Privacy Policy

Last updated: August 1, 2026

This Privacy Policy is intended to describe the privacy practices of Smokybrands Marketing Agency Inc. in accordance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”), and any applicable provincial privacy legislation.

This Website is intended primarily for businesses and individuals located in Canada and North America. We do not intentionally target or offer services to individuals located in the European Union through this Website.

Smokybrands Marketing Agency Inc. (“Smokybrands Marketing Agency Inc.”, “Company”, “we”, “us” or “our”) respects the privacy of individuals whose Personal Information we collect, use, disclose, or otherwise process.

This Privacy Policy (“Policy”) explains how we collect, use, disclose, retain, protect, and otherwise handle Personal Information in connection with the smokybrands-marketing.ca website (“Website”) and the related products and services we provide (collectively, the “Services”).

This Privacy Policy forms an integral part of our Terms and Conditions. Capitalized terms not otherwise defined in this Policy have the meanings given in the Terms and Conditions where applicable.

For purposes of this Policy, “Personal Information” means information about an identifiable individual, subject to any exclusions or qualifications under applicable law. Personal Information does not generally include information that has been irreversibly anonymized or information used solely to communicate with an individual in relation to that individual’s employment, business, or profession where applicable law excludes such information.

This Policy does not apply to the independent privacy practices of third parties that we do not own or control. Third-party websites, platforms, applications, and service providers may maintain their own privacy policies and practices.

Accountability

Smokybrands Marketing Agency Inc. is responsible for Personal Information under its control. We have designated a Privacy Officer who is responsible for overseeing our privacy practices, responding to privacy-related inquiries and requests, and supporting compliance with applicable privacy requirements.

Our responsibility extends to Personal Information transferred to service providers for processing on our behalf. We use contractual, administrative, technical, and organizational measures that we consider appropriate to require service providers to protect Personal Information and use it only for authorized purposes.

Information we may collect

The categories of Personal Information we collect depend on how you interact with the Website and Services. We may collect the following categories of information where relevant:

• Identification information, such as your name, position, job title, or professional role.
• Business contact information, such as a business email address, business telephone number, company name, business address, or website address.
• Communication information, including messages, inquiries, support requests, project instructions, feedback, and correspondence.
• Service and transaction information, including requested Services, proposals, agreements, invoices, correspondence, and project records.
• Technical and usage information, including IP address, browser information, device information, operating system, referral information, page activity, and interaction data.
• Marketing and communication preferences, including subscription, consent, and unsubscribe records.
• Other information that you voluntarily provide to us or authorize another person to provide on your behalf.

We do not require you to provide more Personal Information than is reasonably necessary for the identified purpose. Where information is optional, you may choose not to provide it, although doing so may limit our ability to respond to a request or provide a particular Service.

Automatic collection of information

When you access the Website, our servers and authorized technology providers may automatically receive technical information transmitted by your browser or device.

This information may include your IP address, browser type and version, operating system, language preferences, device type, referring page, pages visited, access dates and times, approximate session duration, navigation activity, error information, and similar technical or usage data.

Automatically collected information may be used to operate and secure the Website, detect misuse or technical problems, understand Website traffic, evaluate performance, and improve the Website and Services.

Technical information may constitute Personal Information where it can reasonably be associated with an identifiable individual. We handle such information in accordance with this Policy and applicable law.

Purposes for collecting and using Personal Information

We may collect and use Personal Information for purposes that a reasonable person would consider appropriate in the circumstances, including:

• Operating, maintaining, securing, and improving the Website and Services.
• Responding to inquiries, requests, complaints, and support communications.
• Preparing proposals, quotations, statements of work, agreements, and related business documentation.
• Providing and administering requested Services.
• Managing client, supplier, contractor, and business relationships.
• Preparing and administering invoices and related business records. Payment card or banking information is not collected or processed through the Website.
• Measuring Website usage, service performance, and marketing effectiveness.
• Maintaining records of consent, communication preferences, and unsubscribe requests.
• Preventing fraud, misuse, security incidents, and unlawful activity.
• Complying with legal, regulatory, accounting, tax, insurance, and contractual requirements.
• Establishing, exercising, or defending legal rights and claims.
• Completing a proposed or completed business transaction where permitted by law.
• Using information for another purpose that is disclosed to you and permitted by applicable law.

If we intend to use Personal Information for a materially different purpose that was not previously identified, we will identify the new purpose and obtain any consent required by applicable law before proceeding.

Consent and other lawful authority

Where consent is required, we will seek consent that is appropriate to the nature, sensitivity, and reasonably foreseeable consequences of the collection, use, or disclosure.

Consent may be express or implied depending on the circumstances and the requirements of applicable law. Express consent may be obtained through a written agreement, electronic form, checkbox, email confirmation, verbal confirmation, or another clear affirmative action. Implied consent may be relied upon only where permitted and reasonable in the circumstances.

You may withdraw consent to future collection, use, or disclosure, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent does not affect processing that lawfully occurred before withdrawal.

We may collect, use, or disclose Personal Information without consent where permitted or required by applicable law, including in circumstances involving legal proceedings, fraud prevention, debt collection, emergencies, investigations, or compliance with lawful governmental demands.

Disclosure of Personal Information

We do not sell Personal Information.

We may disclose Personal Information where reasonably necessary for the purposes described in this Policy, including to:

• Service providers and subcontractors assisting with website hosting, information technology, email communications, website forms, analytics, administration, professional services, accounting, document storage, or delivery of the Services.
• Professional advisers, including legal counsel, accountants, auditors, insurers, and consultants.
• Governmental, regulatory, judicial, law-enforcement, or other authorities where disclosure is required or permitted by law.
• A person or organization involved in a proposed or completed business transaction, subject to applicable legal requirements.
• Another person where you have instructed or authorized us to make the disclosure.

We limit disclosures to information reasonably necessary for the applicable purpose. We do not authorize service providers to use Personal Information for their own independent marketing unless you have separately consented to that use or the use is otherwise permitted by law.

Service providers and subcontractors

We may engage service providers and subcontractors to perform functions on our behalf. Their access to Personal Information is limited to what is reasonably necessary to perform the assigned function.

Service providers may include Web Hosting Canada for website hosting and related infrastructure, Google Analytics for website measurement and performance analysis, and providers of email, website-form, security, accounting, document-storage, professional-advisory, and other operational services.

The Website does not provide user accounts or a customer portal and does not process payment card or banking information through the Website.

Service providers receive only the Personal Information reasonably necessary to perform the services for which they have been engaged.

Service providers are required through contractual or comparable measures to maintain appropriate confidentiality and security protections and to process Personal Information only for authorized purposes, subject to applicable law.

Processing outside Canada

Personal Information may be accessed, stored, or processed in Canada and Germany by Smokybrands Marketing Agency Inc. and its authorized service providers or subcontractors.

When Personal Information is processed outside Canada, it may be subject to the laws of the foreign jurisdiction and may be accessible to courts, law-enforcement authorities, national-security authorities, or regulatory bodies in that jurisdiction in accordance with applicable law.

Smokybrands Marketing Agency Inc. remains responsible under applicable Canadian privacy law for Personal Information transferred to a service provider for processing on our behalf. We use contractual and organizational measures intended to provide a level of protection appropriate to the nature of the information and the processing activity.

You may contact our Privacy Officer to request additional general information about the jurisdictions in which Personal Information may be processed and the categories of service providers that may process it.

Retention of Personal Information

We retain Personal Information only for as long as reasonably necessary to fulfil the purposes for which it was collected and to satisfy applicable legal, accounting, tax, insurance, contractual, security, and dispute-resolution requirements.

Unless a longer or shorter period is required or permitted by law or is reasonably necessary for a documented business purpose, we generally apply the following retention periods:

• General website inquiries and related correspondence: up to twenty-four (24) months after the last substantive communication.
• Prospective-client proposals and quotation records that do not result in an engagement: up to twenty-four (24) months after the last substantive communication.
• Client agreements, statements of work, project records, invoices, accounting records, and tax-supporting documents: generally six (6) years from the end of the last tax year to which the records relate, or longer where required by law, an active dispute, an audit, or another documented legal obligation.
• Website server, security, and technical logs: generally up to ninety (90) days, unless a longer period is reasonably required to investigate a security incident, prevent abuse, preserve evidence, or comply with law.
• Google Analytics event and user-level data: generally up to fourteen (14) months, subject to the retention settings configured in Google Analytics and any shorter period required by an applicable consent choice or deletion request.
• Consent, privacy-request, and complaint records: for as long as reasonably necessary to demonstrate compliance and administer the request or complaint, generally up to six (6) years after closure.

When Personal Information is no longer required, we will delete, destroy, anonymize, or otherwise dispose of it using measures appropriate to the sensitivity and format of the information, subject to lawful retention requirements.

We may retain aggregated or anonymized information that no longer identifies an individual.

Accuracy of Personal Information

We take reasonable steps to keep Personal Information as accurate, complete, and up to date as is necessary for the purposes for which it is used.

You are encouraged to notify us if Personal Information you previously provided has changed or is inaccurate. We may request supporting information where reasonably necessary to evaluate a correction request.

Your Canadian privacy rights

Subject to applicable law and any permitted exceptions, you may have the right to:

• Request information about the existence, use, and disclosure of Personal Information under our control.
• Request access to Personal Information under our control that relates to you.
• Request correction of Personal Information that is inaccurate or incomplete.
• Withdraw consent to future processing where the processing is based on consent.
• Ask questions about our privacy practices and the handling of your Personal Information.
• Submit a complaint regarding our compliance with applicable privacy requirements.

These rights are not absolute. Applicable law may permit or require us to refuse access to certain information, including information protected by legal privilege, information that would reveal confidential commercial information, information concerning another individual, or information that cannot be disclosed for legal, security, or investigative reasons.

If we cannot grant a request in whole or in part, we will explain the reason for the refusal to the extent permitted or required by law and advise you of any available complaint process.

How to exercise your rights

Requests to access, correct, or otherwise exercise applicable privacy rights must be submitted directly to our Privacy Officer using the contact information provided at the end of this Policy.

Your request should:

• Identify you and provide current contact information.
• Describe the information or processing activity to which the request relates.
• Describe the action you are requesting.
• Provide any additional information reasonably necessary to locate the relevant records.

We may request information reasonably necessary to verify your identity or authority before processing a request. Verification information will be used only for identity verification and request administration unless otherwise permitted by law.

An authorized representative may submit a request on your behalf. We may require written evidence that the representative has authority to act for you and may take reasonable steps to verify both the representative’s identity and your authorization.

We will respond within the period required by applicable law. If additional time is legally permitted and reasonably necessary, we will provide notice of the extension and the reason for it.

Privacy requests must be submitted directly to our Privacy Officer using the contact information provided at the end of this Policy. We do not currently use an external data-subject request platform for this Canadian Website.

Cookies and similar technologies

The Website may use cookies and similar technologies to support Website functionality, maintain security, store preferences, understand usage, measure performance, and administer Services.

Cookies may be set by us or by authorized third-party providers. Depending on their purpose, cookies may be temporary session cookies or persistent cookies that remain on a device for a defined period.

Where required by applicable law, non-essential cookies or similar technologies will be used only after an appropriate consent choice has been provided.

You may manage cookies through any cookie preference tool made available on the Website and through your browser settings. Blocking or deleting cookies may affect Website functionality.

Additional information is available in our Cookie Policy.

Analytics and performance measurement

We use Google Analytics to understand how visitors access and use the Website, identify technical problems, measure traffic and engagement, and improve Website content and functionality.

Google Analytics may process information such as device and browser characteristics, referring sources, page activity, session information, interaction events, and approximate geographic information derived from technical data. IP address information may be processed transiently for technical and approximate-location purposes. The Website is configured to reduce the identifiability of IP address information where the applicable technology permits.

According to Google’s documentation for Google Analytics 4, IP addresses are not logged or stored by Google Analytics. Other analytics identifiers and event data may nevertheless constitute Personal Information depending on their configuration and the surrounding circumstances and are therefore handled in accordance with this Policy.

Google Analytics is used solely for measurement and performance analysis. We do not use Google Analytics for advertising personalization, audience creation, remarketing, or behavioural advertising through this Website.

Google Analytics is used for measurement and performance analysis. We do not use marketing or retargeting pixels on the Website and do not use Google Analytics audiences for advertising or remarketing through this Website.

Social media and embedded services

The Website may contain links to social media platforms or may include content, media, buttons, or functions provided by third parties.

When you interact with a third-party feature, the third party may receive technical and usage information and may place or access cookies or similar technologies. The third party’s collection and processing of information is governed by its own terms and privacy policy.

We do not control the independent privacy practices of third-party platforms.

Electronic communications

We do not currently offer a newsletter through the Website.

We may send communications that are reasonably necessary to respond to an inquiry, prepare or perform an engagement, administer a business relationship, provide service information, address a legal or security matter, or comply with applicable law.

If we send a commercial electronic message, we will do so only where we have the consent or other lawful authority required by Canada’s Anti-Spam Legislation (“CASL”) and will include identification, contact, and unsubscribe information where required.

You may withdraw consent to future commercial electronic messages by using any unsubscribe mechanism provided or by contacting us. Withdrawal from promotional communications does not prevent us from sending non-promotional communications that are reasonably necessary for an inquiry, existing transaction, service relationship, legal obligation, or security matter.

Privacy of children and minors

The Website and Services are intended for business and professional audiences and are not directed to children.

We do not knowingly collect Personal Information directly from children through the Website without the consent or other authority required by applicable law.

If you believe that a child has provided Personal Information to us without appropriate authorization, please contact our Privacy Officer. We will review the matter and take action required by applicable law.

Links to third-party resources

The Website may contain links to websites, applications, services, or resources that are not owned or controlled by Smokybrands Marketing Agency Inc.

We are not responsible for the privacy, security, content, or operating practices of third parties. A link does not constitute an endorsement of a third party’s privacy practices.

You should review the privacy policy of each third-party service before providing Personal Information or using the service.

Information security

We maintain administrative, technical, physical, and organizational safeguards that are intended to protect Personal Information against loss, theft, unauthorized access, disclosure, copying, use, modification, destruction, and other unauthorized processing.

The nature of the safeguards used depends on factors including the sensitivity, amount, format, location, and intended use of the information and the reasonably foreseeable risks associated with its processing.

Safeguards may include access restrictions, authentication controls, confidentiality obligations, technical security measures, service-provider controls, backups, monitoring, and internal procedures.

Access to Personal Information is limited to persons who require such access for legitimate business purposes and who are subject to appropriate confidentiality obligations.

No method of transmission, storage, or electronic processing is completely secure. We therefore cannot guarantee absolute security. This statement does not limit any obligation that cannot lawfully be excluded or reduced.

Privacy and security breaches

We maintain procedures intended to identify, assess, contain, investigate, document, and respond to suspected or confirmed breaches of security safeguards involving Personal Information under our control.

Where a breach creates a real risk of significant harm to an individual, we will report the breach to the Office of the Privacy Commissioner of Canada and notify affected individuals as required by PIPEDA.

Where required, we may also notify another organization or governmental institution if that notification could reduce or mitigate the risk of harm.

We will maintain records of breaches of security safeguards as required by applicable law.

Business transactions

Personal Information may be used or disclosed in connection with a proposed or completed business transaction, including a merger, amalgamation, financing, acquisition, reorganization, sale of assets, or transfer of all or part of a business.

Any collection, use, or disclosure in connection with a business transaction will be subject to applicable legal requirements, including requirements concerning confidentiality, limited use, and protection of the information.

Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, the Website, the Services, legal requirements, or the service providers we use.

The revised Policy will be posted on this page with an updated revision date. Where required by applicable law, we will provide additional notice or obtain renewed consent before using Personal Information for a materially different purpose.

Changes to this Policy do not retroactively authorize a collection, use, or disclosure that was unlawful when it occurred.

Questions and complaints

You may contact our Privacy Officer if you have a question, concern, or complaint about our handling of Personal Information.

We will review privacy complaints fairly and make reasonable efforts to investigate and respond. We may contact you for additional information where necessary to understand and resolve the complaint.

If you are not satisfied with our response, you may have the right to submit a complaint to the Office of the Privacy Commissioner of Canada or another privacy regulator with jurisdiction over the matter.

Submitting a complaint does not affect any other legal rights or remedies available under applicable law.

Contacting us

To exercise a privacy right, request access or correction, withdraw consent, or submit a privacy-related question or complaint, contact:

Privacy Officer
Smokybrands Marketing Agency Inc.
92 Caplan Ave., Suite 634
Barrie, Ontario L4N 9J2
Canada

Email: info@smokybrands-marketing.ca
Phone: +1 (416) 302-4098