01. Controller, scope and contact
Service provider / controller: WHITE TOWER CONSULTING LLC
U.S. federal EIN: 39-3421389
Mailing address on the IRS notice: 30 N Gould St, Ste R, Sheridan, WY 82801, United States.
Website: https://wt365.org
Customer support, complaints and privacy email: info@wt365.org
Telephone: +1 786 448 5077
WHITE TOWER CONSULTING LLC is responsible for personal data processed through its site, enquiries, purchases and professional-service delivery. An IRS EIN letter identifies the company but does not establish the location of every operational activity. The GDPR may apply where processing occurs in the context of an EU establishment or where a non-EU controller offers services to individuals in the EU, subject to Article 3 GDPR. Incorporation in the United States does not automatically exempt a company from EU privacy rules.
If White Tower is required to appoint an EU representative under GDPR Article 27, the appointed representative’s identity and contact details will be disclosed through the appropriate channels and this Policy updated. Our direct contact at info@wt365.org is not a substitute for formally appointing an EU representative when required.
02. Data subjects and how data are obtained
We may process information about website visitors, prospective customers, individual customers, company contacts, owners, authorized advisers and attorneys. Data come from forms, email, meetings, uploaded records, payment events, documents submitted lawfully by customers or advisers, business registers and other publicly available sources. Customers providing third-party personal information must have an appropriate basis to share it and cooperate with any applicable notice requirements.
03. Personal-data categories
- Identity and communications: name, position, organization, email, phone, address, nationality where relevant and authorized representative information.
- Immigration and residency cases: résumé, identification or passport information where needed, employment history, immigration records, location, and spouse/dependant records when a family-related service is contracted.
- Business and investment: corporate structure, declared investment/source of funds, management and staffing data, revenues, accounts, seller disclosures, CIMs, financial and tax records supplied.
- Transactions: service requested, quotation, fee, currency, tax and billing information, masked card/payment identifiers, Stripe transaction events, refunds and disputes.
- Online operation: IP address, device/browser data, operational logs and cookie preferences reflecting the tools actually used.
- Marketing: preferences, opt-in records and suppression/opt-out records.
Please do not submit medical, religious, criminal-conviction or other special-category information without a specific request. If an exceptional service requires it, we must first identify an appropriate legal condition under GDPR Article 9, provide enhanced notice, minimize collection and supply a suitably secure transmission method.
04. Purposes and lawful bases
| Activity | Purpose | GDPR legal basis |
|---|---|---|
| Enquiries and quotes | Answer enquiries and prepare quotes | Art. 6(1)(b), where requested pre-contractual steps; or 6(1)(f), for proportionate corporate enquiries. |
| Service projects | Prepare reports, case-support material and deliverables | Art. 6(1)(b) for customers; as appropriate 6(1)(f) or 6(1)(c) for third parties. |
| Billing and payments | Take payments, issue bills, comply with tax law | Art. 6(1)(b) and/or 6(1)(c). |
| Website security | Prevent fraud and protect rights | Art. 6(1)(f) and relevant legal duties. |
| Commercial email | Send permitted updates and offers | Art. 6(1)(a), or lawful soft-opt-in for similar own services where conditions are met. |
| Non-essential analytics | Measure website usage with non-exempt cookies | Prior consent when legally required. |
| Complaints and claims | Investigate complaints and protect lawful rights | Art. 6(1)(f) and/or 6(1)(c). |
Legitimate interests will be balanced against individual rights where relied upon. Marketing consent is optional and is not a condition of the main service. Required fields will be identified at collection: a missing essential document may make it impossible to complete an assignment.
05. Dependants, third parties and sensitive case records
Family immigration assignments may require information concerning children. We will only request relevant material, respect the rights of minors and their lawful guardians, and restrict access to records. Due-diligence reports may include personal data relating to sellers, employees or directors. Information should be aggregated or de-identified where individual identification is not necessary. Passports, bank statements and immigration case files must be uploaded only through designated secure channels.
06. Stripe and payment processing
Online payments may be processed by Stripe. Depending on the activity, Stripe acts as our data processor or as an independent controller for payment-network operations, fraud prevention and legal compliance. We receive references, status and billing information necessary for order management, but do not need to hold full payment-card numbers or CVV codes. Stripe may handle identity, payment, device and transaction records under its own notices and Data Processing Agreement: https://stripe.com/privacy and https://stripe.com/legal/dpa .
07. Processors, advisers and other recipients
Data may be accessed as necessary by website hosting, professional email, secure storage, customer support, project-management providers, Stripe/banking partners, accounting advisers, confidentiality-bound contractors, attorneys expressly authorized by the client and public authorities where lawfully required. Processor arrangements will be established where GDPR Article 28 applies.
The recipient categories above refer only to vendors actually involved in the operation. Individuals may request information about specific recipients and their functions from info@wt365.org. We do not sell personal-data lists. A click on the external Feather Insurance link takes visitors to a separately operated site; it does not necessarily involve us transmitting the client’s underlying case file. If affiliate tracking or leads are actually transferred, they must be specifically disclosed beforehand.
08. International processing and transfers
As a U.S.-based business serving customers globally, including in Spain and the European Union, White Tower may process records in the United States and lawfully disclose them to customers and expressly authorized advisers in other countries. Where a disclosure constitutes a restricted international transfer under GDPR Chapter V, an applicable adequacy decision, standard contractual clauses with appropriate supplementary measures or a narrowly applicable derogation will be used. On request, we will provide relevant information about verified recipients, countries and safeguards. The exact transfer map depends on the providers and operating setup that are ultimately deployed.
09. Retention and deletion
We keep enquiries only as long as needed for a reasonable response and follow-up; project data during performance and for applicable tax, accounting, regulatory and legal-claim periods thereafter; invoices for the legally required period; marketing details until consent is withdrawn or objection is made, retaining minimal suppression records when needed; and technical logs for a risk-proportionate period. When no longer required, data are deleted, anonymized or lawfully restricted. Specific retention periods depend on the applicable tax, corporate and contractual rules in the relevant jurisdictions.
10. Security and incidents
Controls are proportionate to processing risks and may include role-based access, multifactor authentication, transmission encryption, limited shared-folder permissions, backups and secure deletion. Data-security incidents will be assessed and, where legally required, reported to the competent authority and affected people within the applicable GDPR deadlines. Customers should avoid sending sensitive documents through insecure open forms or unnecessary email attachments.
11. GDPR rights and regulator complaints
Where GDPR applies, individuals may request access, correction, erasure, restriction, portability where applicable and objection to relevant legitimate-interest processing or direct marketing. They may withdraw consent prospectively and exercise rights concerning qualifying solely automated decisions. Send requests to info@wt365.org. We may perform proportionate identity checks and normally reply within one month, subject to lawful extensions.
Individuals may lodge a complaint with their competent supervisory authority, including the Spanish Data Protection Agency where appropriate: https://www.aepd.es .
12. Cookies and direct marketing
Strictly necessary cookies may be deployed subject to legal exemptions. Non-exempt analytics, advertising and third-party cookies must not activate before valid consent is obtained; the interface should offer accept, reject and appropriate configuration controls in an equally accessible manner as legally required. A separate current Cookie Policy must identify actual cookies, providers, lifetimes, purposes and withdrawal mechanisms. Accepting Terms is not consent to advertising or non-essential tracking. Promotional emails are subject to an applicable lawful basis and easy opt-out.
13. Automated decision-making
White Tower does not state that its consultancy makes solely automated decisions producing legal or similarly significant effects. External payment providers such as Stripe may undertake automated fraud detection under their respective roles. If White Tower later introduces profiling or automated decisions, this notice and any additional Article 22 information will be updated before processing begins.
14. Accuracy, reuse and updates
Please keep personal details current. Access to case materials is restricted to authorized persons. We will not publicly identify client projects or repurpose case files to train systems without an appropriate lawful basis and safeguards. Material changes in processing or purpose will be notified and fresh consent sought when legally necessary. The most recent policy version will be made available on the website.
15. Privacy and communications for U.S. customers
Where a U.S. state privacy law applies to White Tower and the individual, additional rights may exist to know about, access, correct, delete or receive personal data, or to opt out of specified activities, subject to that law’s conditions and exceptions. Requests may be sent to info@wt365.org and will be processed under applicable verification and response requirements. U.S. commercial marketing email will identify the sender and provide an effective opt-out mechanism in accordance with applicable law, including CAN-SPAM.
16. Privacy contact
WHITE TOWER CONSULTING LLC, EIN 39-3421389. IRS-notice mailing address: 30 N Gould St, Ste R, Sheridan, WY 82801, United States. Privacy contact: info@wt365.org. Website: https://wt365.org. Phone: +1 786 448 5077.