1. Who we are (Controller)
The controller is Tri State Enterprise, a Kentucky limited-liability company based in Ashland, Kentucky, United States.
General contact: Contact TSE · (606) 836-2534. Privacy matters: (606) 836-2534 (calls only).
2. Scope
This notice covers Personal Data (PD) we process about you when you visit our website, request property services, use our customer portal, apply to join a crew, or communicate with us. It supplements (does not replace) our Privacy Policy.
3. Lawful basis for processing (Art. 6 GDPR)
| Purpose | Lawful basis (Art. 6(1)) | Data |
|---|---|---|
| Delivering agreed property services | (b) Contract | Name, address, contact, service preferences |
| Processing payment | (b) Contract and (c) legal obligations where applicable | Payment token and billing record |
| Sending transactional email / SMS | (b) Contract | Email, phone |
| Marketing email / SMS | (a) Consent | Email, phone, preferences |
| Basic site measurement and service improvement | (f) Legitimate interests | Page and masked network context |
| Optional analytics and advertising technologies | (a) Consent where required | Browser identifiers and interaction data |
| Fraud prevention, security | (f) Legitimate interests | Network, session, and device context |
| Quality-assurance call review | (f) Legitimate interests and consent where required | Call audio or transcript when recorded |
| Crew GPS during assigned shift | (b) Contract and (f) legitimate interests where applicable | Assigned-service location and timestamp |
| Background checks for crew applicants | (a) Consent, (f) legitimate interests, and legal obligations where applicable | Identity and screening information |
| Tax, accounting, insurance records | (c) Legal obligation | Invoices, payroll, and insurance records |
| Protecting life or property in emergency | (d) Vital interests | As needed |
4. Special category data (Art. 9)
We do not routinely process special category data (health, religion, ethnicity, trade-union status, sex life, biometrics, genetic). Please do not share special category data that is not needed for your service. If you choose to share health information needed for a service accommodation, we process it only for that purpose and seek any consent required by applicable law. You may ask us to remove the note, subject to applicable legal exceptions.
5. Your rights as a data subject
- Access (Art. 15) — a copy of your PD.
- Rectification (Art. 16) — correction of inaccurate PD.
- Erasure (Art. 17) — "right to be forgotten" subject to applicable exceptions.
- Restriction (Art. 18) — restrict processing in the circumstances provided by law.
- Portability (Art. 20) — structured, machine-readable export.
- Object (Art. 21) — to processing based on legitimate interests or direct marketing.
- Withdraw consent (Art. 7(3)) — at any time, without affecting prior lawful processing.
- Not be subject to solely automated decisions with legal or significant effects (Art. 22).
6. International data transfers
We are based in the United States. When European, UK, or Swiss personal data is transferred to a country that has not been recognized as providing an adequate level of protection, we use safeguards required by applicable law. Depending on the transfer, those safeguards may include:
- Approved contractual clauses or addenda for the relevant jurisdiction.
- Access restrictions, encryption, and other technical or organizational safeguards appropriate to the transfer.
- An applicable adequacy decision or a provider's participation in a recognized transfer framework, when available.
You may request information about the safeguards relevant to your data by contacting (606) 836-2534 (calls only).
7. Retention
We retain personal data only as long as reasonably necessary for the purpose for which it was collected, including service delivery, account administration, dispute resolution, safety, and applicable tax, accounting, employment, insurance, or other legal obligations. The period varies by record and context. See our Privacy Policy for more information.
8. Automated decision-making
Automated tools may assist with tasks such as summarizing communications, drafting replies, or organizing service information. We do not rely on a solely automated decision that produces legal or similarly significant effects on you. Contact us if you have a concern about a decision or want the information supporting it reviewed.
9. Privacy contact and representatives
Direct privacy questions and requests to (606) 836-2534 (calls only). If applicable law requires us to appoint and publish a Data Protection Officer or local representative, we will update this notice with the appropriate contact information.
10. Breach notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
- Notify the competent supervisory authority within 72 hours where feasible when Article 33 requires notification.
- Notify affected data subjects without undue delay when the breach is likely to result in a high risk (Art. 34).
- Document the incident and response as required by applicable law.
11. Right to complain to a supervisory authority
You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. In the UK, the authority is the Information Commissioner's Office (ico.org.uk).