Privacy Policy.

This Privacy Policy ("Policy") describes how RSK.Systems ("RSK.Systems," "we," "us," or "our") collects, uses, stores, and protects personal and organizational data submitted to or collected by the RSK.Systems platform, website, and associated services ("Services").

This Policy applies to all Authorized Users of the platform, visitors to rsk.systems, and any individual or organization that submits information through our contact channels. By using the Services, you acknowledge and agree to the practices described herein.

This Policy should be read in conjunction with our Terms of Use and Model Guidelines, which together constitute the complete legal framework governing your use of the platform.

RSK.Systems collects the minimum data necessary to deliver and improve the Services. We operate on a strict data minimization principle — if we don't need it to serve you, we don't collect it.

Expand each category below to understand exactly what we collect and why:

Data collected by RSK.Systems is used exclusively for the following purposes. We do not use your data for advertising, profiling for commercial purposes, or sale to third parties — ever.

• Providing, maintaining, and improving the RSK.Systems platform and associated Services.
• Verifying the identity and authorization level of users accessing the platform.
• Monitoring for unauthorized access, security incidents, and potential abuse of the platform.
• Communicating with you regarding your account status, security alerts, and material policy changes.
• Meeting legal obligations, responding to lawful requests from government authorities, and maintaining records required by applicable law.
• Conducting internal analytics to understand platform performance, reliability, and user workflow patterns — using aggregated, anonymized data only.

RSK.Systems does not sell, lease, or share your personal data with third parties for their commercial purposes. The only circumstances under which your data may be disclosed to a third party are as follows:

• Service Providers: Trusted vendors who assist in operating our infrastructure (hosting, security monitoring, email delivery) under strict data processing agreements that prohibit secondary use.
• Legal Compliance: In response to valid legal process, including court orders, subpoenas, or lawful requests from U.S. law enforcement agencies. We will notify affected users where legally permitted to do so.
• Business Continuity: In the event of a merger, acquisition, or sale of substantially all assets, user data may transfer to the acquiring entity under equivalent or stronger privacy protections.
• User Consent: Where you have provided explicit, informed written consent to a specific disclosure.

All third-party service providers are contractually required to maintain appropriate security standards and are prohibited from using your data for any purpose other than providing the specified service to RSK.Systems.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal obligations, and to resolve disputes. The following schedule governs our standard retention periods:

Upon expiration of applicable retention periods, data is permanently deleted using NIST SP 800-88 compliant media sanitization procedures.

RSK.Systems implements enterprise-grade security controls across all layers of our infrastructure, consistent with the sensitivity of the environments our clients operate in. Our security architecture is not aspirational — it is operational and continuously validated.

• Encryption at Rest: All stored data is encrypted using AES-256. Encryption keys are managed through a dedicated key management system with automatic rotation.
• Encryption in Transit: All data transmitted between clients and our infrastructure is protected by TLS 1.3. Legacy protocol negotiation is disabled.
• Access Controls: Role-based access control (RBAC) is enforced at every layer. Principle of least privilege is applied to all internal systems. Multi-factor authentication is mandatory for all administrative access.
• Audit Logging: All access events, data queries, and administrative actions are logged in tamper-evident audit trails retained for 12 months.
• Penetration Testing: Independent security assessments are conducted at least annually. Critical findings are remediated within 72 hours; high findings within 14 days.
• Incident Response: A documented incident response plan is maintained and tested quarterly. In the event of a breach affecting personal data, affected users and applicable authorities will be notified within 72 hours of detection.

Authorized Users of the RSK.Systems platform have the following rights with respect to their personal data. All requests are processed within 30 days of receipt, subject to identity verification and applicable legal restrictions.

To exercise any of these rights, contact our Privacy Office at info@rsk.systems with the subject line "Privacy Rights Request." Identity verification is required before processing requests involving access to or deletion of personal data.

RSK.Systems uses a minimal set of cookies strictly necessary for platform functionality and security. We do not use third-party advertising cookies, cross-site tracking pixels, or behavioral profiling technologies.

• Session Cookies: Essential cookies that maintain your authenticated session while using the platform. Expire when you close your browser or log out. Cannot be disabled without breaking core platform functionality.
• Security Tokens: CSRF protection tokens and anti-replay tokens used to prevent common web attacks. Expire after each request and are rotated automatically.
• Preference Cookies: Optional cookies that remember your display preferences (e.g., map view settings). Can be cleared at any time without impacting core functionality.

No third-party analytics platforms (Google Analytics, Mixpanel, etc.) are loaded on the RSK.Systems platform. Internal analytics are conducted using server-side log analysis on anonymized data only.

RSK.Systems is an American company. Our primary infrastructure is located within the continental United States. Personal data collected by RSK.Systems is processed and stored within U.S. data centers operated by approved infrastructure providers.

• Data is not routinely transferred to servers outside the United States. In limited circumstances where operational resilience requires geographic redundancy, backup data may be stored in approved U.S. territory or allied-nation data centers under equivalent security controls.
• Any international transfer of personal data from users in jurisdictions with specific data transfer requirements (such as the EU/EEA) is conducted pursuant to applicable Standard Contractual Clauses or equivalent approved transfer mechanisms.
• RSK.Systems does not transfer personal data to countries lacking adequate data protection frameworks without explicit contractual safeguards.

For all privacy-related inquiries, requests, and complaints, contact the RSK.Systems Privacy Office directly. We do not use automated ticketing systems — your message is received by a human member of our operations team.

• For data subject rights requests, include your full name, organizational email on file, the specific right you wish to exercise, and any relevant details about the data in question.
• For security vulnerability reports, use subject line "Security Disclosure" and include a technical description of the issue. We commit to 24-hour acknowledgment and responsible remediation timelines.
• For complaints about our data handling practices, we request initial contact to allow us the opportunity to resolve the issue directly before escalation to regulatory authorities.

Document ID: RSK-PRIV-002 · Version 3.0 · © 2026 RSK.Systems™ · All Rights Reserved