Privacy
Policy.

01

Scope

This Privacy Policy describes how Choco Inc., a Delaware corporation doing business through the Choco Insurance brand and operating the Choco SafeBuild program (collectively, “Choco,” “we,” “us,” or “our”), handles personal information when you visit chocoinsurance.com, submit a membership or program inquiry, communicate with us, or otherwise interact with services that link to this Policy (the “Services”). Choco Inc. is the entity responsible for the personal information described in this Policy.

This Policy does not replace privacy notices that may accompany a specific insurance product, membership agreement, partner service, or other offering. If another notice is provided for a particular product or relationship, that notice will govern that context.

02

Information we collect

Information you provide

When you submit a SafeBuild inquiry or contact us, we may collect:

• Identity and contact information, such as your name, work email address, telephone number, and job title.
• Business information, such as company name, website, company type, headquarters state, ISO 45001 status, and insurance renewal month.
• Inquiry information, including whether you are interested in membership, an ISO 45001 journey, or potential captive eligibility.
• Communications, including messages, feedback, and other information you choose to provide to us.

Information collected automatically

When you use the Services, we and our hosting and security providers may automatically process limited technical and activity information, such as IP address, browser and device type, operating system, pages requested, date and time, referring page, landing-page URL, and diagnostic or security logs. If you arrive through a tagged campaign link, we also collect the associated UTM source, medium, campaign, content, and term values.

Information from other sources

We may receive business contact information from your organization, referral partners, professional advisers, publicly available sources, or other people who believe you may be interested in Choco. We handle that information under this Policy and any restrictions imposed by the source.

03

How we use information

We use personal information to:

• receive, review, and respond to inquiries;
• evaluate potential fit for SafeBuild membership, certification support, risk-management services, or other programs;
• communicate about requested services, events, updates, and related business opportunities;
• operate, maintain, secure, troubleshoot, and improve the Services;
• understand campaign performance and how visitors reach and use the Services;
• detect spam, fraud, abuse, security incidents, and other harmful activity;
• comply with law, enforce our agreements, and establish, exercise, or defend legal claims; and
• carry out another purpose disclosed to you when the information is collected or with your consent.

Where applicable law requires a legal basis, we rely on your consent, steps requested before entering a contract, performance of a contract, compliance with legal obligations, and our legitimate interests in operating and protecting our business and communicating with current and prospective business contacts. You may withdraw consent at any time, but withdrawal does not affect earlier lawful processing.

04

How we disclose information

We may disclose personal information to the following recipients for the purposes described in this Policy:

• Service providers. Vendors that provide website hosting, cloud infrastructure, email delivery, security, technical support, communications, and professional services. The current site and inquiry form use Microsoft Azure infrastructure and Twilio SendGrid for transactional email delivery.
• Choco personnel and affiliates. Team members and affiliated entities that need the information to respond to you or administer the relevant relationship.
• Professional advisers and program partners. Lawyers, auditors, consultants, insurers, brokers, underwriters, certification professionals, or other partners when appropriate to evaluate or provide a service you request. We will seek additional permission where required.
• Authorities and protection of rights. Government authorities, courts, counterparties, or other parties when we reasonably believe disclosure is required by law or necessary to protect rights, safety, security, and the integrity of the Services.
• Business transactions. Relevant parties and advisers in connection with a financing, merger, acquisition, reorganization, sale of assets, or similar transaction, subject to appropriate safeguards.
• At your direction. Other recipients when you ask us to disclose information or otherwise consent.

Choco does not sell personal information for money. If you enable Advertising in Cookie settings, limited online identifiers and Internet or network activity may be disclosed to Meta, Outbrain, and X for advertising measurement. Information submitted in the SafeBuild inquiry form is not provided to those advertising partners.

05

Cookies and tracking technologies

Choco uses Google Tag Manager to manage optional analytics and advertising technologies. The Tag Manager container may load when a page opens, but its analytics and advertising tags are blocked unless and until you grant the corresponding permission. Essential storage remains available for security, core site functions, and recording your privacy choice.

If you enable Analytics, Google Analytics 4 may process the page path, limited interaction and conversion events, approximate device and browser information, IP-derived general location, and related technical data. If you enable Advertising, approved tags from Meta, Outbrain, and X may process limited online identifiers, page activity, and device or browser information for advertising measurement. Choco does not intentionally send names, email addresses, telephone numbers, company names, form contents, certificate information, inquiry reference numbers, or other direct identifiers through these tags.

Your choice is stored in this browser for up to 180 days. You may accept all, reject all, or select categories separately, and you can change or withdraw your choice at any time using “Cookie settings” in the website footer. Withdrawal blocks future events and attempts to remove accessible cookies associated with the disabled category. When a browser sends a Global Privacy Control signal, Advertising remains disabled.

Our hosting and security providers may separately process standard server logs necessary to deliver and protect the Services. Browser “Do Not Track” signals are not standardized; we respond to Global Privacy Control as described above and honor other legally recognized opt-out preference signals where they apply.

06

Retention and security

Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including to manage an inquiry or business relationship, comply with legal and recordkeeping obligations, resolve disputes, and enforce agreements. Retention periods vary based on the nature and sensitivity of the information, the relationship, legal requirements, and operational needs. We then delete, de-identify, or securely archive the information as appropriate.

Security

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. No Internet transmission or storage system can be guaranteed to be completely secure, so we cannot promise absolute security.

07

Your rights and choices

Depending on where you live and subject to applicable exceptions, you may have the right to:

• request access to, confirmation of, or a portable copy of personal information we hold about you;
• request correction or deletion of personal information;
• object to or request restriction of certain processing;
• withdraw consent where processing is based on consent;
• opt out of marketing communications by using an unsubscribe method in the message or contacting us; and
• appeal our decision on a request or complain to your local data-protection authority.

To submit a request, email hello@chocoinsurance.com with the subject line “Privacy Request.” Please describe the request and the relationship through which you interacted with Choco. We may ask for information reasonably necessary to verify your identity and authority. You may use an authorized agent where permitted by law. We will not discriminate against you for exercising applicable privacy rights.

08

Supplemental U.S. state privacy notice

This section supplements the rest of the Policy for residents of states with comprehensive privacy laws. In the preceding 12 months, Choco may have collected the categories below. The examples describe the website’s current practices and do not indicate that we collect every item included in a statutory category.

We collect these categories from you, your device, your organization, referral sources, and public business sources. We use them for the purposes in “How we use information.” We do not sell these categories for money. When Advertising is enabled, disclosure of limited identifiers and Internet or network activity to advertising-measurement providers may be treated as sharing, targeted advertising, or a sale under some state laws. We do not knowingly collect sensitive personal information through the website for purposes requiring a right to limit its use.

State law may provide rights to know, access, correct, delete, and obtain a portable copy of personal information, and to opt out of sale, targeted advertising, certain profiling, or sharing. You can opt out of advertising-related processing through “Cookie settings” or a supported Global Privacy Control signal. You may exercise other applicable rights using the contact method above.

09

International visitors

Choco is based in the United States, and the Services are directed primarily to U.S. businesses. If you access the Services from another country, your personal information may be transferred to, stored in, and processed in the United States and other countries where we or our providers operate. Those countries may have different data-protection laws. Where required, we use appropriate safeguards for international transfers.

10

Children’s privacy

The Services are business-to-business services and are not directed to children under 13. We do not knowingly collect personal information online from children under 13. If you believe a child has provided personal information to us, contact us so we can investigate and delete it as appropriate.

11

Changes to this Policy

We may update this Policy to reflect changes in our Services, practices, or legal obligations. We will post the revised version on this page and change the “Last updated” date. If a change is material, we will provide additional notice when required by law.

12

Contact us

For questions, concerns, or privacy requests, contact: