Privacy Policy

Who We Are

CFS Partners LLC ("CFS PLLC", "we", "us", or "our") is a fraud investigation and legal support firm registered in the State of Colorado, United States. We provide digital forensic investigation services, fraud response support, legal case documentation, and fund recovery assistance to individuals and businesses across the USA and Canada.

Registered Address:
CFS Partners LLC
1801 Broadway, Suite 1225
Denver, CO 80202
United States

European Office:
661 Chelsea Cloisters, Sloane Avenue
London, SW3 3EN
United Kingdom

For all privacy-related enquiries, contact: privacy@cfspllc.com

Information We Collect

We collect personal information in the following circumstances:

2.1 Information You Provide Directly

When you submit a fraud report, free case evaluation, or contact us through any form on our website, we collect:

• Identity information: Full name, first name, last name
• Contact information: Email address, phone number (including country code)
• Case information: Type of fraud or incident, estimated amount lost, timeframe of incident, payment method used, description of events
• Location information: Country of residence (optional)
• Communication preferences: Preferred contact method

2.2 Information Collected Automatically

When you visit our website, our servers automatically collect:

• Technical data: IP address, browser type and version, operating system
• Usage data: Pages visited, time spent on pages, referring URL
• Device data: Device type, screen resolution

2.3 Information from Third Parties

We do not purchase data from data brokers. We may receive information from blockchain analytics partners (Chainalysis, TRM Labs, Elliptic, CipherTrace, MetaSleuth) in the course of investigating a reported fraud case — only after you have engaged us as a client.

How We Use Your Information

We use the personal information you provide for the following purposes:

• Case assessment and investigation: To review your fraud report, assess legal options, and build your case file
• Client communication: To respond to your submission, provide case updates, and contact you about your recovery options
• Legal documentation: To prepare evidence packages, regulatory complaints, dispute filings, and legal documentation on your behalf
• Security and fraud prevention: To detect spam, bots, and fraudulent submissions using IP-based rate limiting and honeypot techniques
• Service improvement: To understand how our website is used and improve our services — using aggregated, anonymised data only
• Legal compliance: To comply with applicable laws, court orders, regulatory requirements, and professional obligations
• Email communication: To send you a confirmation email and follow-up correspondence regarding your case — we do not send unsolicited marketing emails

Legal Basis for Processing

For users in the European Economic Area (EEA) and United Kingdom, we process your personal data under the following legal bases as set out in the UK GDPR and EU GDPR:

• Contractual necessity (Article 6(1)(b)): Processing required to perform services you have requested — specifically reviewing your fraud case and providing legal support
• Legitimate interests (Article 6(1)(f)): Processing necessary for our legitimate business interests, including fraud prevention, security, and improving our services — where these interests are not overridden by your rights
• Legal obligation (Article 6(1)(c)): Processing required to comply with applicable legal obligations, including anti-money laundering regulations, court orders, and regulatory requirements
• Consent (Article 6(1)(a)): Where we process data for any purpose not covered above, we will ask for your explicit consent

For California residents, we process data in accordance with the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) 2023. See Section 8 for your specific rights.

Data Sharing & Third Parties

We do not sell, rent, or trade your personal information. We may share your information only in the following strictly limited circumstances:

5.1 Service Providers

We work with vetted third-party service providers who assist us in delivering our services. These providers are bound by contractual data processing agreements and may only process your data on our behalf:

• Email delivery: Transactional email services (for sending case confirmations)
• Web hosting: Our hosting provider (Hostinger) for server infrastructure
• Blockchain analytics: Chainalysis, TRM Labs, Elliptic, CipherTrace, or MetaSleuth — only when tracing funds related to your reported case

5.2 Legal & Regulatory Disclosure

We may disclose your information without your consent if required to do so by:

• A valid court order or subpoena
• Regulatory authorities (SEC, FTC, FinCEN, FCA, or equivalent agencies)
• Law enforcement agencies investigating the fraud reported by you
• Anti-money laundering obligations under the Bank Secrecy Act or UK Proceeds of Crime Act

We will notify you of any such disclosure unless legally prohibited from doing so.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. You will be notified before your data is transferred and becomes subject to a different privacy policy.

Data Security

We implement industry-standard security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2+ (HTTPS)
• Server-side security: Form submissions are protected by CSRF tokens, honeypot fields, IP-based rate limiting, and input sanitisation
• Data storage: CSV submission logs are stored outside the public web directory (outside public_html) with restricted file permissions (0640)
• Database security: Database credentials are stored in server configuration files, not in publicly accessible code
• Access controls: Internal access to client data is restricted to attorneys and specialists directly assigned to a case
• No persistent cookies: We do not store sensitive session data in persistent browser cookies

While we implement these measures, no method of transmission over the internet is 100% secure. In the event of a data breach that affects your personal data, we will notify you within 72 hours in accordance with applicable law.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

After the applicable retention period, data is securely deleted or anonymised. You may request early deletion of your data — see Section 8 for your rights.

Your Rights (GDPR / CCPA)

8.1 Rights Under GDPR (EEA & UK Residents)

If you are located in the EEA or United Kingdom, you have the following rights under the UK GDPR / EU GDPR:

• Right of access: Request a copy of all personal data we hold about you (Subject Access Request)
• Right to rectification: Request correction of inaccurate or incomplete personal data
• Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to legal retention obligations
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your personal data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Rights related to automated decision-making: We do not make automated decisions that significantly affect you

To exercise any of these rights, email privacy@cfspllc.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (UK: ICO at ico.org.uk; EU: your national DPA).

8.2 Rights Under CCPA / CPRA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to delete: Request deletion of personal information we have collected, subject to certain exceptions
• Right to correct: Request correction of inaccurate personal information
• Right to opt-out of sale/sharing: We do not sell or share personal information — this right is automatically honoured
• Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights

To submit a CCPA rights request, email privacy@cfspllc.com with "CCPA Request" in the subject line. We will respond within 45 days.

Cookies & Tracking

Our website uses a minimal number of cookies and tracking technologies:

9.1 Essential Cookies (Strictly Necessary)

These cookies are required for the website to function correctly and cannot be disabled:

• PHP Session Cookie (PHPSESSID): A temporary session cookie used to store your CSRF security token and form load time for anti-spam purposes. It expires when you close your browser and contains no personal information.

9.2 No Analytics or Advertising Cookies

We do not currently use Google Analytics, Facebook Pixel, advertising cookies, or any third-party tracking scripts on our website. If we add analytics in the future, we will update this policy and implement a cookie consent banner.

9.3 Managing Cookies

You can control cookies through your browser settings. Note that disabling the session cookie will prevent our forms from working correctly as it is required for security (CSRF protection). Most browsers allow you to delete cookies, block certain types of cookies, or browse in private/incognito mode.

Children's Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal information from children under the age of 13 (or 16 in the EEA/UK). If you believe a child under this age has submitted personal information to us, please contact us immediately at privacy@cfspllc.com and we will promptly delete that information.

International Data Transfers

CFS Partners LLC operates primarily from the United States, with an additional office in the United Kingdom. If you submit personal data from the EEA, UK, or another jurisdiction, your data may be transferred to and processed in the United States.

We ensure that such transfers are protected by appropriate safeguards including:

• UK IDTA (International Data Transfer Agreement): For transfers from the UK to the US
• EU Standard Contractual Clauses (SCCs): For transfers from the EU to the US
• Adequacy decisions: Where applicable

By submitting personal data to us, you acknowledge that your information may be transferred internationally in accordance with the safeguards described above.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post the updated policy on this page with a new effective date
• Notify active clients by email where the changes are significant

We encourage you to review this policy periodically. Your continued use of our website after changes are posted constitutes your acceptance of the updated policy.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact our designated Privacy Officer: