Privacy Policy

This Privacy Policy applies to all visitors, users, and customers of Aspen's websites, hosted services, and applications (collectively, the "Services"). It explains what personal information we collect, why we collect it, how we use it, and what rights you have. Unless otherwise stated, Pando HR, Inc. ("Aspen", "we", "us") acts as the data controller.

1. Information we collect

A. Website visitors

We automatically collect:

• IP address
• browser and device details
• referral URL
• pages visited
• interaction events
• performance and error logs

This data is used to understand and improve the Services, secure the website, and support visitors.

B. Account customers

When you sign up or use Aspen, we collect:

• name, email, company, job title
• login credentials and authentication metadata
• billing and payment method details
• subscription plan and usage
• support requests and communications

C. Support and communications

When you contact us, we may keep:

• email and message content
• support case notes
• feedback and survey responses

D. Applicant and hiring information

If you apply for a job with us, we may collect:

• contact details
• resume or CV
• employment history and qualifications
• interview notes
• recruitment correspondence
• publicly available professional profile data

E. Optional marketing data

If you opt in, we may also collect:

• newsletter preferences
• marketing interests
• lead or demo request details

2. What we don't collect

We do not intentionally collect:

• sensitive personal data such as biometric, health, genetic, or race information
• data from children under 16

3. Why we collect data

We use personal information to:

• operate and maintain Aspen
• authenticate and manage accounts
• process payments and subscriptions
• provide customer support
• improve product quality and features
• communicate service updates and announcements
• comply with legal obligations
• protect against fraud and abuse

4. Legal bases for processing

We process personal data based on:

• performance of a contract with you
• our legitimate interests, where they are not overridden by your rights
• your consent, where required
• compliance with legal obligations

If you'd like to know which legal basis applies to a specific processing activity, contact us using the details above.

5. How we share data

We may share data with:

• service providers that support hosting, payments, analytics, support, email, and security
• affiliates and subsidiaries for business operations
• law enforcement or regulators when required by law
• professional advisors and auditors
• buyers or partners in the event of a merger, acquisition, or sale of assets

We require third parties to protect your data and only use it for the purposes we instruct.

6. International transfers

Your data may be transferred outside your home country, including to the United States. Where required, we use safeguards such as Standard Contractual Clauses or similar legal mechanisms to protect your data in transit and at rest.

7. Your rights

Depending on your location, you may have the right to:

• access your personal information
• correct inaccurate information
• delete or erase your data
• restrict or object to processing
• withdraw consent at any time
• port your data to another controller
• lodge a complaint with a data protection authority

To exercise any of these rights, contact us at security@pando.com. We'll respond as early as possible and always within one month.

8. Cookies and tracking

We use cookies and similar technologies to:

• keep you signed in
• remember preferences
• analyze website usage
• secure the site

We do not use third-party tracking cookies for advertising or retargeting.

Do Not Track

We do not track users across the web or use third-party advertising trackers. Because of this, we do not change our behavior based on browser Do Not Track settings.

9. Data retention

We retain personal data as long as needed to:

• provide the Services
• fulfill business purposes
• comply with legal obligations
• resolve disputes
• enforce agreements

After data is no longer needed, we delete or anonymize it. In some cases, specific records may remain when required for integrity or legal reasons.

10. Security

We use industry-standard administrative, technical, and physical safeguards to protect personal data. No system is completely secure, but we work to keep your data safe and review our practices regularly.

11. Job applications

If you apply for a job with Aspen:

• we process your application data to evaluate your candidacy
• we may use an applicant tracking system
• we may obtain publicly available professional information about you
• we will not use applicant data for marketing

We retain applicant data for up to 24 months unless you request earlier deletion.

12. California and U.S. privacy addendum

This section integrates with and supplements the rest of this Privacy Policy. It applies to users who are residents of California under the California Consumer Privacy Act (CCPA) and, where indicated, residents of other U.S. states with comparable privacy laws.

Our role

Aspen acts as a service provider for our business customers with respect to data they submit through the Services. For our own website visitors, prospects, and applicants, we act as a business under the CCPA.

What we collect, and why

The categories of personal information we collect, the sources, and the purposes are described above in this Policy. Over the past 12 months we have collected the categories listed in section 1.

Sale or sharing of personal information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We restrict our use of customer personal data to providing and improving the Services.

Your California rights

You have the right to:

• Know and access. Request the categories and sources of personal information we collect about you, the purposes for which we use it, and the categories of third parties with whom we share it.
• Portability. Receive your personal information in a portable, machine-readable format where technically feasible.
• Deletion. Request that we delete personal information we hold about you, subject to exceptions set out by law (for example, to detect security incidents, complete a transaction, or comply with a legal obligation).
• Correction. Request that we correct inaccurate personal information.
• Opt out of sale or sharing. Although we do not sell or share your personal information, you have the right to opt out if our practices change.
• Non-discrimination. Exercise your rights without receiving discriminatory treatment.

How to exercise your rights

To exercise any of these rights, contact us at security@pando.com. We need to verify your identity before responding, so please include enough information to let us confirm you are the person about whom we hold data, or that you are an authorized representative.

We will confirm receipt of a verifiable request within 10 days and respond within 45 days. If we need more time, we'll tell you why and we may take up to 90 days total. You can submit up to 2 requests per 12-month period. There is no fee unless your request is manifestly unfounded or excessive, in which case we'll explain any charge.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we'll post the updated policy on this page and update the "Last updated" date above. If the changes are material, we'll take reasonable steps to notify you. Your continued use of the Services after changes take effect means you accept the updated policy.

14. Contact

Questions or privacy requests:

• Email: security@pando.com
• Address: Pando HR, Inc., 434 Camino Bandera, San Clemente, CA 92673

Aspen is a product by Pando. For our cookie controls, use the privacy settings link in the site footer or the cookie banner.