Privacy Policy

1. Introduction

Lovell Government Services ("Lovell," "we," "us," or "our") operates the Lovell Partner Portal (the "Portal"). This Privacy Policy explains how we collect, use, disclose, and protect personal and business information in connection with the Portal.

The Portal is a business-to-business system for Partner companies and Lovell personnel supporting federal contracting onboarding. It is not directed to children under 18.

2. Who this policy covers

• Partner users — employees or agents of supplier/partner companies invited to the Portal.
• Lovell users — staff and authorized contractors who administer the Portal.
• Contacts named in Partner records — individuals listed as company contacts (for example authorized signers or department contacts), even if they never log in.

3. Information we collect

3.1 Account and authentication

• Name, work email address, role, and password (stored as a secure hash, not plain text).
• Multi-factor authentication data (email one-time codes; optional authenticator app secrets encrypted at rest; backup codes as applicable).
• Session tokens and related security metadata (including optional extended "keep me logged in" preferences).
• Avatar or profile images if you upload them.

3.2 Partner company and onboarding data

• Legal name, DBA, website, addresses, and federal pathway / playbook selection.
• Government and business identifiers (for example tax ID / EIN, UEI, CAGE, DUNS), which may be encrypted at rest.
• Company logo and approval status.
• Points of contact (name, title, department, email, phone) by category.
• Step assignments, status, due dates, form responses, and workflow history.
• Files and documents uploaded for pricing, catalog, compliance, or other playbook items.
• In-portal messages associated with steps and related notifications.
• Profile change requests and review outcomes.
• Optional distribution agreement / DA signed dates and other profile fields configured by Lovell.

3.3 Lovell operational data

• Help directory contacts (name, role, email, phone, photo, help descriptions) published for Partner support.
• Templates, playbooks, alerts, FAQs, and similar content managed by Lovell.
• Staff notifications, email delivery logs (metadata and content as configured), error reports, and audit/activity entries.

3.4 Technical and usage data

• IP address (for security, rate limiting, and abuse prevention), approximate request metadata, and browser user agent as logged by infrastructure.
• Cookies and similar technologies described in our Cookie Notice.
• Security-related events (failed logins, lockouts, session invalidation).

3.5 Information we do not intentionally collect

We do not intentionally collect Social Security numbers of individuals, payment card numbers for consumer checkout, or precise geolocation of mobile devices through the Portal. Please do not upload unnecessary sensitive personal data.

4. How we use information

• Authenticate users, enforce MFA, and protect accounts.
• Operate onboarding playbooks, reviews, approvals, messaging, and notifications.
• Establish and maintain Partner records for federal systems and catalog support.
• Communicate about account security, workflow status, and Portal operations.
• Improve reliability, debug errors, and maintain audit trails.
• Comply with law, enforce terms, and protect Lovell, Partners, and third parties.
• As otherwise described at the time of collection or with your consent.

5. Legal bases (where applicable)

For individuals in jurisdictions that require a legal basis (for example the EEA/UK), we typically process Portal data to perform a contract or pre-contractual steps with the Partner, based on legitimate interests in operating a secure B2B onboarding platform, to comply with legal obligations, or with consent where required (for example optional cookies beyond strictly necessary, if introduced later).

6. How we share information

We do not sell personal information. We may share information with:

• Service providers that host infrastructure, databases, file storage, email delivery, or monitoring under contractual obligations (for example cloud providers used to run the Portal).
• Lovell personnel and authorized contractors with a need to know for onboarding, contracting, security, or support.
• Government customers or systems as needed to perform federal catalog, contracting, or compliance activities you engaged us to support (and only as appropriate to that purpose).
• Professional advisors (legal, auditors) under confidentiality.
• Authorities or counterparties when required by law, legal process, or to protect rights, safety, and security.
• Successors in connection with a merger, acquisition, or asset transfer, subject to appropriate safeguards.

Partner users within the same Partner organization may see company and workflow information according to role permissions configured for that Partner.

7. International transfers

Lovell is based in the United States. The Portal is hosted on U.S.-oriented cloud infrastructure. If you access the Portal from outside the United States, you understand that information may be processed in the United States and other locations where our providers operate.

8. Security

We implement administrative, technical, and physical safeguards appropriate to a business portal handling commercial and limited government-related data, including encryption in transit (HTTPS), encrypted storage of certain sensitive fields, hashed passwords, MFA, session controls, role-based access, rate limiting, audit logging, and upload validation. No method of transmission or storage is 100% secure; you use the Portal at your own risk subject to our Terms.

Security researchers: see our Vulnerability Disclosure Policy and security.txt.

9. Retention

We retain account, Partner, workflow, file, message, email log, and audit data for as long as needed to provide the Portal, meet contractual and legal obligations, resolve disputes, and enforce agreements. Retention periods vary by record type. When no longer needed, we delete or de-identify information in accordance with our practices and technical constraints (for example backups may persist for a limited period).

10. Your choices and rights

• Update certain profile and contact information through the Portal or by contacting Lovell.
• Request password reset via the sign-in flow.
• Request account deactivation through your Partner administrator or Lovell.
• Depending on your location, you may have rights to access, correct, delete, or restrict processing of personal data, or to object to certain processing. Submit requests to lovelltech@lovellgov.com. We may need to verify identity and may deny requests as permitted by law (for example when data must be retained for compliance or is primarily business records of the Partner).

If you are a Partner employee, some requests may need to be coordinated with your employer as the business customer of the onboarding relationship.

11. California and similar U.S. state notices

We do not sell or share personal information for cross-context behavioral advertising as those terms are commonly defined under the CCPA/CPRA. Categories of personal information collected are described in Section 3 and used as in Section 4. To exercise applicable rights, contact us using the details below. We will not discriminate against you for exercising privacy rights.

12. Cookies

See our Cookie Notice for details on essential session cookies and related technologies.

13. Children

The Portal is not intended for individuals under 18. We do not knowingly collect personal information from children.

14. Changes

We may update this Privacy Policy by posting a revised version with a new effective date. Material changes may be communicated by email or in-portal notice when appropriate.

15. Contact

Privacy inquiries:
Lovell Government Services
223 W Gregory St., Pensacola, Florida 32502
lovelltech@lovellgov.com
(850) 607-0007

Security reports: reportcyber@lovellgov.com