Privacy Policy

This Privacy Policy explains how Culture Cartel Inc. handles personal information when you visit www.culturecartel.ca, use the tools on it, contact us, or appear in the work we show. We have written it to be read, not skimmed past. If anything is unclear, ask us and we will explain.

The short version

We collect what you choose to give us (for example your name, work email and project details) and a small amount of technical information that every website receives.
We use it to reply to you, to scope and deliver work, to keep the site secure and to understand how the site is used. We do not sell personal information.
In the EU, the EEA, the UK, Switzerland and Quebec, analytics only runs after you accept it. Anywhere, you can switch it off with “Privacy choices” at the foot of every page.
Our AI tools send what you type, or the public web page you point them at, to our AI provider to produce your result. We do not keep those inputs in our own database unless you ask us to send you the result.
You only get our email dispatch if you tick an unticked box, and you can leave at any time.
Our providers include Cloudflare, Anthropic, Google, Microsoft, Resend and Make, and some of them process information in the United States.
You can ask to see, correct or delete your information, and you can complain to a regulator. The details are below.

1. Who we are and how to reach us

Culture Cartel Inc. (“Culture Cartel”, “we”, “us” or “our”) is a design and creative studio based in Toronto, Ontario, Canada. We are responsible for the personal information described in this policy.

Privacy Officer. Our founder is the person responsible for privacy at Culture Cartel and acts as our Privacy Officer (in Quebec, the person in charge of the protection of personal information).

Culture Cartel Inc.
Attention: Privacy Officer
8 The Esplanade
Toronto, Ontario M5E 0A6
Canada

Email: info@culturecartel.ca (please put “Privacy” in the subject line)
Phone: +1 647 459 2154

If you are in the United Kingdom or Europe you can also write to our UK and Europe desk at london@culturecartel.ca. Requests reach the same Privacy Officer.

2. What this policy covers

This policy applies to this website and the forms, tools, pages and messages on it that link here. It also covers personal information that appears in the case studies and imagery on this website (see section 18).

It does not cover third-party sites we link to, or separate properties with their own terms, such as the F1inTO race-day app at go.f1into.ca or the GRID+CLUB community. Where we handle personal information on behalf of a client, the client’s own privacy terms usually apply as well (see section 19).

3. What we collect

We aim to collect only what we need. Most of the site can be used without telling us anything about yourself.

Information you give us

Where	What we collect
Start a project form, Live events RFP, press and careers doors	Name, work email, company, the services you are interested in, timeline, budget band, event details (date, city, attendance, format), anything you write in the message box, and any file you choose to upload
AI Readiness Check	Your answers and score. They stay in your browser unless you ask for your plan, in which case your name, email, answers and score are sent to us
Cartel Lens, Brand Teardown and Brief Builder	The website address or copy you give the tool, your answers to the Brief Builder’s questions, and, only if you ask us to send you the result, your email address and a summary of the result
Ask Culture Cartel (the site assistant)	The messages you type
Email dispatch opt-in	The fact that you ticked the box, and when and where you did so
Booking a call	Your name, email, phone number, company website, what you tell us and the time you pick
Emails and messages to us	Whatever you choose to include

Please do not send us sensitive information (such as health, financial account or government identification details) through the website. We do not need it.

Information collected automatically

Technical request data. Like every website, our servers receive your IP address, browser and device type, the page requested, the referring page and the time. This is processed by Cloudflare, which hosts the site.
Crawler counts. Our server counts visits from automated crawlers, such as search engine bots and AI assistants, by crawler name and page. It checks the visiting address against the crawler’s published address list and then discards it; it does not record IP addresses for this. Visits from people are not counted this way.
Form context. When you submit a form we record the page you submitted it from, the referring page, any campaign tags in the link (UTM parameters), the page you first arrived on during that visit, the website that sent you there (its name only, for example “google.com”, never the full address) and a one-way hash of your IP address, keyed with a secret so that it cannot be reversed by trying every possible address. We do not store your raw IP address with your enquiry.
Analytics. Where you allow it, we use Google Analytics through Google Tag Manager to understand how the site is used. See section 9.
Bot protection. Our forms and AI tools may use Cloudflare Turnstile, which looks at technical signals from your browser to tell people from automated abuse.

Information from other sources

Public websites. When you ask the Cartel Lens or Brand Teardown to read a website, we fetch that one public page (see section 5).
Professional context. When you contact us about a project, we may look at public information about your company, such as its website, so we can reply usefully.

4. How enquiries are handled

When you submit a form, this is what happens:

Your submission goes to our application on Cloudflare’s network, where it is checked for abuse and recorded in our enquiry database (Cloudflare D1). Partial submissions are saved, so if you complete the first step of the project form and stop, we still have that first step.
Any file you upload (PDF, Word, text or image, up to 10 MB) is stored in our private file storage (Cloudflare R2). It is not public, and it is deleted with your enquiry record (see section 12).
A copy of the enquiry is emailed to our inbox (info@culturecartel.ca) through Resend, our email delivery service, so we can reply. When automation is switched on, a copy is also passed to Make.com, our automation service, which may create or update a record in our customer relationship management (CRM) tool and may prepare a draft reply for us to review. If you opted in to the dispatch, you are added to our mailing list. No other route adds you to the list.
A senior member of the studio reads the enquiry and replies.

5. The AI tools on this website

This website includes optional tools that use artificial intelligence. They are labelled as AI, and you can always reach a person instead by booking a call or emailing us.

Tool	What it sends to the AI provider
Cartel Lens	Text, headings, colours and fonts read from the one public web page you point it at, then a brand profile drawn from that page
Brand Teardown	The same page snapshot, or the homepage copy you paste in
Brief Builder	Your answers to its questions, so it can draft a one-page brief and choose the next question
Ask Culture Cartel	Your recent messages in the conversation, plus our own published facts about Culture Cartel

The AI Readiness Check is not an AI tool. It is a fixed questionnaire scored in your browser.

Who processes it. The AI models are provided by Anthropic, PBC, in the United States, through its commercial API. Our application runs on Cloudflare. Under Anthropic’s published commercial terms at the time of writing, inputs and outputs sent through its API are not used to train its models, and are deleted from its systems within 30 days unless they need to be kept longer for safety, abuse prevention or legal reasons.

How we read a website you give us. We fetch that single public page and its main stylesheet, identifying our request as the Culture Cartel Lens. If a site blocks simple requests, we may load the page in a headless browser provided by Cloudflare (Cloudflare Browser Rendering). Cloudflare may cache the fetched page for up to ten minutes. We first run the page through a safety screen, which is itself an AI model, so content that tries to manipulate the tool is not used. Only point the tools at websites you are entitled to have reviewed. We do not log in to anything, and we only read what any visitor can see.

What we keep. We do not store what you type into the AI tools, or the pages they read, in our own database. The results are shown in your browser. If something goes wrong, our error logs may record the domain name of the website you entered (for example “example.com”), never the full address, and Cloudflare’s request logs are kept for a short period (see section 12). If you ask us to email you a Lens board, a Teardown report or your AI Readiness plan, your email address and the result (for example the brand name, the headline and the territories, the verdict and the positioning directions, or your score and moves) become an enquiry record, so a person can check the result email before it is sent. If you send us your finished brief from the Brief Builder, the brief and the questions and answers behind it become an enquiry record.

What the models do not get. Before it reaches the model, we automatically remove email addresses, phone numbers (North American and international formats) and web links from what you type into Ask Culture Cartel and the Brief Builder, and email addresses and phone numbers from homepage copy you paste into the Brand Teardown. Your contact details from our forms are never sent to the AI model. This removal works by pattern matching, so a number written in an unusual way may get through: please do not type personal information into the AI tools.

What the output is. AI output is generated automatically, can be wrong and is a speculative starting point, not advice. Lens concepts carry no trademark, legal or availability clearance. A tool may decline to show a result when its quality or safety checks are not met. That is a judgment about the output, not about you.

6. Why we use personal information, and our legal bases

Purpose	Legal basis (where the law asks for one)
Replying to enquiries, scoping and quoting work, booking calls	Your request and steps before a contract; our legitimate interest in answering business enquiries
Delivering and managing client work, billing and records	Performance of a contract; legal obligations (for example tax records)
Running the AI tools you choose to use	Your request; your consent where required
Sending the email dispatch	Your express consent
Keeping the site secure, preventing spam, abuse and fraud, and capping costs	Our legitimate interest in a safe, working website
Understanding how the site is used and improving it	Our legitimate interest, or your consent where the law requires consent for analytics cookies
Showing our work, including imagery in which people appear	Our legitimate interest in showing professional experience, balanced against the rights of the people shown (see section 18)
Recruiting	Your application; steps before a contract
Complying with law, and establishing or defending legal claims	Legal obligation; legitimate interest

We do not use personal information for purposes that a reasonable person would not expect in the circumstances. If we want to use it for a new purpose, we will tell you and, where required, ask for your consent first.

In Canada we rely on your meaningful consent, which may be express (for example ticking the dispatch box) or implied by what you do (for example sending us an enquiry so that we can reply to it). You can withdraw consent at any time by emailing us, subject to legal or contractual limits. For analytics, you can also use “Privacy choices” at the foot of every page. If you withdraw consent for something we need in order to do what you asked, such as replying to an enquiry, we will tell you what that means before we act on it. Withdrawing consent does not affect anything we did before.

8. Email marketing and Canada’s anti-spam law

We send the occasional Culture Cartel dispatch (new work and ideas) only to people who have opted in.

Opt-in only. The dispatch box on our forms is never pre-ticked. Getting a reply to your enquiry or a copy of an AI result does not sign you up.
Identification. Every dispatch identifies Culture Cartel Inc. and includes our mailing address and a way to contact us.
Unsubscribe. Every dispatch has an unsubscribe link that works for at least 60 days after it is sent. You can also email us. We act on unsubscribe requests promptly, and in any case within 10 business days, as Canada’s Anti-Spam Legislation (CASL) requires.
Records. We keep a record of when and how you gave consent, and of any unsubscribe, so we can prove consent and keep honouring your choice.
No bought lists. We do not buy, rent or sell email lists.

Follow-ups on your enquiry. If you send an enquiry or a Live RFP, we email you once straight away to confirm we have it. After a person at the studio has replied to you, we may follow up about that enquiry a few more times over the next two to three weeks (at most four emails), then we stop. Each one identifies us, says why you are getting it and has a one-click link to stop them, which works at once. A reply, a booked call or that link ends them. They never add you to the dispatch, and we send none once six months have passed since your enquiry. The AI tools work the same way, with one difference: after your result, we only follow up if you tick “Follow up on my result” (an unticked box), and then it is two or three short emails before we stop. A record of what we sent and when is kept with your enquiry and deleted with it.

Replies to your own enquiry, and messages about work you have engaged us for, are not marketing messages.

9. Cookies, analytics and local storage

Our own site sets no cookies. It stores a few small, non-identifying settings in your browser:

Name	Where	What it does
cc-consent	Local storage	Remembers your analytics choice (accepted or declined) and when you made it, so we do not ask on every visit. After 12 months we ask again
cc-sound2	Local storage	Remembers whether you switched the site’s sound on or off with the toggle at the top. Until you do, only quiet page-move and click sounds play, and videos are always muted
cc-intro	Session storage	Remembers that the opening animation has played in this tab, so it does not replay. Cleared when you close the tab
cc-internal	Local storage	Set only on our own team’s devices, to leave our own visits out of the analytics. Never set for visitors

Analytics and your consent. We use Google Tag Manager, which runs Google Analytics 4, and Cloudflare Web Analytics. We do not use session recording or heatmap tools. What happens depends on where you are. When you first visit, your browser asks our site whether a consent notice is needed, and our host, Cloudflare, answers yes or no from the approximate location of your IP address. Only that yes or no is sent back, and we do not store your location.

In the EU, the EEA, the UK, Switzerland and Quebec, and wherever we cannot tell where you are, a short notice at the bottom of the page asks for your choice. Google Tag Manager and Google Analytics do not load, and set no cookies, until you select Accept. If you select Decline, or simply ignore the notice, they do not load.
Everywhere else, including the rest of Canada and the United States, they load a few seconds after a page opens, or when you first scroll, tap or type, unless you have declined. You can decline at any time with “Privacy choices” at the foot of every page.
Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a decline wherever you are, and the analytics tools do not load unless you later select Accept in the notice.
Google Consent Mode. Before Google Tag Manager can load, we tell Google that analytics storage and advertising storage are both denied. Analytics storage is switched on only when you accept, or, outside the regions above, when you have not declined. Advertising storage, ad user data and ad personalization always stay denied, because we run no advertising.
Changing your mind. “Privacy choices” reopens the notice. If you decline after the analytics tools have loaded, we switch their storage off straight away and delete their cookies on our domain. Until you reload the site or open it again, they may still send measurement signals without cookies or identifiers. After that, they do not load at all.

What the analytics tools collect. When they run, these tools can set their own cookies (for example Google Analytics cookies whose names begin with “_ga”, which can last up to two years) and collect information such as pages viewed, clicks, scrolling, approximate location derived from your IP address, and device and browser details. We send these tools the names of actions on the site (for example “started the brief” or “submitted a form”), but not your name, email address or the content of your messages.

Cloudflare Web Analytics. It sets no cookies, stores nothing on your device and does not identify you or follow you across sites. It counts page views and measures how quickly pages load and respond (for example Largest Contentful Paint), from the page address, the referring site, your browser and device type and an approximate country. Because it sets no cookies and identifies no one, it runs for every visitor, including before you answer the notice, unless you decline analytics or your browser sends a Global Privacy Control signal. If you decline, it stops the next time you open or reload the site.

Enquiries and Google Analytics. When analytics is allowed and you send an enquiry or book a call, our server tells Google Analytics that it happened, after the enquiry is saved. It sends the type of form, the budget band you picked (if any) and the kind of source that brought you (for example search or an AI assistant), linked to the same pseudonymous analytics ID your browser already uses. It never sends your name, email address, phone number, company or message. When analytics is declined or not yet accepted, our server sends Google nothing. If an enquiry later becomes paid work, our server may tell Google Analytics once that a project was won and its value, against the same pseudonymous ID and only if analytics was allowed when you sent the enquiry. To make that link we keep that ID with your enquiry record, and it is deleted with it.

Booking a call. Booking runs on our own system. Nothing loads from a booking service in your browser and no cookies are set. To show free times we check our calendar for busy periods only; your booking adds a call to it. We email you the confirmation and a calendar invite through Resend, and a reminder about two hours before the call. Your booking details (name, email, phone number, company website, notes and time) are kept for the same period as enquiries, counted from the date of the call. Embedded services you choose to open. The F1inTO app demo only loads when you press play. Once loaded, those services may set their own cookies under their own policies. Bot protection by Cloudflare Turnstile, where it is active, collects technical signals to confirm you are a person. Cloudflare states that it does not use this information for advertising.

Images and video. The images and videos on this site are served from our own hosting on Cloudflare. As with any web request, those servers receive your IP address and browser details.

No advertising pixels. We do not currently use advertising pixels or remarketing tags on this website. If we add them, we will update this policy first and, where the law requires, ask for your consent before they run.

Your choices. Use “Privacy choices” at the foot of any page to accept or decline analytics. You can also block or delete cookies and site data in your browser settings, use a content blocker, or use Google’s browser add-on to opt out of Google Analytics, and you can ask us to stop. Declining or blocking analytics does not stop the site from working.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share it only as described here.

Provider	What they do for us	Where they may process data
Cloudflare, Inc.	Hosting, content delivery, security, bot protection (Turnstile), our application, enquiry database (D1), file storage (R2), short-lived counters (KV and Durable Objects), crawler visit counts (Analytics Engine), page view and page speed counts (Web Analytics), headless browser (Browser Rendering) and request logs	Global network, including the United States
Anthropic, PBC	The AI models behind the Lens, Teardown, Brief Builder and Ask Culture Cartel	United States
Resend	Delivering enquiry notifications to our inbox, and our emails to you (confirmations, follow-ups and the dispatch). Resend tells us when an email bounces or is marked as spam, so we stop emailing that address	United States
Make (Celonis)	Routing enquiry notifications to our CRM and mailing list, when switched on	United States
Google LLC	Google Analytics and Tag Manager, including the enquiry signals our server sends when analytics is allowed	United States and other countries
Microsoft Corporation	Microsoft 365 for our email (provided through GoDaddy)	United States and other countries
Our CRM and email dispatch providers	Managing contacts and sending the dispatch to people who opted in	Varies by provider; ask us for current details

We also share information with professional advisers (such as lawyers and accountants), with authorities where the law requires it, with anyone you ask us to share it with, and with a buyer or successor if our business is reorganized or sold, under appropriate confidentiality. Our service providers may only use personal information to provide their services to us, and we use contracts and their published data protection terms to require appropriate protection.

11. Where your information is stored, and transfers outside Canada

We are based in Canada, but several of our providers store or process information in the United States, the European Union and other countries. While it is there, it is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities.

For people in Quebec: before we communicate personal information outside Quebec, we assess whether it will be adequately protected, taking into account its sensitivity, the purpose, the safeguards in place and the legal framework where it will be held, and we use written agreements with providers.
For people in the UK and the European Economic Area: Canada has an adequacy decision from the European Commission for commercial organizations subject to its federal privacy law. Where your information goes from us to a provider in a country without such a decision, we rely on the provider’s standard contractual clauses, or the UK equivalent, or another lawful transfer mechanism. You can ask us for details.

12. How long we keep information

We keep personal information only as long as we need it for the purpose it was collected for, or as the law requires, and then delete or anonymize it.

Information	How long
Enquiries, and files uploaded with them	Our website enquiry database deletes each enquiry, and every file uploaded with it, automatically 24 months after the enquiry was last updated (normally the day you sent it). A check runs once a day. Copies in our inbox and CRM are deleted within 24 months of our last contact with you, unless the enquiry led to work, in which case the next row applies
Client and project records, contracts and invoices	For the relationship, then as long as tax and corporate law require, generally six years after the end of the tax year they relate to
Email dispatch list	Until you unsubscribe. We then keep a minimal record of your email, consent and unsubscribe so we can prove consent and keep honouring your choice
Stop requests (unsubscribes, bounces and spam reports)	Your email address and the reason, kept for as long as we send email, so a stop is honoured for good, even after your enquiry itself is deleted
What you type into the AI tools, and pages they read	Not stored in our database. Held by Anthropic for up to 30 days under its terms, as described in section 5
Request and error logs	A short period set by Cloudflare, normally no more than a few days
Rate-limit and spending counters	Short-lived. Form counters are keyed by a hash of your IP address and expire within 20 minutes. Daily AI tool counters are keyed by a hash of your IP address, the date and a secret, so the key changes every day and cannot be linked across days. Your IP address itself is never stored in them. They are deleted automatically just after midnight UTC at the end of the day they cover
Analytics data	No longer than 14 months at the user level, under the retention settings in our analytics account
Job applications	Applications sent through our careers form are deleted from our website enquiry database automatically 12 months after they were last updated. Applications sent by email are deleted within 12 months after the role is filled. We keep an application longer only if you agree
Privacy requests, complaints and takedown requests	As long as needed to deal with them and to show how we did, normally up to 24 months

We may keep information longer where we are legally required to, or where it is needed to deal with a dispute or legal claim.

13. How we protect information

We use reasonable administrative, technical and physical safeguards that fit the sensitivity of the information. These include encrypted connections (HTTPS with HSTS), a content security policy, private storage for uploaded files, keyed hashing of IP addresses stored with enquiries, daily-rotating hashes in place of IP addresses in our rate limits, automatic deletion of old enquiries and uploads, signed short-lived sessions for the AI tools, rate limits and spending caps, bot protection, screening of untrusted content before it reaches our AI models, and limiting access to the people who need it. No website or system is perfectly secure, so we cannot promise that information will never be lost or accessed without authorization, but we work to keep the risk low and to act quickly if something goes wrong.

14. If there is a breach

If a breach of security affecting personal information creates a real risk of significant harm (in Quebec, a risk of serious injury), we will report it to the Office of the Privacy Commissioner of Canada or the Commission d’accès à l’information du Québec as applicable, notify the people affected as soon as feasible, and tell them what they can do to reduce the risk. Where UK or EU law applies, we will notify the relevant supervisory authority within 72 hours where required. We keep a record of every breach, whether or not it has to be reported, for at least 24 months.

15. Automated processing and decisions

We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you. Every enquiry is read and answered by a person.

Some features work automatically: the AI tools generate content, quality and safety checks may decide not to show a generated result, the AI Readiness Check calculates a score from a fixed formula, and our security systems may block traffic that looks automated or abusive. If you think an automated step has affected you unfairly, contact us and a person will review it. Where Quebec law applies and a decision about you is made exclusively by automated processing, you can ask us what personal information was used, the main reasons and factors behind the decision, and to have the information corrected.

16. Your rights

Your rights depend on where you live, but we aim to honour the following requests from anyone, wherever the law allows.

Everyone. You can ask us to tell you what personal information we hold about you and how we use and share it, to give you a copy, to correct it, to delete it, and to stop sending you marketing. You can withdraw consent, and you can complain to us or to a regulator.

Canada (PIPEDA). You have the right to access and challenge the accuracy of your personal information, and to withdraw consent. We will respond within 30 days, or tell you within that time if we need an extension permitted by law and why.

Quebec. You also have the right to have information about you de-indexed or its dissemination stopped where the law allows, to receive computerized personal information you provided in a structured, commonly used technological format, and to be informed about automated decisions as described in section 15. We do not knowingly collect information from anyone under 14 without the consent of a parent or guardian.

United Kingdom and European Economic Area. You have the right of access, rectification, erasure, restriction and portability, the right to object to processing based on our legitimate interests, an absolute right to object to direct marketing, the right to withdraw consent, and rights about solely automated decisions. We will respond within one month, which can be extended by up to two further months for complex requests. You can complain to us first, and we will acknowledge your complaint within 30 days, respond without undue delay and tell you the outcome.

United States. Depending on your state, you may have the right to know what personal information we collect, use and disclose, to access, correct and delete it, to opt out of its sale, sharing for targeted advertising, or profiling, to limit the use of sensitive personal information, and not to be treated differently for exercising these rights. Some state laws may not apply to a business of our size, but we will honour these requests anyway. We do not sell or share personal information, or use it for targeted advertising, and we do not use sensitive personal information to infer characteristics about you. We treat a Global Privacy Control signal from your browser as a request to opt out, and as a decline of analytics on this website (see section 9). If we decline your request, you may appeal by replying to our decision, and we will review it and give you our reasons in writing.

How to make a request. Email info@culturecartel.ca with “Privacy request” in the subject line, or write to us at the address in section 1. We may need to confirm your identity before acting, usually by asking you to reply from the email address we hold. An authorized agent may make a request for you if we can verify their authority and your identity. Requests are free, unless the law allows a reasonable fee for requests that are clearly unfounded or excessive, in which case we will tell you first. If we cannot do what you ask, we will explain why, unless the law prevents us.

17. Children

This website is for businesses and professionals. It is not directed to children, and we do not knowingly collect personal information from anyone under 16 through it. If you believe a child has given us personal information, contact us and we will delete it. Fan events and communities such as F1inTO set their own age rules in their own terms.

18. Images, case studies and people in our work

Our case studies show work that our founder and the teams he worked with produced, including in earlier roles at other companies, for brands owned by others. Some of that imagery shows people, such as performers, event attendees, crews, staff and customers, and some shows names, messages or data. Where an image identifies a person, we treat it as personal information.

We show this material to document professional work, not to suggest that anyone shown endorses Culture Cartel.
Conversations, names, messages and data marked “Illustrative” are samples created to show how a product works. They are not real people’s messages or records.
If you appear in an image or video on this site and would like it removed, blurred or cropped, email us with the page and a description. We will act promptly and, in most cases, take the image down while we review your request.

Our Legal Disclaimer sets out the fuller notice on work, images and third-party trademarks.

19. Information we handle for clients

When we deliver services such as campaigns, CRM, automation, websites or events, we may handle personal information on a client’s behalf. In that role we act as a service provider (a processor), we follow the client’s instructions and our contract, and the client’s own privacy terms apply. If your question is about a client’s handling of your information, we will pass it to the client or tell you how to reach them.

20. Job applicants

If you apply to work with us, we collect what you send, such as your contact details, CV, portfolio and references, and use it only to assess your application and communicate with you. We keep it as described in section 12.

If you interact with us on social media, the platform’s own privacy policy applies, and we may see and use what you make available to us there to reply and to understand engagement. Links to other websites are provided for convenience. We are not responsible for their privacy practices, so please read their policies.

22. Changes to this policy

We will update this policy when our practices, providers or the law change. The date at the top of the page shows when it last changed. If we make a material change, such as a new use of personal information or a new kind of provider, we will make it clear on this page and, where the law requires, ask for your consent.

23. Questions and complaints

Please contact our Privacy Officer first, using the details in section 1. We take every concern seriously and will try to resolve it. If you are not satisfied, you can complain to a regulator:

Canada: the Office of the Privacy Commissioner of Canada, priv.gc.ca
Quebec: the Commission d’accès à l’information du Québec, cai.gouv.qc.ca
United Kingdom: the Information Commissioner’s Office, ico.org.uk
European Economic Area: the data protection authority in your country, listed by the European Data Protection Board at edpb.europa.eu
United States: your state attorney general or, in California, the California Privacy Protection Agency