Privacy policy
Effective date: July 6, 2026
1. About us
This privacy policy (the “Policy”) explains how Stones Site Surveys & Consultation (“Stones”, “we”, “us”, or “our”), collects, uses, discloses, retains, and safeguards personal information in the course of our commercial activities in Canada. We collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances. This Policy is intended to address Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and other applicable Canadian privacy laws.
We provide downloadable digital site survey templates and related training and consultation services to signage companies and related industry professionals through our website, contact forms, email communications, and related online tools (collectively, the “Services”).
We are accountable for personal information under our control and have designated John Stones, Owner / Privacy Officer, as the individual accountable for our compliance with the privacy principles set out in PIPEDA and for receiving questions, requests, and complaints. Contact details are set out in Section 17.
2. What is personal information
“Personal information” means information about an identifiable individual. Personal information may include a person’s name, email address, telephone number, mailing or billing address, online identifiers, payment-related information, and communications with us.
Personal information does not include business contact information that is collected, used, or disclosed solely for the purpose of communicating or facilitating communication with an individual in relation to their employment, business, or profession.
3. Personal information we collect
We limit the personal information we collect to that which is necessary for the purposes identified in this Policy, and we collect personal information by fair and lawful means. Depending on how you interact with us, we may collect the following types of personal information:
a) Contact and inquiry information, such as your name, business name, job title, email address, telephone number, mailing address, and the contents of messages submitted through website contact forms, email, telephone, scheduling tools, or other communications with us.
b) Purchase and transaction information, such as products or services purchased, order numbers, invoices, receipts, download or access information, billing details, payment status, refunds or chargebacks, and related customer service communications.
c) Payment information. Payments are processed by our e-commerce platform’s integrated payment processor. We do not collect or store full payment card numbers or card security codes. We may receive limited payment information from the payment processor, such as confirmation that a payment was made, the amount, date, transaction identifier, and limited card or payment method details.
d) Order history. Our e-commerce platform may retain order history associated with your purchase, such as products purchased, order numbers, and download records. We do not require you to create an account or log in to make a purchase.
e) Consultation and training information, such as information you provide about your business, signage projects, site survey processes, training needs, template requirements, or other information included in documents, emails, calls, forms, or meeting materials you choose to share with us.
f) Communication preference information, such as whether you have opted in to receive product updates, unsubscribed, or otherwise indicated your communication preferences.
g) Website and technical information, such as IP address, browser type, device type, operating system, referring URLs, pages viewed, and interactions with our website. Our e-commerce platform may automatically collect certain technical information required to operate the website and process transactions.
h) Other information you choose to provide, including information submitted in survey responses, feedback, reviews, testimonials, or other voluntary communications.
We do not intentionally seek sensitive personal information. Please do not submit sensitive information through our website or contact forms unless it is necessary for your request. If you choose to provide sensitive information, we will use it only for the purpose for which it was provided or as otherwise permitted or required by law.
4. How we collect personal information
We may collect personal information directly from you when you contact us, submit a website form, purchase or download digital products, request training or consultation, respond to a survey, or otherwise communicate with us.
Our e-commerce platform may automatically collect certain information when you use our website, such as through cookies or similar technologies required for website functionality and transaction processing.
We may receive limited information from service providers that help us operate the Services, such as our e-commerce platform and its integrated payment processor.
5. How we use personal information
We identify the purposes for collecting personal information at or before the time of collection. We may use personal information to:
a) Provide, administer, and improve the Services, including making digital products available for purchase and download, providing training or consultation services, responding to inquiries, and managing customer relationships.
b) Process purchases and payments, issue invoices and receipts, confirm orders, provide access to downloads, manage refunds or payment disputes, and maintain transaction records.
c) Communicate with you about the Services, including administrative messages, customer support, scheduling, updates to digital products or training materials, and responses to your requests.
d) Send product updates or other service-related communications to existing customers where we have an existing business relationship or are otherwise permitted by applicable law, including Canada’s anti-spam legislation, and manage unsubscribe requests and communication preferences.
e) Understand how the website and Services are used, troubleshoot issues, improve content and user experience, and develop or improve templates, training, and consultation offerings.
f) Protect the security and integrity of our website, systems, business, and customers, including detecting, investigating, and preventing fraud, misuse, unauthorized access, or other unlawful activity.
g) Comply with legal, tax, accounting, regulatory, contractual, and recordkeeping obligations, and establish, exercise, or defend legal rights or claims.
We do not use personal information for automated decision-making that produces legal or similarly significant effects without meaningful human involvement.
If we wish to use personal information for a purpose not previously identified, we will identify that purpose prior to use. Unless the new purpose is required by law, we will obtain your consent before using your personal information for that purpose.
6. Consent and marketing communications
We collect, use, and disclose personal information with your knowledge and consent, except where consent is not required or is not appropriate under applicable law. Your consent is only valid if it is reasonable to expect that you would understand the nature, purpose, and consequences of the collection, use, or disclosure of the personal information to which you are consenting. The form of consent may vary depending on the sensitivity of the information, the purpose of collection, and your reasonable expectations.
You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. If you withdraw consent, we will explain any implications, which may include our inability to provide certain Services, process a purchase, or respond to a request.
We may send product updates or service-related communications to existing customers where we have an existing business relationship, in accordance with Canada’s anti-spam legislation. Each such communication will include a mechanism to unsubscribe. You can also unsubscribe at any time by contacting us using the information in Section 17.
7. Cookies, analytics, and similar technologies
Our e-commerce platform may use essential cookies and similar technologies required to operate the website, maintain security, and support core functions such as the shopping cart, checkout, and access to downloads.
We do not currently use analytics, advertising, or tracking cookies on our website. If we introduce non-essential cookies or similar technologies in future, we will update this Policy and obtain consent where required by law.
You can usually block or delete cookies through your browser settings. If you disable cookies, some website features, checkout functions, or downloads may not work properly.
8. How we share personal information
We do not sell personal information. We may disclose personal information only as necessary for the purposes described in this Policy, with your consent, or as otherwise permitted or required by law.
We may share personal information with service providers that help us operate our small business. At present, our primary service provider is our e-commerce platform, which provides website hosting, payment processing, and related transaction services. If we engage additional service providers in future, we will update this Policy as appropriate.
We require service providers that process personal information for us to protect that information and use it only for the services they provide to us, subject to their own legal obligations and applicable terms.
We may disclose personal information without your knowledge or consent if we receive a subpoena, warrant, court order, or other legal requirement issued by a court, tribunal, regulator, or other person with jurisdiction to compel disclosure. We may also disclose personal information if required or permitted by law to comply with a tax or accounting obligation, regulatory requirement, or to collect amounts owed, investigate fraud or security incidents, or protect our rights, property, customers, or others.
If we sell, transfer, reorganize, or otherwise dispose of all or part of our business, personal information may be disclosed or transferred as part of that transaction, subject to appropriate confidentiality and use restrictions and applicable law.
We do not currently have employees or subcontractors. If that changes, we will limit access to personal information to those who need it for authorized purposes and will require appropriate confidentiality and privacy safeguards.
9. Storage and processing outside Canada
Personal information may be stored or processed outside Ontario or outside Canada by us or by service providers, including providers of e-commerce, payment processing, hosting, or cloud storage services. Information processed outside Canada may be subject to the laws of the jurisdiction where it is processed, including lawful access by courts, law enforcement, or government authorities in that jurisdiction.
We are responsible for personal information in our possession or custody, including information that has been transferred to a third party for processing. When we use service providers to process personal information, we use contractual or other means to provide a comparable level of protection while the information is being processed by the service provider.
10. Retention
We retain personal information only as long as necessary to fulfil the purposes for which it was collected, to provide the Services, to meet legal, tax, accounting, regulatory, contractual, security, or dispute-resolution requirements, or as otherwise permitted or required by law. Personal information that is no longer required to fulfil the identified purposes will be destroyed, erased, or made anonymous in accordance with our retention practices.
We generally expect to retain:
a) Contact and inquiry records for as long as necessary to respond to the inquiry and for a reasonable period afterward for relationship management, quality assurance, and legal purposes.
b) Purchase, invoice, payment, refund, and tax/accounting records for at least seven years from the end of the taxation year to which they relate, or another period required by applicable law, to meet tax, accounting, audit, chargeback, and legal requirements.
c) Consultation and training records for the duration of the client relationship and for a period of two years afterward, to provide the Services, maintain records of advice or deliverables, and address follow-up questions, disputes, or legal obligations.
d) Communication preference and unsubscribe records for at least three years after the last product update is sent or the customer relationship ends, whichever is later, to manage preferences, demonstrate compliance with Canada’s anti-spam legislation, and avoid sending unwanted communications.
e) Technical and cookie information collected by our e-commerce platform for the period set by the platform, subject to applicable law.
f) Privacy access requests, correction requests, complaints, and breach records for at least two years after the matter is resolved, or longer if required to allow the individual to exhaust any recourse under PIPEDA.
11. Accuracy
We take reasonable steps to keep personal information as accurate, complete, and up to date as is necessary for the purposes for which it is to be used. You can help us by providing accurate information and notifying us of changes. You may request correction of personal information as described in Section 13.
12. Safeguards and breach reporting
We use physical, organizational, and technological safeguards appropriate to the sensitivity, amount, distribution, format, and storage of the personal information we hold. These safeguards may include limited access, password protection, multi-factor authentication where available, device security, encryption in transit, secure cloud services, backups, secure disposal, and vendor due diligence.
We limit access to personal information to those who need it for authorized purposes. Access is expected to be limited to the owner and service providers necessary to operate the Services.
If it is reasonable in the circumstances to believe that a breach of security safeguards creates a real risk of significant harm to an individual, we will report the breach to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible. Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on a credit record, and damage to or loss of property. We keep and maintain a record of every breach of security safeguards involving personal information under our control, whether or not the breach is reported.
No method of transmission or storage is completely secure. We cannot guarantee that unauthorized access, loss, misuse, or disclosure will never occur. You should avoid sending highly sensitive information through our website forms or ordinary email unless necessary.
13. Your rights: access, correction, deletion, inquiries, and complaints
You may request access to personal information we hold about you by submitting a request in writing. After verifying your identity, we will inform you whether we hold personal information about you, provide access to it, and explain how it has been used and to whom it has been disclosed, subject to lawful exceptions.
If you demonstrate that personal information we hold is inaccurate or incomplete, you may request that we correct or update it. Where appropriate, we will provide corrected information to third parties to whom it was disclosed. You may also request that we delete personal information we hold about you. We will respond to such requests unless we are required or permitted by law to retain the information, or the information is needed to fulfil the purposes for which it was collected or for legal, tax, accounting, or dispute-resolution requirements.
We will respond to access and correction requests with due diligence and in any case not later than 30 days after receipt of the request. If meeting the time limit would unreasonably interfere with our activities or if consultations are necessary, we may extend the time limit by up to 30 additional days and will notify you of the extension, the reasons, and your right to complain to the Privacy Commissioner. We will respond at minimal or no cost to you. If we refuse a request, we will provide reasons in writing and information about available recourse.
You may also contact our Privacy Officer with questions or complaints about our privacy practices. We will investigate all complaints and respond in a fair and timely manner. If a complaint is found to be justified, we will take appropriate measures, including, if necessary, amending our policies and practices.
14. Children’s privacy
The Services are intended for businesses, signage companies, and related industry professionals, and are not directed to children. We do not knowingly collect personal information from children or knowingly allow minors to purchase Services. If you believe a child has provided personal information to us, please contact us so that we can take appropriate steps.
15. Links to third-party websites
Our website or e-commerce platform may contain links to third-party websites, such as the websites of our payment processor, e-commerce platform provider, or other third parties. These links are provided for your convenience. We do not control those websites and are not responsible for their privacy practices or content. Your use of a third-party website is subject to that website’s own privacy policy and terms. We encourage you to review the privacy policies of any third-party website before providing personal information.
16. Availability outside Ontario and Canada
This Policy is currently designed to address Canadian privacy law, including PIPEDA. The Services are initially offered in Ontario, with plans to expand to other Canadian provinces and territories and to other countries. If we make the Services available to residents of Quebec, additional requirements under Quebec’s provincial privacy legislation may apply, including language, consent, and transparency obligations. If we make the Services available to individuals outside Canada, additional privacy or consumer protection requirements of the applicable jurisdictions may apply. We will update this Policy as necessary to address any such requirements.
17. Contact us
If you have questions, requests, or complaints about this Policy or our privacy practices, please contact our Privacy Officer:
Privacy contact: John Stones, Owner / Privacy Officer
Email: info@stonessitesurveys.ca
Phone: (905) 246-8332
Mailing address: 70 Lakehurst Drive, St Catharines,Ontario, CanadaL2N4C4
Website: https://www.stonessitesurveys.ca
Please provide enough information for us to identify you and understand your request. We may ask for information to verify your identity before responding to an access, correction, or deletion-related request.
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada:
Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, Quebec K1A1H3
Website: www.priv.gc.ca
Toll-free: 1-800-282-1376
18. Changes to this Policy
We may update this Policy from time to time to reflect changes to our practices, Services, technologies, service providers, or legal requirements. We will post the updated Policy with a new effective date and obtain consent to material changes where required by law.
If any part of this Policy conflicts with applicable Canadian privacy law, the applicable law will prevail to the extent of the conflict.