Vulcan Facility Services
Privacy Policy
Last updated October 15, 2026
This Privacy Policy explains how Vulcan Data Solutions dba Vulcan Facility Services ("Vulcan Facility Services," "we," "us") collects, uses, shares, and protects personal information through www.vulcanfacility.com (the "Site"). We are the controller (and, under California law, the "business") responsible for that information. This policy is written to meet the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), and the Texas Data Privacy and Security Act.
Information you give us
When you submit a quote request, contact form, or government inquiry, we collect what you enter: your name, company or agency, email address, phone number, facility city, ZIP code and address, facility type and size, services and schedule requested, budget, and any message or instructions. Please do not include sensitive personal information such as Social Security, bank, or health details in a form.
Information collected automatically
When you submit a form we also record the page you submitted it from, the referring website, any marketing campaign tags in the page address (UTM parameters), your browser's user agent, and a one-way hashed version of your IP address used only to stop spam and abuse. Our hosting and security providers also keep standard server logs.
Cookies and similar technologies
We use strictly necessary technologies to run and protect the Site, including Cloudflare Turnstile, which checks that form submissions come from a real person, and browser storage that remembers your cookie choice and campaign tags for your visit. Optional analytics cookies are off by default and are used only if you click Accept on our cookie banner; declining is as easy as accepting. You can change or withdraw your choice at any time with the Cookie Settings link in the footer, or block cookies in your browser. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a refusal of optional cookies and an opt-out of any sale or sharing.
How we use information
We use your information to respond to your inquiry, prepare quotes and proposals, provide and coordinate services, send you a confirmation of your request, keep business records, understand which pages and campaigns bring inquiries, and protect the Site against spam, fraud, and abuse. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
Legal bases for processing (GDPR)
If the GDPR applies to you, we rely on these legal bases: taking steps at your request before entering into a contract, and performing a contract, when we respond to a quote request or provide services; our legitimate interests in running our business, answering inquiries, understanding which marketing brings inquiries, and protecting the Site from spam and abuse, balanced against your rights; your consent for optional analytics cookies, which you may withdraw at any time without affecting earlier processing; and compliance with legal obligations such as tax and accounting record keeping. Providing your contact details is needed for us to respond to your inquiry; if you do not provide them, we cannot reply.
Who we share it with
We share information only with service providers that help us operate the Site and our business, under their own security and privacy terms: Supabase (database and form processing), Resend (email delivery), Cloudflare (security and spam protection), and our website hosting provider. If you request service, we may share the details of your facility and scope with the contracted service providers who perform the work. We may also disclose information when required by law, to protect our rights or safety, or as part of a merger, sale, or transfer of our business.
International transfers
We are based in the United States, and our service providers store and process information in the United States. If you submit information from the European Economic Area, the United Kingdom, or Switzerland, it will be transferred to the United States. Where the GDPR requires it, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) in our providers' data processing terms, or on the provider's certification under the EU-U.S. Data Privacy Framework, to protect that transfer.
How long we keep it
We keep inquiry information for as long as needed to respond to you, provide services, and meet our legal, tax, and accounting obligations, and then delete or anonymize it.
How we protect it
Information is sent over encrypted HTTPS connections and stored with access limited to our team. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Your choices and rights
You may ask us to access, correct, or delete the personal information you submitted, or to stop contacting you, at any time. We do not use your information for automated decision-making that has legal or similarly significant effects on you. The sections below describe the additional rights you have under the GDPR, the CCPA, and Texas law, and how to use them.
Your rights under the GDPR (EEA, UK, and Switzerland)
If the GDPR applies to you, you have the right to: access your personal data and receive a copy; correct inaccurate data; have your data erased; restrict our processing; receive your data in a portable, machine-readable format; object to processing based on our legitimate interests, and to object at any time to direct marketing; and withdraw consent at any time where we rely on consent. You also have the right to lodge a complaint with the data protection supervisory authority where you live or work, or where an alleged infringement took place. We respond to requests within one month, which may be extended by two further months for complex requests, and we will tell you if it is.
Notice to California residents (CCPA)
In the past 12 months we have collected these categories of personal information: identifiers (name, email address, phone number, hashed IP address); commercial information (facility details, services requested, budget, and current provider); internet or other electronic network activity (pages visited, referring site, campaign tags, browser user agent); and professional information (company or agency name). We collect it directly from you and automatically from your device, for the business purposes described in "How we use information," and we disclose it for business purposes only to the service providers listed in "Who we share it with." We do not collect sensitive personal information as defined by the CCPA. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months; we have no actual knowledge of selling or sharing the personal information of consumers under 16. Retention is described in "How long we keep it." California residents have the right to know what personal information we collect, use, and disclose; to delete it; to correct inaccurate information; to opt out of the sale or sharing of personal information (which we do not do, and we honor Global Privacy Control signals); to limit the use of sensitive personal information (which we do not collect); and not to be discriminated against for exercising these rights.
How to exercise your rights
To make a request under any of the laws above, use the form on our Contact page and say which right you are using. We will verify your request by matching the name and email address you give against the information we hold, and may ask a follow-up question if needed; we will only use that information to verify your request. You may use an authorized agent, who must give us signed written permission from you, and we may still ask you to confirm your identity directly. We confirm receipt of California requests within 10 business days and respond within 45 days, which may be extended once by another 45 days with notice. Texas residents may appeal a decision we make by replying to our response, and we will answer the appeal within 60 days; if the appeal is denied, you may contact the Texas Attorney General.
Children's privacy
The Site is intended for businesses and is not directed to children under 13. We do not knowingly collect personal information from children.
Changes to this policy
We may update this policy from time to time. The "Last updated" date above shows when it last changed, and changes take effect when posted.
Contact us
Questions about this policy or your information can be sent through the form on our Contact page. Vulcan Data Solutions dba Vulcan Facility Services, Irving, Texas.