Privacy
Policy.

01

Scope

This Privacy Policy describes how Choco Inc., a Delaware corporation doing business through the Choco Insurance brand and operating the Choco SafeBuild program (collectively, “Choco,” “we,” “us,” or “our”), handles personal information when you visit chocoinsurance.com, submit a membership or program inquiry, communicate with us, or otherwise interact with services that link to this Policy (the “Services”). Choco Inc. is the entity responsible for the personal information described in this Policy.

This Policy does not replace privacy notices that may accompany a specific insurance product, membership agreement, partner service, or other offering. If another notice is provided for a particular product or relationship, that notice will govern that context.

02

Information we collect

Information you provide

When you submit a SafeBuild inquiry or contact us, we may collect:

• Identity and contact information, such as your name, work email address, telephone number, and job title.
• Business information, such as company name, website, company type, headquarters state, ISO 45001 status, and insurance renewal month.
• Inquiry information, including whether you are interested in membership, an ISO 45001 journey, or potential captive eligibility.
• Communications, including messages, feedback, and other information you choose to provide to us.

Information collected automatically

When you use the Services, we and our hosting and security providers may automatically process limited technical and activity information, such as IP address, browser and device type, operating system, pages requested, date and time, referring page, landing-page URL, and diagnostic or security logs. If you arrive through a tagged campaign link, we also collect the associated UTM source, medium, campaign, content, and term values.

Information from other sources

We may receive business contact information from your organization, referral partners, professional advisers, publicly available sources, or other people who believe you may be interested in Choco. We handle that information under this Policy and any restrictions imposed by the source.

03

How we use information

We use personal information to:

• receive, review, and respond to inquiries;
• evaluate potential fit for SafeBuild membership, certification support, risk-management services, or other programs;
• communicate about requested services, events, updates, and related business opportunities;
• operate, maintain, secure, troubleshoot, and improve the Services;
• understand campaign performance and how visitors reach and use the Services;
• detect spam, fraud, abuse, security incidents, and other harmful activity;
• comply with law, enforce our agreements, and establish, exercise, or defend legal claims; and
• carry out another purpose disclosed to you when the information is collected or with your consent.

Where applicable law requires a legal basis, we rely on your consent, steps requested before entering a contract, performance of a contract, compliance with legal obligations, and our legitimate interests in operating and protecting our business and communicating with current and prospective business contacts. You may withdraw consent at any time, but withdrawal does not affect earlier lawful processing.

04

How we disclose information

We may disclose personal information to the following recipients for the purposes described in this Policy:

• Service providers. Vendors that provide website hosting, cloud infrastructure, email delivery, security, technical support, communications, and professional services. The current site and inquiry form use Microsoft Azure infrastructure and Azure Communication Services Email.
• Choco personnel and affiliates. Team members and affiliated entities that need the information to respond to you or administer the relevant relationship.
• Professional advisers and program partners. Lawyers, auditors, consultants, insurers, brokers, underwriters, certification professionals, or other partners when appropriate to evaluate or provide a service you request. We will seek additional permission where required.
• Authorities and protection of rights. Government authorities, courts, counterparties, or other parties when we reasonably believe disclosure is required by law or necessary to protect rights, safety, security, and the integrity of the Services.
• Business transactions. Relevant parties and advisers in connection with a financing, merger, acquisition, reorganization, sale of assets, or similar transaction, subject to appropriate safeguards.
• At your direction. Other recipients when you ask us to disclose information or otherwise consent.

Choco does not sell personal information for money. Choco also does not share personal information for cross-context behavioral advertising or use personal information submitted through this website for targeted advertising.

05

Cookies and tracking technologies

Choco does not currently use advertising cookies or third-party analytics cookies on this website. Our hosting and security providers may process standard server logs and use technologies that are strictly necessary to deliver and protect the Services.

Because we do not currently use tracking for cross-context behavioral advertising, the Services do not respond differently to browser “Do Not Track” signals. Where required, we will honor legally recognized opt-out preference signals for processing to which they apply. If our cookie or tracking practices materially change, we will update this Policy and provide any consent controls required by law.

06

Retention and security

Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including to manage an inquiry or business relationship, comply with legal and recordkeeping obligations, resolve disputes, and enforce agreements. Retention periods vary based on the nature and sensitivity of the information, the relationship, legal requirements, and operational needs. We then delete, de-identify, or securely archive the information as appropriate.

Security

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. No Internet transmission or storage system can be guaranteed to be completely secure, so we cannot promise absolute security.

07

Your rights and choices

Depending on where you live and subject to applicable exceptions, you may have the right to:

• request access to, confirmation of, or a portable copy of personal information we hold about you;
• request correction or deletion of personal information;
• object to or request restriction of certain processing;
• withdraw consent where processing is based on consent;
• opt out of marketing communications by using an unsubscribe method in the message or contacting us; and
• appeal our decision on a request or complain to your local data-protection authority.

To submit a request, email hello@chocoinsurance.com with the subject line “Privacy Request.” Please describe the request and the relationship through which you interacted with Choco. We may ask for information reasonably necessary to verify your identity and authority. You may use an authorized agent where permitted by law. We will not discriminate against you for exercising applicable privacy rights.

08

Supplemental U.S. state privacy notice

This section supplements the rest of the Policy for residents of states with comprehensive privacy laws. In the preceding 12 months, Choco may have collected the categories below. The examples describe the website’s current practices and do not indicate that we collect every item included in a statutory category.

We collect these categories from you, your device, your organization, referral sources, and public business sources. We use them for the purposes in “How we use information.” We have not sold these categories or shared them for cross-context behavioral advertising in the preceding 12 months. We do not knowingly collect sensitive personal information through the website for purposes requiring a right to limit its use.

State law may provide rights to know, access, correct, delete, and obtain a portable copy of personal information, and to opt out of sale, targeted advertising, certain profiling, or sharing. Because Choco does not engage in sale, targeted advertising, or qualifying profiling through this website, there is no separate opt-out mechanism for those activities. You may exercise other applicable rights using the contact method above.

09

International visitors

Choco is based in the United States, and the Services are directed primarily to U.S. businesses. If you access the Services from another country, your personal information may be transferred to, stored in, and processed in the United States and other countries where we or our providers operate. Those countries may have different data-protection laws. Where required, we use appropriate safeguards for international transfers.

10

Children’s privacy

The Services are business-to-business services and are not directed to children under 13. We do not knowingly collect personal information online from children under 13. If you believe a child has provided personal information to us, contact us so we can investigate and delete it as appropriate.

11

Changes to this Policy

We may update this Policy to reflect changes in our Services, practices, or legal obligations. We will post the revised version on this page and change the “Last updated” date. If a change is material, we will provide additional notice when required by law.

12

Contact us

For questions, concerns, or privacy requests, contact: