Effective Date: June 26, 2025

Section 1: Scope, Acceptance & Definitions (10 paragraphs)

1. This Privacy Policy (“Policy”) applies to all users of our website(s), services, mobile apps, email communications, social media pages, offline activities, and affiliated domains (collectively, “Services”), managed by A‑Z Websites, a sole proprietorship located in Brantford, Ontario (“A‑Z,” “we,” “us,” “our”).

2. By accessing, browsing, using, or registering with our Services, and by communicating with us offline, you acknowledge you have read, understood, and agreed to the practices described. Any dispute regarding use of this Policy will be resolved in accordance with Section 12 (Governing Law & Dispute Resolution).

3. Use of our Services by individuals under thirteen (13) is strictly prohibited. We do not seek or accept knowingly any personal information from minors. If we become aware that we have collected information from a minor, we will delete it immediately.

4. Where required by applicable law, we may seek consent for specific collection, processing, or disclosure of personal information. Consent may be implied by your actions (e.g., filling out a form) or express (e.g., clicking “I agree”).

5. The term “personal information” refers to “personal information” as defined by PIPEDA, including any information that relates to an identifiable individual. “Non-personal information” refers to aggregated, anonymized, statistical, or de-identified data.

6. “Third‑Party Service Providers” include but are not limited to hosting, analytics, email, CRM, marketing, payment, and support vendors.

7. This Policy complements our Terms of Service but does not replace or modify their terms.

8. We may update or revise this Policy at any time. Any changes will be posted with a revised effective date, and unless otherwise stated, shall apply to all information previously collected.

9. For questions related to this Policy or to exercise your rights, contact us using the details in Section 11.

10. The headings in this Policy are for convenience only and do not affect interpretation or meaning.

---

Section 2: Personal Information We Collect (10 paragraphs)

1. Information You Provide: When you fill out contact forms, request quotes, sign up for newsletters, comment on blog posts, download resources, provide feedback, or otherwise interact, we collect: full name, email address, phone number, business name, province or region, role/title, and any additional information you submit.

2. Communications: We collect content and metadata from your emails, messages, support tickets, and phone calls with us.

3. Transactional Data: For paid clients, we collect billing information such as invoice records, address, payment method (e.g., credit card or PayPal), transaction dates, and amounts.

4. Automatically-Collected Data: We use server logs and analytics tools (Google Analytics, Hotjar, Facebook Pixel) to gather technical details like IP address, device type, browser version, language preferences, operating system, referral URLs, pages visited, time spent, interaction events (clicks, forms), and geographic region.

5. Cookies & Tracking Technologies: Our Services employ first-party and third-party cookies as defined in Section 4, to remember preferences, track behavior, and support marketing.

6. Third-Party Sources: We may supplement our information by obtaining data from LinkedIn, Google My Business, public registries, review platforms, or other vendor sources.

7. Optional Sensitive Data: Occasionally, you may volunteer sensitive personal data (e.g., health-related info in case studies). That data is used strictly for the stated purpose and deleted upon fulfillment or demand.

8. User Profiles: Data may be consolidated into profiles, combining provided and tracked information for workflow enhancements, personalization, and customer experience improvement.

9. Retention in Forms/Assets: Uploaded files—logos, content documents, images—are retained per Section 8 retention policy.

10. Accuracy: We strive to maintain accurate data. To correct or amend information you’ve provided, contact us anytime at our support address.

---

Section 3: Use & Disclosure (10 paragraphs)

1. Primary Purposes: We use personal information to provide services, process transactions, manage client relationships, communicate, and personalize your experience.

2. Marketing & Communications: With your consent, we may send promotional material, newsletters, offers, or event invites. You can withdraw such consent anytime via unsubscribe link or direct request.

3. Service Providers: We share your data with hosting providers (e.g., SiteGround), analytics services (Google Analytics), payment processors (Stripe or PayPal), email platforms (MailerLite), support vendors (Intercom), and legal or accounting professionals, under binding confidentiality agreements and only as necessary.

4. Regulatory Compliance: Data may be disclosed to government authorities, courts, law enforcement, or regulatory bodies when required, including legal due process or to prevent fraud.

5. Business Transfers: If sold or merged, your personal data may be part of the transaction. You will receive notice prior and can object to such transfer.

6. Aggregated Data: We publish anonymous summaries, usage statistics, case study performance metrics, or testimonials (with consent).

7. Legal Rights Protection: We may use data to defend against legal claims, enforce our rights, or mitigate liabilities.

8. No Sale of Personal Info: We do not sell or lease personal data to unaffiliated third parties unless legally required or with your explicit opt-in.

9. Disclosure upon Consent: With your explicit permission, we may share information publicly or with third parties for testimonials, co-promotion, or referrals.

10. Children’s Data Handling: Any data from persons under 13 is erased immediately. We block under-age users and delete associated data.

---

Section 4: Cookies & Tracking (10 paragraphs)

1. Cookie Types: We use Essential, Preference, Analytics, and Marketing cookies for site functionality, remembering settings, usage metrics, and ad tracking.

2. First-Party vs Third-Party: Essential and preference cookies are first-party. Analytics and marketing cookies may be third-party (Google Analytics, Facebook Pixel, LinkedIn Insight).

3. Cookie Consent Banner: We display a banner upon first visit offering cookie settings consent. Essential cookies are always active; others activate only with consent.

4. Cookie Duration: Essential/preferences last up to 12 months; analytics 6 months; marketing up to 90 days (subject to vendor policies).

5. Disabling Cookies: Users can block or delete cookies through browser settings. Disabling may break site features like login, forms, and analytics tracking.

6. Opt-Out Tools: We include links to vendor opt-outs (Google Analytics, Facebook Ad Preferences). Users can control cookies independently via their browser plugin or settings.

7. Device Fingerprinting: We may use fingerprinting technology to prevent fraud (e.g., repeated form submissions). It respects user anonymity and can be disabled upon request.

8. Performance & Analytics: Aggregated cookie data informs performance improvements, UI/UX testing, content optimization, and capacity planning.

9. Remarketing: If consented, we may use marketing cookies for remarketing (e.g., “You visited our contact page? Here's an reminder” approach). This is opt-in only.

10. Cookie Policy Updates: Cookie section is updated alongside major privacy/regulatory changes (e.g., Bill C‑76, GDPR references, browser changes).

---

Section 5: Data Security (10 paragraphs)

1. Security Measures: We use HTTPS/TLS encryption via SSL certificates, and data-at-rest encryption on our hosting infrastructure.

2. Access Controls: Personal data access is restricted to authorized personnel under confidentiality agreements. Access is on a need-to-know basis.

3. Employee Training: All collaborators and contractors receive privacy and security training and sign NDAs.

4. Vendor Security Requirements: Third-party service providers must demonstrate security measures, encryption standards, and incident handling protocols.

5. Vulnerability Testing: We perform quarterly vulnerability scans, penetration tests, and timely software updates to avoid known threats.

6. Incident Response: We have formal breach-response procedures, including containment, impact assessment, notification per PIPEDA, and recovery.

7. Breach Notification: If personal data is compromised and risk exists, we will notify you via email and report to the OPC within 72 hours of identification.

8. Data Backup & Retention: We maintain encrypted daily backups stored off-site, tested monthly for integrity and restore success.

9. Disaster Recovery: Procedures include hardware failure recovery, data corruption reversal, and emergency operational continuity plans.

10. Security Updates: Security provisions are reviewed and refreshed annually, or sooner if required by threat landscape or technology shifts.

---

Section 6: International Transfers (10 paragraphs)

1. We operate in Canada, but some third-party providers may process your data outside Canada (e.g., USA, EU).

2. Vendor transfers occur pursuant to service provider data agreements aligned with PIPEDA standards and adequacy determinations.

3. Where international transfers occur, we implement secure channels (e.g., TLS, SFTP) and ensure vendor compliance with data protection.

4. Users in foreign jurisdictions have data rights similar to Canadian users; requests will be honored within 30 days.

5. We do not store or process data in countries without adequate privacy protections unless consented explicitly.

6. Transfers are used for functionality (e.g. Google Analytics), hosting, or client-requested storage locations.

7. Data residency requests (e.g. EU-local storage) can be made; we will accommodate where reasonable.

8. Access to data stored abroad is restricted to approved personnel under confidentiality and data processing terms.

9. Aggregated anonymized data may be shared widely without restriction, as it contains no personal identifiers.

10. If cross-border transfer laws change, we will update this section and notify users with an updated Policy.

---

Section 7: Data Retention (10 paragraphs)

1. We retain personal data for as long as necessary to fulfill service agreements, unless longer retention is required or permitted by law.

2. Transactional records (invoices, payment data) are retained 7 years per Canada Revenue Agency record-keeping requirements.

3. Website user data (cookies, IP logs) are retained per Section 4 durations.

4. Contact form data is retained until the business relationship ends plus 2 years.

5. Deleted or anonymized upon request, once retention period ends or service ends, unless legal hold applies.

6. Data for marketing campaigns is retained until unsubscribed, then purged within 90 days.

7. Backups older than 1 year are archived in a hardened environment with destruction policy after 7 years.

8. Sensitive data (e.g., health info) is retained only as long as needed, strictly controlled and promptly deleted when no longer needed.

9. SARs (subject access requests) may temporarily override retention periods until fulfilled.

10. We review retention policies annually or when legislative/regulatory changes occur.

---

Section 8: Your Rights & Choices (10 paragraphs)

1. You may access your personal information and request corrections (PIPEDA right to access).

2. You may withdraw consent at any time (though it may limit certain functionalities).

3. You may request deletion of your data except where legal retention applies.

4. You may object to or restrict processing, including marketing and profiling.

5. You may opt-out of cookies/tracking or marketing communications anytime.

6. You can request portability to receive your data in readable electronic form.

7. You may lodge a complaint with us; we must respond within 30 days; if unresolved, escalate to OPC.

8. You can file directly to OPC: www.priv.gc.ca (with effective date & transaction details).

9. For EU residents, you may have GDPR rights (erasure, data portability).

10. We’ll verify identity before actioning any data rights request.

---

Section 9: Children’s Privacy (10 paragraphs)

1. Our Services are not aimed at children under 13.

2. We do not knowingly collect data of children under 13.

3. Visitors under 13 must be supervised and cannot submit personal data.

4. Any data from minors found in our system is deleted within 72 hours.

5. We log deletion confirmation in audit logs.

6. Parents can request details of data retained and have it deleted.

7. Minor data is never used for marketing or profiling.

8. Age screening questions may be used if applicable in future site features.

9. We adhere to Canada’s Age-Appropriate Design Code when applicable.

10. Changes to children’s privacy rules will be updated in this section and communicated via email or site banners.

---

Section 10: Changes to Policy (10 paragraphs)

1. We may modify this Policy at any time.

2. Substantive changes (e.g. data sharing, new services) will be communicated via email 30 days prior.

3. Minor changes (grammar, links, cookie durations) are posted immediately.

4. Changes go into effect on the updated “Effective date” above.

5. Continued use after changes means acceptance.

6. Archived versions kept for auditing and compliance.

7. Users notified by email, banner notification, or blog post on major changes.

8. Users who disagree may discontinue use and request data deletion.

9. If legal changes require re-consent, we’ll request it explicitly.

10. We will maintain proof of prior versions and user consents.

---

Section 11: Contact Information (10 paragraphs)

1. To contact privacy-related requests:
   A‑Z Websites
   Brantford, Ontario, N3S 5X1
   Email: launch@azwebsites.ca
   Phone: (647) 700-7269

2. Provide subject line: “Privacy Request” and brief details.

3. We aim to respond within 30 days for access or rectification requests.

4. PIPEDA complaint escalation to: Office of the Privacy Commissioner of Canada at www.priv.gc.ca

5. Postal and courier mail inquiries accepted.

6. For questions or feedback, use email or phone anytime during business hours.

7. Privacy training and policy awareness are part of our team culture.

8. For data breach notifications, we will use your last-provided contact.

9. Feedback helps us refine data controls; submit anonymously if preferred.

10. A designated Privacy Officer oversees compliance and inquiries.

---

Section 12: Legal Disclaimers & Miscellaneous (10 paragraphs)

1. We disclaim liability for unintentional security breaches or acts of God, war, or system failures.

2. We disclaim reliability of third-party service privacy—proceed at your own risk.

3. Any data confirmatory warranties are limited to “best efforts.”

4. We’re not liable for indirect, incidental, punitive, or consequential damages arising from privacy losses.

5. We set dispute resolution and indemnification terms in our Terms of Service.

6. If any part is invalid or unenforceable, it’ll be severed without affecting other sections.

7. Users waive the right to class actions.

8. We do not guarantee confidentiality of unencrypted electronic transmission (e.g., email).

9. This Policy is governed by Canadian law and courts of Ontario.

10. Captions, headings, or clauses references do not affect interpretation of legal obligations.

Terms of Service