Privacy

Privacy Policy

Effective May 1, 2025 · Last updated April 2026

Canaleno Consulting is committed to protecting the privacy of the people and businesses we work with across Canada. This policy explains what information we collect, why, how we use it, and the rights you have over it. It is written to meet the standards of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta's Personal Information Protection Act (PIPA), Québec's Act respecting the protection of personal information in the private sector as amended by Law 25, Brazil's Lei Geral de Proteção de Dados (LGPD), and Chile's Ley 21.719 (2024). Where you are covered by the EU General Data Protection Regulation (GDPR), we apply its standard as well.

1. Who We Are

Canaleno Consulting is a sole proprietorship operated by René Silva Bennett, based in Canada. We provide operational infrastructure consulting to small and mid-sized businesses across Canada.

For any question, request, or complaint under this policy, you can reach us directly:

Email: info@canalenoconsulting.com
Phone / WhatsApp: +1 (587) 921-8677

For the purposes of applicable privacy law, René Silva Bennett, operating as Canaleno Consulting, is the data controller (or the equivalent concept in your jurisdiction — for example, controlador under the LGPD, or responsable under Chile's Law 21.719).

2. Information We Collect

We collect only the information we need to respond to you and to deliver services you request. Specifically:

Information you submit through our diagnostic intake form: your name, email address, company name, industry, the operational pain point you describe, your responses to the five diagnostic questions, and your consent to be contacted.

Information you share when you contact us directly: if you reach out by phone, WhatsApp, or email on your own initiative, anything you choose to share in that correspondence — including, at your option, your phone number.

Local-device diagnostic state: while you are using the diagnostic, your in-progress answers and your language preference are stored in your browser's localStorage. This data stays on your own device and is not transmitted to us until you submit the intake form. You can clear it at any time through your browser's site-data settings.

What we do not collect. We use Google Analytics 4, provided by Google LLC, to collect anonymous data about how visitors use this Site — including pages visited, time spent, and how you arrived. GA4 uses cookies. Data is processed by Google and may be transferred to servers in the United States. You can opt out by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout. We do not run tracking pixels or advertising tags. Payment processing is handled offline through a separate engagement process. No payment card data is collected, processed, or stored through this website. We do not buy, sell, rent, or trade personal information with any third party.

No cookie consent banner. Because our only tracking technology is Google Analytics 4, which you can opt out of via the link above, and we do not operate advertising cookies or consent-required tracking, we do not display a cookie consent banner. The absence of the banner is itself a statement of our approach.

3. How We Use Your Information

We use the information you provide for the following purposes only:

• To respond to your inquiry and follow up on the diagnostic you submitted.
• To deliver the consulting services you contract us to perform, including sending documents, invoices, and deliverables.
• To maintain the business records we are required to keep under Canadian tax and commercial law.
• To improve the questions, copy, and structure of our website, based on aggregate, non-identifying patterns (for example, which language a visitor chose).

No automated decision-making with legal effect. Our diagnostic produces a score and a recommended engagement tier, but the actual decision to enter into a consulting engagement is always made by a human — René. The diagnostic is a conversation starter, not an automated gatekeeping system within the meaning of Article 22 of the GDPR or the equivalent provisions of the LGPD or Québec Law 25.

No advertising. No profiling. No selling of data. We do not use your information for advertising. We do not build behavioural profiles. We do not sell, rent, or otherwise make your information available to third parties for their own marketing or data-brokerage purposes. Ever.

4. Legal Basis for Processing

Where applicable law requires us to identify a legal basis for processing your personal information, we rely on the following grounds:

• Your consent — for example, when you submit the intake form after checking the consent box, or when you contact us directly.
• Performance of a contract (or steps taken at your request prior to entering a contract) — for delivering the consulting services you have engaged us for.
• Our legitimate interests — for example, responding to inquiries, keeping records of our dealings with clients, preventing fraud and abuse of our systems, and defending legal claims. Where we rely on this ground, we balance our interests against your rights and will not rely on it where your interests override ours.
• Legal obligation — for example, retaining records for the period required by the Canada Revenue Agency, or responding to a valid legal order.

You can withdraw your consent at any time by contacting us. Withdrawing consent will not affect the lawfulness of processing we carried out before the withdrawal, and we may still be required by law to retain certain records after you withdraw.

5. Third-Party Service Providers

We rely on a small number of reputable third-party service providers, each of which is limited to a specific, narrow purpose. We do not share your information with any third party for marketing, advertising, profiling, or data-brokerage purposes.

Formspree — delivers our intake form submissions from our website to our email inbox. Formspree sees your intake form data in transit. Formspree's privacy policy is available at formspree.io/legal/privacy-policy.

Email and messaging platforms — when you correspond with us by email, phone, or WhatsApp, your message passes through the providers that operate those services (for example, our email host, your telephone carrier, or Meta Platforms for WhatsApp), each subject to its own privacy terms.

If we ever need to add a new service provider that handles personal information (for example, a CRM or a scheduling tool), we will update this policy before making the change effective.

6. Security Safeguards

We protect the personal information we hold using safeguards appropriate to its sensitivity. Those safeguards include administrative, technical, and physical measures:

• Access to your information is restricted to people who need it to do their work for Canaleno Consulting. Today, that is René.
• Business email and cloud accounts are protected by strong, unique passwords and multi-factor authentication.
• All communications with our website and our service providers travel over encrypted channels (HTTPS / TLS).
• Formspree and our other third-party processors maintain their own independent security programs and certifications.

No system is perfectly secure, and we cannot guarantee absolute security. If a security incident does occur, we will handle it according to Section 8 below.

7. Data Retention

We keep personal information only as long as we need it for the purpose for which it was collected, or as long as the law requires.

• Inquiries that do not result in an engagement: retained for up to 12 months from the date of your last contact, then deleted. This lets us pick up a conversation if you come back, without holding onto stale information indefinitely.
• Client records (engagements, invoices, deliverables, correspondence related to paid engagements): retained for 6 years from the end of the tax year in which the records were created, to meet the Canada Revenue Agency's record-keeping requirements for sole proprietors.
• Device-local diagnostic state (localStorage): controlled entirely by you. It stays on your own device until you clear it through your browser's site-data settings.
• Records of privacy requests and breach notifications: retained for the period required by applicable law — under PIPEDA's breach regulations, at least 24 months.

When the retention period ends, we delete, anonymize, or securely destroy the information.

8. Privacy Incident Response

We take privacy incidents seriously. If a breach of security involving your personal information creates a real risk of significant harm — such as identity theft, financial loss, reputational damage, or other serious consequences — we will:

• Notify you as soon as reasonably possible, explaining what happened, what information was involved, and what you can do to protect yourself.
• Notify the relevant privacy authority as required by applicable law. Depending on where you live, that may include the Office of the Privacy Commissioner of Canada (OPC), the Alberta Office of the Information and Privacy Commissioner (OIPC), Québec's Commission d'accès à l'information (CAI), Brazil's Autoridade Nacional de Proteção de Dados (ANPD), Chile's data protection authority, or an EU/EEA supervisory authority.
• Notify any other organization or government body that may be able to reduce the risk of harm.
• Keep a record of the incident for as long as applicable law requires.

We will not use the threshold of "real risk of significant harm" to avoid telling you about incidents that affect you — when in doubt, we will err on the side of disclosure.

9. Your Rights

You have meaningful rights over the personal information we hold about you. Depending on where you live, the exact names and contours of these rights vary, but the core is the same:

• Access — you can ask what information we hold about you and receive a copy.
• Correction — you can ask us to correct information that is inaccurate or incomplete.
• Deletion — you can ask us to delete your information, subject to legal retention obligations (for example, tax records we are required to keep).
• Withdrawal of consent — you can withdraw consent to processing that is based on consent, at any time.
• Portability — you can ask for a copy of your information in a structured, commonly used format.
• Objection — you can object to processing that is based on our legitimate interests.
• Complaint — you can complain to us first, and to the relevant privacy authority if you are not satisfied with our response.

To exercise any of these rights, email us at info@canalenoconsulting.com. We will respond within 30 days of receiving your request. We may need to verify your identity before acting on it.

If you are not satisfied with our response, you may escalate to the privacy authority for your jurisdiction — for example, the Office of the Privacy Commissioner of Canada for PIPEDA matters, the Alberta OIPC for Alberta PIPA matters, the Commission d'accès à l'information for Québec Law 25 matters, Brazil's ANPD for LGPD matters, the Chilean data protection authority under Law 21.719, or your local supervisory authority if you are in the EU or EEA.

10. International Data Transfers

Canaleno Consulting is a Canadian business, and your information is primarily processed in Canada. Some of our third-party processors — notably Formspree — may process data on servers in the United States or elsewhere, under their own published privacy and security terms.

Canada has been formally recognized by the European Commission as providing an adequate level of protection for personal data transferred from the EU to Canadian private-sector organizations subject to PIPEDA, so data transfers from the EU/EEA to us do not generally require additional safeguards. Where we transfer data to providers outside Canada, we rely on the contractual protections offered by those providers and on the legal protections available in the destination country.

11. Children's Privacy

Our services are directed at business owners and operators, not children. We do not knowingly collect personal information from anyone under the age of 16. If you believe that a minor has submitted information to us, please contact us and we will delete it.

12. Changes to This Policy

We may update this policy from time to time — for example, when we add a new service provider, when applicable law changes, or when our practices evolve. The "Last updated" date at the top of the page will always reflect the most recent revision.

For material changes that affect how we handle information we already hold about you, we will notify the individuals and clients on record before the change takes effect, so you have a meaningful chance to review it and, if needed, to object or to withdraw consent.

13. Contact

For any privacy question, request, or complaint, please contact us directly:

René Silva Bennett
Canaleno Consulting (sole proprietorship)
Email: info@canalenoconsulting.com
Phone / WhatsApp: +1 (587) 921-8677

We read every message that comes in through this address personally, and we will respond promptly.