Privacy Policy

Effective Date: January 1, 2025

Vortex Marketing ("we," "us," or "our") is committed to protecting the privacy of our clients, website visitors, and prospective customers. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights you have over it.

This policy is written to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and follows its ten fair information principles. It applies to our website (vortexmarketing.ca), our marketing services, and any other interaction you have with us.

1. What Personal Information We Collect

We collect only the information we need to provide our services and operate our business:

• Contact information — your name, business name, email address, and phone number when you submit our contact form, request a free audit, or become a client.
• Payment information — when you purchase a plan, payments are processed by Stripe. Your card number is sent directly to Stripe and never touches or is stored on our servers. We receive only confirmation of payment, the plan purchased, and billing contact details.
• Cookies and similar technologies — small data files used to remember your preferences (such as your cookie consent choice) and, only with your consent, to measure site traffic.
• Analytics data — if you consent to analytics cookies, we may collect anonymized usage data (pages visited, device type, approximate location) through Google Analytics.
• Client project data — for active clients, information needed to build and optimize your website (website content, hosting access, and Google Analytics data).

2. How We Use Your Information

• Service delivery — designing and building your website, running your SEO campaigns, and reporting on results.
• Communications — responding to inquiries, sending audit results, scheduling calls, and providing service updates.
• Billing — processing payments, issuing receipts, and maintaining accounting records.
• Analytics — understanding how visitors use our website so we can improve it (only with your consent).

We do not sell, rent, or trade your personal information to anyone.

3. Our PIPEDA Commitments — The Ten Principles

PIPEDA sets out ten fair information principles. Here is how Vortex Marketing meets each one:

1. Accountability — We have designated a Privacy Officer responsible for our compliance with PIPEDA. You can reach them at vortexmarketingontario@gmail.com.
2. Identifying Purposes — We identify why we are collecting your information at or before the time of collection (for example, the contact form states it is for your free audit request).
3. Consent — We collect, use, or disclose your personal information only with your knowledge and consent, except where permitted by law. Our cookie banner lets you accept or reject non-essential cookies before any analytics load.
4. Limiting Collection — We collect only the information necessary for the purposes we have identified, by fair and lawful means.
5. Limiting Use, Disclosure, and Retention — We use your information only for the purposes it was collected for, and keep it only as long as needed (see Retention below).
6. Accuracy — We keep your information as accurate, complete, and up to date as necessary. You may ask us to correct your information at any time.
7. Safeguards — We protect your information with safeguards appropriate to its sensitivity, including HTTPS encryption in transit, access controls, and PCI-compliant payment processing through Stripe.
8. Openness — We make our privacy practices publicly available through this policy.
9. Individual Access — Upon written request, we will tell you what personal information we hold about you, how it is used, and to whom it has been disclosed, and give you access to it.
10. Challenging Compliance — You may challenge our compliance with these principles by contacting our Privacy Officer (see Section 9).

4. Third-Party Service Providers

We use a small number of trusted third parties to operate our business. Each receives only the information necessary to perform its function:

Cross-border transfer disclosure: Stripe and Google are U.S.-based companies, and information processed by them may be stored or processed on servers located in the United States or other countries. While in another jurisdiction, your information is subject to the laws of that jurisdiction and may be accessible to its courts, law enforcement, and national security authorities. We use contractual and technical safeguards to ensure a comparable level of protection wherever your data is processed.

5. Cookie Policy

We use the following categories of cookies:

• Essential cookies — strictly necessary for the site to function (for example, remembering your cookie consent choice in your browser's local storage). These cannot be disabled.
• Analytics cookies — Google Analytics, used to understand site traffic. Loaded only after you click "Accept All" on our cookie banner.
• Marketing cookies — we do not currently use marketing or advertising cookies. If that changes, we will update this policy and ask for your consent first.

Opting out: You can reject non-essential cookies by clicking "Reject Non-Essential" on the cookie banner. To change your choice later, clear your browser's local storage for this site and the banner will reappear. You can also block cookies entirely through your browser settings, or opt out of Google Analytics across all sites using the Google Analytics Opt-out Browser Add-on.

6. Data Retention

• Client records and billing data — retained for 7 years after the end of the engagement, as required by Canadian tax and accounting law (Income Tax Act record-keeping requirements).
• Contact form inquiries — retained for 2 years from the date of your inquiry, then securely deleted unless you have become a client.
• Analytics data — retained according to Google Analytics' standard retention settings (maximum 26 months), and only collected with your consent.

When information is no longer required, we delete or anonymize it securely.

7. Your Rights Under PIPEDA

You have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate or incomplete information.
• Withdrawal of consent — withdraw your consent to our collection, use, or disclosure of your information at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may limit our ability to provide services to you.
• Explanation — ask questions about how your information is handled and receive a clear answer.

To exercise any of these rights, email vortexmarketingontario@gmail.com with the subject line "Privacy Request." We will respond within 30 days as required by PIPEDA.

8. How We Protect Your Information

• All website traffic is encrypted in transit using HTTPS/TLS.
• Payment card data is handled exclusively by Stripe, a PCI DSS Level 1 certified processor — the highest level of payment security certification.
• Access to client information is limited to team members who need it to deliver your services.
• We review our safeguards regularly and update them as threats evolve.

9. Questions or Privacy Complaints

If you have a question, concern, or complaint about how we handle your personal information:

1. Contact our Privacy Officer first — email vortexmarketingontario@gmail.com or call 647-949-9986. We take every privacy concern seriously and will investigate and respond promptly.
2. Escalate if unresolved — if you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

10. Governing Law & Changes to This Policy

This Privacy Policy and our handling of personal information are governed by the laws of the Province of Ontario and the federal laws of Canada, including PIPEDA.

We may update this policy from time to time. When we do, we will update the effective date at the top of this page and, for material changes, provide notice on our website. Your continued use of our website after changes take effect constitutes acceptance of the revised policy.