Privacy Policy

Effective Date: January 1, 2024 | Last Updated: April 1, 2025 | Governing Law: Nova Scotia, Canada

LEGISLATIVE NOTE (as of April 2025): Canada’s federal privacy law is currently PIPEDA (Personal Information Protection and Electronic Documents Act). Bill C-27 (Digital Charter Implementation Act, 2022) proposed replacing PIPEDA with the Consumer Privacy Protection Act (CPPA). As of the date of this draft, Bill C-27 had not yet received Royal Assent. BuzzBronco must verify the current status of this legislation before publishing and update all references accordingly. If the CPPA is now in force, references to PIPEDA throughout this Policy must be updated to the CPPA.

1. Introduction and Scope

BuzzBronco (“Company”, “we”, “us”, or “our”) is committed to protecting your privacy and handling your personal information with transparency, integrity, and care. This Privacy Policy (“Policy”) explains how we collect, use, disclose, store, and protect personal information obtained through our website buzzbronco.com (the “Website”) and in the course of providing our services.

This Policy applies to all personal information collected: (a) through the Website; (b) in email, electronic forms, or other digital communications between you and the Company; and (c) in connection with services purchased from the Company.

Please read this Policy carefully before using the Website. By using the Website, you acknowledge that you have read and understood this Policy and consent to the collection, use, and disclosure of your personal information as described herein. If you do not agree with this Policy, please do not use the Website.

This Policy should be read together with our Terms of Service and Cancellation and Refund Policy, both available on our Website.

2. Applicable Privacy Law

2.1 Canadian Privacy Law (PIPEDA / CPPA)

Our privacy practices are governed by the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”) and the ten fair information principles it incorporates: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance.

ACTION REQUIRED: Verify whether Canada’s Consumer Privacy Protection Act (CPPA) under Bill C-27 has received Royal Assent. If so, replace all references to “PIPEDA” in this Policy with references to the CPPA and review whether any new obligations apply, including enhanced consent requirements, data portability rights, and algorithmic transparency obligations.

2.2 Canadian Anti-Spam Legislation (CASL)

All electronic communications sent by the Company comply with the Canadian Anti-Spam Legislation (CASL). We will not send commercial electronic messages without your express or implied consent, and every marketing communication will contain a clear and functional unsubscribe mechanism.

2.3 General Data Protection Regulation (GDPR) — EU and UK Users

If you are accessing the Website from within the European Union or the United Kingdom, your personal data is also protected under Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and, in the UK, the UK GDPR as incorporated into UK law by the Data Protection Act 2018. Section 10 of this Policy sets out your specific rights and our obligations under the GDPR in detail.

3. What Personal Information We Collect

3.1 Information You Provide Directly

We collect personal information that you voluntarily provide to us, including when you:

Fill out a contact form, inquiry form, or request a quote on the Website;
Sign up for our newsletter or email list;
Purchase a service or digital product;
Register for an account or membership area;
Communicate with us by email, phone, or other means;
Respond to a survey or provide feedback.

The types of personal information collected in these contexts may include: your full name, email address, phone number, mailing address, billing information (processed by our third-party payment processor), company name, job title, and the content of your communications.

3.2 Information Collected Automatically

When you visit the Website, certain information is collected automatically through cookies, server logs, and similar tracking technologies, including:

Device and technical data: IP address, browser type and version, operating system, device identifiers, and screen resolution;
Usage data: Pages viewed, time spent on pages, links clicked, traffic patterns, and referring URLs;
Location data: General geographic location based on your IP address (city or region level; we do not collect precise GPS location);
Analytics data: Aggregated and statistical data about how visitors use the Website, collected via Google Analytics.

Automatically collected data is generally used in aggregate for statistical purposes and Website improvement. Where it is associated with your personal information, it will be treated as personal information under this Policy.

3.3 Information from Third Parties

We may occasionally receive personal information about you from third parties, including:

Marketing and referral partners who have obtained your consent to share your information with us;
Professional advisors, where relevant to a client engagement;
Publicly available sources, such as professional networking platforms;
Government agencies or regulatory bodies, where required or permitted by law.

We will only use such information for the purposes for which it was provided and in accordance with this Policy.

3.4 Sensitive Information

We do not intentionally collect sensitive personal information (such as health data, financial account details, government-issued identification numbers, or information about racial or ethnic origin, religion, or political beliefs) through the Website. Please do not submit such information through our Website forms or email. If sensitive information is required in connection with a specific service engagement, we will address its handling in the applicable Agreement.

4. How and Why We Use Your Personal Information

We collect and use personal information only for identified, legitimate purposes with your knowledge and consent, or as otherwise permitted by applicable law. Our purposes include:

Service delivery: To provide, manage, and fulfill the services you have purchased or requested, including communicating about project status, deliverables, and invoicing;
Account management: To create and manage any account or membership you hold with us;
Marketing and communications: To send you newsletters, promotional content, and information about services that may interest you, where you have provided consent or where permitted under CASL;
Website improvement: To analyze how visitors use the Website and to improve its content, functionality, and user experience;
Legal and compliance: To comply with applicable laws, regulations, and court orders, and to enforce our Terms of Service and other agreements;
Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions and other illegal activity;
Business operations: To administer our business, including record-keeping, accounting, and internal reporting.

We will not use your personal information for any purpose that is incompatible with the purpose for which it was collected without first obtaining your consent, except as permitted or required by applicable law.

5. Legal Bases for Processing (EU and UK Users)

This section applies to EU and UK users and is required under GDPR Article 13. It identifies the legal basis for each category of processing activity.

For EU and UK users, we rely on the following legal bases under GDPR Article 6 for processing your personal data:

Contract performance (Art. 6(1)(b)): Processing your name, contact details, and billing information to fulfil a service agreement you have entered into with us;
Legitimate interests (Art. 6(1)(f)): Analyzing Website usage data to improve our services; sending marketing to existing clients about similar services (subject to your right to object); fraud prevention and information security. We have assessed that our legitimate interests are not overridden by your interests or fundamental rights in these cases;
Consent (Art. 6(1)(a)): Sending marketing emails to new contacts; placing non-essential cookies on your device; processing data for targeted advertising. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal;
Legal obligation (Art. 6(1)(c)): Retaining financial and transactional records as required by applicable tax and commercial law.

6. Cookies and Tracking Technologies

6.1 What We Use

The Website uses cookies, pixels, and similar tracking technologies to improve functionality and understand how the Website is used. These include:

Essential cookies: Required for the Website to function. These cannot be disabled without impairing Website functionality.
Analytics cookies: Used to collect information about how visitors use the Website (e.g., Google Analytics). We use this data in aggregate to improve the Website.
Marketing and advertising cookies: Used to deliver targeted advertising and to track the effectiveness of marketing campaigns, including social media pixels (e.g., Meta Pixel, Google Ads). These cookies may track your activity across other websites.

6.2 Your Cookie Choices

When you first visit the Website, you will be presented with a cookie consent notice (for EU and UK users, this will be a consent banner requiring your active opt-in for non-essential cookies). You may accept all cookies, accept only essential cookies, or customize your preferences.

You may also manage or disable cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of the Website. Instructions for managing cookies in common browsers are available at allaboutcookies.org.

6.3 Third-Party Tracking

Third-party services embedded in the Website (such as Google Analytics, social media plugins, and advertising networks) may use their own cookies and tracking technologies to collect information about you. These third parties’ data practices are governed by their own privacy policies, which we encourage you to review. The Company is not responsible for third-party tracking practices.

7. Disclosure of Your Personal Information

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We may disclose your personal information in the following limited circumstances:

Service providers: We engage trusted third-party service providers (e.g., payment processors, email platforms, hosting providers, analytics tools) who process personal information on our behalf and under our instructions. These providers are contractually obligated to maintain appropriate security measures and to use your information only as directed by us;
Professional advisors: We may share information with our lawyers, accountants, or other professional advisors where necessary for legitimate business or legal purposes;
Enforcement: We may disclose information to a third party, including a lawyer or collection agency, when necessary to enforce our Terms of Service or recover amounts owing;
Legal requirements: We may disclose information when required by law, court order, regulatory authority, or government request, or to protect the rights, property, or safety of the Company, our clients, or the public;
Business transfers: In the event of a merger, acquisition, sale of assets, or other business reorganization, your personal information may be transferred to the successor entity, subject to equivalent privacy protections;
With your consent: We may share information with third parties for other purposes with your express prior consent.

Where we disclose personal information to third parties, we take reasonable steps to ensure that those parties maintain adequate privacy and security protections.

8. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to provide our services, and to comply with our legal obligations. Our general retention practices are:

Client and project records: Retained for a minimum of 7 years following the completion of a project or termination of the client relationship, to comply with applicable tax and commercial record-keeping requirements;
Marketing and newsletter contacts: Retained until you withdraw consent or unsubscribe, after which your information is deleted or anonymized within 30 days;
Website analytics data: Retained in aggregate form for up to 26 months, in accordance with Google Analytics standard retention settings;
Correspondence and support records: Retained for up to 3 years following the last interaction, unless a longer period is required for legal or compliance purposes.

When personal information is no longer required, we will securely delete or anonymize it using industry-standard methods. Residual copies may remain in backup systems for a limited time before being overwritten.

9. Security Measures

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

Encrypted data transmission using HTTPS/TLS protocols;
Access controls limiting personal information access to authorized personnel only;
Firewalls and security software on our servers and systems;
Password policies and secure credential management;
Regular review of our information security practices.

Despite these measures, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security of your personal information. You should be aware that email is not a fully secure medium and should exercise caution when sending personal information by email.

In the event of a data breach that is likely to result in a risk to your rights and freedoms (for EU/UK users) or a real risk of significant harm (for Canadian users), we will notify you and applicable regulatory authorities in accordance with our legal obligations and within the required timeframes.

10. Your Privacy Rights

10.1 Rights for All Users (Canadian Law)

Under applicable Canadian privacy law, you have the right to:

Access: Request access to the personal information we hold about you, subject to certain legal exceptions. We will respond within 30 days of a valid access request and will advise you of any associated costs before retrieving records;
Correction: Request that we correct any inaccurate, incomplete, or outdated personal information we hold about you;
Withdrawal of consent: Withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions. Withdrawal of consent may affect our ability to provide certain services;
Complaint: Lodge a complaint about our privacy practices with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, if applicable, with a provincial privacy commissioner.

10.2 Additional Rights for EU and UK Users (GDPR)

If you are located in the EU or UK, you have the following additional rights under the GDPR:

Right of erasure (“right to be forgotten”): Request that we delete your personal data in certain circumstances, such as where it is no longer necessary for the purpose it was collected or where you withdraw consent;
Right to restriction of processing: Request that we restrict the processing of your personal data in certain circumstances, such as while we verify the accuracy of data you have contested;
Right to data portability: Receive your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller, where technically feasible, in certain circumstances;
Right to object: Object to processing based on our legitimate interests, or to processing for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately;
Rights related to automated decision-making: Not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, without human review;
Right to withdraw consent: Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal;
Right to lodge a complaint: Lodge a complaint with your national data protection supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu. UK users may contact the Information Commissioner’s Office (ico.org.uk).

To exercise any of your rights, please contact us at info@buzzbronco.com with sufficient information to identify yourself and the nature of your request. We will respond within 30 days (or within 1 month for GDPR requests, with the possibility of a 2-month extension for complex requests, with notice to you). We will not charge a fee for reasonable requests; we reserve the right to charge a reasonable fee for manifestly unfounded or excessive requests.

11. International Data Transfers

The Company is based in Nova Scotia, Canada. Your personal information may be processed by our service providers in jurisdictions outside Canada, including the United States and the European Union. Canada has been recognized by the European Commission as providing an adequate level of data protection for the purposes of GDPR, with respect to commercial organizations subject to PIPEDA.

Where we transfer personal data of EU or UK users to third countries that do not benefit from an adequacy decision, we will implement appropriate safeguards, such as Standard Contractual Clauses (SCCs) as approved by the European Commission, or equivalent mechanisms. You may request information about the safeguards in place for international transfers by contacting us at info@buzzbronco.com.

12. Children’s Privacy

The Website is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you are under 18, please do not submit any personal information through the Website.

If we become aware that we have inadvertently collected personal information from a minor without parental consent, we will take steps to delete that information promptly. If you believe we have collected information from a minor, please contact us immediately at info@buzzbronco.com.

13. Email and Marketing Communications

We are committed to keeping your email address confidential. We do not sell, rent, or lease our subscriber lists to third parties. All marketing emails sent by the Company will comply with CASL, including clearly identifying the sender and providing a functional unsubscribe mechanism.

You may opt out of receiving marketing communications from us at any time by: (a) clicking the unsubscribe link in any marketing email; or (b) contacting us at info@buzzbronco.com with the subject line “Unsubscribe”. We will process your opt-out within 10 business days. Please note that even after opting out of marketing communications, you may still receive transactional emails related to services you have purchased.

14. Third-Party Services and Links

The Website may include links to third-party websites, or may embed third-party services such as social media widgets, payment processors, or analytics tools. These third parties have their own privacy policies, which govern how they collect and use your information. We encourage you to review the privacy policies of any third-party services you interact with.

We currently use the following categories of third-party services that may collect or process personal information:

Analytics: Google Analytics (Google LLC). Google’s privacy policy is available at policies.google.com/privacy;
Payment processing: Third-party payment processors (details available on request). We do not store complete payment card details on our systems;
Email marketing: Email platform service providers compliant with CASL and, where applicable, GDPR;
Social media: Social media platforms whose pixels or plugins may be embedded on the Website.

The Company is not responsible for the privacy practices of third-party services and does not accept liability for their handling of your personal information.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or other factors. We will post the updated Policy on this page with a revised “Last Updated” date. For material changes — particularly those that expand our use of your personal information or affect your rights — we will provide advance notice by posting a prominent notice on the Website or by sending an email to registered users or newsletter subscribers at least 14 days before the changes take effect.

For EU and UK users, where a material change affects the legal basis for processing or your rights under GDPR, we will seek fresh consent where required before implementing that change.

Your continued use of the Website after the effective date of a revised Policy constitutes your acceptance of the changes. If you do not agree with a revised Policy, you should discontinue use of the Website and may contact us to request deletion of your personal information.

16. Contact Us and How to Make a Complaint

If you have any questions, concerns, or complaints about this Privacy Policy or our privacy practices, or if you wish to exercise any of your privacy rights, please contact us at info@buzzbronco.com.

We will acknowledge your inquiry within 5 business days and will provide a substantive response within 30 days (or within the GDPR timeframe of 1 month for EU/UK users). If you are not satisfied with our response, you have the right to lodge a complaint with the applicable privacy regulator:

Canada: Office of the Privacy Commissioner of Canada — priv.gc.ca / 1-800-282-1376;
EU: Your national data protection supervisory authority — list available at edpb.europa.eu;
UK: Information Commissioner’s Office — ico.org.uk / 0303 123 1113.

Effective Date: January 1, 2024

Last Updated: April 1, 2025