Privacy Policy

1. Introduction and Scope

Boomy Marketing Inc. ("Boomy Marketing," "we," "us," or "our") is a digital marketing agency incorporated in Ontario, Canada, with its principal place of business at 240 Richmond St W, Toronto, ON M5V 1V6. We are committed to protecting the privacy and confidentiality of the personal information entrusted to us by our clients, prospective clients, website visitors, and employees.

This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. It applies to all personal information collected through our website at boomymarketing.com, our marketing services, client onboarding processes, and any other means by which we receive your information.

By using our website or engaging our services, you consent to the collection, use, and disclosure of your personal information as described in this policy. If you do not agree with these practices, please do not use our website or services.

2. What Personal Information We Collect

We collect personal information necessary to provide our marketing services, maintain our business relationships, and improve our website experience. The categories of personal information we may collect include:

2.1 Information You Provide Directly

• Contact details: full name, business name, email address, telephone number, and mailing address
• Account and billing information: payment card details (processed securely via third-party processors), invoicing address, and purchase history
• Project information: marketing goals, budget ranges, target audiences, brand assets, and campaign briefs you share with us
• Communications: emails, chat messages, feedback forms, and any other correspondence you send to us
• Form submissions: information provided via our contact form, quote request form, or newsletter sign-up

2.2 Information Collected Automatically

• Technical data: IP address, browser type and version, operating system, referring URLs, and device identifiers
• Usage data: pages visited, time spent on pages, clicks, scroll depth, and navigation paths on our website
• Cookie data: identifiers stored via cookies and similar tracking technologies (see our Cookie Policy for details)
• Analytics data: aggregated and pseudonymous behavioural data collected via Google Analytics 4 and similar tools

2.3 Information from Third Parties

• Business contact information from publicly available sources such as LinkedIn or company websites
• Referral information from current clients or business partners
• Advertising platform data (Google Ads, Meta Ads) when you grant us access to manage your ad accounts

3. How We Use Your Personal Information

We use the personal information we collect for the following purposes, relying on consent, contractual necessity, or legitimate business interests as the legal basis for processing:

• Service delivery: To provide, manage, and improve the digital marketing services we have contracted to deliver, including SEO, paid advertising, social media management, web design, and AI-driven marketing automation
• Client communication: To respond to enquiries, provide quotes, send project updates, share performance reports, and maintain ongoing business relationships
• Billing and financial administration: To process payments, issue invoices, manage accounts receivable, and comply with tax reporting obligations under Canadian law
• Marketing and business development: To send relevant updates, case studies, and promotional materials about our services — only where you have provided consent or where we have a legitimate interest
• Website improvement: To analyse how visitors use our website, identify technical issues, and enhance user experience through A/B testing and heatmap analysis
• Legal and compliance: To meet obligations under applicable law, respond to legal process, enforce our Terms of Service, and protect the rights, property, or safety of Boomy Marketing, our clients, or the public
• Recruitment: To evaluate job applications and maintain a talent pipeline for future hiring

We will not use your personal information for any purpose not described in this policy without first obtaining your consent, unless required or permitted by law.

4. Disclosure of Personal Information

We do not sell, rent, or trade personal information to third parties for their own marketing purposes. We may share personal information in the following limited circumstances:

4.1 Service Providers

We engage trusted third-party vendors who process personal information on our behalf to support our operations. These include cloud hosting providers, CRM platforms, email delivery services, payment processors, project management tools, and analytics platforms. All such vendors are required by contract to protect personal information in a manner consistent with this policy and applicable Canadian privacy law.

4.2 Advertising Platforms

When managing paid advertising campaigns on your behalf, we may share necessary campaign data with platforms including Google, Meta, LinkedIn, and Microsoft Advertising. This sharing is governed by those platforms' own privacy policies.

4.3 Legal Requirements

We may disclose personal information when required by applicable law, court order, government authority, or regulatory body; when necessary to protect the rights and safety of our company, clients, or others; or in connection with the investigation of fraud or other illegal activity.

4.4 Business Transfers

In the event of a merger, acquisition, sale of assets, or other business transition, personal information may be transferred to the acquiring entity, subject to equivalent privacy protections.

5. International Data Transfers

Some of the third-party service providers we use — including cloud infrastructure and analytics tools — may store or process data outside of Canada, including in the United States or the European Union. When personal information is transferred internationally, we ensure appropriate contractual protections are in place, consistent with PIPEDA's accountability principle. By using our services, you acknowledge that your data may be processed in jurisdictions outside Canada, which may have different privacy laws.

6. Data Retention

We retain personal information only as long as is necessary to fulfil the purposes for which it was collected, to maintain our business records, and to comply with legal obligations. Our general retention practices are:

• Client records: Retained for seven (7) years following the end of the client relationship to satisfy Canadian tax and financial record-keeping requirements
• Prospective client inquiries: Retained for up to two (2) years if no engagement results, then securely deleted
• Website analytics data: Aggregated data retained for up to twenty-six (26) months; raw event data deleted on a rolling basis per platform defaults
• Marketing communications: Retained until you unsubscribe or withdraw consent, after which we retain a minimal suppression record to honour your opt-out
• Employment applications: Retained for one (1) year for unsuccessful candidates, unless you consent to a longer retention period

7. Your Privacy Rights

As an individual whose personal information we hold, you have the following rights under PIPEDA and applicable Canadian privacy law:

• Right to access: You may request a copy of the personal information we hold about you, along with information about how it is being used and with whom it has been shared
• Right to correction: You may request that inaccurate or incomplete personal information be corrected or supplemented
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time, subject to legal or contractual restrictions. Withdrawal of consent may affect our ability to provide services
• Right to be forgotten: Subject to retention obligations required by law or contract, you may request that we delete personal information we hold about you
• Right to restrict processing: You may ask us to limit how we use your personal information in certain circumstances
• Right to complain: You have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca if you believe we have not handled your personal information appropriately

To exercise any of these rights, please contact our Privacy Officer using the information in Section 11 below. We will respond to all verified requests within 30 days.

8. Security Measures

We implement industry-standard technical and organizational security measures to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction. Our security practices include:

• TLS/SSL encryption for all data transmitted between your browser and our servers
• Access controls and role-based permissions limiting data access to authorized personnel on a need-to-know basis
• Regular security reviews and vulnerability assessments of our systems and tools
• Staff training on privacy and data protection responsibilities
• Secure disposal of physical documents and electronic media containing personal information

While we take reasonable precautions to protect personal information, no security system is impenetrable. In the event of a data breach that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada in accordance with PIPEDA's mandatory breach reporting requirements.

9. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to improve functionality, remember your preferences, and analyse how our website is used. For detailed information about the specific cookies we use, their purposes, duration, and how to manage your preferences, please refer to our Cookie Policy.

10. Links to Third-Party Websites

Our website may contain links to third-party websites, including our social media profiles, advertising platforms, and partner sites. This Privacy Policy applies only to boomymarketing.com and does not govern the privacy practices of third-party sites. We encourage you to review the privacy policies of any third-party website you visit. We are not responsible for the privacy practices or content of such sites.

11. Contact Our Privacy Officer

If you have questions, concerns, or requests regarding this Privacy Policy or our personal information handling practices, please contact our designated Privacy Officer:

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The "Last Updated" date at the top of this page indicates when the most recent changes were made. We will notify you of material changes by posting a prominent notice on our website or, where appropriate, by sending an email notification. Your continued use of our website or services following notification of changes constitutes your acceptance of the revised policy.