Last updated · 11 May 2026

Privacy policy · Canada.

How seo-consultant.co handles the personal information of Canadian residents under the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), and Canada's Anti-Spam Legislation (CASL). Written in plain English — en français sur demande.

Where this policy applies. This Canadian policy applies if you live in Canada (any province or territory) at the time you give us personal information, or if you are a Quebec resident regardless of where you are when you visit the site. If you are in the UK / EU, see /privacy/uk. In the United States, see /privacy/usa.

1. Privacy Officer — the person accountable

PIPEDA Principle 1 (Accountability) and Quebec Law 25 both require that one named person is accountable for our privacy practices and that their contact details are public. That person is:

  • Syed, Founder & Privacy Officer
  • seo-consultant.co
  • Email: hello@seo-consultant.co (subject line: “Privacy — Canada”)
  • WhatsApp: +44 7538 773627
  • Postal address available on written request.

The Privacy Officer answers data-subject requests, breach notifications, and complaints from the Office of the Privacy Commissioner of Canada (OPC) and the Commission d'accès à l'information du Québec (CAI). One named human, one inbox, one working day.

2. What personal information we collect

We try to collect the minimum needed. Categories:

  • Identification & contact data, given by you when you submit the brief form, email us or message WhatsApp: name, email, mobile / WhatsApp number, company name, website URL.
  • Commercial context, given by you when you submit the brief form: industry, budget band, preferred meeting time and the text of your message.
  • Billing data, given by you if we enter a paid engagement: invoicing address, payment-method last-4 and any tax IDs needed (e.g. Canadian GST/HST or Quebec QST registration numbers).
  • Technical data, collected automatically: IP address, user agent, referring URL, click identifiers (gclid, fbclid), UTM parameters, pages viewed, time on site. Server logs and (with consent) Google Analytics 4.

We do not ask for, and ask you not to send us, sensitive personal information as defined by PIPEDA / Law 25 — health, financial-account, biometric, government-issued ID, or precise geolocation data — unless a specific service engagement requires it under a separate written agreement.

3. Why we collect it — identified purposes

PIPEDA Principle 2 requires that purposes be identified before or at the time of collection. We collect personal information for the following purposes only:

  1. To reply to your enquiry and prepare a written proposal if relevant.
  2. To deliver SEO, web-design, social-media or AI-agent work you have engaged us for.
  3. To invoice you and meet Canadian tax-recordkeeping obligations.
  4. To send you transactional updates about your project (no marketing newsletters).
  5. To measure aggregate traffic to this website (only with your cookie-banner consent).
  6. To attribute marketing campaigns — e.g. understanding that you arrived from a Meta or Google Ads campaign — again, only with your consent.
  7. To protect the site against fraud and abuse and to comply with legal obligations.

We will not use your information for any new, materially different purpose without your fresh consent.

4. Consent — how we get it and how you withdraw it

PIPEDA Principle 3 requires meaningful consent. Under Quebec Law 25, consent for personal information processing must be free, informed, specific, granular and given for specific purposes — not bundled.

  • Express consent when you submit the brief form: an unticked checkbox confirms you have read this policy and consent to us processing your contact data to reply.
  • Express consent via the cookie banner before any analytics or advertising cookies fire. Defaults are set to “denied” in Google Consent Mode v2 so GA4, Google Ads, and Meta Pixel tags in our GTM container do not load until you choose Accept.
  • Implied consent only for the strictly necessary purposes (responding to an email you sent us, hosting and securing the site).
  • Withdrawal at any time: reply to any email from us, email the Privacy Officer, or use the “Cookie preferences” link in the footer to re-open the banner and change your choice.

5. Limiting collection, use, disclosure & retention

PIPEDA Principles 4, 5 and 7 require that we collect, use and keep only what we need for the identified purposes. In practice:

  • Enquiries that did not proceed, 12 months from last contact, then deleted.
  • Active client records, for the duration of the engagement plus 6 years afterwards to meet Canadian tax-recordkeeping obligations (Income Tax Act, Excise Tax Act for GST/HST, Quebec Taxation Act for QST).
  • Marketing emails (transactional updates only at present), until you unsubscribe.
  • Server logs, 30 days.
  • Analytics data (with consent), 14 months (GA4 default).

6. Who we disclose your information to

We do not sell personal information. We do not trade it. We do not share it with lead-generation aggregators or advertising networks for their own marketing. The only categories of third parties that receive any of your data, and only for the purposes listed, are:

  • Email + form delivery: Google Workspace (email), Web3Forms (receives the brief-form payload and forwards it to our inbox).
  • Hosting + CDN: Vercel (US-based) and Cloudflare for static assets.
  • Messaging: WhatsApp / Meta if you choose to message us via WhatsApp.
  • Analytics & ads (only with consent): Google Analytics 4, Google Ads, Meta Pixel + Conversions API.
  • Accounting & payment: Canadian and UK accounting software, Stripe for card payments (if used).
  • Professional advisors: lawyers and accountants under professional confidentiality, if their advice is required.
  • Law enforcement: only when compelled by a valid Canadian court order or equivalent legal process.

Each processor is bound by written contractual terms requiring them to handle personal information only on our instructions and to apply security safeguards comparable to ours.

7. Cross-border data transfers — transparency notice

seo-consultant.co is operated from London, United Kingdom. Several of the processors above (Vercel, Cloudflare, Google, Meta, Stripe, Web3Forms) host data in the United States or the European Economic Area. Quebec Law 25 requires that we tell you this explicitly before sending Quebec-resident data outside the province, and that we assess that the destination jurisdiction offers protection equivalent to that in Quebec.

By using this site or submitting the brief form, you consent to your personal information being transferred to and stored in the UK, the EEA and the United States, where it is subject to that jurisdiction's laws (including possible access by foreign law enforcement under valid legal process). We use Standard Contractual Clauses with US-based processors and limit transfers to those strictly needed for the purposes identified.

8. Your rights as a data subject

PIPEDA Principles 8 (Openness) and 9 (Individual Access) give you the right to know what we hold about you and to challenge its accuracy. Quebec Law 25 adds further rights including portability and the right to de-indexing in certain cases.

  • Right of access: ask for a copy of the personal information we hold about you.
  • Right of rectification: ask us to correct inaccurate or incomplete data.
  • Right of erasure / withdrawal of consent: ask us to delete data we no longer need for the original purpose.
  • Right to data portability (Quebec residents, Law 25): receive your personal information in a structured, commonly used, machine-readable format.
  • Right to object to automated decisions made solely by an automated system (Law 25). We do not currently make any.
  • Right to lodge a complaint: see section 12 below.

To exercise any right, email the Privacy Officer at hello@seo-consultant.co. We respond within 30 days. We may ask for proof of identity proportional to the sensitivity of the data before releasing it. No fee for a reasonable request.

9. Safeguards — how we protect your information

PIPEDA Principle 7 requires physical, organisational and technological safeguards proportional to the sensitivity of the data. Ours include:

  • Encryption in transit (HTTPS/TLS 1.2+) on every page of this site, including the brief form.
  • Encryption at rest on all primary systems (Google Workspace, Vercel, Stripe).
  • Two-factor authentication on every service login that holds your data.
  • Principle-of-least-privilege access — only the Privacy Officer and named contractors with a need-to-know touch personal information.
  • Working devices encrypted at the disk level, automatic screen lock, kept up-to-date.
  • Annual review of safeguards, data-processing inventory and processor list.

10. Breach response — what we do if something goes wrong

Both PIPEDA (since 1 November 2018) and Quebec Law 25 require us to notify the regulator and affected individuals of any breach of security safeguards involving personal information that creates a real risk of significant harm (RROSH under PIPEDA, “risk of serious injury” under Law 25).

If a breach occurs:

  1. We contain it and assess the scope within 24 hours.
  2. We notify the OPC and, if Quebec residents are affected, the CAI, as soon as feasible.
  3. We notify you directly, by email, where the assessment shows real risk of significant harm.
  4. We maintain a written record of every breach for 24 months and supply it to regulators on request, as PIPEDA requires.

11. CASL — commercial electronic messages

Canada's Anti-Spam Legislation governs commercial emails and SMS to Canadian recipients. We do not send marketing newsletters. If we ever do, every message to a Canadian recipient will:

  • Be sent only after express or valid implied consent under CASL section 6 / 10.
  • Identify the sender and provide a postal address, phone or email contact.
  • Include a working unsubscribe mechanism that takes effect within 10 business days.

Transactional emails about a project you have engaged us for — quotes, invoices, status updates — are not commercial electronic messages under CASL section 6(6) and may be sent without consent. You can still ask us to stop at any time.

12. Complaints — OPC and CAI

If you believe we have not handled your personal information properly, please raise it first with the Privacy Officer at hello@seo-consultant.co. We respond within 30 days.

If you are not satisfied, you have the right to complain to the federal regulator and, if you live in Quebec, to the provincial regulator:

  • Office of the Privacy Commissioner of Canada
  • 30 Victoria Street, Gatineau, Quebec, K1A 1H3
  • Toll-free: 1-800-282-1376
  • Website: priv.gc.ca
  • Commission d'accès à l'information du Québec (Quebec residents)
  • 525, boul. René-Lévesque Est, Bureau 2.36, Québec (Québec) G1R 5S9
  • Toll-free: 1-888-528-7741
  • Website: cai.gouv.qc.ca

13. Meta (Facebook / Instagram) Lead Ads disclosure

We run Meta Lead Generation campaigns targeting Canadian businesses (notably Calgary, Montreal, Toronto and other major cities). If you submit your contact details through a Meta Lead Form rather than this website, the following applies in addition to everything above:

  • What Meta sends us. When you submit the Meta Lead Form, Meta transmits the fields you filled (name, email, phone, and any custom questions) to seo-consultant.co. From that moment seo-consultant.co becomes the controller of those details under PIPEDA and, for Quebec residents, Quebec Law 25. We process them on the same legal basis and for the same purposes set out in sections 3 and 4 above.
  • What Meta keeps. Meta also retains a copy of the submission under its own privacy policy at facebook.com/privacy/policy. Meta is a joint or independent controller for that retention, not us.
  • Meta Pixel + Conversions API. If you reach this website from a Meta ad and have consented to advertising cookies via our banner, our Meta Pixel reports the page view to Meta, and on a successful brief submission our server-side Meta Conversions API (CAPI) endpoint at /api/lead/capi sends a hashed copy of your name + email + phone to Meta so Meta can attribute the conversion. Hashing uses SHA-256 in line with Meta's Advanced Matching standard.
  • Your rights apply identically. Access, correction, deletion, withdrawal of consent, OPC / CAI complaint — sections 8 and 12 above. To remove the data Meta itself retains, submit a deletion request via facebook.com/help/contact/507739850717246 (Meta's lead-ad data deletion form).
  • Cross-border transfer notice. Meta is headquartered in the United States and Ireland. Your Lead Form submission therefore transits and is stored outside Canada. See section 7 above for the safeguards we apply.
  • Withdrawal of consent on Meta's side. You can disable Pixel tracking for your Meta account at facebook.com/settings/?tab=ads or set your browser to send the Global Privacy Control signal. Our site honours GPC.

14. Children

This site is not directed at children under 14 (the Quebec Law 25 threshold for parental consent). We do not knowingly collect personal information from anyone under 14. If you believe a child has submitted data to us, contact the Privacy Officer and we will delete it.

15. Changes to this policy

We review this policy at least annually and update it when our practices or Canadian law change. The “last updated” date at the top reflects the most recent substantive change. For material changes affecting Canadian users, we will notify active clients directly by email.

Last reviewed: 11 May 2026 · Next scheduled review: 11 May 2027 · Privacy Officer: Syed, hello@seo-consultant.co.

30% OFF websites7th month FREEends 30 May →