pathworks collects only the information reasonably needed to respond to inquiries, scope and quote engineering work, deliver projects, secure its systems, meet legal obligations, and improve its website. Project files are treated as confidential, access is limited to personnel and reviewers who need the material for the engagement, and Pathworks does not sell personal information or use client project material for marketing without explicit permission.

This Privacy Policy explains how Pathworks Engineering (“Pathworks”, “we”, “us”, or “our”) collects, uses, discloses, stores, transfers, retains and protects personal information when you use our website, submit a Start a Project request, contact us, upload project material, request a quotation, communicate with us about an engagement, or otherwise interact with our engineering design, drafting and documentation services.

It applies to website visitors, prospective clients, clients, business contacts and other individuals whose personal information is provided to Pathworks through those interactions. It also explains how Pathworks handles personal information that may appear within project materials supplied by a client, subject to the controller/ processor distinction described in Section 3.

This policy does not replace a project-specific NDA, data processing agreement, master services agreement, statement of work, client security schedule, records-retention requirement, or other written contract. If a contract imposes stricter confidentiality, security, residency, deletion or use restrictions, Pathworks applies the contract to the extent it governs the relevant data. Employment, contractor onboarding and internal workforce information may be subject to separate workforce privacy notices.

Pathworks operates as a remote-first engineering services provider and may serve clients in multiple jurisdictions. We apply a baseline of transparency, purpose limitation, data minimization, security, retention control and individual rights across our operations; when a law provides greater protection, Pathworks applies that law to the extent it applies to the relevant processing.

Pathworks generally acts as a controller for personal information it collects directly for its own business purposes, including website inquiries, quotation requests, client relationship management, contact information, website security, vendor management, billing administration, legal compliance, and limited analytics.

A client may provide project material containing personal information about third parties — for example, property owners, site contacts, field technicians, utility representatives, contractors, or other stakeholders. When Pathworks processes that information only to provide contracted engineering services under the client’s instructions, Pathworks may act as the client’s processor or service provider rather than as an independent controller. In that situation, the client remains primarily responsible for the lawful basis, required notices and honoring applicable rights; individuals should generally direct privacy requests to that client, and Pathworks will provide reasonable assistance as required by contract or law.

Where required, Pathworks will enter into a data processing agreement or equivalent terms addressing processing instructions, confidentiality, security, approved subprocessors, international transfers, assistance with rights requests, security incidents, and deletion or return of data.

The information collected depends on how you interact with Pathworks and what you choose to submit. We ask clients not to provide personal information that is unnecessary for the project.

• Identity and contact data: name, company, business email, phone number, job title, mailing address where needed.
• Business and professional data: employer, role, service area, project responsibilities, vendor/client relationship information.
• Project details: requested service, engagement type, location, scope description, schedule, delivery requirements, standards, NDA preference.
• Project material: sketches, photos, maps, spreadsheets, CAD/BIM files, drawings, specifications, field notes, survey information, calculations, redlines and other technical documents.
• Communications: emails, contact-form messages, notes from calls or meetings, feedback and support history.
• Technical and device data: IP address, browser type, operating system, device type, timestamps, requested URLs, error logs and security events.
• Usage and analytics data: pages viewed, approximate referral source, UTM/campaign parameters, session events and aggregated performance metrics.
• Security and access records: authentication events where applicable, file-upload events, access logs, permission changes and malware-scan results.
• Contract and compliance data: executed agreements, NDA status, consent records, privacy request records and compliance correspondence.
• Billing and transaction data: invoice details, purchase-order information, tax information and transaction status. Payment providers may process card or bank details directly.

If you submit information about another person, you represent that you are authorized to provide it and that your disclosure is consistent with applicable law and any confidentiality obligations. Pathworks does not request social security numbers, passport numbers, health information, biometric identifiers, private financial credentials, children’s information, or other sensitive personal information through the ordinary website quotation workflow; project material may occasionally contain sensitive or regulated information incidentally, handled as described in Section 10.

Project material can be commercially sensitive even when it is not “personal information” under privacy law. It may reveal network topology, facility locations, equipment, infrastructure routes, system capacities, construction details, property information, client strategy, schedules, vulnerabilities or other confidential technical information. Pathworks treats project material as confidential in accordance with the applicable engagement terms and reasonable security practices, and uses it only to evaluate the request, prepare a scope or quotation, perform the requested engineering work, communicate with authorized stakeholders, secure and maintain its systems, and satisfy legal, contractual, insurance or audit obligations.

Pathworks does not use client project material, drawings, site photographs, maps, designs, deliverables, project names or other confidential project content in advertising, portfolio pages, case studies, training examples or marketing materials without explicit authorization. Clients may request an NDA before providing sensitive project materials; a signed NDA supplements this policy and controls for the covered material to the extent of any conflict.

• Directly from you: forms, emails, calls, meetings, uploads and project instructions.
• From your employer, client, consultant, contractor or project partner when they identify you as a contact.
• From project documents and technical files supplied by authorized parties.
• Automatically from your browser, device and interactions with the website.
• From service providers supporting hosting, security, email, storage, analytics or payment operations.
• From public or professional sources where necessary for business verification or legal compliance.

We use information to respond to inquiries and prepare quotes; enter into and perform a services contract; provide design, drafting, documentation and QC; administer and support ongoing projects; secure the website, uploads and systems; operate and improve website analytics; maintain accounting, tax, insurance and legal records; prevent fraud, misuse, disputes or unlawful activity; and send requested or permitted service communications.

Under laws such as the EU and UK GDPR, Pathworks relies on the following bases depending on context: performance of a contract or steps requested before entering one; legitimate interests in responding to B2B inquiries, delivering services and securing systems; consent, where required for non-essential cookies, analytics or marketing (which can be withdrawn at any time without affecting prior lawful processing); and legal obligation for accounting, tax and compliance records. Where Pathworks relies on legitimate interests, we weigh the business purpose against the individual’s reasonable expectations and potential privacy impact, and do not override an individual’s rights where they require protection.

The Start a Project workflow collects enough information to understand the requested engineering work and prepare a responsible scope or quotation, including service discipline, engagement type, project location, description, timeline, contact information, NDA preference and supporting files. Please submit only what Pathworks reasonably needs at the quotation stage; if highly sensitive technical files are not needed for an initial estimate, you may first provide a high-level description and request an NDA or secure onboarding instructions before uploading detailed project material.

If a quotation does not proceed, Pathworks retains the inquiry and uploaded material only for a period reasonably necessary for follow-up, recordkeeping, security, dispute prevention or legal obligations, and then deletes, de-identifies or archives it under the retention approach in Section 12. You may request earlier deletion, subject to lawful exceptions.

Pathworks may send communications necessary to respond to an inquiry or administer an engagement — acknowledgements, quotation discussions, contract notices, project updates, file-delivery messages, security notices, billing and support messages. These are treated as transactional, not optional marketing.

If Pathworks sends newsletters, service announcements or other marketing, we do so consistent with applicable law: where consent is required we will seek it, and where B2B marketing is permitted on another lawful basis, recipients may opt out at any time. Project material is never converted into marketing content merely because it was submitted to Pathworks; public case studies, portfolio examples, testimonials or images require explicit client authorization.

Cookies and similar technologies may be used for strictly necessary functions (site security, session management, form functionality), functional/preference settings, analytics/performance (understanding traffic and improving the quotation flow), and, only if Pathworks’ practices change, advertising or cross-context tracking. Pathworks does not currently use project material for advertising and does not intentionally sell or share personal information for cross-context behavioral advertising.

Where law requires consent for non-essential cookies or similar technologies, Pathworks will request consent before activating them and will provide a way to change or withdraw preferences. Necessary technologies remain available because the site may not function securely without them. Where required by applicable U.S. state privacy law, Pathworks will recognize qualifying browser-based opt-out preference signals, including Global Privacy Control, for processing to which such signals legally apply.

Pathworks asks users to provide only information reasonably necessary to scope and perform the work. Do not upload the following through an ordinary project form unless Pathworks has expressly agreed in writing that the engagement and systems are approved to handle it: classified government information; export-controlled technical data; controlled unclassified information subject to specific contractual safeguards; payment-card data beyond ordinary billing information; passwords or authentication secrets; protected health information; highly sensitive personal identifiers; biometric templates; criminal-history data; or other information subject to specialized security or localization requirements.

Some engineering documents may be security-sensitive because they identify critical facilities, network routes, controls, system configurations, access points or vulnerabilities. Clients should identify any special handling requirements before upload; Pathworks may decline or restructure an engagement if its standard remote workflow cannot satisfy the required controls. If Pathworks receives sensitive or restricted information that is not necessary for the engagement or was submitted without required approval, we may isolate, return, redact or delete it and ask for a minimized resubmission.

Pathworks does not disclose personal information for commercial resale. We may disclose information in the following limited circumstances:

• Authorized Pathworks personnel who need access for quoting, project delivery, administration, support, security, finance or legal functions.
• An independent quality-control reviewer or specialist assigned to the engagement, subject to confidentiality and limited-access requirements.
• Service providers supporting hosting, file storage, secure transfer, email, collaboration, analytics, security, malware scanning, backups, payment or accounting, under appropriate contractual restrictions.
• Professional advisers such as lawyers, accountants, insurers or auditors where reasonably necessary.
• Government, regulatory, judicial or law-enforcement authorities where disclosure is required by law, court order or valid legal process, or necessary to protect rights, safety or security.
• A successor or transaction counterparty in connection with a merger, financing, acquisition, reorganization or sale of assets, subject to confidentiality restrictions.
• Other parties when you direct or authorize the disclosure, or where necessary to complete a request you have made.

Pathworks does not sell personal information for money and does not intentionally “share” personal information for cross-context behavioral advertising as that term is used by California law. If Pathworks adopts practices that constitute sale or sharing under an applicable privacy law, this policy and website controls will be updated before or when required, including required opt-out mechanisms.

Pathworks retains personal information and project material only for as long as reasonably necessary for the purposes described in this policy, the applicable engagement, and legitimate legal, accounting, security, warranty, professional, dispute-resolution or compliance needs. Retention factors include whether the information is needed to provide or support the engagement; its sensitivity, volume and type; any minimum or maximum period required by contract, NDA, professional standard, insurer or law; applicable limitation periods and audit needs; security and fraud-prevention requirements; and whether the information can be de-identified instead of retained in identifiable form.

As a general approach: quotation and inquiry records are kept for a reasonable follow-up and business-record period, then deleted or de-identified; unaccepted proposal uploads are kept only as long as needed to assess the opportunity or protect against disputes; active project files are retained for the engagement and any agreed support period; completed project files and deliverables are retained only as justified by contract, warranty, professional or legal-claim needs; contracts, invoices and accounting records are retained as required for tax, accounting, insurance or audit purposes; and security/technical logs are retained for periods appropriate to monitoring and investigations, then rotated or deleted.

You may request deletion of your personal information or project uploads by emailing business@pathworksengineering.com. We will honor the request where required by law and consistent with the client relationship, subject to legal, contractual, backup, security and recordkeeping obligations. Deletion from an active workspace does not always mean immediate erasure from every backup copy; data scheduled for deletion may remain in encrypted or access-restricted backups until overwritten through the normal lifecycle, unless faster deletion is technically feasible and legally or contractually required.

Depending on where you live and which law applies, you may have some or all of the following rights:

• Access / know: ask whether we process personal information about you and request a copy or information about the processing.
• Correction: ask us to correct inaccurate personal information.
• Deletion / erasure: ask us to delete personal information, subject to legal exceptions.
• Restriction: ask us to limit certain processing in circumstances provided by law.
• Objection: object to processing based on certain lawful bases, including direct marketing.
• Portability: request certain information in a structured, machine-readable format where the law provides this right.
• Withdraw consent where consent is the legal basis, without affecting prior lawful processing.
• Opt out of sale, sharing, targeted advertising or qualifying profiling where a U.S. state law provides those rights.
• Appeal a denied request where applicable state law provides an appeal right.
• Complain to an applicable data-protection or privacy authority.

To submit a request, email business@pathworksengineering.com with the subject “Privacy Request” and describe the right you wish to exercise. Pathworks may ask for information reasonably necessary to verify your identity and match the request to our records, but will not ask for more than reasonably necessary. Where applicable law permits an authorized agent to make a request on your behalf, Pathworks may require evidence of the agent’s authority.

Pathworks will respond within the period required by applicable law — for example, GDPR and UK GDPR requests are generally handled without undue delay and within one month, subject to lawful extensions, and California requests to know, delete or correct are generally subject to a 45-calendar-day response period, subject to permitted extensions and verification. Pathworks will not unlawfully discriminate against you for exercising a privacy right. If Pathworks holds your personal information only because a client provided it in project materials and the client controls the processing, we may refer your request to the client and assist as required.

If the EU or UK GDPR applies to Pathworks’ processing of your personal data, you may have the rights of access, rectification, erasure, restriction, data portability, objection, withdrawal of consent, and rights relating to solely automated decisions that produce legal or similarly significant effects, subject to conditions and exceptions in the applicable law. You may lodge a complaint with the supervisory authority in your EEA country of residence, place of work, or the place of the alleged infringement, or with the UK Information Commissioner’s Office.

Because Pathworks is remote-first and may use personnel, reviewers or service providers in more than one country, personal information and project material may be accessed, processed or stored outside the country where it was originally submitted. Where cross-border transfer rules apply, Pathworks will use a lawful transfer mechanism appropriate to the circumstances, which may include an adequacy decision, approved standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or another approved mechanism, together with supplementary measures where required. Clients with regulatory, critical-infrastructure, government, export-control or data-residency restrictions should raise those requirements before sharing restricted data so Pathworks can determine whether the engagement can be supported.

Several U.S. states provide privacy rights to residents when statutory thresholds and other conditions are met, which may include access/confirmation, correction, deletion, data portability, opt-out of sale, targeted advertising or certain profiling, limits relating to sensitive data, and an appeal process. Where an applicable state law requires recognition of a qualifying universal opt-out mechanism, Pathworks will process it for the covered browser/device to the extent technically and legally required.

To the extent the California Consumer Privacy Act (CCPA), as amended, applies to Pathworks: the categories of personal information collected generally correspond to those listed in Section 3 (identifiers, customer records, commercial information, internet/network activity, geolocation inferred from IP where enabled, audio/visual project material if submitted, and professional/employment information); sources include the individual, their employer or project organization, project documents, and service providers; and Pathworks does not sell personal information and does not intentionally share it for cross-context behavioral advertising. California residents have the right to know/access, delete, correct, opt out of sale or sharing (if applicable), limit use of sensitive personal information (if applicable), and non-discrimination for exercising these rights. Requests can be submitted to business@pathworksengineering.com. Pathworks does not currently offer a financial incentive or price/service difference in exchange for personal information.

The Pathworks website and engineering services are intended for businesses and professionals and are not directed to children under 13. Pathworks does not knowingly collect personal information online from children under 13 through the website. If we learn that a child under 13 provided personal information without legally required authorization, we will take reasonable steps to delete it. If a project legitimately involves information about minors, the client should notify Pathworks before submission and confirm the lawful basis and any special handling requirements.

Pathworks may use ordinary software tools to route inquiries, filter spam, detect malware, organize project information, calculate website analytics or support engineering workflows; these functions do not by themselves mean Pathworks makes a legally significant automated decision about an individual. The website quotation workflow is intended to support human scoping and business review rather than a solely automated decision producing legal or similarly significant effects.

Pathworks uses administrative, technical and organizational safeguards intended to protect personal information and confidential project material, including encryption in transit and, where the platform supports it, at rest for uploaded files; access restricted to authorized personnel assigned to the project and, where applicable, the independent quality-control reviewer; basic file-type and executable-signature screening on upload; and additional malware scanning where a configured storage or security provider supports it. Because Pathworks is remote-first, project access is limited by role and assignment rather than granted broadly by default, and an independent reviewer receives only the access needed for the assigned review. No internet transmission or storage system can be guaranteed completely secure; clients should use Pathworks’ designated upload or file-transfer methods for sensitive project data and notify Pathworks promptly of any suspected unauthorized access or misdirected files.

The Pathworks website may link to third-party websites, collaboration platforms, map services, file-transfer services or scheduling tools with their own privacy practices; Pathworks is not responsible for an independent third party’s privacy practices except to the extent a provider acts as Pathworks’ contracted processor.

If Pathworks is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information and project records may be disclosed to advisers and counterparties where reasonably necessary, subject to confidentiality protections.

Pathworks may preserve or disclose information when reasonably necessary to comply with law, regulation, subpoena, court order or valid legal process; to investigate or prevent fraud, misuse or security incidents; to protect Pathworks, clients, users or others; or to establish, exercise or defend legal claims. Where legally permitted, Pathworks will seek to narrow overbroad requests and notify the affected client or individual before disclosure.

If Pathworks identifies or suspects loss, unauthorized access, disclosure, alteration or compromise of personal information or confidential project material, it will take reasonable steps to investigate, contain and respond, which may include preservation of evidence, credential or access changes, vendor coordination, risk assessment and remediation. If an incident involves personal information and applicable law requires notification to affected individuals, clients or regulators, Pathworks will provide or support the required notification within applicable timeframes; when Pathworks acts as a processor, it will notify the client as required by contract or law.

Pathworks may update this Privacy Policy to reflect changes in law, technology, services, vendors, business practices or security requirements. The “last updated” date at the top of this page is revised when the policy changes. If a change materially affects how we use personal information, we will provide additional notice or obtain consent when required by law. Continued use of the website after an update does not waive any consent requirement or privacy right that applicable law makes mandatory.

Questions, privacy requests, complaints, or deletion requests about this Privacy Policy may be sent to business@pathworksengineering.com. Pathworks will review privacy complaints in good faith and seek to resolve them promptly. If a privacy law applies to you, you may also have the right to complain to the competent supervisory authority, privacy regulator, or attorney general in your jurisdiction; contacting Pathworks first is welcome but does not limit any right to contact a regulator directly. Pathworks has not represented that it has appointed a statutory Data Protection Officer, EU representative, or UK representative; if an appointment becomes legally required, contact details will be added to this policy.