Privacy Policy

This Privacy Policy explains how Dune Advertising Inc. ("Dune Advertising", "we", "us") collects, uses, discloses, and protects personal information through our website, duneadvertising.org, and when you contact us. We are committed to handling personal information responsibly and in accordance with applicable privacy laws, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA) where applicable, and — for visitors in those regions — the EU and UK General Data Protection Regulation (GDPR) and applicable US state privacy laws.

1. Who we are and how to contact us

Dune Advertising Inc. is a digital marketing agency with its registered address at 6517 Noblewood Place, Sooke, British Columbia V9Z 0W3, Canada. We are responsible for the personal information described in this policy. For any privacy question or request, contact the person accountable for privacy at Dune Advertising by email at admin@duneadvertising.org or by mail at the address above.

This policy covers our website and enquiries. When we provide services to a client, any personal information we process on the client's behalf (for example, data within their advertising accounts) is handled under our agreement with that client.

2. Information we collect

Information you provide

When you submit our marketing audit request form or contact form, we collect the information you enter, which may include your name, business email address, company name, website address, country, approximate monthly advertising budget (optional), advertising channels you use, your main marketing challenge or enquiry topic, and any message or additional details you choose to share. We also collect information you send us directly by email.

Please do not include sensitive personal information, account passwords, or payment card details in forms or messages.

Consent records

When you submit a form, we record that you agreed to this Privacy Policy, together with the date and time, the form used, the version of the consent statement, your name and email address, your browser type, and a one-way hashed (non-reversible) representation of your IP address. We keep this record so we can demonstrate how and when consent was given.

Information collected automatically

• Security and spam prevention. To protect our forms from abuse, our server temporarily processes your IP address to limit repeated submissions. It is stored only in hashed form and automatically discarded within 24 hours.
• Essential cookies. We use a session cookie to protect form submissions against cross-site request forgery, and a cookie that remembers your cookie choices. See our Cookie Policy.
• Server logs. Like most websites, our hosting provider automatically records technical information such as IP address, browser type, pages requested, and the date and time of requests, for security and operational purposes.
• Optional analytics and advertising technologies. If we enable analytics or advertising measurement tools, they run only if you consent through our cookie preferences. Details of which tools are active are listed in our Cookie Policy.

3. How we use your information

• To respond to your enquiry or audit request and communicate with you about it.
• To evaluate, propose, and provide our services, and to manage our business relationship with you.
• To keep our website and forms secure and to prevent spam, fraud, and abuse.
• With your consent, to understand how our website is used and to measure the effectiveness of our own advertising.
• To keep records required for legal, accounting, and compliance purposes, and to establish or defend legal claims.

We do not use your enquiry to add you to marketing email lists without your express consent, and we do not sell your personal information.

4. Legal bases for processing (EEA and UK visitors)

Where the GDPR applies, we rely on: your consent (for responding to form submissions you choose to send and for optional cookies); steps taken at your request before entering into a contract; our legitimate interests in operating a secure website, preventing abuse, and managing business communications; and compliance with legal obligations. You may withdraw consent at any time without affecting processing that occurred before withdrawal.

5. How we share information

We share personal information only as needed for the purposes above, with:

• Service providers who host our website and deliver our email, acting on our instructions and bound to protect the information.
• Analytics and advertising providers (such as Google, Meta, LinkedIn, TikTok, or Microsoft), only if those tools are enabled and only with your consent. These providers may use the data in accordance with their own privacy policies.
• Professional advisers, such as lawyers and accountants, under duties of confidentiality.
• Authorities or other parties where required by law, or to protect our rights, property, or safety or those of others.
• A successor organization in connection with a merger, acquisition, or sale of business assets, subject to appropriate protections.

We do not sell personal information, and we do not share it for cross-context behavioural advertising without your consent.

6. International transfers

We are based in Canada. Our service providers may store or process information in Canada, the United States, or other countries, where it may be accessible to authorities under local law. Where we transfer personal information from the EEA or UK, we rely on applicable adequacy decisions (including the European Commission's decision regarding Canada for organizations subject to PIPEDA) or other lawful transfer mechanisms.

7. How long we keep information

• Enquiries and audit requests: for as long as needed to respond and manage any resulting relationship. If an enquiry does not lead to an engagement, we aim to delete it within 24 months of our last contact.
• Client records: for the duration of the engagement and as required for legal, tax, and accounting purposes afterwards.
• Consent records: for as long as needed to demonstrate consent, typically for the same period as the related enquiry.
• Rate-limiting data: automatically discarded within 24 hours.
• Cookie-choice cookie: up to 180 days.

8. How we protect information

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encrypted (HTTPS) connections, server-side validation of form data, protection against automated abuse, access restricted to people who need it, and storage of configuration secrets outside the public website. No method of transmission or storage is completely secure, but we work to protect your information and will notify you and regulators of breaches where required by law.

9. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and request a copy;
• ask us to correct inaccurate or incomplete information;
• withdraw your consent, subject to legal or contractual restrictions;
• ask us to delete your information, or to restrict or object to certain processing;
• receive your information in a portable format;
• opt out of the sale or sharing of personal information or targeted advertising (we do not sell personal information); and
• not be discriminated against for exercising your rights.

To make a request, email admin@duneadvertising.org. We may need to verify your identity before responding, and we will respond within the time required by applicable law (generally within 30 days). You can change your cookie choices at any time using the "Cookie preferences" link in the footer of every page. Where your browser sends a Global Privacy Control signal, we treat it as a request not to enable advertising cookies unless you actively choose otherwise.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, or, if you are in the EEA or UK, your local data protection authority.

10. Children's privacy

Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with information, please contact us so we can delete it.

11. Third-party websites

Our website may link to other websites. We are not responsible for their privacy practices, and we encourage you to review their policies.

12. Changes to this policy

We may update this policy to reflect changes in our practices or legal requirements. We will post the updated version on this page with a new effective date and, where changes are significant, take additional steps to inform you.