Privacy Policy

Effective Date: 25 July 2026 Last Updated: 25 July 2026 Website: www.trancelance.com

1. INTRODUCTION AND SCOPE

1.1 Trancelance Services ("Trancelance", "we", "us" or "our") is a professional language services provider offering legal translation, website and mobile application localization, marketing translation and transcreation, and financial translation to clients worldwide.

1.2 We are committed to protecting the privacy and security of personal data. This Privacy Policy explains what personal data we collect, how and why we use it, with whom we share it, how long we keep it, how we protect it, and the rights available to you under applicable data protection laws.

1.3 This Privacy Policy applies to: (a) visitors to and users of the website at www.trancelance.com (the "Website"); (b) prospective, current and former clients and their personnel; (c) linguists, subcontractors, suppliers and applicants who deal with us; and (d) any other individual whose personal data we handle in the course of our business, other than personal data contained in client source materials, which is addressed at section 7.

1.4 This Privacy Policy does not apply to third-party websites, platforms or services that may be linked from the Website. We are not responsible for their privacy practices and encourage you to read their policies.

1.5 This Privacy Policy should be read together with our Terms and Conditions and our Cookie Policy.

2. WHO WE ARE AND HOW TO CONTACT US

2.1 For personal data collected through the Website and in the course of our client relationships, Trancelance Services is the data controller (and, under Indian law, the Data Fiduciary).

2.2 Our contact details are:

Trancelance Services

Address: G-23, South City Road, Gurgaon, Haryana, India

Email: contact@trancelance.com

Website: www.trancelance.com

2.3 Grievance Officer and Privacy Contact: [to be designated], contactable at contact@trancelance.com. All privacy queries, requests to exercise rights and complaints should be addressed to this contact.

2.4 We are not currently required to appoint a statutory Data Protection Officer. If that position changes, we will update this Privacy Policy with the relevant contact details. Where we are required to designate a representative in the European Union or the United Kingdom under Article 27 of the EU or UK General Data Protection Regulation, details will be published here.

3. DEFINITIONS

3.1 In this Privacy Policy:

"Personal data" means any information relating to an identified or identifiable natural person, and includes "personal information" and "personal data" as defined under applicable laws including the Indian Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the EU General Data Protection Regulation ("GDPR"), the UK GDPR and United States state privacy laws.
"Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer, erasure and destruction.
"Controller" (Data Fiduciary under the DPDP Act) means the party that determines the purposes and means of processing.
"Processor" (Data Processor under the DPDP Act) means a party that processes personal data on behalf of a controller.
"Source Material" means documents, files and content supplied to us by a client for translation, localization or related services.
"Sensitive personal data" means the special categories of personal data identified in Article 9 GDPR, sensitive personal data or information under the Indian Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and sensitive personal information as defined under applicable United States state privacy laws.

4. PERSONAL DATA WE COLLECT FROM YOU

4.1 Enquiry and contact form data. When you complete the contact or enquiry form on the Website, or contact us by email or messaging, we collect the information you choose to provide, which typically includes your name, email address, telephone number, company or organisation name, country, language pair required, service type, description of your requirement and any attachments or further details you supply.

4.2 Client relationship data. If you become a client or are a contact at a client, we collect contact details, job title, correspondence, project instructions, glossaries and preferences, quotation and order records, invoicing and billing contact details, bank or remittance references necessary to process payments, tax identification information where required, and records of complaints and feedback.

4.3 Supplier and linguist data. If you apply to work with us or supply services to us, we collect your name, contact details, curriculum vitae, qualifications, certifications, language pairs and specialisms, rates, references, test translations, contractual documents, tax and payment details and performance records.

4.4 Communications. We retain records of correspondence with you by email, contact form, telephone note, messaging application or otherwise, including the content of those communications.

4.5 Marketing data. Where you have subscribed or where permitted by law, we hold your marketing preferences and records of communications sent to you and your interaction with them.

4.6 Compliance data. We may hold information required for anti-money laundering, sanctions screening, conflict checking, tax and accounting compliance.

4.7 We do not sell products or process payments through the Website. We do not collect payment card details through the Website. Payments, where applicable, are made by bank transfer or other agreed method outside the Website.

4.8 Please do not submit sensitive personal data, confidential documents or third-party personal data through the Website contact form. Source Material should be exchanged only through the channels we agree with you after initial contact.

5. INFORMATION COLLECTED AUTOMATICALLY

5.1 When you visit the Website, our servers and, where deployed, our analytics and security providers may automatically collect: your Internet Protocol address, approximate location derived from that address, browser type and version, operating system and device type, screen resolution and language settings, referring website or source, pages viewed, time and duration of visit, clickstream and interaction data, and error and diagnostic logs.

5.2 This information is collected through server logs, cookies and similar technologies. Full details of the cookies used, their purpose and duration, and how to control them are set out in our Cookie Policy.

5.3 Some of this information may not identify you directly but may become personal data when combined with other information. We treat it as personal data where applicable law requires.

5.4 We do not knowingly use tracking technologies to build advertising profiles across third-party websites. Where any non-essential analytics or marketing technology is used, it is deployed only in accordance with the consent requirements described in the Cookie Policy.

6. COOKIES AND SIMILAR TECHNOLOGIES

6.1 We use cookies and similar technologies such as pixels, local storage and scripts to operate the Website, to keep it secure, to remember preferences and, where you consent, to understand how the Website is used.

6.2 Strictly necessary cookies are used without consent because the Website cannot function properly without them. All other categories are used only where you have given consent through our cookie banner or preference tool, where such consent is required by law, and consent may be withdrawn at any time.

6.3 Please see our Cookie Policy for the full list of cookie categories, purposes, retention periods and instructions for managing your choices in your browser and through our consent tool.

7. PERSONAL DATA CONTAINED IN CLIENT SOURCE MATERIALS

7.1 Source Material sent to us for translation or localization frequently contains personal data relating to third parties, including parties to contracts, litigants, witnesses, employees, patients, applicants, shareholders and customers of our clients.

7.2 In relation to that personal data, our client is the controller (Data Fiduciary) and Trancelance acts as a processor (Data Processor) acting on the documented instructions of the client. We do not determine the purposes for which that data is processed and we do not use it for our own purposes.

7.3 As processor we: process such personal data only to perform the agreed services; impose written confidentiality obligations on all employees, linguists, reviewers and subcontractors who access it; apply appropriate technical and organisational security measures; use sub-processors only under equivalent contractual obligations; assist the client with data subject requests and security incidents so far as reasonably practicable; notify the client without undue delay of any personal data breach affecting its data; and delete or return the data on completion of the engagement, subject to legal retention obligations and routine encrypted backups.

7.4 If you are an individual whose personal data appears in a document sent to us by one of our clients and you wish to exercise your rights, you should contact that client, who is the controller. If you contact us, we will, where lawful and practicable, refer your request to the relevant client rather than act on it directly.

7.5 We ask all clients to redact, anonymise or minimise personal data in Source Material wherever the purpose of the project permits.

8. HOW AND WHY WE USE YOUR PERSONAL DATA

8.1 We use personal data for the following purposes:

to respond to enquiries submitted through the Website, by email or otherwise, and to prepare and issue quotations;
to negotiate, enter into and perform contracts for our services, including project management, communication, delivery and support;
to assign work to suitably qualified linguists and subcontractors and to manage quality assurance and review;
to maintain client accounts, records, translation memories and terminology assets;
to invoice, collect payment, maintain accounting records and manage credit control and debt recovery;
to operate, maintain, secure, improve and troubleshoot the Website and our systems;
to detect, investigate and prevent fraud, unauthorised access, misuse and other unlawful activity;
to send service communications and, where permitted, relevant marketing communications about our services;
to recruit, engage, assess and manage linguists, suppliers and subcontractors;
to comply with legal, regulatory, tax, accounting and record-keeping obligations, and to respond to lawful requests from authorities;
to establish, exercise or defend legal claims and to obtain professional advice;
to conduct internal business analysis, planning, quality management and process improvement, including in support of our quality management framework.

8.2 We will use personal data only for the purposes for which it was collected, unless we reasonably consider that another purpose is compatible with the original purpose, or as otherwise permitted or required by law. Where we need to use personal data for an unrelated purpose, we will notify you and, where required, obtain your consent.

9. LEGAL BASES FOR PROCESSING UNDER THE GDPR AND UK GDPR

9.1 Where the GDPR or UK GDPR applies to our processing, we rely on the following legal bases:

Performance of a contract, or steps taken at your request before entering into a contract: to respond to enquiries, prepare quotations, deliver services, manage projects and process payments.
Legitimate interests: to operate and secure the Website, to manage and develop our client and supplier relationships, to market our services to business contacts, to conduct quality management and business analysis, to prevent fraud and misuse, and to protect our legal position. We balance these interests against your rights and freedoms and do not rely on this basis where your interests override ours.
Compliance with a legal obligation: to meet tax, accounting, statutory record-keeping, anti-money laundering and other regulatory requirements, and to respond to lawful requests from public authorities.
Consent: for non-essential cookies and analytics, for certain direct marketing communications where consent is required, and for any processing of special category data that is not otherwise permitted. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
Establishment, exercise or defence of legal claims, and other applicable exemptions, where relevant.

9.2 Where we act as processor in respect of Source Material, the legal basis is determined by our client as controller.

10. LEGAL BASIS AND NOTICE UNDER INDIAN LAW

10.1 As a business established in India, we process personal data in accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, together with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, as applicable and as brought into force.

10.2 Where we rely on consent under the DPDP Act, this Privacy Policy, together with any consent notice presented at the point of collection, constitutes the notice required under that Act. It informs you of the personal data to be processed, the purposes of processing, the manner in which you may exercise your rights, and the manner in which you may make a complaint to the Data Protection Board of India.

10.3 Consent given to us is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose. You may withdraw your consent at any time by contacting our Grievance Officer at contact@trancelance.com, with the same ease with which it was given. Withdrawal does not affect the lawfulness of processing carried out before withdrawal and may prevent us from continuing to provide services to you.

10.4 We also process certain personal data for legitimate uses recognised under the DPDP Act, including where you have voluntarily provided personal data for a specified purpose, for compliance with law or judgment, and for the performance of a legal obligation.

10.5 We do not process the personal data of children under Indian law, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

11. SENSITIVE AND SPECIAL CATEGORY PERSONAL DATA

11.1 We do not seek sensitive or special category personal data through the Website contact form and ask that you do not submit it.

11.2 Source Material provided by clients may contain sensitive personal data, for example health information in medical or insurance documents, criminal offence data in litigation or immigration files, biometric or identity data in official documents, and financial information. Where this occurs we process it strictly as processor on our client instructions, apply enhanced confidentiality and access controls, restrict access to the linguists directly assigned to the project, and rely on our client to ensure that a valid legal basis and, where required, explicit consent is in place.

11.3 We do not use sensitive personal data for marketing, profiling, model training or any purpose of our own.

12. MARKETING COMMUNICATIONS

12.1 We may send you information about our services where you have requested it, where you are an existing client and the communication relates to similar services, or where you have otherwise consented in accordance with applicable law.

12.2 Every marketing email includes an unsubscribe mechanism. You may also opt out at any time by contacting us at contact@trancelance.com. Opting out of marketing does not affect service communications relating to a project, quotation, invoice or legal notice, which are necessary for the performance of our contract.

12.3 We do not sell, rent or trade personal data to third parties for their own marketing purposes.

13. DISCLOSURE OF PERSONAL DATA

13.1 We may disclose personal data to:

our employees, project managers and internal reviewers, on a need-to-know basis;
linguists, translators, revisers, proofreaders, subject-matter experts, desktop publishing specialists and partner agencies engaged to deliver the services, who may be located in India or in other countries;
service providers who support our business, including information technology, hosting, cloud storage, email, secure file transfer, translation management and computer-assisted translation platforms, website analytics, backup and cybersecurity providers;
professional advisers, including lawyers, auditors, accountants and insurers, where necessary;
banks and payment processing intermediaries, for the purpose of receiving payment;
notaries, courts, registries and competent authorities, where expressly instructed by a client in connection with certification or legalisation;
regulators, law enforcement, courts and government bodies, where required by law, court order or lawful request, or to establish, exercise or defend legal claims;
a purchaser or prospective purchaser in connection with any sale, merger, reorganisation or transfer of all or part of our business, subject to appropriate confidentiality protections.

13.2 All linguists, subcontractors and service providers with access to personal data are bound by written confidentiality and data protection obligations, and are permitted to process the data only for the purposes for which we have engaged them.

13.3 We do not sell personal data and we do not share personal data for cross-context behavioural advertising.

14. SERVICE PROVIDERS AND SUB-PROCESSORS

14.1 We select service providers and sub-processors on the basis of their ability to provide sufficient guarantees in relation to technical and organisational security measures, confidentiality and legal compliance.

14.2 We enter into written agreements with our sub-processors imposing obligations equivalent to those to which we are subject, including confidentiality, security, restrictions on onward transfer, assistance with data subject rights, breach notification and deletion or return of data on termination.

14.3 Clients may request a current list of the categories of sub-processors used in connection with their projects by contacting us at contact@trancelance.com.

14.4 We remain responsible to our clients for the acts and omissions of our sub-processors in relation to the processing of personal data on our clients behalf.

15. INTERNATIONAL TRANSFERS OF PERSONAL DATA

15.1 We are based in India and we serve clients globally. Personal data provided to us will be processed in India and may be transferred to, stored in and accessed from other countries in which our linguists, subcontractors, service providers and cloud infrastructure operate.

15.2 Some of these countries may not provide the same level of protection for personal data as the country in which you are located, and may not have been the subject of an adequacy decision by the European Commission, the United Kingdom government or any other authority.

15.3 Where we transfer personal data originating in the European Economic Area or the United Kingdom to a country without an adequacy decision, we implement appropriate safeguards, which may include the European Commission Standard Contractual Clauses, the United Kingdom International Data Transfer Agreement or Addendum, supplementary technical and organisational measures such as encryption in transit and at rest and access restriction, and a transfer risk assessment where required.

15.4 Transfers of personal data out of India are made in accordance with the DPDP Act and any restrictions notified by the Central Government from time to time.

15.5 You may request a copy of the relevant transfer safeguards by contacting us at contact@trancelance.com, subject to redaction of commercially confidential information.

16. DATA RETENTION

16.1 We retain personal data only for as long as is necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, regulatory and reporting requirements and to establish, exercise or defend legal claims.

16.2 Our general retention practice is as follows, subject to any specific instruction agreed with a client:

Website enquiries that do not result in an engagement: up to twenty-four (24) months from last contact.
Client contact, correspondence and project records: for the duration of the relationship and for up to eight (8) years after the last project, to meet contractual, tax and limitation requirements.
Source Material and Deliverables: retained for the period agreed with the client, and in the absence of agreement for up to twelve (12) months after delivery, after which they are deleted from active systems, subject to secure encrypted backups which are cycled in the ordinary course.
Translation memories and terminology databases: retained for the duration of the client relationship for consistency purposes, and deleted on written request in accordance with our Terms and Conditions.
Invoices, accounting and tax records: for the period required by applicable law, ordinarily eight (8) years.
Linguist and supplier records: for the duration of the relationship and for up to six (6) years thereafter.
Marketing records and consent evidence: until you unsubscribe and for a reasonable period thereafter to evidence compliance.

16.3 Where a client instructs us to delete Source Material immediately on completion of a project, we will do so, subject to backup cycling and to any legal obligation to retain.

16.4 When personal data is no longer required, it is securely deleted, destroyed or irreversibly anonymised.

17. DATA SECURITY

17.1 We implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, alteration, disclosure or access. These include encryption of data in transit and, where appropriate, at rest; access controls applied on a least-privilege and need-to-know basis; individual user credentials and, where available, multi-factor authentication; secure file transfer for Source Material and Deliverables; confidentiality and non-disclosure obligations binding on all personnel and subcontractors; vetting of linguists and subcontractors; secure backup and recovery arrangements; malware protection and patching; and internal policies and staff awareness training.

17.2 No method of transmission over the internet or of electronic storage is completely secure. While we take reasonable steps to protect personal data, we cannot guarantee absolute security, and any transmission to us is at your own risk. Email is not a secure medium and we encourage the use of the secure transfer channels we make available for confidential material.

17.3 We maintain procedures to detect, investigate, contain and remediate personal data breaches. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority and, where required, affected individuals and our clients, within the timeframes prescribed by applicable law.

17.4 You are responsible for maintaining the confidentiality of any credentials or access links we provide to you and for the security of your own devices, networks and email accounts.

18. YOUR RIGHTS UNDER THE GDPR AND UK GDPR

18.1 If the GDPR or UK GDPR applies to the processing of your personal data, you have the following rights:

Right of access: to obtain confirmation as to whether we process your personal data and a copy of that data together with prescribed information.
Right to rectification: to have inaccurate personal data corrected and incomplete data completed.
Right to erasure: to have your personal data deleted where one of the grounds set out in law applies.
Right to restriction of processing: to require us to suspend processing in defined circumstances.
Right to data portability: to receive personal data you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means.
Right to object: to object to processing based on our legitimate interests, and an absolute right to object to processing for direct marketing purposes.
Right to withdraw consent: at any time, where processing is based on consent.
Right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects.
Right to lodge a complaint with a supervisory authority in your country of residence, place of work or place of the alleged infringement.

18.2 To exercise any right, contact us at contact@trancelance.com. We may request information to verify your identity. We will respond within one (1) month, which may be extended by a further two (2) months where the request is complex or numerous, in which case we will inform you within the first month.

18.3 Exercising your rights is free of charge. We may charge a reasonable fee, or refuse to act, where a request is manifestly unfounded or excessive, and we will explain our reasons.

18.4 Where we process your personal data as a processor on behalf of a client, we will refer your request to that client as controller.

19. YOUR RIGHTS UNDER INDIAN LAW

19.1 Where the DPDP Act applies, you (as a Data Principal) have the right to: obtain a summary of the personal data being processed and of the processing activities undertaken; obtain the identities of other Data Fiduciaries and Data Processors with whom your personal data has been shared, together with a description of the data shared; request correction, completion, updating and erasure of your personal data; nominate another individual to exercise your rights in the event of death or incapacity; and have access to a readily available grievance redressal mechanism.

19.2 You also have duties under the DPDP Act, including not to impersonate another person when providing personal data, not to suppress material information, not to register a false or frivolous grievance or complaint, and to furnish only authentic information when seeking correction or erasure.

19.3 To exercise your rights or raise a grievance, contact our Grievance Officer at contact@trancelance.com. We will acknowledge your grievance promptly and respond within the period prescribed by applicable law.

19.4 If you are not satisfied with our response, you may complain to the Data Protection Board of India in accordance with the DPDP Act.

20. YOUR RIGHTS UNDER UNITED STATES STATE PRIVACY LAWS

20.1 If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas or another United States state with a comprehensive privacy law, you may have the following rights, subject to the conditions and exceptions of the applicable statute: the right to know or access the categories and specific pieces of personal information collected, the sources, the business purposes and the categories of recipients; the right to correct inaccurate personal information; the right to delete personal information; the right to obtain a copy of your personal information in a portable format; the right to opt out of the sale or sharing of personal information and of targeted advertising; the right to limit the use and disclosure of sensitive personal information; the right to opt out of profiling that produces legal or similarly significant effects; and the right not to receive discriminatory treatment for exercising any of these rights.

20.2 Categories of personal information we may have collected in the preceding twelve (12) months, using California statutory categories, are: identifiers (name, email address, telephone number, Internet Protocol address); commercial information (services enquired about or purchased); internet or other electronic network activity information; approximate geolocation data derived from Internet Protocol address; professional or employment-related information; and, in respect of client Source Material processed on behalf of our clients, potentially any category contained in that material. The sources, purposes and recipients are described in sections 4, 5, 8 and 13.

20.3 We do not sell personal information and we do not share personal information for cross-context behavioural advertising, and we have not done so in the preceding twelve (12) months. We do not knowingly sell or share the personal information of consumers under sixteen (16) years of age.

20.4 We use and disclose sensitive personal information only for the purposes permitted without a right to limit under applicable law, and only where such information is contained in client Source Material processed as a service provider.

20.5 Where we process personal information contained in client Source Material, we act as a service provider or processor under these laws and process the information only for the business purpose of providing our services.

20.6 To exercise your rights, contact us at contact@trancelance.com. You may use an authorised agent, in which case we may require proof of authorisation and verification of your identity. We will respond within the statutory period, ordinarily forty-five (45) days, extendable where permitted. If we deny a request, you may appeal by writing to the same address, and we will respond to the appeal within the period required by the applicable law.

21. AUTOMATED DECISION-MAKING AND PROFILING

21.1 We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing.

21.2 We use computer-assisted translation tools, translation memory systems and quality assurance software as productivity aids under human supervision. These tools do not make decisions about individuals.

21.3 We do not use personal data or client Source Material to train, fine-tune, evaluate or develop any machine learning model or generative artificial intelligence system, and we contractually prohibit our linguists and subcontractors from doing so. Where a client expressly requests the use of machine translation or artificial intelligence-assisted workflows for a project, this is agreed in writing in advance and applied only to that project.

22. CHILDREN AND MINORS

22.1 The Website and our services are intended for business users and adults. They are not directed at children and we do not knowingly collect personal data from any individual under the age of eighteen (18).

22.2 We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

22.3 If we become aware that we have collected personal data from a child without appropriate verifiable parental or guardian consent where required, we will delete that data promptly. If you believe a child has provided us with personal data, please contact us at contact@trancelance.com.

22.4 Where client Source Material contains personal data relating to minors, for example in family law, education, immigration or medical documents, our client remains the controller and is responsible for the lawful basis for that processing. We handle such data as processor with enhanced confidentiality controls.

23. THIRD-PARTY LINKS AND EXTERNAL PLATFORMS

23.1 The Website may contain links to third-party websites, social media pages, plug-ins and applications. Clicking on or enabling those links or connections may allow third parties to collect or share data about you.

23.2 We do not control third-party websites or services and are not responsible for their privacy statements or practices. We encourage you to read the privacy policy of every website and service you visit or use.

23.3 Where we communicate with you through third-party platforms such as email providers, messaging applications or professional networks, the privacy practices of those platforms apply in addition to this Privacy Policy.

24. CHANGES TO THIS PRIVACY POLICY

24.1 We may update this Privacy Policy from time to time to reflect changes in our practices, in the services we offer, or in legal or regulatory requirements.

24.2 The date at the top of this Privacy Policy indicates when it was last revised. The current version is always available at www.trancelance.com.

24.3 Where a change is material, we will take reasonable steps to bring it to your attention, for example by a notice on the Website or, where appropriate, by email. Where required by law, we will obtain your consent to the change.

24.4 We encourage you to review this Privacy Policy periodically. Your continued use of the Website after any change takes effect constitutes acknowledgement of the revised Privacy Policy to the extent permitted by law.

25. COMPLAINTS AND HOW TO CONTACT US

25.1 If you have any question, request or concern regarding this Privacy Policy or our handling of personal data, please contact us in the first instance:

Trancelance Services

Grievance Officer and Privacy Contact: [to be designated] — contact@trancelance.com

Email: contact@trancelance.com

Address: G-23, South City Road, Gurgaon, Haryana, India

Website: www.trancelance.com

25.2 We take all privacy concerns seriously and aim to acknowledge your communication within two (2) business days and to resolve it promptly.

25.3 You also have the right to complain to a supervisory authority. In India, this is the Data Protection Board of India. In the European Economic Area, this is the supervisory authority in your country of residence, place of work or place of the alleged infringement. In the United Kingdom, this is the Information Commissioner Office. In the United States, this may be your state Attorney General. We would, however, appreciate the opportunity to address your concerns before you approach a regulator.