Privacy Policy

Effective Date: March 13, 2026
Last Updated: March 13, 2026

Neumann Mendro Andrulaitis Architects, LLP (“NMA Architects,” “we,” “us,” or “our”) operates the website www.nmaarchitects.com (the “Site”). This Privacy Policy describes how we collect, use, disclose, and protect personal information when you visit our Site. It also explains your rights and choices regarding your information.

By using our Site, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

1.1 Information You Provide Directly

We collect personal information that you voluntarily submit through our Site:

  • Contact Form: Your name, email address, inquiry type, how you heard about us, and your message.
  • Job Application Form: Your name, email address, and resume (PDF attachment, up to 20 MB).

1.2 Information Collected Automatically

  • IP Address: We record your IP address when you submit a form. This is stored alongside your form submission.
  • Approximate Geolocation: We use the MaxMind GeoLite2 database to derive your approximate city and country from your IP address at the time of form submission. This is used to understand the geographic origin of inquiries and is not used to identify you personally.
  • Analytics Data (With Your Consent Only): If you consent, we use Google Analytics (via Google Tag Manager) to collect usage data such as pages visited, session duration, and referring URLs. We use Google Consent Mode v2, which means no analytics cookies are set and no personal data is collected by Google Analytics until you affirmatively consent. See Section 3 for details.

1.3 Information We Do Not Collect

We do not collect payment or financial information, Social Security numbers, driver’s license numbers, or other government-issued identifiers through this Site.

2. How We Use Your Information

We use the information we collect for the following purposes:

  • Responding to your inquiries submitted through our contact form.
  • Reviewing job applications submitted through our careers form.
  • Analyzing website traffic to improve our Site (only with your explicit consent).
  • Preventing spam and abuse through Google reCAPTCHA on form pages.
  • Complying with legal obligations and protecting our legal rights.

We do not sell, rent, lease, or trade your personal information to third parties for monetary or other valuable consideration.

3. Cookies and Tracking Technologies

3.1 Cookie Categories

Strictly Necessary Cookies: Essential for the Site to function (e.g., session management, cookie consent preferences). These cannot be disabled.

Analytics Cookies (Opt-In Only): Used by Google Analytics to understand how visitors interact with our Site. These cookies (including _ga and _gid) are only set after you affirmatively consent. We use Google Consent Mode v2, which ensures that when consent is denied, no analytics cookies are set and no personally identifiable data is collected by Google Analytics.

3.2 Your Cookie Choices

When you first visit our Site, a cookie consent banner allows you to accept or decline analytics cookies. You can change your preferences at any time by clicking “Manage Cookie Preferences” in the site footer.

If you decline or revoke consent, any existing analytics cookies will be automatically cleared from your browser.

3.3 Global Privacy Control (GPC)

We honor the Global Privacy Control (GPC) browser signal. If your browser sends a GPC signal, analytics cookies are automatically disabled and the preference is locked — you will not be prompted to enable them.

3.4 Region-Specific Consent Defaults

We apply the most protective consent standard based on your location:

  • European Economic Area (EEA), United Kingdom, and Switzerland: Analytics cookies are disabled by default and require your affirmative opt-in consent, in compliance with the GDPR and ePrivacy Directive.
  • California and select U.S. states (CT, FL, IL, MD, MA, MT, NH, PA, WA): Analytics cookies are disabled by default and require your affirmative opt-in consent, in compliance with applicable state privacy and wiretap laws, including the California Invasion of Privacy Act (CIPA).
  • All other regions: Analytics cookies are enabled by default unless you have GPC enabled, but you may decline them at any time through the consent banner or footer link.

4. Third-Party Services

4.1 Google Tag Manager and Google Analytics

We use Google Tag Manager (“GTM”) to manage Google Analytics with Google Consent Mode v2. GTM loads on each page to manage consent state, but no analytics cookies are set and no personally identifiable data is collected until you grant consent. When consent is denied, Google’s tags operate in a limited, cookieless mode that does not collect personal data. When you grant consent, Google Analytics collects anonymized usage data about how you interact with our Site. Google may process this data on servers located in the United States.

We have entered into a Data Processing Agreement with Google, and Google Analytics is configured with appropriate data retention settings. For more information, see Google’s Privacy Policy and How Google Uses Data.

4.2 Google reCAPTCHA

Our contact and job application forms are protected by Google reCAPTCHA v3, which helps prevent spam and abuse. reCAPTCHA loads only on pages containing forms (not site-wide) and may collect hardware and software information, such as device data and browser characteristics, and transmit it to Google for analysis.

We use reCAPTCHA on the legal basis of legitimate interest (preventing fraudulent and abusive form submissions). Use of reCAPTCHA is subject to Google’s Privacy Policy and Terms of Service.

4.3 Instagram Feed

Our homepage displays a feed of our own Instagram posts using the Instagram Basic Display API. When this content loads, your browser makes requests to Instagram’s (Meta’s) servers, which may expose your IP address and browser information to Meta Platforms, Inc. This occurs as part of standard web content delivery and is not used by us to track or identify you. Meta’s handling of this data is subject to Meta’s Privacy Policy.

4.4 Third-Party Links

Our Site contains links to third-party websites (e.g., social media profiles on Facebook, LinkedIn, Pinterest, Houzz). We are not responsible for the privacy practices of these external sites and encourage you to review their privacy policies.

5. Data Retention

We retain personal information for the following periods:

  • Contact form submissions: Up to 2 years, or until no longer needed to respond to and follow up on your inquiry.
  • Job application submissions (including resumes): Up to 1 year after the position is filled, unless you request earlier deletion.
  • IP addresses and geolocation data: Retained with the associated form submission and deleted on the same schedule.
  • Analytics data: Subject to Google Analytics’ retention settings (currently set to 14 months). Analytics cookies expire as follows: _ga after 2 years; _gid after 24 hours.
  • Cookie consent preferences: Retained until you clear your browser cookies or change your preferences.

You may request deletion of your personal data at any time (see Section 6).

6. Your Rights

6.1 All Visitors

Regardless of your location, you may:

  • Opt out of analytics cookies at any time via the cookie consent banner, the “Manage Cookie Preferences” footer link, or by enabling GPC in your browser.
  • Request deletion of personal information you have submitted through our forms by contacting us (see Section 10).
  • Request access to the personal information we hold about you.

6.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

  • Right to Know: You may request a description of the categories and specific pieces of personal information we have collected about you.
  • Right to Delete: You may request that we delete your personal information.
  • Right to Correct: You may request correction of inaccurate personal information.
  • Right to Opt Out of Sale/Sharing: We do not sell or share your personal information as those terms are defined by the CCPA/CPRA. No opt-out is necessary, but the “Do Not Sell or Share My Personal Information” link is provided in our footer for transparency.
  • Right to Limit Use of Sensitive Information: We do not collect sensitive personal information as defined by the CCPA/CPRA.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

To exercise your rights, contact us using the information in Section 10. We will verify your identity before processing your request.

6.3 California Invasion of Privacy Act (CIPA)

We use Google Consent Mode v2, which ensures that no analytics cookies are set and no personally identifiable data is collected for visitors in California without prior affirmative opt-in consent. Analytics consent is denied by default for California visitors and is only activated if you affirmatively consent through our cookie banner.

6.4 European Residents (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation:

  • Access your personal data.
  • Rectify inaccurate personal data.
  • Erase your personal data (“right to be forgotten”).
  • Restrict or object to processing of your personal data.
  • Data portability — receive your data in a structured, machine-readable format.
  • Withdraw consent at any time for consent-based processing, without affecting the lawfulness of processing based on consent before its withdrawal.
  • Lodge a complaint with your local data protection authority.

Legal Bases for Processing:

Processing Activity Legal Basis
Analytics cookies Consent (Article 6(1)(a))
Form submissions (contact/jobs) Legitimate interest (Article 6(1)(f)) — responding to inquiries and reviewing applications
reCAPTCHA Legitimate interest (Article 6(1)(f)) — preventing spam and abuse
IP address and geolocation Legitimate interest (Article 6(1)(f)) — understanding geographic origin of inquiries

6.5 International Data Transfers

If you are located outside the United States, please be aware that data collected through our Site may be transferred to and processed in the United States, where our servers and third-party service providers (including Google) are located. We rely on Standard Contractual Clauses (SCCs) and other appropriate safeguards as required by applicable law to protect data transferred internationally.

7. Data Security

We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These include encrypted connections (HTTPS/TLS), filtered parameter logging to prevent accidental exposure of sensitive data, and restricted access to form submission data.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

8. Children’s Privacy

Our Site is not directed at children under the age of 16, and we do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 16, we will promptly delete it. If you believe a child has provided us with personal information, please contact us (see Section 10).

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the revised policy on this page and update the “Last Updated” date. Material changes will be highlighted via the cookie consent banner or other conspicuous notice on the Site. Your continued use of the Site after changes are posted constitutes your acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or want to make a complaint, please contact us through our contact form.

Neumann Mendro Andrulaitis Architects, LLP
Website: www.nmaarchitects.com

For GDPR-related inquiries, you may also contact your local data protection authority.