Privacy Policy

How we collect, use, and protect your information.

Effective Date: May 7, 2026 • Last Updated: May 7, 2026

Central Coast HR ("we," "our," or "us") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains what we collect, how we use it, how we protect it, and the rights you have under California law.

1. Who We Are

Central Coast HR is an independent HR consulting practice owned and operated by Erin Coleman, SHRM-CP. We are based in Paso Robles, California and provide consulting services to businesses across California. Contact us at erin@centralcoasthr.com or (818) 726-9146.

2. Information We Collect

Information You Provide Directly

  • Contact form submissions: name, email address, phone number, company, website, service of interest, and your message.
  • Client portal accounts: name, email, encrypted password, company, phone, and any account preferences you set.
  • Communications: messages, emails, files, attachments, and notes you send to us through any channel (portal, email, contact form, phone).
  • Engagement information: details about your business, employees, workplace situations, documents, and other information you share during a consulting engagement.
  • Billing information: billing contact details and information necessary to invoice and receive payment.

Information Collected Automatically

  • Server logs: IP address, browser type, operating system, pages viewed, referring URLs, and timestamps. Used for security and to diagnose technical issues.
  • Cookies: we use a session cookie to keep you logged into the client portal and a CSRF (security) token to protect form submissions. We do not use advertising, analytics, or tracking cookies.

3. How We Use Your Information

  • To respond to your inquiries and consultation requests
  • To provide HR consulting services under our engagement with you
  • To manage your client portal account and authenticate access
  • To send transactional notifications (invoices, message replies, project updates, password resets)
  • To prepare deliverables, reports, and other work product
  • To comply with legal obligations and respond to lawful requests
  • To protect the security and integrity of our systems

We do not use your information for advertising or marketing purposes, and we do not sell your information to anyone.

4. How We Share Your Information

We do not sell your personal information. Ever.

We share information only in these limited circumstances:

  • Service providers: our website host (Midphase) and email delivery infrastructure, who process information solely on our behalf and under confidentiality obligations.
  • Legal compliance: when required by subpoena, court order, or applicable law, or to protect the rights, safety, or property of Central Coast HR, our clients, or others.
  • With your consent or at your direction: for example, when you ask us to coordinate with your employment counsel or other professionals.
  • Business transitions: if we are involved in a merger, acquisition, or sale of assets, your information may be transferred to the successor entity, subject to this policy.

5. Confidential Client Information

Information shared during HR consulting engagements — including details about employees, workplace investigations, personnel decisions, and internal documents — is held in strict confidence. Access is limited to Erin Coleman and any contractors or counsel specifically authorized by you. We do not disclose engagement-specific information except as permitted by our engagement agreement, required by law, or expressly authorized by you.

6. Cookies and Tracking Technologies

We use only the minimum cookies necessary to operate the site:

  • Session cookie: keeps you logged into the client portal during your visit.
  • CSRF token: a security cookie that protects forms from cross-site attacks.

We do not use Google Analytics, Facebook Pixel, or any third-party advertising or tracking technologies. You can disable cookies in your browser, though doing so will prevent the client portal from working correctly.

7. Data Security

We use reasonable administrative, technical, and physical safeguards to protect your information, including:

  • Encryption in transit via HTTPS/TLS
  • Hashed passwords (bcrypt) — we never store passwords in plain text
  • Server-side access controls and isolated upload directories
  • Parameterized database queries to prevent injection attacks
  • CSRF protection on all forms

No system is completely secure. While we take security seriously, we cannot guarantee absolute protection against every threat. If we become aware of a security breach affecting your information, we will notify you as required by California law.

8. Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements.

  • Contact form submissions: retained for up to 24 months unless an active engagement results.
  • Client engagement records: retained for the duration of the engagement plus seven (7) years, consistent with professional practice and California statutes of limitation for employment matters.
  • Server logs: retained for up to 90 days.

You may request deletion of your information at any time, subject to our legal and professional retention obligations.

9. Your California Privacy Rights

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the following rights:

  • Right to Know: request what categories and specific pieces of personal information we have collected about you.
  • Right to Delete: request deletion of personal information we collected from you, subject to legal exceptions.
  • Right to Correct: request correction of inaccurate personal information.
  • Right to Opt-Out of Sale or Sharing: we do not sell or share your personal information for cross-context behavioral advertising. Nothing to opt out of.
  • Right to Limit Use of Sensitive Personal Information: request that we limit use to what is necessary to provide our services.
  • Right to Non-Discrimination: we will not deny services, charge different prices, or provide different quality based on your exercise of these rights.

To exercise any of these rights, email erin@centralcoasthr.com with the subject "Privacy Rights Request." We will respond within 45 days as required by California law (with one possible 45-day extension if necessary, and you will be notified). We may need to verify your identity before fulfilling certain requests, particularly deletion requests.

How Deletion Requests Are Handled

When you request deletion of your personal information, we will: (1) acknowledge your request, (2) verify your identity, (3) review the request against our legal and professional retention obligations described in Section 8 (some engagement records may need to be retained), and (4) delete the information we are able to delete.

Following a deletion, we retain a limited deletion record consisting of your name, email, the date of deletion, the reason (if provided), and a summary of the categories of data deleted. This record is preserved for compliance and audit purposes and demonstrates that we honored your request. It is not used for any other purpose, is not shared with third parties, and is the only information we keep about you after a deletion request is fulfilled.

Authorized Agents

You may use an authorized agent to submit a privacy rights request. We will require written authorization from you and may verify your identity directly.

"Shine the Light" (California Civil Code § 1798.83)

We do not share personal information with third parties for their direct marketing purposes.

10. Children's Privacy

Our services are intended for businesses and adult professionals. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted information to us, please contact us and we will delete it.

11. Third-Party Links

Our site may link to third-party websites (for example, our LinkedIn profile or scheduling tools we direct clients to). We are not responsible for the privacy practices of those sites. Review their privacy policies before sharing information with them.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Material changes will be communicated through the client portal or via email to active clients. Continued use of our services after changes constitutes acceptance of the revised policy.

13. Contact Us

Questions about this Privacy Policy or your information?

Central Coast HR
Erin Coleman, SHRM-CP
Paso Robles, California
Phone: (818) 726-9146
Email: erin@centralcoasthr.com