Privacy Policy
Last updated: November 3, 2026
This policy explains how VanRein Compliance ("VanRein," "we," "us") collects, uses, shares, and protects personal information when you visit vanreincompliance.com, contact us, subscribe to our newsletter, use our client portals, or work with us. We are a compliance consultancy based in New Braunfels, Texas, and we serve clients in the United States.
Health information and business associate agreements
When we provide services to a HIPAA covered entity or business associate, we act as a business associate under a signed business associate agreement (BAA). Any protected health information (PHI) we receive in that work is governed by the BAA and by HIPAA, not by this policy. If this policy and a BAA conflict, the BAA controls for PHI.
Please do not send PHI through our website contact form, newsletter replies, or general email to hello@vanreincompliance.com. If your engagement involves PHI, we will agree on a secure way to share it under your BAA.
Information we collect
Information you give us
- Contact form. Your name, email address, and message.
- Newsletter. Your email address, and your name if you provide it.
- Calls, meetings, and email. Your name, work contact details, company, and what we discuss. With notice to participants, we may record or transcribe meetings and keep notes so we can follow up accurately.
- Client portals. If you are a client user, your name, work email, login details, and the project, audit, training, and document records you or your team add. This includes the VRC1 client portal and our training portal.
- Proposals, agreements, and billing. Signer names and emails, signed documents, billing contacts and addresses, and invoice and payment records. We do not receive or store full payment card numbers.
Information collected automatically
- Device and usage data. IP address, browser and device type, pages viewed, referring page, and approximate location derived from your IP address.
- Form protection signals. When you use the contact form, a spam and bot check reviews browser and device signals.
- Cookies and similar technologies. See "Cookies and analytics" below.
Information from others
Colleagues who introduce you or add you to a client portal, and public business sources such as company websites.
We do not ask for, and ask you not to send, sensitive personal information through the website.
How we use information, and our legal bases
Use
Answer your questions and requests, and schedule calls
Legal basis
Your request; our legitimate interest in responding
Use
Deliver our services, run client portals and training, and keep project records
Legal basis
Performance of our contract with you or your organization
Use
Send proposals and agreements, invoice, and keep accounting records
Legal basis
Contract; legal obligations (tax and accounting)
Use
Send our newsletter
Legal basis
Your consent, which you can withdraw at any time
Use
Measure and improve the website with analytics cookies
Legal basis
Your consent through the cookie banner
Use
Cookie-free measurement of site traffic
Legal basis
Our legitimate interest in running and improving the site
Use
Protect the site and our systems, and prevent spam and fraud
Legal basis
Our legitimate interest in security
Use
Meet legal obligations and enforce our agreements
Legal basis
Legal obligation; legitimate interest
We do not sell personal information, and we do not use or share it for targeted advertising.
How long we keep information
We keep personal information only as long as we need it for the purposes above:
- Inquiries and prospect records: while we are in contact, then for a reasonable period afterward.
- Client records: for the length of the engagement, then as our agreement, BAA, and legal and tax obligations require.
- Newsletter: until you unsubscribe.
- Analytics: for the periods set in our analytics tools.
When information is no longer needed, we delete it or de-identify it.
How we protect information
We use administrative, technical, and physical safeguards suited to a compliance firm. These include limiting access to staff who need it, multi-factor sign-in on core business systems, encrypted connections (HTTPS), and vetting the providers we use. No method of transmission or storage is perfectly secure, and we cannot promise absolute security. If a breach affects your personal information, we will notify you as the law and our agreements require.
Your privacy rights
Depending on where you live, you may have the right to:
- know what personal information we have about you and get a copy;
- correct inaccurate information;
- delete your information;
- opt out of the sale of personal information, targeted advertising, and profiling (we do none of these);
- withdraw consent you have given, such as for the newsletter or analytics cookies; and
- not be treated differently for using these rights.
Texas residents. Under the Texas Data Privacy and Security Act, you may use the rights above. If we decline your request, you may appeal by replying to our decision. If we deny your appeal, you may contact the Texas Attorney General.
California residents. Under the California Consumer Privacy Act, as amended, you may use the rights above, including the right to know the categories of personal information we collect, the sources, our purposes, and the categories of recipients, all described in this policy. We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information for purposes that require an opt-out.
Residents of other states with comprehensive privacy laws have similar rights, and we will honor them as those laws require.
How to make a request. Email hello@vanreincompliance.com or call 830-201-1880. We will verify your identity before acting on a request and respond within the time the law allows. An authorized agent may make a request for you with your written permission.
Client data. If your information is in a client's records that we process on that client's behalf, we will refer your request to that client and help them respond.
Children's privacy
Our website and services are for businesses and professionals. They are not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
International transfers
We are based in the United States and store and process information in the United States. Some of our providers process information in other countries, as shown on our subprocessor list. Where they do, we rely on their contractual and legal safeguards for that transfer.
Changes to this policy
We may update this policy as our practices or the law change. We will post the new version here and change the "Last updated" date. If a change is significant, we will give more prominent notice, such as a notice on our website or an email to clients.
Contact us
VanRein Compliance
New Braunfels, Texas
Email: hello@vanreincompliance.com
Phone: 830-201-1880