Privacy Policy
1. Introduction
Digita11y Accessible Inc. ("Digita11y Accessible", "we", "our", or "us") is a Canadian company located in Mississauga, Ontario. We provide document accessibility services, including PDF remediation and ongoing accessibility subscriptions, to organizations across Canada, the United States, and Europe.
This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our website at digita11yaccessible.io or interact with us through our contact form, newsletter, and services. We are committed to handling your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Law 25, and other applicable Canadian, U.S., and European privacy laws.
2. Scope of this policy
This policy covers personal information collected through:
- Our public website at digita11yaccessible.io
- Our contact form
- Our newsletter subscription
- Analytics on our website
Personal information handled through our accessibility services platforms and client project deployments is governed by separate security and data protection terms agreed to as part of each engagement. A Security, Privacy, and Compliance Package is available on request.
3. Information we collect
We collect the following categories of personal information:
Contact form submissions
When you submit our contact form, we collect your first name, last name, email address, organization, phone number (if provided), inquiry type, and the message you send us. We also record your IP address, browser user agent, and the time of your submission for security, abuse prevention, and record keeping.
Newsletter subscriptions
When you subscribe to our newsletter, we collect your email address, the newsletter type you selected, and the time of your subscription. We also store a confirmation token and an unsubscribe token to manage your subscription.
Analytics
We use Fathom Analytics to understand how visitors use our website. Fathom is a privacy-friendly analytics service that does not use cookies and does not collect personally identifiable information. Fathom provides us with aggregated data about page views, referrers, and general visitor patterns.
Server logs
Our hosting infrastructure records standard web server logs, which may include IP addresses, user agents, requested URLs, and timestamps. These logs are retained for operational and security purposes.
4. How we use your information
We use personal information for the following purposes:
- To respond to your inquiries submitted through the contact form
- To send you the newsletter you subscribed to and confirmation messages for that subscription
- To operate, secure, and improve our website
- To prevent fraud, abuse, and spam submissions
- To comply with legal obligations
- To communicate with you about our services when you have requested information
We do not sell your personal information. We do not use your personal information for automated decision making that has legal or similarly significant effects on you. We do not use your contact form submissions or newsletter subscriber information to train artificial intelligence models.
5. Legal basis for processing
Under Canadian law (PIPEDA and provincial equivalents), we process your personal information on the basis of your consent, which may be express (for example, by checking the privacy consent box when submitting the contact form) or implied (for example, by voluntarily subscribing to our newsletter after reading this policy).
Under the European General Data Protection Regulation (GDPR), if it applies to you, we process your personal information on the following legal bases:
- Your consent, for newsletter subscriptions and contact form submissions
- Our legitimate interests in operating our business and communicating with prospective clients, where this does not override your rights
- Compliance with legal obligations
6. How we share your information
We share personal information only with service providers who help us operate our website and deliver our services. These providers are contractually required to protect your information and use it only for the purposes we authorize. Our current service providers are:
Google Cloud Platform (Google LLC)
Hosts our website infrastructure. The marketing website is hosted in Google Cloud's United States region. Google Cloud is contractually bound by Standard Contractual Clauses for international data transfers.
Postmark (ActiveCampaign LLC)
Delivers transactional and newsletter emails on our behalf. Postmark receives your email address, name, and message content so that messages can be sent.
Fathom Analytics (Conva Ventures Inc.)
Provides privacy-friendly, cookieless analytics. Fathom is a Canadian company headquartered in British Columbia.
We may also disclose personal information if required by law, to respond to a valid legal process, to protect our rights or property, or to protect the safety of any person.
7. International data transfers
Our marketing website is hosted in the United States by Google Cloud Platform. This means that personal information you submit through our website, including contact form submissions and newsletter signups, is stored and processed in the United States.
For clients with data residency requirements, application deployments for accessibility services can be configured in the Google Cloud region of their choice, including Canadian regions (Montréal or Toronto). Data residency for client engagements is negotiated as part of each project.
We rely on Google Cloud's Standard Contractual Clauses to provide a lawful basis for cross-border transfers of personal information from Canada, the European Economic Area, and the United Kingdom. If you have questions about our international transfers, please contact our Privacy Officer using the contact details below.
8. Your rights
You have the following rights regarding the personal information we hold about you.
All users can:
- Request access to the personal information we hold about you
- Request correction of inaccurate or incomplete information
- Withdraw consent for activities we have relied on consent for, such as newsletter subscriptions. You can unsubscribe from our newsletter at any time using the link in any newsletter email.
- Ask us questions about our privacy practices
If you are in the European Economic Area or the United Kingdom (GDPR rights), you also have:
- The right to erasure of your personal information, subject to our legal obligations
- The right to data portability
- The right to restrict or object to our processing
- The right to lodge a complaint with a supervisory authority in your country
If you are a California resident (CCPA/CPRA rights), you also have:
- The right to know what personal information we collect and how we use it
- The right to delete personal information, subject to exceptions
- The right to correct inaccurate information
- The right to opt out of the sale or sharing of personal information (note: we do not sell or share personal information as those terms are defined under California law)
- The right to non-discrimination for exercising your rights
If you are in Quebec, under Law 25, you also have:
- The right to request a Privacy Impact Assessment for transfers of personal information outside Quebec
- Enhanced rights regarding automated decisions
To exercise any of these rights, contact our Privacy Officer. We will respond within 30 days as required by PIPEDA, or sooner where other laws require.
9. How long we keep your information
We keep personal information only for as long as necessary to fulfill the purposes described in this policy or as required by law.
Contact form submissions
Retained for 24 months from the date of submission, then securely deleted.
Newsletter subscribers
Retained while your subscription is active. Unsubscribed and inactive subscribers are retained for 24 months from the date of last activity, then securely deleted.
Server logs and operational data
Retained for up to 12 months for security and operational purposes.
Legal and financial records
Retained for longer periods as required by Canadian tax and business law, typically 6 to 7 years.
You may request that we delete your personal information sooner by contacting our Privacy Officer. We will comply to the extent permitted by law.
10. Security
We take reasonable steps to protect your personal information from unauthorized access, disclosure, alteration, and destruction. Our safeguards include:
- Encryption of data in transit using TLS
- Encryption of data at rest in our databases
- Role-based access controls for staff
- Parameterized database queries to prevent injection attacks
- Rate limiting and abuse prevention on public forms
- Regular security reviews and software updates
- Use of established, security-audited infrastructure providers (Google Cloud Platform, Postmark, Fathom)
No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a privacy breach that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA.
11. Cookies and tracking
Our website uses minimal tracking:
Fathom Analytics
Does not use cookies and does not track individuals.
Essential session handling
We may use temporary cookies or browser storage to enable core website features such as language preferences. These do not track you across websites.
We do not use advertising cookies, third party behavioral tracking, or cross-site trackers.
12. Children's privacy
Our website and services are not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact our Privacy Officer and we will delete the information promptly.
13. Newsletter and anti-spam compliance
Our newsletter subscriptions use a double opt-in process to comply with Canada's Anti-Spam Legislation (CASL). When you subscribe, we send a confirmation email that you must click to activate your subscription. You can unsubscribe at any time using the unsubscribe link in any newsletter email. We keep records of subscription and unsubscribe actions to demonstrate compliance.
14. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this policy and, where appropriate, notify you by email or by a prominent notice on our website. We encourage you to review this policy periodically.
15. Contact us
If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our Privacy Officer:
If you are not satisfied with our response, you have the right to contact the Office of the Privacy Commissioner of Canada:
Privacy Officer, Digita11y Accessible Inc.Email: info@digita11yaccessible.io
Location: Mississauga, Ontario, CanadaOffice of the Privacy Commissioner of Canada
Address: 30 Victoria Street, Gatineau, Quebec K1A 1H3
Phone: Toll-free: 1-800-282-1376
Website: priv.gc.ca
If you are in the European Economic Area, the United Kingdom, California, or another jurisdiction with its own data protection authority, you may also contact that authority directly.