Legal
Privacy policy
Personal Information Protection & Data Practices
Last Updated: August 12, 2026
Effective Date: April 30, 2026
Jurisdiction: Ontario, Canada — with provisions for international users
Version: 1.2
By using our services or submitting information through our platforms, you consent to the practices described in this policy. If you do not agree, please do not use our services.
1. Who We Are
Canada Business Consulting is a digital marketing and technology agency incorporated in Ontario, Canada. We operate zalvica.com as our primary marketing, onboarding, and client services platform.
We act as a data controller for personal information we collect directly. Where we process personal data on behalf of our White-Label Partners or their clients, we act as a data processor.
Where we access data held on third-party platforms — including Meta (Facebook, Instagram, WhatsApp, Threads) and TikTok — on behalf of a Direct Client or a White-Label Partner, we likewise act as a service provider / data processor on that client’s documented instructions. The client remains the controller of that data (see Section 15).
Contact for Privacy Matters: [email protected] | Canada Business Consulting, Ontario, Canada
2. Scope of This Policy
This Policy applies to: Direct Clients who engage Canada Business Consulting through our website or intake platform; White-Label Partners authorized to resell our services; End Clients of Partners whose data Partners provide to Canada Business Consulting in connection with White-Label service delivery; and Website Visitors who visit zalvica.com or its intake routes. It also applies to Platform Data we access from third-party platforms (including Meta and TikTok) strictly on behalf of clients who have authorised that access, as described in Sections 4.6 and 15. This Policy does not apply to third-party websites or services linked from our platforms.
3. Legal Framework
| Law | Jurisdiction | Applies When |
|---|---|---|
| PIPEDA | Federal Canada | All commercial activities involving personal data |
| Quebec Law 25 | Province of Quebec | Clients or visitors located in Quebec |
| CASL | Federal Canada | Commercial electronic messages to Canadian addresses |
| CAN-SPAM | United States | Commercial email to US-based recipients |
| GDPR | European Union / EEA | Services targeting or involving EU/EEA residents |
| CCPA / CPRA | California, USA | California residents using our services |
4. Personal Information We Collect
4.1. Information You Provide Directly
| Category | Examples | Legal Basis |
|---|---|---|
| Identity & Contact | First name, last name, email address, phone number | Contract; Legitimate interest |
| Business Information | Company name, website URL, business niche, model, active channels | Contract performance |
| Geographic Data | Country of registration, country of operation, target market regions | Contract; Legal compliance |
| Market & Audience Data | Audience profile, competitors, keywords, content guidelines, brand tone | Contract performance |
| Platform Access | Delegated access grants to client business assets made through each platform’s own authorisation system (e.g., Meta Business Manager partner access, TikTok Business Center access, platform-issued API tokens — stored encrypted). For non-social systems (e.g., a client’s CRM), credentials the client chooses to provide (stored encrypted). We do not request, collect or store clients’ Facebook, Instagram, WhatsApp or TikTok account passwords. | Contract performance |
| Communication Data | Messages, emails, intake form submissions, support inquiries | Legitimate interest |
| Payment Data | Billing name, payment method (processed by third-party — raw card data not stored) | Contract; Legal obligation |
4.2. Information Collected Automatically
When you visit our websites, we automatically collect technical data including IP address and approximate geographic location, browser type and version, operating system, pages visited and session duration, referring URL, device type, and session identifiers.
4.3. Device & Technical Environment Data (Signed-In Users)
When you sign in to and use our client platform, we collect a technical profile of the device and browser environment you use to access the Services. This information is made available by your browser through standard web interfaces (such as the User-Agent string and User-Agent Client Hints) and may include: browser name and version; operating system and version; device type and, where the browser exposes it, device model; screen resolution and pixel density; input capabilities (touch or pointer); preferred language; time zone; and connection characteristics (such as network type).
We collect this information for the following limited purposes: (a) operating the platform and rendering it correctly on your device; (b) diagnosing and resolving technical issues, including reproducing errors on the same browser and device configuration on which they occurred; (c) ensuring compatibility of new features across the devices our clients actually use; and (d) protecting the security of your account, including identifying sign-ins from unrecognized devices. The legal basis for this processing is contractual necessity and our legitimate interest in maintaining a reliable and secure service.
Device and technical environment data is not used for advertising, behavioural profiling, or automated decision-making, is not enriched with data from other sources, and is not disclosed to third parties except to the service providers listed in Section 6.1 to the extent strictly necessary to host and operate the platform. We do not employ device fingerprinting techniques that circumvent browser privacy controls.
4.4. Information from Third Parties
We may receive personal information from White-Label Partners who provide End Client data; CRM and marketing platforms integrated by Client; third-party platforms whose APIs we access on a client’s behalf under the client’s own authorisation, including Meta and TikTok (see Section 4.6); and public professional sources such as business directories and LinkedIn (used in AISalesPro service).
4.5. Sensitive Information
We do not intentionally collect sensitive personal information such as health data, financial account numbers, government identification numbers, racial or ethnic origin, or religious beliefs. If such information is inadvertently provided, we will delete it and notify you promptly.
4.6. Platform Data Accessed on Behalf of Clients (Meta, TikTok and Similar Platforms)
Where a client engages us to manage their presence or advertising on a third-party platform, the client grants us access to their own business assets through the platform’s own delegated-access system — for example Meta Business Manager partner access or TikTok Business Center access. We never obtain such access by asking for the client’s password.
Through those authorised connections we may access, on the client’s instructions:
- Meta: the client’s Facebook Pages and their published content, comments and engagement metrics; linked Instagram professional accounts, their media, comments and insights; ad accounts, campaigns, audiences and advertising performance data; product catalogues; WhatsApp Business accounts, phone numbers, message templates and messaging analytics; and the client’s datasets/pixels, including server-side conversion events sent from the client’s own website.
- TikTok: the client’s TikTok Business Account, its published videos, profile information, comments and engagement metrics; TikTok Ads Manager advertiser accounts, campaigns, audiences and performance reports; and, where used by the client, TikTok Pixel and Events API data originating from the client’s own properties.
This information may incidentally include personal information of people who interact with the client’s channels (for example, the display name of a commenter). We access it only to the extent needed to deliver the contracted service, we process it under the client’s instructions, and we treat it under the restrictions in Sections 6.5, 8, 13 and 15.
5. How We Use Your Information
| Purpose | Legal Basis |
|---|---|
| Deliver and manage the Services you have contracted for | Contractual necessity |
| Process payments and manage billing | Contract; Legal obligation |
| Send service-related communications (onboarding, updates, invoices) | Contract; Legitimate interest |
| Send marketing communications (newsletters, promotions) | Consent (express, per CASL/GDPR) |
| Manage Free Month, intake period, subscription pauses, and billing transitions | Contractual necessity |
| Improve and develop our Services and Platform | Legitimate interest |
| Conduct B2B lead research and outreach on behalf of Client (AISalesPro) | Client instruction; Client’s legal basis |
| Manage the client’s own social pages, profiles and messaging channels — reading published content and engagement, publishing client-approved content, moderating and responding to comments and messages, and producing performance reports for that client | Client instruction; Contractual necessity |
| Create, manage and optimise advertising campaigns inside the client’s own advertising accounts (Meta, TikTok, Google and similar), including sending the client’s own first-party conversion events to the client’s pixel or dataset | Client instruction; Contractual necessity |
| Comply with legal obligations (tax, anti-spam, privacy law) | Legal obligation |
| Detect and prevent fraud, abuse, or security threats | Legitimate interest; Legal obligation |
6. How We Share Your Information
Canada Business Consulting does not sell personal information. We share data only in the following circumstances.
6.1. Service Providers & Technology Partners
We use third-party processors to deliver our Services, including automation platforms (e.g., Make/Integromat), AI model providers (e.g., OpenAI, Anthropic, Google), CRM and outreach tools, cloud hosting providers, payment processors, and analytics providers. All are bound by data processing agreements.
6.2. White-Label Partners
Client data provided by the Partner is shared with Canada Business Consulting solely for the purpose of service delivery. Canada Business Consulting does not use End Client data for any purpose beyond fulfilling the Partner’s service contract.
6.3. Legal & Regulatory Disclosure
We may disclose personal information if required by law, court order, or regulatory authority. Where legally permissible, we will notify the affected individual prior to disclosure.
6.4. Business Transfers
In connection with a merger, acquisition, or sale of assets, personal information may be transferred to the acquiring entity subject to equivalent privacy protections.
6.5. What We Never Do
- We do not sell, rent, or trade personal information to third parties for their own marketing purposes;
- We do not use End Client data provided through White-Label Partners for Canada Business Consulting’s own marketing;
- We do not share personal information across unrelated White-Label Partner accounts;
- We do not disclose personal information to advertisers or data brokers.
- We do not sell, license or otherwise monetise Platform Data obtained from Meta, TikTok or any other platform API;
- We do not combine Platform Data belonging to one client with data of any other client, and we do not use it to build Canada Business Consulting’s own audiences, profiles or marketing lists;
- We do not use Platform Data for advertising outside the client’s own advertising accounts;
- We do not use Platform Data to train artificial-intelligence or machine-learning models;
- We do not attempt to re-identify individuals from aggregated or anonymised platform metrics, and we do not use Platform Data in connection with eligibility decisions (credit, insurance, employment, housing or similar).
7. Cookies & Tracking Technologies
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Essential | Authentication, session management, security. Required for platform to function. | No — required for basic functionality |
| Analytics | Page views, session duration, traffic sources (e.g., Google Analytics). | Yes — opt out via cookie banner |
| Preference | Remembers user settings, language, saved form progress, and region. | Yes — may affect functionality |
| Marketing | Retargeting and ad performance tracking (e.g., Meta Pixel, Google Ads), where applicable. | Yes — requires explicit consent |
You may manage cookie settings through our cookie consent banner on first visit, your browser settings, or opt-out tools provided by analytics providers. We honor Do Not Track browser signals to the extent technically practicable.
8. Data Retention
| Data Category | Retention Period | Reason |
|---|---|---|
| Active client account data | Duration of Agreement | Service delivery |
| Post-termination client data | 60 days after termination | Transition support |
| Financial and billing records | 7 years | Tax & legal compliance |
| Website analytics data | 26 months | Service improvement |
| Device & technical environment data (signed-in users) | Duration of Agreement, then deleted with account data | Diagnostics, compatibility & security |
| CASL consent records | 3 years from last activity | CASL compliance |
| Prospect/lead research data (AISalesPro) | Duration of Client engagement | Service delivery |
| Platform Data (Meta, TikTok and similar; Section 4.6) | Only while needed to deliver the service; deleted within 30 days of the earliest of: the client revoking our platform access, termination of the engagement, or a deletion request under Section 16 | Service delivery; platform developer-policy compliance |
Following the applicable retention period, personal information is securely deleted or irreversibly anonymized.
9. International Data Transfers
Canada Business Consulting operates in Canada and uses technology providers that may process data in the United States, the European Union, and other jurisdictions. Where personal data is transferred outside Canada, we ensure appropriate safeguards including standard contractual clauses (SCCs), adequacy decisions, and data processing agreements with all third-party processors.
10. Your Privacy Rights
10.1. Canada (PIPEDA)
Right to access personal information we hold; request correction of inaccurate information; withdraw consent to non-essential processing; and file a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).
10.2. Quebec (Law 25)
Additionally: data portability, request correction and its communication to third parties, request de-indexing, and file a complaint with the Commission d’accès à l’information (www.cai.gouv.qc.ca).
10.3. EU / EEA (GDPR)
Right to access, rectification, and erasure; restriction of processing and data portability; object to processing based on legitimate interests; withdraw consent; and lodge a complaint with your local Data Protection Authority.
10.4. California (CCPA / CPRA)
Right to know what personal information is collected, used, shared, or sold; delete personal information; opt out of the sale or sharing of personal information (note: Canada Business Consulting does not sell personal information); and non-discrimination for exercising privacy rights.
10.5. How to Exercise Your Rights
Submit a written request to [email protected]. We will respond within 30 days (or within the timeframe required by applicable law). We may ask you to verify your identity before processing your request. Step-by-step instructions for requesting deletion, including deletion of Platform Data, are set out in Section 16 of this Policy.
11. Security Measures
Canada Business Consulting implements commercially reasonable technical and organizational security measures to protect personal information, including encryption of data in transit and at rest, access controls, and regular security assessments. Platform API credentials issued to us (such as Meta system-user tokens) are held in encrypted storage with file-level access restrictions, are never embedded in client-side code, are accessible only to personnel responsible for the client concerned, and can be revoked at any time by the client from their own platform settings. All access to platform APIs occurs over encrypted (TLS) connections, and multi-factor authentication is enforced on the accounts that administer such access. In the event of a data breach affecting your personal information, we will notify you and applicable regulatory authorities as required by law.
12. White-Label Partners — Data Responsibilities
Where Canada Business Consulting delivers services through a White-Label Partner, the Partner is the data controller for all personal information of End Clients. Canada Business Consulting acts as a data processor, processing End Client data only as instructed by the Partner and as necessary to deliver the contracted services. White-Label Partners are responsible for their own privacy policy, lawful basis for data collection, and executing a Data Processing Agreement with Canada Business Consulting.
Canada Business Consulting maintains strict data isolation between different Partner accounts. End Client data from one Partner is not accessible to or shared with any other Partner under any circumstances.
13. Automated Decision-Making & AI
Some of our Services use AI and automated processing to generate content and analyze data. Where AI tools process personal information on your behalf: we use AI solely to deliver contracted Services, not to make legally significant automated decisions about individuals; content generated by AI is subject to Client review and approval before publication; and we do not use Client data to train third-party AI models beyond what is permitted under our agreements with those providers. Platform Data obtained from Meta or TikTok APIs is never used to train, fine-tune or evaluate any artificial-intelligence or machine-learning model, whether ours or a third party’s.
14. Children’s Privacy
Our Services are intended for businesses and professionals and are not directed at individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we may hold information about a minor, please contact us at [email protected].
15. Third-Party Platform Data — Developer Policy Compliance
When we access data through Meta’s APIs we do so as a Tech Provider acting on behalf of the client that authorised the access, and we comply with the Meta Platform Terms, Meta Developer Policies, Meta Business Tools Terms and the applicable product terms (including the WhatsApp Business Terms). When we access data through TikTok’s APIs we comply with the TikTok Developer Terms of Service, TikTok Business Products (Data) Terms and TikTok Advertising Policies.
In each case we: use Platform Data only for the permitted purpose of providing the contracted service to the client whose assets the data belongs to; retain it no longer than needed for that purpose (Section 8); protect it as described in Section 11; do not transfer it except to subprocessors bound by equivalent obligations (Section 6.1); and delete it when the authorisation ends or the platform or client requires deletion. If a platform requests certification of deletion, we provide it. Clients may revoke our access at any time directly in Meta Business Manager or TikTok Business Center, without notice to us.
16. Data Deletion Instructions
<!– anchor: id=”data-deletion” — СОХРАНИТЬ на новом сайте –>
This section is our official data deletion procedure for the purposes of Meta, TikTok and any other platform requiring published deletion instructions.
If you are a client (or White-Label Partner) and want us to stop processing data connected to your platform accounts:
- Revoke our access at the source. In Meta Business Manager: Settings → Users → Partners → select Canada Business Consulting → remove assigned assets or remove the partner. In TikTok Business Center: Members / Partners → remove Canada Business Consulting. Revocation takes effect immediately and ends our ability to read or write anything on your accounts.
- Request erasure of what we hold. Email [email protected] with the subject line “Data deletion request”, stating your business name and the accounts or services concerned.
If you are an individual — for example you commented on or messaged a page we manage for a client, or you submitted information through our website — email [email protected] with the subject line “Data deletion request” and enough detail for us to locate your information (the page, account or form concerned and the name or handle you used). Where we hold the data as a processor for a client, we will forward your request to that client and assist them in fulfilling it, as platform rules and privacy law require.
What happens next. We acknowledge every deletion request within 5 business days, verify the requester’s identity or authority, complete deletion within 30 days, and confirm completion in writing. We may retain the minimum records we are legally required to keep (for example, invoices and CASL consent logs); if so, we will say so in our confirmation. There is no charge for making a deletion request.
17. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date, post the updated Policy on our website, and notify active Clients by email at least 14 days before changes take effect. Continued use of our Services after the effective date constitutes acceptance of the revised Policy.
18. Contact & Complaints
Privacy Officer: Canada Business Consulting
Email: [email protected]
Website: zalvica.com
Mailing Address: CBC at Suite 221, 312 Dolomite Drive, Toronto, ON M3J2N2 Canada
Phone: (+1) 416-865-9166 xt. 222
If you are not satisfied with our response, you may contact: the Office of the Privacy Commissioner of Canada (www.priv.gc.ca); Commission d’accès à l’information — Quebec (www.cai.gouv.qc.ca); your local EU/EEA Data Protection Authority; ICO — UK (www.ico.org.uk); or the California Attorney General (oag.ca.gov).
Canada Business Consulting | zalvica.com | [email protected] | Version 1.2 | Ontario, Canada
Questions about this policy?
Email the ZALVICA team.
Write to [email protected] and we will reply during business hours.