Privacy Policy

This Privacy Policy explains how Florian Brach Executive Search LLC collects, uses, stores, shares, and protects personal information in connection with The Industrial Reality Index, its website, Executive Preview requests, publications, briefings, communications, and related activities.

The Industrial Reality Index is published under CEO 2028 OS and is owned and operated by Florian Brach Executive Search LLC.

This Privacy Policy applies specifically to The Industrial Reality Index. Personal and organizational data processed within CEO 2028 OS is governed separately by the CEO 2028 OS Privacy Policy, applicable client agreements, and, where required, data processing agreements.

Where applicable, this Privacy Policy is intended to provide transparency under United States privacy laws and the General Data Protection Regulation.

Florian Brach Executive Search LLC
999 Vanderbilt Beach Road, Suite 200
Naples, Florida 34108
United States

Email: info@florian-brach.com

This Privacy Policy applies to personal information processed in connection with:

• theindustrialrealityindex.com and related Index website pages;
• requests for Executive Previews;
• distribution of Executive Previews, reports, and publications;
• requests for executive briefings;
• communications relating to the Index;
• publication access and distribution records;
• website administration, security, and analytics;
• research participation or research-related communications where applicable;
• and other activities directly connected to The Industrial Reality Index.

This Privacy Policy does not replace the CEO 2028 OS Privacy Policy or contractual privacy terms governing data processed inside CEO 2028 OS.

We may collect the following categories of personal information.

Contact and Professional Information

• name;
• business email address;
• telephone number;
• company or organization;
• job title, function, or professional role;
• industry, jurisdiction, or professional context;
• and professional profile information voluntarily provided to us.

Executive Preview and Publication Requests

• information submitted when requesting an Executive Preview, report, publication, or related material;
• the publication, edition, topic, or briefing requested;
• the date and status of the request;
• delivery and access records;
• and communications relating to approval, distribution, access, or follow-up.

Executive Briefings and Communications

• messages submitted through forms or by email;
• briefing requests and scheduling information;
• professional, organizational, investment, governance, transaction, or risk context voluntarily provided by the requester;
• communications, correspondence, and administrative notes relating to the briefing;
• and follow-up communications or requests.

Website and Technical Information

• IP address;
• browser type;
• device type;
• operating system;
• referring and accessed pages;
• dates and times of website access;
• cookie identifiers;
• website interaction and usage information;
• approximate location derived from IP address;
• and technical, diagnostic, fraud-prevention, and security information.

Publication and Access Information

• records showing when a publication was requested, issued, delivered, accessed, or downloaded;
• document version or identifier;
• recipient and distribution classification;
• access authorization;
• and records reasonably required to protect confidential or restricted publications.

Information Collected in Connection With Research

Where individuals or organizations communicate with us in connection with Index research, we may process:

• professional and organizational information;
• research-related correspondence;
• information voluntarily provided during discussions, briefings, interviews, or other interactions;
• and administrative records relating to the research relationship.

The Industrial Reality Index does not require public attribution of individual research participants unless expressly agreed.

We may use personal information to:

• operate, maintain, administer, and secure The Industrial Reality Index website;
• review and respond to Executive Preview requests;
• issue and distribute authorized publications;
• verify recipient identity, role, organization, or professional relevance;
• manage restricted or confidential publication access;
• schedule and conduct executive briefings;
• respond to inquiries and communications;
• maintain publication and distribution records;
• protect the confidentiality, integrity, and permitted use of Index materials;
• detect, investigate, and prevent unauthorized access, disclosure, redistribution, misuse, fraud, or security incidents;
• understand website use and improve website performance;
• maintain, improve, and develop The Industrial Reality Index and related services;
• conduct research and prepare aggregated, anonymized, or non-identifiable findings;
• comply with contractual, legal, regulatory, accounting, and recordkeeping obligations;
• establish, exercise, or defend legal rights;
• and communicate regarding relevant Index publications, briefings, or activities where permitted by law.

The Industrial Reality Index presents observations, classifications, comparisons, benchmarks, and related findings derived from organizational and operating contexts.

Published Index materials are intended to use aggregated, anonymized, non-identifiable, or otherwise lawfully publishable information.

The Industrial Reality Index does not publicly identify an individual, client organization, research participant, or source in connection with confidential underlying information unless:

• the relevant person or organization has expressly authorized identification;
• the information is already lawfully public;
• identification is required by law;
• or another lawful basis permits the disclosure.

Research findings may combine information across multiple organizations, industries, operating contexts, jurisdictions, and time periods.

Aggregation and anonymization are used to reduce the likelihood that findings can be attributed to a specific individual or organization.

Where underlying organizational information originates through CEO 2028 OS, the processing of client-submitted personal and organizational data remains subject to the CEO 2028 OS Privacy Policy, applicable client agreements, access controls, and data processing arrangements.

The publication of The Industrial Reality Index does not give readers or recipients access to identifiable underlying client data, source records, individual user information, or confidential organizational records.

Where the GDPR or another law requiring a legal basis applies, we may process personal information based on:

Contractual Necessity

Processing may be necessary to provide requested publications, briefings, services, or communications, or to take steps at the request of an individual or organization before entering into a business relationship.

Legitimate Interests

We may process information where reasonably necessary for legitimate interests such as:

• operating and administering the Index;
• reviewing access requests;
• protecting confidential publications;
• maintaining security;
• preventing unauthorized use;
• conducting and improving research;
• communicating with relevant professional audiences;
• maintaining business records;
• and protecting our legal and proprietary rights.

We consider the nature of the information, the context of processing, and the interests and rights of affected individuals when relying on legitimate interests.

Consent

We may rely on consent where required, including for certain marketing communications, optional cookies, or voluntary participation in particular activities.

Consent may be withdrawn at any time without affecting processing lawfully carried out before withdrawal.

Legal Obligations

We may process personal information where necessary to comply with applicable legal, regulatory, accounting, tax, court, or government requirements.

We may create and use aggregated, anonymized, statistical, or otherwise non-identifiable information for:

• research;
• benchmarking;
• publication;
• analysis;
• methodological development;
• system and publication improvement;
• security;
• and other legitimate business purposes.

Information that has been effectively anonymized so that an individual is no longer identifiable is not personal information under many applicable privacy laws.

We do not use public Index publications to disclose identifiable confidential client-submitted OS data across organizations.

We may disclose personal information to the following categories of recipients where reasonably necessary.

Service and Infrastructure Providers

We may use providers supporting:

• website hosting;
• cloud infrastructure;
• email delivery;
• document delivery;
• scheduling;
• communications;
• analytics;
• security;
• data storage;
• technical support;
• and professional administration.

Such providers may process information only as necessary to perform services for us and subject to applicable contractual, confidentiality, and data protection obligations.

Professional Advisors

Information may be disclosed where reasonably necessary to attorneys, accountants, auditors, insurers, consultants, and other professional advisors who are subject to confidentiality obligations.

Legal and Protective Disclosures

We may disclose information:

• where required by law, regulation, court order, subpoena, legal process, or government request;
• to establish, exercise, or defend legal rights;
• to enforce applicable Terms and Conditions or confidentiality restrictions;
• to investigate unauthorized access, redistribution, misuse, or security incidents;
• or to protect the rights, property, security, and integrity of Florian Brach Executive Search LLC, CEO 2028 OS, The Industrial Reality Index, recipients, clients, or others.

Business Transactions

Information may be disclosed in connection with a proposed or completed merger, acquisition, financing, restructuring, sale of assets, investment, or similar corporate transaction, subject to appropriate confidentiality and legal safeguards.

Authorized Disclosures

We may disclose information where the relevant individual or organization has requested or authorized the disclosure.

• We do not sell personal information.
• We do not sell client-submitted CEO 2028 OS data.
• We do not use confidential client-submitted OS data for targeted advertising.
• We do not disclose identifiable client-submitted OS data between unrelated clients through The Industrial Reality Index.

The Index website may use cookies and similar technologies for:

• essential website functionality;
• security;
• fraud prevention;
• preference management;
• performance;
• analytics;
• and understanding website use.

Where required by applicable law, non-essential cookies or similar technologies will be used only after consent has been obtained.

Users may manage cookie preferences through available consent controls or browser settings.

Disabling certain cookies may affect website functionality.

Florian Brach Executive Search LLC is established in the United States.

Personal information may be processed in the United States or other jurisdictions in which our service providers operate.

Where personal information protected by the GDPR or comparable transfer restrictions is transferred outside the European Economic Area, the United Kingdom, Switzerland, or another relevant jurisdiction, appropriate safeguards may be used where required.

These safeguards may include:

• Standard Contractual Clauses;
• adequacy decisions;
• contractual and technical protections;
• or another legally recognized transfer mechanism.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Retention periods may depend on:

• the nature and purpose of the information;
• the duration of the relevant relationship;
• publication and distribution requirements;
• confidentiality and access-control requirements;
• research and documentation needs;
• security and fraud-prevention requirements;
• contractual obligations;
• legal limitation periods;
• and applicable accounting, tax, regulatory, or recordkeeping requirements.

For example, records of restricted-publication access may be retained for as long as reasonably necessary to document authorized distribution and enforce confidentiality or use restrictions.

When information is no longer required, it may be deleted, securely destroyed, or anonymized.

We use technical and organizational measures designed to protect personal information against unauthorized access, use, alteration, disclosure, loss, or destruction.

Depending on the context, these measures may include:

• access controls;
• role-based permissions;
• authentication controls;
• encryption in transit and at rest where appropriate;
• restricted publication access;
• logging and audit records;
• company-level or system-level data separation;
• security monitoring;
• service-provider controls;
• administrative safeguards;
• and incident-response procedures.

No security system can guarantee complete protection. Users should exercise care when transmitting information electronically and should notify us of suspected unauthorized access or disclosure.

Depending on applicable law and jurisdiction, individuals may have the right to request:

• access to personal information;
• correction of inaccurate information;
• deletion of personal information;
• restriction of processing;
• objection to certain processing;
• data portability;
• withdrawal of consent where processing is based on consent;
• and information regarding certain disclosures or processing activities.

These rights may be subject to legal limitations, exemptions, verification requirements, and the rights of other persons or organizations.

A request concerning personal information does not automatically require disclosure of:

• confidential information belonging to another person or organization;
• proprietary Index methodology;
• trade secrets;
• privileged information;
• information that would adversely affect the rights of others;
• or source materials protected from disclosure by law or contract.

Where legally required, we will explain any applicable limitation.

Requests may be submitted to: info@florian-brach.com

We may request information reasonably necessary to verify identity and authority before responding.

Where the GDPR, United Kingdom GDPR, Swiss data protection law, or comparable law applies, individuals may also have the right to lodge a complaint with the competent data protection supervisory authority.

Individuals are encouraged to contact us first so that we may attempt to address the matter directly.

Depending on the individual’s state of residence and the applicability of the relevant law, additional rights may apply concerning access, correction, deletion, portability, or certain uses and disclosures of personal information.

We do not discriminate against individuals for exercising applicable privacy rights.

Because privacy laws contain different thresholds, definitions, exemptions, and applicability requirements, not every right applies in every circumstance.

The Index website does not use personal information to make solely automated decisions that produce legal or similarly significant effects concerning an individual.

Requests for Executive Previews or briefings may be reviewed individually based on professional relevance, intended use, distribution scope, availability, and other legitimate considerations.

Research classifications, benchmark findings, or Industrial Reality Scores are not intended to constitute automated decisions concerning an identified natural person.

We may communicate with individuals who:

• request an Executive Preview;
• request a briefing;
• contact us;
• receive an authorized publication;
• participate in a professional or research interaction;
• or have an existing business relationship with us.

Communications may include:

• responses to requests;
• publication delivery;
• administrative information;
• security or access notices;
• briefing coordination;
• relevant publication updates;
• and related professional communications.

Where required, marketing communications will be sent based on consent or another lawful basis.

Recipients may opt out of non-essential marketing communications by using available unsubscribe mechanisms or contacting us.

Operational, legal, security, and requested-service communications may continue where necessary.

Executive briefings may involve discussion of organizational, professional, investment, governance, transaction, or risk context voluntarily provided by participants.

Such information will be handled in accordance with this Privacy Policy and any applicable confidentiality agreement.

Participants should not disclose personal, confidential, regulated, or third-party information unless they are authorized to do so and the disclosure is reasonably necessary.

Unless otherwise agreed, private briefing discussions are not publicly attributed to participants or their organizations.

The Index website or publications may contain links to third-party websites, platforms, professional profiles, or services.

We are not responsible for the privacy, security, content, or practices of third parties.

Individuals should review the privacy terms of the relevant third-party service before providing information.

The Industrial Reality Index is intended for professional and business audiences and is not directed to children.

We do not knowingly collect personal information from children under the age at which parental consent is required under applicable law.

If we learn that such information has been collected unintentionally, we may take reasonable steps to delete it.

We may update this Privacy Policy from time to time to reflect:

• changes to The Industrial Reality Index;
• new publications or services;
• changes in technology;
• changes in data practices;
• legal or regulatory developments;
• or security and operational requirements.

The latest version will be published on the official Industrial Reality Index website with the applicable “Last Updated” date.

Material changes may also be communicated through the website, email, publication-access process, or another appropriate channel.