Privacy Policy

Last updated: 14 September 2026

1. Who is responsible for your information

This website is operated by David Albert, a business consultant based in Ontario, Canada, operating as David Albert.

For any question about this policy or about your personal information, contact:

• Email: davidalbert@hotmail.ca
• Phone and WhatsApp: +1 (613) 453-7525
• Postal address: 149 Aaron Place, Amherstview, Ontario, Canada K7N 2A

Privacy questions are handled by David Albert personally.

2. Which law applies

Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA) generally applies to personal information collected in the course of commercial activity by private-sector organisations, and to personal information that crosses provincial or national borders.

Alberta, British Columbia and Quebec have their own private-sector privacy legislation that has been deemed substantially similar to PIPEDA for activity inside those provinces. Ontario has no general private-sector privacy statute of that kind, so PIPEDA is the framework that applies to this business, and this policy is written to its ten fair information principles.

Ontario's health privacy legislation governs health information custodians. This is a business consulting practice, it collects no health information, and that legislation does not apply here.

Because visitors may reach this site from outside Canada, other privacy laws may apply to those visitors. This policy does not attempt to describe every one of them.

3. What this site actually collects

Information you give deliberately

The consultation form on the contact page asks for:

• Your name
• Your email address
• Your company name
• Your phone number (optional)
• A one-line description of what your business does
• An annual revenue range you select from a list
• A free-text description of what feels stuck in your business
• How long the problem has persisted

The revenue range is a band you choose, not a figure you type. You can select "Rather discuss on the call" instead.

You may also contact David directly by email, telephone, WhatsApp or LinkedIn. Anything you send through those channels is held by the relevant provider under that provider's own terms.

Information collected automatically

• Server logs. The hosting provider records standard request data, including IP address, browser type, referring page and timestamp, for delivery, security and abuse prevention. This happens for every website and cannot be switched off without stopping the site from working.
• Analytics, only with your consent. If you accept analytics, Umami records page views, referrer, approximate country, browser and device type, and the CTA clicks described below. Umami does not use cookies, does not store an IP address, and does not track you across other websites.

What this site does not do

• No advertising or retargeting pixels
• No social media tracking pixels
• No cross-site profiling
• No sale of personal information, ever
• No newsletter or mailing list at this time
• No user accounts, logins or passwords
• No payment processing on this website

4. Why it is collected and how it is used

• To reply to you. Form submissions are used to prepare for and respond to your enquiry. Nothing more.
• To run the consultation. Knowing your sector, revenue band and what is stuck lets David open the call with something useful rather than generic discovery questions.
• To keep the site working and secure. Server logs support delivery, troubleshooting and abuse prevention.
• To understand which pages are read. Analytics, where consented, informs what gets written next.

Your information is not used for automated decision-making or profiling.

5. Consent

Submitting the contact form is your consent to be contacted about your enquiry. Analytics runs only after you accept it on the consent panel; choosing "Reject non-essential" means the analytics script is never loaded.

You may withdraw consent at any time. Open Cookie preferences to change your analytics choice, or email David to ask that your enquiry details be deleted. Withdrawing consent to be contacted means David can no longer respond to that enquiry.

6. Who your information is shared with

Personal information is never sold, rented or traded. It is shared only with the service providers needed to run the site:

• Netlify — website hosting and form handling. Receives everything you submit, plus standard server log data. Servers are located outside Canada, including in the United States.
• Umami Cloud — analytics, only if you consent. Receives page view data. Cookieless, no IP storage.
• Microsoft (Outlook/Hotmail) — the mailbox that receives form notifications and your direct emails.
• Calendly — used only if you click "Book a call". You leave this website and provide your details to Calendly directly, under Calendly's own privacy policy.
• WhatsApp (Meta) — used only if you choose to send a WhatsApp message. The message is handled under WhatsApp's own terms.

Information may also be disclosed where required by law, court order or lawful authority, or where necessary to establish or defend a legal claim.

7. Cross-border storage

Netlify, Umami, Microsoft, Calendly and WhatsApp process data on servers outside Canada, including in the United States and the European Union. While information is in another country it may be accessible to that country's courts, law enforcement and national security authorities under that country's law.

PIPEDA permits transfers to third-party processors abroad provided the organisation uses contractual or other means to give the information a comparable level of protection, and is transparent about it. This section is that transparency. If you would prefer your information not to leave Canada, contact David by telephone instead of using this website.

8. How long it is kept

• Form submissions: retained while the enquiry is active and for up to 24 months afterwards, so David can pick up a conversation that resumes later. Deleted on request.
• Client correspondence: retained for the duration of the engagement and for as long as needed afterwards to meet tax, accounting and legal obligations.
• Server logs: retained by the hosting provider on its own schedule, typically weeks rather than years.
• Analytics: aggregate statistics only, with no record identifying you.

9. How it is protected

• The entire site is served over HTTPS, so anything you submit is encrypted in transit.
• Security headers restrict which scripts can run and prevent the site being framed by others.
• The form carries a hidden anti-spam field and passes through the host's spam filtering.
• There is no database, no login and no stored password on this website, which removes the most commonly breached surfaces entirely.
• Access to the mailbox and hosting account is limited to David Albert.

No method of transmission or storage is perfectly secure. Please do not send confidential financial records, identity documents or anything you would not want in an email through this form.

10. If there is a breach

Under PIPEDA, an organisation must report a breach of security safeguards to the Privacy Commissioner of Canada, and notify affected individuals, where the breach creates a real risk of significant harm. A record of every breach is kept regardless of whether it is reportable.

If a breach affecting your information met that threshold, you would be notified directly and told what happened, what was involved and what to do about it.

11. Your rights

You may ask David to:

• Confirm whether he holds personal information about you
• Give you access to it
• Correct anything inaccurate or incomplete
• Delete your enquiry
• Explain how it has been used and who it has been shared with
• Withdraw your consent, subject to legal and contractual limits

Email davidalbert@hotmail.ca. Requests are answered within 30 days. Identity may need to be verified first so information is not disclosed to the wrong person. There is no charge for a reasonable request.

If you are not satisfied with the response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to your provincial privacy commissioner where one has jurisdiction.

12. Children

This is a business-to-business website aimed at business owners. It is not directed at children and no information is knowingly collected from them.

13. External links

This site links to LinkedIn, Calendly and WhatsApp. Once you follow a link you are on someone else's site, governed by their privacy policy, not this one.

14. Changes

This policy may be updated as the website changes. The date at the top shows the current version. Material changes will be reflected there.