Privacy Policy

2.1 Information You Provide Directly

We collect information that you voluntarily provide to us, including:

3.1 Providing Services

• Processing your enrollment and service agreements
• Conducting credit report analysis and identifying disputed items
• Preparing and submitting dispute letters to credit bureaus and creditors
• Facilitating business funding applications and connecting you with lending partners
• Providing credit monitoring services through SmartCredit®
• Delivering DIY credit repair training materials and resources
• Offering financial consulting and personalized action plans
• Connecting you with life insurance carriers
• Calculating debt-to-income ratios and creating financial strategies
• Managing your client portal account and access
• Processing payments and billing
• Providing customer support and responding to inquiries

4.1 Service Partners (As Needed)

We share information with trusted service partners only when necessary to provide services you have requested.

5.1 Types of Cookies We Use

8.1 Security Measures

• Encryption: SSL/TLS encryption for data transmission
• Secure Storage: Encrypted databases and secure cloud storage
• Access Controls: Role-based access restrictions and multi-factor authentication
• Firewalls: Network security and intrusion detection systems
• Regular Security Audits: Vulnerability assessments and penetration testing
• Employee Training: Ongoing security awareness and privacy training
• Secure Payment Processing: PCI-DSS compliant payment processors

Retention Periods:

• Active Clients: Information retained for the duration of the service relationship
• Inactive Clients: Information retained for seven (7) years after termination, which exceeds the five (5) year minimum required by the Telemarketing Sales Rule (TSR), to satisfy legal, tax, and recordkeeping obligations
• Credit Reports: Retained as required by FCRA and CROA
• Financial Records: Retained for seven (7) years (IRS requirements)
• Marketing Data: Retained until you opt out or request deletion

After retention periods expire, we securely delete or anonymize your information. We may retain residual copies in backup systems for a limited time for disaster recovery purposes.

10.1 General Rights

Subject to applicable law, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your information (subject to legal retention requirements)
• Opt-Out: Unsubscribe from marketing emails and SMS messages
• Withdraw Consent: Withdraw consent for data processing where consent is the legal basis

10.4 Exercising Your Rights

To exercise your privacy rights, contact us:

• Email: compliance@mesagroupconsulting.com
• Phone: 661-310-3040

• Mail:

  Mesa Group Consulting, Attn: Compliance Department

  5001 California Ave, Suite 219

  Bakersfield, CA 93309

We will respond to your request within thirty (30) days, or within forty-five (45) days where required by applicable law (such as CCPA). If we need additional time, we will notify you within the initial response period and may extend the response period by up to forty-five (45) additional days.

We may require verification of your identity before processing requests. Verification may include matching information you provide against our records, requesting government identification, or using knowledge-based authentication.

To authorize an agent, the agent must provide:

• Written authorization signed by you (notarized authorization is preferred and may be required for certain requests)
• A copy of the agent's government-issued identification
• Sufficient information about you to allow us to verify your identity

Submission methods:

• Email: compliance@mesagroupconsulting.com (with required documents attached)

• Mail: Mesa Group Consulting, Attn: Compliance Department — Authorized Agent Request

  5001 California Ave, Suite 219

  Bakersfield, CA 93309

Third-Party Services We Link To:

• SmartCredit® (credit monitoring)
• Lending partners (business funding)
• Life insurance carriers
• Social media platforms (Facebook, Instagram, TikTok, YouTube, X/Twitter, LinkedIn)
• Educational resources and tools

14.1 California Residents

California residents have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information held by a business
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information
• Right to limit use and disclosure of sensitive personal information
• Right to non-discrimination for exercising privacy rights

Full California rights detail appears in Section 14 of this Privacy Policy.

14.2 Nevada Residents

Under Nevada Revised Statutes Chapter 603A, Nevada residents have the right to opt out of the sale of certain personal information. Mesa Group Consulting does not sell personal information as defined under Nevada law. To submit any opt-out or privacy request, contact us at compliance@mesagroupconsulting.com or 661-310-3040.

14.3 Colorado Residents

Under the Colorado Privacy Act (CPA), Colorado residents have the right to:

• Access personal data
• Correct inaccuracies
• Delete personal data
• Obtain personal data in a portable format
• Opt out of targeted advertising, sale of personal data, and certain profiling

To exercise these rights, contact compliance@mesagroupconsulting.com.

14.4 Virginia Residents

Under the Virginia Consumer Data Protection Act (VCDPA), Virginia residents have similar rights to those listed for Colorado residents above, including access, correction, deletion, portability, and opt-out rights. To exercise these rights, contact compliance@mesagroupconsulting.com.

14.5 Connecticut Residents

Under the Connecticut Data Privacy Act (CTDPA), Connecticut residents have the right to access, correct, delete, port, and opt out of the sale of personal data and targeted advertising. To exercise these rights, contact compliance@mesagroupconsulting.com.

14.6 Utah Residents

Under the Utah Consumer Privacy Act (UCPA), Utah residents have the right to access, delete, port, and opt out of the sale of personal data and targeted advertising. To exercise these rights, contact compliance@mesagroupconsulting.com.

14.7 Texas Residents

Under the Texas Data Privacy and Security Act (TDPSA), Texas residents have the right to access, correct, delete, port, and opt out of the sale of personal data, targeted advertising, and certain profiling. To exercise these rights, contact compliance@mesagroupconsulting.com.

14.8 Other States

Residents of other states with comprehensive privacy laws (including but not limited to Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, and Tennessee) may have rights similar to those described above. To exercise any state-law privacy right, contact compliance@mesagroupconsulting.com.