3. Why we use personal information
We use personal information to:
- respond to inquiries and audit requests, and provide requested information;
- deliver, administer, and invoice our consulting services;
- send newsletters and commercial electronic messages with your consent or as otherwise permitted by CASL, always with a working unsubscribe;
- operate, secure, and improve this website, including spam and abuse prevention;
- measure and improve our own marketing, including understanding how visitors find and use the site;
- comply with legal, tax, and regulatory obligations; and
- establish, exercise, or defend legal claims.
Consent. In Canada, we rely on your express consent for things like newsletter subscriptions and non-essential cookies, and on implied consent where the purpose is obvious and reasonable — for example, using your email address to reply when you email us. You may withdraw consent at any time (Section 11), subject to legal or contractual restrictions, and we’ll explain any consequences of withdrawal.
For visitors in the EEA, UK, or Switzerland, our legal bases are: consent (marketing communications and non-essential cookies); performance of a contract or pre-contractual steps (responding to inquiries, delivering services); legitimate interests (site security, service improvement, B2B relationship management — balanced against your rights); and legal obligation (tax and accounting records).
4. Cookies and similar technologies
Cookies, pixels, tags, and local storage help the site function, tell us how it’s used, and support our marketing. We group them as:
- Strictly necessary — required for the site to work (e.g., security, spam protection, load balancing). These don’t require consent.
- Analytics — help us understand site usage in aggregate.
- Advertising — support measurement and, where used, remarketing of our own services.
- Functional — remember your preferences.
Where required by law — including for visitors from Quebec, the EEA, and the UK — non-essential cookies are set only after you consent through our cookie banner, and you can change your choices at any time via the Cookie Preferences link in the site footer.
Services currently in use on this website:
Managing cookies. Beyond our banner, you can control cookies through your browser settings and delete existing cookies at any time. Blocking some cookies may affect site functionality. General information is available at allaboutcookies.org.
5. Analytics and interest-based advertising choices
If we show ads for our own services on platforms like Google, Meta, or LinkedIn, those platforms may use cookies or hashed identifiers to measure performance and reach people who visited this site. You can limit this:
6. Visitor identification technology
[CONFIRM: This section applies only if RB2B (Retention.com / GetEmails, LLC) remains deployed. If it has been or will be removed, delete this section and its table row. If it stays, this disclosure must remain prominent and the tool must sit behind the consent banner.]
We use RB2B, a service that attempts to associate website visits from United States–based visitors with business contact information (such as a work email address) drawn from its partners’ datasets, so we can follow up with companies that showed interest in our services. RB2B states that it does not perform this identification for visitors outside the United States. You can opt out of RB2B’s identification and data collection at app.retention.com/optout and, for GDPR-related requests, at rb2b.com/rb2b-gdpr-opt-out. Any email we send as a result of this service complies with applicable anti-spam law and includes an unsubscribe.
7. Email marketing and CASL
We send commercial electronic messages only where we have express consent, implied consent under CASL (for example, an existing business relationship or a conspicuously published business address relevant to your role), or another lawful basis. Every marketing email identifies Welby, includes our contact information, and contains an unsubscribe mechanism that we honour within 10 business days — in practice, immediately. We do not buy email lists. Transactional and service messages (invoices, project updates, replies to your inquiries) are not marketing and are sent as needed.
8. When we disclose personal information
We disclose personal information only:
- To service providers who process it on our behalf under contracts limiting use to our instructions — including website hosting (WP Engine), analytics and tag management (Google), CRM and marketing (HubSpot), accounting and invoicing (Wave), e-signature (Docusign), meeting transcription, scheduling, and productivity tools (Google Workspace). [CONFIRM: adjust this vendor list to current stack before publishing.]
- To professional advisors — lawyers, accountants, insurers — under confidentiality obligations.
- For legal reasons — to comply with applicable law, respond to lawful requests such as a subpoena or warrant, enforce our agreements, or protect the rights, property, or safety of Welby, our clients, or others.
- In a business transaction — if Welby is involved in a merger, acquisition, financing, or sale of assets, personal information may be disclosed to the parties involved under confidentiality protections, and this policy (or notice of a new one) will continue to govern it.
We do not sell personal information. Where advertising cookies are considered “sharing” or “targeted advertising” under certain U.S. state laws, you can opt out via our cookie banner, the tools in Section 5, or a Global Privacy Control signal (Section 15).
9. International transfers
We are based in Canada, and personal information is primarily stored and processed in Canada and the United States by the providers listed above. Information transferred outside your province or country is subject to the laws of those jurisdictions and may be accessible to their courts and authorities under lawful process. For transfers of EEA, UK, or Swiss personal data to the United States, we rely on providers certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) or on Standard Contractual Clauses, together with appropriate supplementary safeguards.
10. How long we keep personal information
We keep personal information only as long as needed for the purposes described in this policy, then delete or anonymize it. Our standard periods:
| Category | Retention |
|---|
| Inquiries and prospect records | Up to 3 years after last meaningful contact |
| Client engagement records, contracts, invoices | 7 years after the engagement ends (tax and limitation requirements) |
| Newsletter subscriptions | Until you unsubscribe, then suppressed to honour the opt-out |
| Website analytics (GA4) | [CONFIRM: 14] months of user-level data, per our GA4 configuration |
| Meeting recordings and transcripts | Deleted or reduced to notes within [CONFIRM: 12] months |
| Blog comments | While the post remains published; removed on request |
| Consent and unsubscribe records | 3 years after they cease to be active (CASL evidentiary requirement) |
11. Your rights and choices
Subject to legal exceptions, you may:
- Access the personal information we hold about you and how we’ve used and disclosed it;
- Correct inaccurate or incomplete information;
- Delete your information, where we’re not required to keep it;
- Withdraw consent to collection, use, or disclosure, including unsubscribing from marketing;
- Ask questions or complain about our practices.
Contact our Privacy Officer (Section 17). We may need to verify your identity, will respond within 30 days, and won’t charge you for a reasonable request. If you’re not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, or your provincial privacy regulator.
Visitors in the EEA, UK, or Switzerland additionally have the rights to restrict or object to processing (including an unconditional right to object to direct marketing), to data portability, and to lodge a complaint with their local supervisory authority.
Residents of U.S. states with comprehensive privacy laws may have rights to know, correct, delete, and opt out of targeted advertising, which we honour as described in this policy regardless of whether those laws technically apply to a business of our size.
12. Quebec residents
For the purposes of Quebec’s Act respecting the protection of personal information in the private sector, the person in charge of the protection of personal information is Grant Higginson, reachable at [email protected]. Quebec residents may exercise the rights in Section 11 and, where applicable, request the cessation of dissemination or de-indexing of their personal information, and may file a complaint with the Commission d’accès à l’information du Québec. Technologies that could identify, locate, or profile you are not activated without your consent (see Section 4).
13. Our role in client engagements
When Welby implements analytics, tag management, advertising, or related systems for a client, the personal information involved belongs to that client’s relationship with its own customers. We process it as a service provider on the client’s documented instructions, under confidentiality and data-protection terms in our agreements. We don’t use client-side personal information for our own purposes, and we support our clients in meeting their access, deletion, and breach-notification obligations. If you contact us with a rights request about a website we built or manage for someone else, we’ll route you to the responsible organization and assist them in responding.
14. How we protect personal information
We use safeguards appropriate to the sensitivity of the information: encryption in transit (TLS), access on a need-to-know basis, multi-factor authentication on core systems, vendor due-diligence, and separation of client environments. No method of transmission or storage is completely secure, and we can’t guarantee absolute security — but if a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and report to the Privacy Commissioner of Canada (and other regulators where required) as the law prescribes, and we maintain records of all breaches.
15. Do Not Track and Global Privacy Control
There is no uniform standard for browser “Do Not Track” signals. However, where you visit with a recognized Global Privacy Control (GPC) signal enabled, we treat it as a valid opt-out of targeted advertising and any “sharing” of personal information to the extent applicable law requires. Our cookie banner remains the most reliable way to set your preferences on this site.
16. Children
This website and our services are directed to businesses and professionals. We do not knowingly collect personal information from anyone under 18, and we’ll delete any such information promptly if we learn of it.
17. Contact us
Privacy Officer Grant Higginson
Welby Marketing Ltd. o/a Welby Consulting
Email: [email protected]
Address: 13 Queenston Street, St. Catharines, Ontario L2R 2Y8
Web: welbyconsulting.com
18. Changes to this policy
We review this policy at least annually and update it when our practices, tools, or the law change. The effective date at the top reflects the latest version, and material changes will be flagged on this page. Continued use of the site after an update doesn’t replace consent where consent is required — we’ll ask again when the law says we must.
