Privacy Policy

Definitions
Who is responsible for your personal information
Privacy Officer
What personal information we collect
How we collect personal information
Why we collect, use, and disclose personal information
Consent: how it is obtained and how to withdraw it
Disclosure to service providers; named processors
Cross-border data transfer and foreign-government access
Retention periods
Safeguards
Your rights as an individual
Quebec residents — specific rights under Law 25
European Economic Area, United Kingdom, and Switzerland residents
California residents
Minors and children
Cookies and analytics
Do Not Track signals
Breach notification commitment
Automated decision-making
Changes to this Privacy Policy
How to make a complaint
How to contact us

1. Definitions

1.1 “Personal Information” means information about an identifiable individual, as defined under Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and equivalent provincial legislation.

1.2 “SEBS”, “we”, “us”, “our” has the meaning given in our Terms & Conditions (Smart Earth Build Solutions, a sole proprietorship operated by Tony Morra).

1.3 “Website”, “Visitor”, “Client”, “You” have the meanings given in our Terms & Conditions.

1.4 “Service Provider” means any third party that processes Personal Information on our behalf or in connection with services it provides to us.

2. Who is responsible for your personal information

2.1 Smart Earth Build Solutions, a sole proprietorship registered in Ontario (Business Identification Number 1001424268, operated by Tony Morra), is responsible under PIPEDA for the Personal Information we collect, use, and disclose through the Website and through our consulting services. We remain accountable for Personal Information transferred to Service Providers for processing.

3. Privacy Officer

3.1 Under PIPEDA Principle 1 (Accountability) and the Act respecting the protection of personal information in the private sector (Quebec), as amended by Law 25, we have designated a Privacy Officer:

Tony Morra, Principal and Privacy Officer Smart Earth Build Solutions 455 Danforth Avenue, Suite 322 Toronto, Ontario M4K 1P1, Canada Email: contact@smartearthbuildsolutions.com Phone: (647) 948-3068

4. What personal information we collect

4.1 Through the contact form on the Website, we collect:

your name (as you provide it);
your email address; and
the content of the message you choose to send us.

4.2 Through general use of the Website, our hosting provider (Netlify) and any analytics provider we use may collect:

your IP address;
your browser type and version;
your device type and operating system;
the pages you visit on the Website, the order in which you visit them, and the time spent on each;
the page that referred you to the Website; and
the date and time of access.

4.3 Through any consulting Engagement, we collect the Personal Information you choose to provide to us in the course of the Engagement (for example, business contact information of you and your colleagues, information about your operations, and other information relevant to the Engagement).

4.4 We do not currently operate a newsletter, downloadable-content gate, payment-processing form, or scheduling tool on the Website. If any of these is added in the future, this Privacy Policy will be updated before they go live to describe the additional Personal Information collected and the lawful basis for collection.

4.5 We do not knowingly collect Personal Information directly from children under 14 years of age (see Section 16).

4.6 We do not collect biometric information, social-insurance numbers, government-issued identification numbers, payment card numbers, or special categories of sensitive data (as defined under GDPR Article 9) through the Website.

5. How we collect personal information

5.1 We collect Personal Information directly from you when you submit the contact form, communicate with us by email, telephone, or other means, or share information during a consulting Engagement.

5.2 We collect technical information automatically through the Website’s hosting and analytics infrastructure when you access the Website.

5.3 We do not purchase Personal Information from data brokers and do not collect Personal Information from third-party sources without your knowledge.

6. Why we collect, use, and disclose personal information

6.1 In accordance with PIPEDA Principle 2 (Identifying Purposes), we collect, use, and disclose Personal Information for the following specific purposes:

to respond to inquiries you submit through the contact form, by email, or by telephone;
to provide consulting services to Clients under Engagements;
to administer, invoice, and collect payment for Engagements;
to operate, maintain, secure, and improve the Website;
to monitor and analyze Website usage in aggregate to understand visitor interests;
to comply with Applicable Law, court orders, and regulatory requirements;
to detect, prevent, and respond to security incidents, fraud, and unlawful activity;
to establish, exercise, or defend legal claims; and
to send transactional communications related to (a) through (c) above.

6.2 We will not use or disclose your Personal Information for any new purpose materially different from those identified in Section 6.1 without your fresh consent or as required by Applicable Law.

6.3 We do not sell Personal Information, do not rent Personal Information, and do not use Personal Information for advertising profiling, behavioural advertising, or targeted advertising.

7.1 In accordance with PIPEDA Principle 3 (Consent), we obtain consent in a manner appropriate to the sensitivity of the Personal Information collected.

7.2 Implied consent is sufficient where you submit an inquiry through the contact form, by email, or by telephone, and we use the Personal Information you provided to respond. The purpose is obvious from the context of your submission.

7.3 Express consent is required for any new use or disclosure that is not reasonably obvious from the context — for example, adding you to a marketing email list. We will not add you to any marketing list without your express opt-in.

7.4 You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. To withdraw consent, contact the Privacy Officer (Section 23). Withdrawal of consent may limit our ability to provide services to you.

8. Disclosure to service providers; named processors

8.1 We use the following Service Providers to operate the Website and our business. Each Service Provider processes Personal Information only as needed to perform its services for us and is required by contract or by its publicly stated privacy practices to provide a comparable level of protection.

Service Provider	Service	Personal Information Processed	Jurisdiction of Processing
Netlify, Inc.	Website hosting; contact form processing (Netlify Forms)	All categories listed in Section 4.1 and 4.2	United States
Wix.com Ltd.	Email hosting (contact@smartearthbuildsolutions.com); DNS	Email contents and metadata	United States; Israel
Google LLC (if and when we activate Google Analytics 4 or a comparable analytics tool)	Web analytics	Categories listed in Section 4.2	United States

8.2 We do not share Personal Information with any third party other than (a) the Service Providers listed in Section 8.1, (b) advisors who reasonably need access to provide a service to us (such as a lawyer, accountant, or sub-contractor under Section 21 of the Terms), (c) authorities or third parties when required by Applicable Law, court order, or to establish, exercise, or defend legal claims, or (d) in connection with a sale, merger, reorganization, or change in name of our business, subject to the recipient agreeing to provide equivalent privacy protection.

8.3 If we add a new Service Provider that materially affects the processing of your Personal Information, we will update this Privacy Policy.

9. Cross-border data transfer and foreign-government access

9.1 Personal Information you submit through the Website is processed in Canada and in the United States. Specifically, Netlify (our hosting and contact-form provider) processes data on servers located in the United States; Wix (our email provider) processes data on servers located in the United States and other jurisdictions; if and when we activate Google Analytics, that data is processed by Google in the United States and other jurisdictions.

9.2 Foreign-government access risk. When Personal Information is processed outside Canada, it may be subject to the laws of the country in which it is processed, including possible disclosure to that country’s law enforcement, national security agencies, courts, or regulators, without notice to us or to you, and subject to limited or different legal protections compared to those available under Canadian law.

9.3 We remain accountable under PIPEDA for the Personal Information transferred. We rely on each Service Provider’s contractual commitments and publicly stated privacy practices to provide a comparable level of protection.

9.4 For Quebec residents: Before transferring Personal Information of a Quebec resident outside Quebec, including to any other Canadian province or to a foreign jurisdiction, we conduct a privacy impact assessment that takes into account the sensitivity of the information, the purposes for which it will be used, the contractual safeguards applied, and the legal framework of the destination jurisdiction, as required by section 17 of the Act respecting the protection of personal information in the private sector (Quebec), as amended by Law 25.

10. Retention periods

10.1 We retain Personal Information only for as long as necessary to fulfill the purposes identified in Section 6 or as required by Applicable Law, in accordance with PIPEDA Principle 5.

Category	Retention Period
Contact form submissions (inquiry not converted to an Engagement)	24 months from submission, then deletion
Client communications and records during an Engagement	Duration of the Engagement plus 7 years (consistent with Ontario professional and tax record-keeping practice), then deletion or anonymization
Newsletter or marketing email subscriber list (if and when added)	Until you unsubscribe; thereafter your email address may be retained on a suppression list to honour your unsubscribe request
Web-server logs	Standard hosting provider defaults (Netlify: typically 30 days for raw logs)
Analytics data (if and when Google Analytics or similar is activated)	Per the provider’s default retention setting, expected not to exceed 26 months
Records of security-safeguard breaches	24 months (per PIPEDA breach record-keeping requirements)
Engagement billing and accounting records	7 years from the end of the relevant fiscal year (consistent with Canada Revenue Agency record-keeping rules)

10.2 When Personal Information is no longer required and is not subject to a legal hold, we securely delete or anonymize it.

11. Safeguards

11.1 In accordance with PIPEDA Principle 7 (Safeguards), we use safeguards appropriate to the sensitivity of the Personal Information we hold:

Technical safeguards: HTTPS / TLS encryption in transit; access controls on email and storage accounts; multi-factor authentication on our email and administrative accounts; reliance on Service Providers (Netlify, Wix, Google) whose published practices include encryption at rest, intrusion detection, and routine patching;
Administrative safeguards: Privacy Officer designated (Section 3); confidentiality obligations on any sub-contractor (Section 21 of the Terms); least-privilege practices;
Physical safeguards: Physical access controls at our principal place of business; secure disposal of any physical records.

11.2 No method of transmission over the Internet or storage method is 100% secure. While we use commercially reasonable safeguards, we cannot guarantee absolute security.

12. Your rights as an individual

12.1 In accordance with PIPEDA, you have the right to:

access the Personal Information we hold about you;
request correction of inaccurate or incomplete Personal Information;
withdraw consent to our use or disclosure (subject to legal or contractual restrictions and reasonable notice);
challenge compliance with this Privacy Policy or with PIPEDA, by contacting the Privacy Officer (Section 23).

12.2 To exercise any of these rights, contact the Privacy Officer (Section 23). We will respond within 30 days, or notify you within 30 days that we require an extension as permitted under PIPEDA.

12.3 We may charge a minimal, reasonable fee for fulfilling an access request, but only with prior notice and only to the extent permitted by PIPEDA.

12.4 Before fulfilling any access or correction request, we may ask you to verify your identity.

13. Quebec residents — specific rights under Law 25

If you reside in Quebec, in addition to the rights in Section 12, you have the following specific rights under the Act respecting the protection of personal information in the private sector (Quebec), as amended by Law 25:

13.1 Right to data portability (effective Sept. 22, 2024): You may request that computerized Personal Information you provided to us be communicated to you, or to a person or body authorized by law to collect such information, in a structured, commonly used technological format.

13.2 Right of de-indexation: You may request that we cease disseminating Personal Information about you or that we de-index any hyperlink attached to your name that provides access to Personal Information, in the circumstances permitted by Law 25.

13.3 Right to information about automated decisions: Where a decision affecting you is made based exclusively on automated processing of your Personal Information, you may request information about the personal information used, the reasons and principal factors leading to the decision, and the right to have that information reviewed by a natural person. We do not currently make any decisions about you based exclusively on automated processing.

13.4 Right to lodge a complaint with the Commission d’accès à l’information du Québec (CAI) (Section 22).

13.5 Cross-border transfer of Quebec personal information is handled as described in Section 9.4.

14. European Economic Area, United Kingdom, and Switzerland residents

14.1 We do not actively target or market our services to residents of the European Economic Area, the United Kingdom, or Switzerland. If you nonetheless interact with the Website from one of these jurisdictions, we want you to know your rights.

14.2 Lawful basis. Our primary lawful basis for processing Personal Information you submit through the contact form is your consent (UK GDPR / EU GDPR Article 6(1)(a)); where consent is not relied upon, we process on the basis of our legitimate interest in responding to your inquiry (Article 6(1)(f)). Our lawful basis for processing in the course of an Engagement is performance of a contract (Article 6(1)(b)).

14.3 As a data subject under the UK GDPR / EU GDPR, you may have the right to access, rectify, erase, restrict, port, or object to processing of your Personal Information, and to lodge a complaint with your local supervisory authority. To exercise any of these rights, contact the Privacy Officer (Section 23).

14.4 We do not have an EU representative or UK representative because we do not regularly offer goods or services to, or monitor the behaviour of, data subjects in the EEA or the UK within the meaning of Article 3 of the UK GDPR / EU GDPR. If your interaction is incidental, our intent is to honour the substantive rights described above on a good-faith basis.

15. California residents

15.1 We do not meet the applicability thresholds of the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA): our gross annual revenue is below the statutory threshold; we do not process the Personal Information of 100,000 or more California consumers, households, or devices; and we do not derive 50% or more of our revenue from selling or sharing California Personal Information.

15.2 Nonetheless, if you are a California resident and you interact with the Website, you may request access to or deletion of the Personal Information we hold about you by contacting the Privacy Officer (Section 23).

15.3 We do not sell, rent, or share Personal Information of any individual, including California residents, for cross-context behavioural advertising or any other purpose, and have not done so in the prior twelve months.

16. Minors and children

16.1 The Website is intended for business users, and not for children. We do not knowingly collect Personal Information directly from children under 14 years of age in Quebec, under 13 years of age in the United States (per COPPA), or under the digital age of consent applicable in any jurisdiction the visitor accesses the Website from.

16.2 If you believe that we have inadvertently collected Personal Information about a child, contact the Privacy Officer (Section 23) and we will promptly delete the Personal Information.

17. Cookies and analytics

17.1 Strictly necessary cookies. The Website may use cookies that are necessary for the basic functioning of the site (such as session cookies set by our hosting provider). These cookies do not collect Personal Information about you for analytics or advertising purposes.

17.2 Analytics (if and when activated). We may add a privacy-respecting analytics tool such as Google Analytics 4. If and when we do, that tool will collect technical and usage information of the kind described in Section 4.2. We will configure analytics to anonymize IP addresses where the tool supports it, will disable cross-site advertising features, and will not link analytics data to any individual.

17.3 Third-party cookies. We do not currently set third-party advertising cookies. Embedded third-party content (for example, if we embed a video from a third-party service in a future blog post) may set its own cookies and is governed by that service’s privacy policy.

17.4 Cookie controls. Most browsers allow you to block or delete cookies through their settings. Blocking strictly necessary cookies may impair the functioning of the Website.

17.5 If we add analytics or any non-essential tracking technology, we will, where required by Quebec Law 25 or other Applicable Law, present a consent mechanism and keep such technology deactivated by default until consent is given.

18. Do Not Track signals

18.1 The Website does not currently respond to “Do Not Track” browser signals because there is no industry consensus on how to interpret them. We do not engage in cross-context tracking of any kind.

19. Breach notification commitment

19.1 If we experience a breach of security safeguards involving Personal Information under our control that creates a real risk of significant harm to an individual, we will, as soon as feasible:

report the breach to the Office of the Privacy Commissioner of Canada (OPC) using the OPC’s prescribed form;
notify each affected individual directly;
notify any third party that may be able to reduce the risk or mitigate the harm; and
where the affected individual is a Quebec resident, also notify the Commission d’accès à l’information du Québec (CAI).

19.2 We will keep records of all breaches of security safeguards involving Personal Information for at least 24 months as required by PIPEDA, whether or not the breach creates a real risk of significant harm.

20. Automated decision-making

20.1 We do not currently make any decisions about Visitors, Clients, or other individuals based exclusively on automated processing of Personal Information. If this changes, this Privacy Policy will be updated to disclose the relevant information as required by Quebec Law 25 and other Applicable Law.

21. Changes to this Privacy Policy

21.1 We may update this Privacy Policy from time to time to reflect changes to our practices, to comply with changes in Applicable Law, or for other operational reasons.

21.2 The current version is posted on the Website with the “Effective Date” and “Last Updated” stamps shown at the top. Material changes will be highlighted (for example, by a banner or by a summary of changes) for at least 30 days following posting.

22. How to make a complaint

22.1 To raise a privacy concern or complaint, contact the Privacy Officer first (Section 23). We will acknowledge receipt within 10 business days and respond substantively within 30 days, or notify you of a permitted extension under PIPEDA.

22.2 If you are not satisfied with our response, you may file a complaint with:

Office of the Privacy Commissioner of Canada (OPC) 30 Victoria Street Gatineau, Quebec K1A 1H3 Toll-free: 1-800-282-1376 Website: https://www.priv.gc.ca

22.3 If you are a Quebec resident, you may also file a complaint with:

Commission d’accès à l’information du Québec (CAI) Bureau 1.10 525, boulevard René-Lévesque Est Québec (Québec) G1R 5S9 Toll-free: 1-888-528-7741 Website: https://www.cai.gouv.qc.ca

22.4 If you are a resident of the European Economic Area, the United Kingdom, or Switzerland, you may also lodge a complaint with your local supervisory authority.

23. How to contact us

For any question, request, or complaint about Personal Information or about this Privacy Policy, contact:

Table of Contents