Privacy Policy

1. Corporate Identity and Relationship

Tech Sol Outsourcing is a business brand, public-facing service platform, commercial interface, and media/service-delivery front owned and operated by Koshar and Harris LLC. Tech Sol Outsourcing is used by Koshar and Harris LLC to present, market, coordinate, administer, and deliver business, technology, outsourcing, marketing, staffing, and operational services.

Unless a proposal, statement of work, order form, master services agreement, or other binding document expressly identifies a different contracting entity, references to “Tech Sol Outsourcing,” “we,” “us,” or “our” in this Privacy Policy mean Koshar and Harris LLC acting through the Tech Sol Outsourcing brand and its authorized personnel, departments, systems, contractors, and service providers.

Nothing in this Privacy Policy should be interpreted as representing that Tech Sol Outsourcing has separate legal personality from Koshar and Harris LLC merely because Tech Sol Outsourcing is presented as a distinct public-facing brand.

2. Purpose and Scope of This Policy

This Privacy Policy explains how we may collect, receive, access, generate, use, organize, analyze, store, maintain, disclose, transmit, protect, retain, anonymize, aggregate, delete, or otherwise process personal information in connection with Tech Sol Outsourcing websites, forms, communications, business relationships, client services, recruitment activities, and service-delivery operations.

This Policy is designed as a global baseline. Jurisdiction-specific obligations apply only where the relevant law applies to the particular processing activity, organization, individual, and factual circumstances. Mentioning a statute does not voluntarily extend that statute beyond its lawful territorial or material scope.

3. Services Covered

This Policy applies, as relevant, to information processed in connection with the services presented through Tech Sol Outsourcing, including:

Product engineering, software development, web development, application development, and related technology delivery.
DevOps, platform engineering, cloud infrastructure, deployment, maintenance, and technical operations.
SI (formerly AI), machine learning, automation, data engineering, analytics, and SI-assisted business solutions.
CRM, data, workflow automation, integrations, reporting, and business intelligence.
Managed IT, cybersecurity, technical support, systems administration, and related technology services.
Marketing technology, digital marketing, performance marketing, paid advertising, SEO, conversion optimization, campaign operations, lead management, sales support, and growth services.
Business process outsourcing, customer support, back-office operations, virtual assistance, administrative operations, dispatch support, short-term rental support, and other outsourced business functions.
Staffing, team augmentation, recruitment-related services, and operational workforce support.
Consultations, proposals, quotations, account administration, communications, billing, recruitment, careers, and other website or business interactions.

4. Our Privacy Roles

4.1 When Koshar and Harris LLC Acts as Controller or Business

Where Koshar and Harris LLC, acting through Tech Sol Outsourcing, determines the purposes and material means of processing personal information for its own business purposes, Koshar and Harris LLC generally acts as the controller, business, organization, responsible party, or equivalent entity under the applicable law.

4.2 When We Process Information for a Client

Where a business client determines why personal information will be processed and instructs us to process it to provide contracted services, the client may act as the controller or business and Koshar and Harris LLC, acting through Tech Sol Outsourcing, may act as a processor, service provider, contractor, subprocessor, operator, agent, or equivalent service organization.

The factual role, not merely the label used by the parties, determines legal responsibility. A written Data Processing Agreement or service agreement may allocate additional responsibilities.

5. Client-Controlled Information and Client Responsibility

Clients may provide, make accessible, or instruct us to process information concerning their customers, prospects, leads, employees, contractors, users, tenants, guests, property owners, vendors, applicants, business partners, or other persons.

To the fullest extent permitted by applicable law and contract, the client is responsible for ensuring that client-controlled information and instructions are lawful, including obtaining required notices, consents, authorizations, permissions, or other legal bases before directing us to process that information.

We may refuse, restrict, suspend, or discontinue an instruction that we reasonably believe is unlawful, unauthorized, fraudulent, insecure, materially inconsistent with an applicable agreement, or likely to create unacceptable legal or security risk.

6. Categories of Personal Information We May Process

6.1 Identity and Contact Information

Names, business names, job titles, organizations, email addresses, telephone and mobile numbers, mailing information, country, region, time zone, communication preferences, account identifiers, and similar contact or identifying details.

6.2 Business and Inquiry Information

Industry, company size, project requirements, selected services, team size, business objectives, existing systems, estimated requirements, preferred meeting times, proposal information, budget information voluntarily provided, and correspondence.

6.3 Communications

Emails, calls, SMS/MMS messages, chats, meeting communications, CRM notes, service tickets, support records, and, where lawful and appropriately disclosed, recordings, transcripts, summaries, quality-assurance notes, and call dispositions.

6.4 Website and Device Information

IP address, device type, browser type, operating system, referring source, pages viewed, timestamps, session information, network information, security events, diagnostic records, and cookie or similar technology identifiers where used.

6.5 Client Service Data

CRM records, customer histories, lead records, support tickets, reservation information, property-operation records, dispatch information, project records, workflow information, transaction-related business information, reporting data, and other information necessary to perform authorized client services.

6.6 Marketing and Advertising Information

Campaign information, lead source, audience information, conversion events, advertising identifiers, campaign performance, permitted customer lists, attribution information, landing-page interactions, and advertising or analytics data.

6.7 Billing and Transaction Information

Billing contacts, invoices, payment status, transaction references, subscription information, tax-related records, and accounting information. Sensitive card data may be processed directly by payment processors rather than stored by us.

6.8 Recruitment and Applicant Information

Contact details, resumes/CVs, work history, education, skills, qualifications, availability, work eligibility, interview records, references, assessment information, compensation expectations where provided, and related application information.

6.9 Security and Compliance Information

Authentication activity, access records, audit logs, consent records, opt-out and suppression records, fraud indicators, abuse reports, complaint records, incident information, and evidence reasonably necessary to investigate disputes or demonstrate compliance.

7. Sensitive and Special-Category Information

We do not generally request highly sensitive personal information through ordinary website inquiry forms. Individuals should not send government identification numbers, account passwords, financial credentials, health information, biometric information, genetic data, precise geolocation, racial or ethnic origin, religious beliefs, sexual orientation, political opinions, trade-union information, or criminal-history information unless specifically requested for a legitimate and lawful purpose.

Where client services require processing sensitive or special-category data, additional conditions, contractual protections, access controls, or lawful bases may be required. Under the EU GDPR, for example, Article 9 conditions may apply in addition to an Article 6 lawful basis.

8. Sources of Personal Information

Information may be collected or received directly from an individual, from an employer or authorized representative, from a business client, through client-controlled platforms, website forms, communications, public business sources, professional directories, referral sources, advertising platforms, service providers, security systems, system logs, or other lawful sources.

9. Purposes for Processing

We may process personal information where reasonably necessary for legitimate, disclosed, authorized, contractual, or legally permitted purposes, including:

Operating, securing, maintaining, and improving our websites, systems, services, and business operations.
Responding to inquiries, scheduling consultations, preparing proposals and quotations, and negotiating engagements.
Providing contracted technology, outsourcing, marketing, staffing, support, and operational services.
Administering clients, projects, customer support, CRM activity, workflows, billing, accounts, and service delivery.
Running client-authorized advertising, marketing, lead-management, sales-support, and campaign operations.
Providing software development, cloud, DevOps, managed IT, cybersecurity, SI (formerly AI), automation, analytics, data, and reporting services.
Providing BPO, back-office, customer support, virtual assistance, staffing, dispatch, property support, and administrative services.
Recruiting, evaluating, and communicating with applicants and prospective personnel.
Detecting, investigating, preventing, and responding to fraud, abuse, security incidents, unauthorized access, unlawful conduct, or contractual violations.
Maintaining legal, tax, accounting, insurance, compliance, audit, and recordkeeping requirements.
Establishing, exercising, investigating, defending, or settling legal claims.
Complying with lawful governmental, regulatory, judicial, or law-enforcement requirements.
Creating aggregated, statistical, anonymized, or de-identified information where permitted.

Where the EU GDPR or UK GDPR applies, processing will be supported by an appropriate lawful basis under Article 6 or the corresponding UK provision. Depending on the circumstances, this may include consent (Article 6(1)(a)), contractual necessity or pre-contractual steps (Article 6(1)(b)), legal obligation (Article 6(1)(c)), vital interests (Article 6(1)(d)), public task where applicable (Article 6(1)(e)), or legitimate interests (Article 6(1)(f)).

Where processing relies on consent, the requirements of Articles 4(11) and 7, as applicable, will be considered. Withdrawal of consent does not invalidate processing lawfully performed before withdrawal.

11. No Sale of Consumer Personal Information

We do not operate a business model based on selling consumer contact lists, website inquiries, customer lists, applicant information, mobile numbers, SMS consent information, or comparable personal information to outsiders for their independent marketing.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile telephone numbers, SMS/MMS opt-in information, messaging consent, consent records, and text-message authorization will not be sold, rented, licensed, transferred, or shared with third parties or affiliates for their independent marketing, advertising, promotional, or lead-generation purposes.

Consent granted to Tech Sol Outsourcing for SMS or MMS communications is not transferable as marketing consent to another business, client, affiliate, data broker, lead generator, or third-party marketer.

Service providers that route, transmit, host, secure, or administer authorized communications may process necessary mobile information solely to perform those operational functions, but are not authorized by us to use that information for their own independent marketing or lead-generation activities.

If any other provision of this Policy could be read more broadly, this Section controls with respect to mobile information and SMS/MMS consent.

13. SMS/MMS Communications

Our SMS/MMS program may include appointment confirmations and reminders, scheduling or rescheduling updates, customer support responses and follow-ups, service-request updates, and account or requested-service notifications. Message frequency may vary. Message and data rates may apply. Reply STOP to opt out of further SMS messages or HELP for assistance. Consent is not a condition of purchase.

We may retain opt-in, opt-out, timestamp, source, suppression, and consent evidence as reasonably necessary to administer messaging, honor preferences, investigate complaints, and demonstrate compliance with applicable law or carrier requirements.

14. Client-Directed Paid Marketing and Advertising

Tech Sol Outsourcing may provide paid advertising, performance marketing, CRM, lead-management, campaign-management, sales-support, attribution, analytics, and related services to business clients. These activities are distinct from selling Tech Sol Outsourcing consumer information.

A client may lawfully provide or authorize access to client-controlled customer, prospect, lead, audience, advertising, or CRM information. At the client's direction, that information may be processed through advertising, analytics, CRM, communications, or technology platforms required to perform the client's campaign.

Where we process such data solely for the client's authorized purpose, the client is responsible for establishing any notice, consent, opt-out, contractual, platform, or lawful-basis requirements applicable to the client's campaign, except to the extent applicable law independently imposes a responsibility on us.

Some privacy laws, including the California CCPA as amended, may define certain advertising disclosures as “sharing” even without a monetary sale. Where such a definition applies, the relevant controller or business must provide legally required notices and opt-out mechanisms. Nothing in this Section permits Tech Sol Outsourcing's own SMS opt-in information to be used for an unrelated client campaign.

15. Internal Processing Within Koshar and Harris LLC

Because Tech Sol Outsourcing is owned and operated by Koshar and Harris LLC, personal information may be processed by authorized Koshar and Harris LLC personnel, departments, management, finance, IT, security, legal, compliance, operations, service teams, and systems where reasonably necessary to operate Tech Sol Outsourcing or provide services.

Internal processing within the same legal entity does not constitute a sale of personal information. If separate affiliated legal entities are used, any disclosure will be subject to applicable law and contractual safeguards. Mobile information will not be provided to a separate affiliate for that affiliate's independent marketing or lead generation.

16. Service Providers and Subprocessors

We may use vendors and service providers for hosting, cloud infrastructure, cybersecurity, telecommunications, messaging, email, CRM, databases, analytics, development infrastructure, payment processing, accounting, professional services, fraud prevention, and related operational purposes.

Such providers may process personal information only to the extent reasonably necessary for their contracted function, legal obligations, or security requirements. Where required, processor or subprocessor obligations may be addressed contractually, including under EU GDPR Article 28 or corresponding law.

17. Professional Advisers

We may disclose personal information where reasonably necessary to attorneys, accountants, auditors, insurers, tax professionals, cybersecurity professionals, investigators, consultants, or other advisers subject to applicable professional or contractual confidentiality duties.

18. Legal, Regulatory, and Protective Disclosures

We may preserve, use, or disclose personal information where we reasonably believe it is required or permitted to comply with law, legal process, regulatory requests, court orders, law-enforcement requests, tax obligations, investigations, fraud prevention, security incident response, protection of persons or property, contractual enforcement, debt collection, intellectual-property protection, or the establishment, exercise, or defense of legal claims.

Where legally permitted, we may challenge requests we reasonably believe are invalid, excessive, disproportionate, or unlawful. Nothing in this Policy creates an obligation to challenge a lawful request where no such duty exists.

19. Business Transactions

Information may be evaluated or transferred in connection with a merger, acquisition, reorganization, financing, investment, sale of assets, insolvency, restructuring, or change of control, subject to applicable law. SMS marketing consent will not be treated as freely transferable where new consent is legally required.

20. Cookies and Similar Technologies

Our use of cookies, pixels, local storage, scripts, tags, browser storage, device identifiers, and similar storage/access technologies is governed by our separate Cookie Policy. Where cookie-derived information constitutes personal information, this Privacy Policy also applies.

21. SI and Automated Processing

Certain services may use SI (formerly AI), machine learning, classification, summarization, workflow automation, analytics, recommendation systems, or similar technologies. Where applicable law imposes special transparency, risk-assessment, or automated-decision requirements, we will address those requirements according to our role and the relevant processing.

Unless expressly disclosed otherwise, we do not intend to subject ordinary website visitors to solely automated decisions that produce legal or similarly significant effects.

22. Data Security

We use reasonable administrative, technical, contractual, and organizational measures designed to protect personal information against unauthorized access, acquisition, disclosure, alteration, misuse, loss, or destruction. Measures may include authentication, authorization, access controls, role-based permissions, logging, monitoring, encryption where appropriate, confidentiality requirements, backups, incident response, vendor controls, and security reviews.

No electronic system, network, cloud environment, telecommunications service, website, database, or storage method can be guaranteed absolutely secure. We therefore do not warrant that security incidents can never occur. This statement does not reduce any mandatory security obligation imposed by applicable law.

23. Client Security Responsibility

Where clients provide access to client-controlled accounts, CRMs, advertising platforms, email systems, cloud environments, databases, repositories, credentials, websites, or other technologies, the client remains responsible for systems and configurations under its control unless a written agreement expressly assigns a particular responsibility to us.

24. Personal Data Breaches and Security Incidents

Qualifying security incidents will be assessed under applicable law and contractual obligations. Under the EU GDPR, Articles 33 and 34 may require supervisory-authority or individual notification depending on the facts and risk. Where we act as a processor, our obligation may be to notify the relevant controller rather than communicate directly with affected individuals.

25. Data Retention

We retain personal information for as long as reasonably necessary for the purpose for which it was processed, taking account of contracts, client instructions, legal limitation periods, disputes, accounting, taxation, security, fraud prevention, litigation, insurance, compliance, audits, and other legitimate retention requirements.

When information is no longer reasonably required, we may delete, destroy, anonymize, aggregate, de-identify, or otherwise dispose of it. Backup copies may remain temporarily until overwritten or deleted through normal backup processes.

Opt-out, suppression, consent, fraud, security, and legal-hold records may be retained where necessary to honor preferences, demonstrate compliance, prevent abuse, or protect legal rights.

26. International Processing and Transfers

Because Tech Sol Outsourcing provides services internationally, personal information may be accessed, hosted, or processed in jurisdictions different from where it was originally collected.

Where international transfers are legally restricted, we may use an available lawful mechanism. Under the EU GDPR, Chapter V (Articles 44-49) may require an adequacy decision under Article 45, appropriate safeguards under Article 46 such as Standard Contractual Clauses, binding corporate rules under Article 47 where applicable, or a permitted Article 49 derogation. UK transfers may use UK adequacy regulations, the International Data Transfer Agreement, the UK Addendum to EU SCCs, or another lawful mechanism.

Other jurisdictions may impose their own cross-border requirements, including APP 8 in Australia, Articles 22-23 of the UAE PDPL where applicable, Article 33 of Brazil's LGPD, Singapore's Transfer Limitation Obligation, and section 72 of South Africa's POPIA.

27. EU/EEA Privacy Framework

Where Regulation (EU) 2016/679 (EU GDPR) applies under Article 3, we seek to process personal data consistently with Article 5 principles, Article 6 lawful bases, Articles 12-14 transparency requirements, Articles 15-22 data-subject rights, Article 28 processor requirements where applicable, Article 32 security obligations, Articles 33-34 breach requirements, Article 35 data-protection impact assessments where required, Articles 37-39 DPO obligations where required, and Chapter V transfer rules.

The mere technical accessibility of our website from the EEA does not, by itself, mean every processing activity is governed by the EU GDPR.

28. EU Representative

Where EU GDPR Article 27 requires a controller or processor not established in the EU to designate a representative, Koshar and Harris LLC will appoint an appropriate representative and publish the required details. We reserve the right to rely on any Article 27 exemption where all legal conditions for the exemption are satisfied.

29. United Kingdom Privacy Framework

Where applicable, processing relating to individuals in the United Kingdom may be governed by the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), and amendments made by the Data (Use and Access) Act 2025 and related instruments.

Core UK GDPR duties generally include principles, lawful processing, transparency, rights, processor obligations, security, international transfers, and accountability, subject to UK-specific amendments and exemptions.

30. UK Representative

Where UK GDPR Article 27 requires a non-UK organization to appoint a UK representative, we will do so and publish the required details. Where processing is only occasional, low risk, and otherwise meets the statutory exemption, we may rely on that exemption to the extent lawful.

31. California Privacy

Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), applies to the relevant business and processing, eligible California consumers may have rights including the right to know, delete, correct, opt out of qualifying sale or sharing, limit certain uses of sensitive personal information, and be free from unlawful discrimination for exercising CCPA rights.

Relevant California Civil Code provisions may include §§ 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.120, 1798.121, 1798.125, 1798.130, 1798.135, and 1798.140, as amended.

We do not sell consumer personal information. If our own use of advertising technology constitutes regulated “sharing” or targeted advertising under applicable law, we will provide any legally required opt-out mechanism. Mobile information remains subject to the stricter prohibition in Section 12.

32. Other United States Privacy Laws

Residents of other U.S. states may have rights under comprehensive state privacy laws where those laws apply and relevant thresholds are met. Depending on the statute, rights may include access, correction, deletion, portability, opt-out from sale or targeted advertising, sensitive-data controls, profiling controls, or appeal rights.

We do not voluntarily extend every state-law right worldwide merely because the website can be accessed from a particular state.

33. United States Telephone, SMS, and Email Communications

Where applicable, telephone and text communications may be subject to the Telephone Consumer Protection Act, 47 U.S.C. § 227, FCC regulations, state telemarketing laws, Do-Not-Call requirements, and carrier/A2P 10DLC rules. Commercial email may be subject to the CAN-SPAM Act, 15 U.S.C. §§ 7701 et seq.

Where legally required, we or the relevant client must maintain appropriate consent, identification, opt-out, and suppression practices. Client-directed communications remain subject to the client's responsibilities for lawful list sourcing and campaign instructions.

34. Canada

Where the Personal Information Protection and Electronic Documents Act (PIPEDA) applies, we seek to handle personal information consistently with the ten fair-information principles in Schedule 1: accountability; identifying purposes; consent; limiting collection; limiting use, disclosure, and retention; accuracy; safeguards; openness; individual access; and challenging compliance.

Provincial private-sector laws may apply in Alberta, British Columbia, Quebec, or other jurisdictions depending on the processing. Commercial electronic messages may also be subject to Canada's Anti-Spam Legislation (CASL), including applicable consent, identification, and unsubscribe requirements.

35. Australia

Where the Privacy Act 1988 and Australian Privacy Principles (APPs) apply, relevant obligations may include APP 1 (open and transparent management), APP 3 (collection), APP 5 (notification), APP 6 (use/disclosure), APP 7 (direct marketing), APP 8 (cross-border disclosure), APP 11 (security), APP 12 (access), and APP 13 (correction).

Commercial electronic messages may also be subject to the Spam Act 2003, including applicable consent, sender-identification, and unsubscribe requirements.

36. United Arab Emirates

Where Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data (UAE PDPL) applies, we will consider applicable requirements concerning lawful processing, data-subject rights, security, impact assessments, controllers/processors, complaints, and cross-border transfers, including Articles 22-23 where relevant.

Separate or additional privacy regimes may apply in particular free zones or regulated sectors.

37. Brazil

Where Brazil's Lei Geral de Proteção de Dados Pessoais, Law No. 13,709/2018 (LGPD), applies, relevant provisions may include Article 3 (territorial scope), Article 6 (principles), Article 7 (lawful bases), Article 9 (transparency), Article 18 (data-subject rights), Article 33 (international transfers), Article 46 (security), and Article 48 (security-incident notification).

38. Singapore

Where Singapore's Personal Data Protection Act 2012 (PDPA) applies, we will address applicable accountability, notification, consent, purpose-limitation, accuracy, protection, retention, transfer-limitation, access, correction, and breach-notification obligations. Access and correction rights include those addressed in sections 21 and 22 of the PDPA.

39. South Africa

Where the Protection of Personal Information Act 4 of 2013 (POPIA) applies, relevant conditions may include accountability, processing limitation, purpose specification, further-processing limitation, information quality, openness, security safeguards, and data-subject participation. Section 72 may apply to qualifying cross-border transfers.

40. Other Jurisdictions

Where another privacy or data-protection law legally applies, we will seek to comply with its mandatory requirements applicable to our role. The omission of a jurisdiction from this Policy does not eliminate an otherwise applicable obligation, and the inclusion of a jurisdiction does not create jurisdiction where none otherwise exists.

41. Privacy Rights and Requests

Depending on applicable law, individuals may have rights to information, access, correction, deletion, restriction, portability, objection, withdrawal of consent, opt-out from certain sales or targeted advertising, or other statutory rights.

Rights are subject to applicable conditions, identity verification, exemptions, competing legal obligations, lawful retention requirements, and controller/processor distinctions.

42. EU/UK Data Subject Rights

Where EU GDPR or UK GDPR applies, rights may include access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), notification of certain changes (Article 19), portability (Article 20), objection (Article 21), and rights concerning certain automated decisions (Article 22), subject to applicable conditions and exemptions.

Qualifying EU data subjects may have the right to lodge a complaint under Article 77 with a competent supervisory authority. UK individuals may have corresponding rights to complain to the Information Commissioner's Office where UK law applies.

43. Verification of Requests

To protect personal information, we may request information reasonably necessary to verify identity, authority, relationship, or the records involved. We may decline or limit requests where permitted by law if identity cannot be verified, the request is manifestly unfounded or excessive, an exception applies, or the information is controlled by a client.

44. Client-Controlled Rights Requests

If a request relates to information we process solely on behalf of a client, we may refer the requester to the client, notify or transmit the request to the client, or assist the client as required by law or contract. Receiving a request does not automatically make Koshar and Harris LLC the controller of client-controlled information.

45. Children

Our general website and business services are directed primarily to businesses and adults and are not designed as consumer services for children. We do not knowingly use our general website to solicit children's personal information in violation of applicable law.

Where a client instructs us to process information concerning minors, the client is responsible for establishing any required parental authorization, notice, lawful basis, or other permission unless law independently places that duty on us.

46. Recruitment Privacy

Applicant information may be used to assess qualifications, communicate with candidates, conduct interviews, administer recruitment, maintain records, verify information where permitted, manage future opportunities where lawful, comply with employment obligations, and establish or defend legal claims.

Submission of an application does not create employment, guarantee an interview, guarantee continued consideration, or guarantee future contact.

47. Accuracy of Information

We may rely on information provided by individuals, clients, authorized representatives, public sources, and third-party systems. Individuals and clients are responsible for providing reasonably accurate information and for correcting material inaccuracies where accuracy is necessary to the relevant service.

48. Third-Party Websites and Platforms

Our website and services may interact with third-party websites, cloud providers, advertising platforms, telecommunications providers, payment providers, software vendors, APIs, repositories, project tools, and other platforms. Those organizations remain responsible for their independent terms, privacy practices, security, availability, and legal obligations.

To the fullest extent permitted by law, we are not responsible for independent acts or omissions of third parties outside our reasonable control.

49. No Voluntary Expansion of Legal Duties

This Policy describes our privacy practices and is not intended to create rights beyond those required by applicable law or binding agreement. It does not waive statutory exemptions, defenses, jurisdictional objections, contractual protections, legal privileges, or limitation periods available to Koshar and Harris LLC.

Nothing in this Policy limits a right or obligation that applicable law prohibits the parties from limiting or waiving.

50. Updates to This Policy

We may update this Privacy Policy when services, vendors, technologies, processing activities, corporate arrangements, or legal requirements change. The Last Updated date identifies the current version. Where applicable law requires additional notice or consent for a material change, we will provide it as required.

Contact Information

Privacy and data protection: privacy@kosharandharris.us

Legal matters: legal@kosharandharris.us

Corporate matters: corporate@kosharandharris.us

Website: https://techsoloutsourcing.us

For privacy-rights requests, please use the privacy email so the request can be routed and recorded appropriately.

Selected Legal Framework References (Non-Exhaustive)

European Union: Regulation (EU) 2016/679 (GDPR), including Articles 3, 5-7, 9, 12-22, 27-28, 32-35, 37-39, 44-49, and 77.
United Kingdom: UK GDPR; Data Protection Act 2018; Privacy and Electronic Communications (EC Directive) Regulations 2003; Data (Use and Access) Act 2025 and applicable implementing instruments.
California: California Consumer Privacy Act, as amended (Cal. Civ. Code §§ 1798.100 et seq.), including §§ 1798.105, 1798.106, 1798.110, 1798.120, 1798.121, 1798.125, and 1798.135.
United States communications: Telephone Consumer Protection Act, 47 U.S.C. § 227; CAN-SPAM Act, 15 U.S.C. §§ 7701 et seq.; applicable FCC and carrier/A2P 10DLC rules.
Canada: Personal Information Protection and Electronic Documents Act (PIPEDA), Schedule 1 fair-information principles; applicable provincial private-sector laws; Canada's Anti-Spam Legislation (CASL).
Australia: Privacy Act 1988 and Australian Privacy Principles (APPs); Spam Act 2003.
United Arab Emirates: Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data.
Brazil: Lei Geral de Proteção de Dados Pessoais, Law No. 13,709/2018 (LGPD).
Singapore: Personal Data Protection Act 2012 (PDPA).
South Africa: Protection of Personal Information Act 4 of 2013 (POPIA).
Messaging compliance: Current carrier and campaign-registration requirements, including requirements that mobile information and SMS consent not be shared with third parties/affiliates for independent marketing or lead generation.