The Calysto Group

Effective Date: October 13, 2026
Last Updated: October 13, 2026

1. Introduction

The Calysto Group (“Calysto,” “we,” “us,” or “our”) is a managed information technology services and cybersecurity provider. We respect the privacy of our customers, prospective customers, website visitors, and other individuals whose information we process in connection with our business operations.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you:

• Visit our website or interact with our online content;
• Inquire about or purchase our products and services;
• Communicate with our sales, administrative, or technical support teams;
• Submit or participate in service requests, support tickets, or other customer communications;
• Receive managed IT, cybersecurity, infrastructure monitoring, or related services; or
• Enroll in our SMS notification programs.

By using our website or providing information to us, you acknowledge the practices described in this Privacy Policy.

This Privacy Policy does not replace any applicable managed services agreement, confidentiality agreement, data processing agreement, or other written contract between Calysto and a customer. Where such an agreement establishes additional or different obligations regarding customer-managed data, that agreement governs to the extent applicable.

2. Information We Collect

Depending on the nature of your relationship with us, we may collect the following categories of information.

2.1 Contact and Business Information

• Name and job title;
• Company or organization name;
• Business and mailing addresses;
• Email addresses;
• Telephone and mobile phone numbers;
• Business affiliation and authorized contact information; and
• Communication and service preferences.

2.2 Customer Account and Service Information

• Customer account identifiers;
• Service agreements and subscription information;
• Billing and payment-related records;
• Authorized users and technical contacts;
• Service requests, support tickets, and associated communications;
• Technical support history;
• Customer-provided documentation and configurations; and
• Records of requested services and customer authorizations.

2.3 Technical and Infrastructure Information

In providing managed IT services, cybersecurity services, and infrastructure monitoring, we may process information concerning customer technology environments, including:

• Device names, identifiers, operating systems, and configurations;
• Network addresses, topology, and connectivity information;
• Equipment availability and performance metrics;
• System event logs and diagnostic data;
• Security alerts, vulnerability information, and threat indicators;
• Software inventory, patch status, and system health;
• Backup and recovery status; and
• Other technical information reasonably necessary to deliver contracted services.

Certain customer environments may contain personal, confidential, regulated, or otherwise sensitive information. Such information is handled according to applicable agreements, our security practices, and applicable law.

2.4 Website and Usage Information

When you visit our website, we or authorized service providers may automatically collect certain technical information, such as:

• IP address;
• Browser type and device characteristics;
• Operating system;
• Pages visited and referral sources;
• Date and time of website activity; and
• Cookies and similar technologies, where applicable.

2.5 SMS Notification Information

If you request SMS notifications, we may collect and maintain:

• Your name and organization;
• Your mobile telephone number;
• The types of notifications you authorize;
• Your consent or opt-in response;
• Date, time, and method of consent;
• The associated service ticket or authorization record;
• SMS delivery and related technical records; and
• Opt-out requests and communication preferences.

We use this information to administer our SMS notification services, maintain records of authorization, deliver requested operational messages, and honor communication preferences.

3. How We Use Information

We may process personal information for legitimate business and service-related purposes, including:

1. Providing, maintaining, and improving managed IT and cybersecurity services.
2. Monitoring customer systems, networks, and infrastructure.
3. Detecting, investigating, and responding to security incidents and technical failures.
4. Providing customer support and managing service requests.
5. Communicating about service delivery, outages, maintenance, and operational matters.
6. Maintaining customer accounts, contracts, billing, and financial records.
7. Responding to questions, service inquiries, and proposals.
8. Maintaining business records and documenting customer authorizations.
9. Improving website functionality, service quality, and internal operations.
10. Protecting our systems, customers, employees, and business interests.
11. Complying with applicable laws, regulations, contractual obligations, and lawful requests.
12. Sending SMS notifications to individuals who have specifically authorized those communications.

We do not use consent to infrastructure monitoring SMS notifications as authorization to send marketing messages.

4. SMS Messaging Privacy and Consent

The Calysto Group offers optional SMS notification services for authorized customer contacts.

These messages may include critical network outages, infrastructure failures, uninterruptible power supply (UPS) events, significant monitoring alerts, incident updates, and restoration notifications.

4.1 How SMS Consent Is Obtained

Recipients must provide explicit consent before receiving SMS notifications.

Our standard enrollment process uses our HaloPSA service management system. An individual receives a service ticket describing the SMS program, the types of messages, potential carrier charges, message frequency, and instructions for opting out.

The individual must provide an affirmative written response authorizing SMS notifications to a specified mobile telephone number.

We retain the authorization and associated consent records within our service management system.

We do not treat an existing customer relationship, possession of a phone number, or prior participation in another communication program as consent to this SMS service.

4.2 Message Frequency and Charges

SMS message frequency varies depending on monitored infrastructure events, incidents, and recovery conditions.

Multiple messages may be delivered during an incident or outage.

Message and data rates may apply.

The Calysto Group does not impose a separate SMS subscription charge for these notifications unless expressly established in a separate written service agreement.

4.3 SMS Opt-Out and Assistance

Recipients may opt out at any time by replying STOP to an SMS message from our notification program.

Recipients may reply HELP for assistance or contact The Calysto Group through our published customer support channels.

After an opt-out request is processed, no further SMS notifications will be sent to that number for the applicable program unless the recipient subsequently provides valid consent to resume messaging.

Participation is voluntary and is not a condition of purchasing or receiving managed IT services.

4.4 Mobile Information and SMS Consent Non-Sharing Policy

The Calysto Group does not sell, rent, share, or disclose mobile phone numbers, SMS opt-in data, or SMS consent records to third parties or affiliates for marketing or promotional purposes.

Text messaging originator opt-in data and consent information are excluded from any sharing or disclosure of personal information for third-party or affiliate marketing.

Mobile information may be processed by service providers acting on our behalf solely as necessary to deliver requested messaging services, maintain consent and opt-out records, provide technical support, protect service security, or fulfill applicable legal requirements.

These service providers are not authorized by Calysto to use SMS consent information for their own marketing or promotional purposes.

We do not transfer SMS consent between unrelated campaigns or treat consent to operational notifications as consent to promotional messaging.

For additional information, please see our SMS Terms & Conditions.

5. How We Share Information

We may disclose information only as reasonably necessary for the purposes described in this Policy.

5.1 Service Providers and Technology Partners

We may work with third-party providers to deliver services, including:

• Cloud hosting and infrastructure providers;
• Remote monitoring and management platforms;
• Cybersecurity and threat detection providers;
• IT service management and ticketing platforms;
• Telecommunications and messaging providers;
• Payment processing and accounting providers; and
• Other service providers supporting our contracted operations.

For example, we may use HaloPSA to maintain service and consent records, Domotz for infrastructure monitoring, and Twilio for SMS delivery.

Information shared with these providers is limited to what is reasonably necessary for their authorized functions and is subject to applicable contractual, confidentiality, security, and legal requirements.

5.2 Customer-Authorized Disclosures

We may disclose information to a customer’s authorized personnel, designated representatives, or approved vendors when necessary to fulfill the customer’s instructions or provide contracted services.

5.3 Legal and Regulatory Requirements

We may disclose information where reasonably necessary to:

• Comply with applicable law or lawful legal process;
• Respond to valid government or regulatory requests;
• Protect the rights, safety, and security of Calysto, our customers, or others;
• Investigate fraud, abuse, or security incidents; or
• Enforce applicable contractual rights.

5.4 Business Transactions

Information may be disclosed in connection with a merger, acquisition, financing, restructuring, or sale of business assets, subject to appropriate confidentiality protections and applicable law.

SMS opt-in information and consent records will not be sold, transferred, or used for unrelated marketing purposes through such transactions.

6. Customer Data and Our Role as a Service Provider

In delivering managed IT and cybersecurity services, Calysto may process information on behalf of customer organizations.

In these circumstances, the customer may determine the purposes and means of processing certain data, while Calysto processes that information to provide contracted services or follow authorized instructions.

Requests relating to personal information controlled by a customer organization may need to be directed to that organization.

We do not claim ownership of customer information merely because it is accessible to us during the provision of services.

Customer information is accessed and used according to our contractual responsibilities, authorized service purposes, and applicable law.

7. Information Security

We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, destruction, or misuse.

Depending on the information and service involved, safeguards may include:

• Role-based access controls;
• Multifactor authentication;
• Access logging and monitoring;
• Endpoint and network security protections;
• Encryption where appropriate;
• Security awareness and employee training;
• Vendor access management;
• Backup and recovery procedures; and
• Security incident detection and response processes.

No method of transmission, processing, or storage is completely secure. Accordingly, we cannot guarantee absolute security.

We evaluate and improve our safeguards in light of evolving risks, business requirements, and applicable obligations.

8. Data Retention

We retain personal information only for as long as reasonably necessary to:

• Deliver requested services;
• Maintain business and customer records;
• Satisfy contractual obligations;
• Comply with applicable legal, tax, regulatory, or accounting requirements;
• Document consent and communication preferences;
• Resolve disputes; or
• Protect our legitimate business and security interests.

Retention periods may vary according to the information category, contractual terms, service requirements, and applicable law.

SMS consent records may be retained after a recipient unsubscribes where necessary to document the authorization history, demonstrate compliance, and prevent unauthorized re-enrollment.

When information is no longer required, we take reasonable steps to securely delete, de-identify, or otherwise dispose of it, subject to applicable retention obligations and technical limitations.

9. Cookies and Website Technologies

Our website may use cookies and similar technologies to support functionality, maintain security, understand website performance, and improve user experience.

These technologies may include:

• Essential cookies required for website operation;
• Functional cookies that support user preferences; and
• Analytics technologies that help us understand website usage.

Where applicable, users may manage cookies through browser settings or available website consent controls.

Disabling certain cookies may affect website functionality.

We do not use website cookie activity as authorization to enroll an individual in SMS messaging.

10. Marketing Communications

We may communicate with customers and prospective customers regarding our services where permitted by applicable law.

Recipients of optional marketing communications may use applicable unsubscribe mechanisms or contact us to request that such communications stop.

Operational, contractual, billing, security, and other service-related communications may continue when necessary or otherwise permitted by law.

Consent to receive operational SMS alerts is separate from consent to receive marketing communications.

11. Your Privacy Choices and Rights

Depending on your location and applicable law, you may have rights concerning your personal information, including the ability to request:

• Access to certain personal information;
• Correction of inaccurate information;
• Deletion of information where legally appropriate;
• Information about our processing practices; or
• Changes to communication preferences.

To submit a privacy-related request, contact us using the information in Section 16.

We may need to verify your identity or authority before processing a request.

Certain requests may be limited by contractual responsibilities, customer instructions, security requirements, recordkeeping obligations, or applicable law.

If we process information on behalf of a customer organization, we may direct the request to that organization.

12. Third-Party Websites and Services

Our website or communications may contain links to third-party websites, applications, or services.

We are not responsible for the privacy practices or content of independently operated third-party services.

We encourage individuals to review the relevant privacy policies before providing information to those services.

13. Children’s Privacy

Our website and services are intended primarily for businesses and professional users and are not directed toward children under the age of 13.

We do not knowingly solicit or collect personal information directly from children under 13 through our website for marketing purposes.

If we learn that personal information has been collected from a child in violation of applicable law, we will take appropriate steps to address the matter.

This provision does not prevent us from processing information contained in a customer’s technology environment when authorized under an applicable service agreement and law.

14. International Processing

Some technology vendors, hosting providers, or service providers may process information outside the state or country in which it was originally collected.

Where applicable, such processing is subject to appropriate contractual and legal safeguards.

Our use of providers does not change our commitment to protecting SMS consent information from disclosure for third-party marketing or promotional purposes.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, business practices, technology, or applicable legal requirements.

The updated policy will be posted on our website with a revised effective date or last-updated date.

Where legally required, we will provide additional notice or obtain consent before making material changes affecting personal information.

Changes to this Privacy Policy do not independently expand any individual’s SMS consent.

16. Contact Us

For privacy questions, information requests, SMS consent concerns, or other inquiries regarding this Privacy Policy, please contact:

The Calysto Group
Website: https://calystogroup.com
Email: help@calystogroup.com
Telephone: (586) 488-4400
Mailing Address: PO Box 119, Algonac, MI 48001

For SMS-specific questions, please see our SMS Terms & Conditions.

The Calysto Group — Managed IT Services & Cybersecurity