Privacy policy
What we collect, why, and what you can ask us to do with it.
Summary
We collect the details you type into our contact form and nothing else that identifies you. We use them to reply to your enquiry. We do not sell personal information, and we do not send marketing email unless you have ticked the optional box asking us to.
This policy explains that in more detail. It is written to meet the requirements of the Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).
Last updated: .
This policy is a working draft prepared alongside the website build. Have it reviewed by a qualified adviser before launch, and confirm the retention periods and the analytics choice described below match what you actually do.
What we collect
Information you give us
When you submit the contact form we collect your name, company, work email address, the industry and challenge you select, and anything you write in the optional detail box. If you tick the optional marketing box, we record that consent, including the date and time it was given.
Information collected automatically
We use privacy-friendly analytics that count page views without cookies and without collecting personal information or building a profile of you across sites. If we ever introduce analytics that set cookies, we will ask for your consent first and this page will say so.
Our hosting provider keeps standard server logs, which may include IP addresses, for security and troubleshooting.
The booking calendar
Our contact page offers a booking calendar provided by Calendly. It is not loaded unless you choose to open it. If you do, Calendly's page runs inside ours and will set its own cookies and contact its own analytics, error-reporting and payment partners. We do not control what Calendly collects; their privacy policy governs that, not ours.
If you would rather not load it, every booking route is available without it: open Calendly's own page in a new tab, use the contact form, or email us and we will arrange the time for you.
How we use it, and for how long
We use your details to respond to your enquiry, to carry out any work you engage us for, and — only with your explicit consent — to send occasional guides.
Canadian privacy law sets no fixed minimum for how long an enquiry must be kept. Both PIPEDA and Alberta's Personal Information Protection Act work the other way round: personal information may be kept only as long as it is needed for the purpose it was collected for, and must then be destroyed or anonymised. Our schedule reflects that, with the longer period applied wherever Alberta and Ontario differ.
- Enquiries that do not become work: 24 months from your last contact with us, then deleted.
- Marketing consent records: kept for as long as the consent stands and for 3 years after it is withdrawn, which is what Canada's Anti-Spam Legislation requires us to be able to prove.
- Client engagement records: 7 years after the engagement ends. This is driven by the Canada Revenue Agency's requirement to retain business records for six years from the end of the relevant tax year, rounded up so a whole year is never cut short.
Who we share it with
We do not sell personal information. We share it only with service providers who help us operate — email, hosting, and scheduling — and only as far as needed. Some providers may store data outside Canada, where it can be subject to the laws of that country. We also disclose information where the law requires it.
Your rights
Under PIPEDA you may ask us to:
- tell you what personal information we hold about you;
- correct anything inaccurate;
- withdraw consent, including for marketing messages;
- delete your information, where no legal obligation requires us to keep it.
Email alex@highlinesystems.ca and we will respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.
Marketing email and CASL
We only send marketing email to people who have given express consent by ticking the optional box on our contact form. That box is never pre-ticked. Every message identifies us, gives our contact details, and includes a working unsubscribe link that we action within ten business days.
Security and contact
We protect personal information with access controls, encryption in transit, and a policy of collecting only what we need. No system is perfectly secure, but we limit what we hold so that there is little to expose.
Questions about this policy, or about personal information we hold, go to our privacy contact at alex@highlinesystems.ca, or by post to either office listed on our about page.