Last updated: October 2026
This Privacy Policy ("Policy") explains how Sequel Services, LLC, doing business as Achieved Compliance Solutions ("Achieved," "we," "us," or "our"), processes information relating to an identified or identifiable individual ("Personal Data") in the course of our business and through our website, achievedcompliance.com (the "Website").
Achieved is a United States business-to-business company providing privacy and data protection compliance services, including virtual data protection officer ("vDPO") services on a global basis, outsourced privacy office, privacy consulting, and solutions implementation. We do not direct our business development to organizations in the European Union ("EU"), the United Kingdom ("UK"), or Switzerland. Any processing of Personal Data of individuals in those jurisdictions is incidental to our client services, for example where a client's personnel are located there, where we help a client respond to a request from an individual there, where an individual there visits our Website or contacts us, or an affiliate has personnel in those jurisdictions.
Achieved Compliance Advocacy ("ACA") is a separate, affiliated company that acts as a representative under Article 27 of the EU General Data Protection Regulation and the UK GDPR for organizations not established in the EU or the UK. The UK and EU office locations shown on our Website are ACA's. ACA is responsible for the Personal Data it processes, as described in its own privacy notice [insert link]. Questions about ACA may be sent to achieved@gdprrepresentative.eu.
We process Personal Data in two capacities.
As controller. We determine how and why we process Personal Data for our own business purposes, such as the contact details of clients, prospective clients, Website visitors, newsletter subscribers, and service providers. This Policy principally describes that processing.
As service provider, processor, or sub-processor. In limited circumstances we process Personal Data on behalf of a client, generally limited to data subject access and other individual rights requests ("DSARs") that we receive, log, route, track, or help the client answer. The client determines the purposes and means of that processing, and we act only on its documented instructions under a written agreement. We act in the same capacity when we provide processing infrastructure to our affiliates, including ACA, and process Personal Data on their behalf. If you have submitted a request to one of our clients, please contact that client directly; we will refer to the client any request we receive about its data.
We principally collect business contact information and information about our clients' internal privacy programs:
Client and business contact information. Name, job title, employer, business email address, telephone number, mailing address, and records of our correspondence and meetings.
Privacy program information. Data inventories, records of processing, assessments, vendor lists, sub-processor contracts, and similar materials our clients provide, which may incidentally include the names, roles, and contact details of client personnel.
DSAR information. When we act for a client, the requester's name, contact details, request, verification information, and related correspondence.
Website inquiries and appointment requests. Information you submit through our contact or "Ask Us Your Questions" forms (name, email address, telephone number, company, and message) or when you book a consultation through our online scheduling tool, and your marketing preference if you check the opt-in box.
Newsletter subscriptions. Your name and email address, and whether you open or click on our emails.
Billing information. Records of services provided, invoices, and payment history. We do not collect payment card information through our Website.
Website usage information. IP address, browser and device type, approximate location, referring page, and pages viewed, as described in Section E.
Service provider and contractor information. Contact, contracting, and payment details of those who provide services to us.
We do not knowingly collect sensitive Personal Data for our own purposes. Where it appears in a DSAR or client materials, we handle it solely on the client's instructions.
We collect Personal Data:
We use cookies only for logistical and analytical purposes: strictly necessary cookies that allow the Website, its forms, and its scheduling features to function, and analytics cookies (such as Google Analytics) that show us in aggregate how the Website is used. We do not use advertising cookies or use analytics data to identify individual visitors. You can manage cookies through your browser or the cookie settings link on our Website. See our Cookie Policy for details.
We use Personal Data to:
We do not make decisions based solely on automated processing that produce legal or similarly significant effects.
We do not sell Personal Data or share it for cross-context behavioral or targeted advertising, and we do not disclose client information to third parties for their own purposes. We disclose Personal Data only to:
Service providers. Providers of website hosting and forms, appointment scheduling, newsletter delivery, website analytics, cloud storage, email and productivity tools (including enterprise artificial intelligence tools whose terms prohibit training on our data), managed IT, accounting, privacy consulting, support services, and office administration. They may use Personal Data only to perform services for us, on our instructions, and subject to written confidentiality and security obligations.
Affiliates. Entities under common ownership or control with Achieved, including ACA and Sequel Technology Law, L.P. where necessary to support our services or under a services agreement.
Our clients. When we act as a service provider, the client on whose behalf we handle a DSAR.
Legal and safety recipients. Courts, regulators, law enforcement, or others where required by law or reasonably necessary to protect our rights, property, or safety, or those of others.
Business transferees. A buyer, investor, or successor and their advisers, in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to confidentiality protections.
Others with your consent. Any other party where you direct or consent to the disclosure.
Personal Data is stored primarily in the United States on secure, professionally managed systems. Some of our personnel are located in the EU and the UK and may access Personal Data from there when performing services for Achieved. We protect cross-border transfers with contractual and other measures appropriate to the jurisdiction. Where Personal Data received by ACA in the EU or the UK is processed on infrastructure Achieved provides in the United States, the transfer is made under the European Commission's standard contractual clauses and, for UK data, the UK International Data Transfer Addendum, or another valid transfer mechanism.
We maintain administrative, technical, and physical safeguards appropriate to the Personal Data we hold, including access controls, encryption where appropriate, managed systems, confidentiality obligations, and written data-handling policies. Personnel and subcontractors may access Personal Data only on managed systems or password-protected devices. No system is completely secure, but we work to protect Personal Data against loss, misuse, and unauthorized access, disclosure, alteration, and destruction.
We keep Personal Data only as long as reasonably necessary for the purposes described in this Policy, including to maintain business and financial records and meet legal and contractual obligations. Client data is returned or deleted in accordance with our agreement with that client. Website inquiries that do not lead to an engagement are deleted when no longer needed. If you unsubscribe from our newsletter, we keep only what is needed to honor that request.
Marketing communications. You may unsubscribe at any time using the link in any email or by contacting us at info@achievedcompliance.com.
Requests about your Personal Data. Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your Personal Data, to object to or restrict certain processing, or to withdraw consent. Whether or not a particular law applies to us, we will respond to any reasonable request sent to info@achievedcompliance.com. We may need to verify your identity, and we will not discriminate against you for exercising your rights. Requests about data we process for a client will be referred to that client.
United States residents. Residents of certain states may have rights under state consumer privacy laws. We do not sell or share Personal Data for targeted or cross-context behavioral advertising, and we do not use sensitive Personal Data in ways that give rise to a right to limit its use. You may use an authorized agent, subject to verification, and, where the law provides, may appeal our decision by replying to it.
Canadian residents. You may request access to and correction of your Personal Data and withdraw consent, subject to legal and contractual restrictions. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.
Individuals in the EU, UK, or Switzerland. As explained in Section A, our processing of Personal Data of individuals in these jurisdictions is incidental, usually as a sub-processor to a client that is the controller. Where we act for a client, please direct your request to that client. To the extent the EU GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies, you may exercise the rights described above by contacting us and may complain to the supervisory authority where you live or work.
Our services and Website are intended for businesses and professionals. We do not knowingly collect Personal Data from children under 16. If you believe a child has provided Personal Data to us, please contact us and we will delete it.
Our Website links to third-party sites and services, such as professional networking sites, map services, and our scheduling and newsletter providers. Their own privacy policies apply when you use them.
For questions about this Policy, to exercise your rights, or to raise a concern, contact us at info@achievedcompliance.com or through the Contact page of our Website. Inquiries are handled by our office administration and referred to the appropriate team member. You may also contact the privacy regulator in your jurisdiction.
We may update this Policy from time to time. We will revise the "Last updated" date when we make material changes and, where appropriate, notify you by email or on our Website. Changes are effective when posted.
