Privacy Policy

Candor ("Candor," "we," "us," or "our") is operated by Artem Furman, Vancouver, British Columbia, Canada.

1. About this policy

Candor provides B Corp and sustainability certification consulting to small businesses. Trust is the product we sell, so the way we handle your personal information matters to us as much as the work we do.

This policy explains, in plain language, what personal information we collect through candorcertified.com (the "Site") and through our consulting services, why we collect it, how we use and share it, how long we keep it, and the rights you have.

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA). Where those laws apply, they govern.

2. Who is responsible for your information

Candor is a small, owner-operated business. The person accountable for your personal information is:

Direct any privacy question or request to that email.

3. Scope

This policy applies to personal information we collect:

• Through the Site, including the free certification self-assessment tool;
• When you contact us by email or contact form;
• When you subscribe to our newsletter; and
• In the course of providing consulting services to clients.

It does not apply to third-party websites we link to, which have their own privacy policies.

4. What personal information we collect

We collect only what we need.

4.1 Information you give us

Please don't send us sensitive information (government IDs, financial account numbers, health data) unless it's genuinely necessary for an engagement and we've agreed how to handle it.

4.2 Information collected automatically

When you visit the Site:

See Section 7 for cookies and your choices.

5. Why we use your information

We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate, namely to:

• Score your assessment and, if you ask, reply to you about your results;
• Respond to your enquiries;
• Provide consulting services you've engaged us for;
• Send newsletters to subscribers who've opted in;
• Understand how the Site is used and improve it;
• Keep the Site and your information secure; and
• Meet our legal, tax, and accounting obligations.

Our basis for processing is your consent — express or implied depending on the sensitivity of the information and the circumstances — together with the limited exceptions PIPEDA and BC PIPA permit. We won't use your information for a materially new purpose without telling you and, where required, getting your consent.

The assessment tool gives you an informational readiness score. Any actual recommendation involves a human (Artem) reviewing your situation — it is not an automated decision made about you.

6. How and with whom we share your information

We share personal information only:

• With the service providers listed in Section 8, who process it on our behalf under contract;
• For legal reasons — where required by law or a lawful request, or to protect our or others' rights and safety;
• In a business transfer — if Candor is sold or merged, subject to this policy; and
• With your consent or at your direction.

We do not sell your personal information, and we do not disclose it to advertisers or data brokers.

7. Cookies, local storage, and analytics

We keep tracking to a minimum, and nothing that could identify you across sites runs until you say yes.

Your choice. The first time you visit, a small banner asks whether you accept analytics cookies. If you decline, or never answer, Google Analytics runs in a cookieless mode (Google "Consent Mode"): it receives anonymous, aggregated pings with no persistent identifier stored on your device. If you accept, Google Analytics may set the cookies listed below. You can change your mind at any time via Cookie settings in the footer of every page. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a decline and don't show the banner.

What the Site stores on your device.

The first three entries contain no personal identifier (the last one holds your email only if you typed it into a submission that failed to send) and are necessary for the Site to behave as intended, so they don't require consent. The analytics cookies do, and we don't set them until you accept.

What analytics processes either way. Even in cookieless mode, Google Analytics processes your IP address (truncated by Google before storage), approximate location, and device and browser type to produce aggregate usage statistics. We use it only to see which pages are useful. We don't use it to identify you individually, we don't run advertising or remarketing tags, and we don't share analytics data with advertisers.

Your other choices. You can:

• Decline or withdraw consent in the banner, or via Cookie settings in the footer;
• Opt out of Google Analytics across all sites using Google's browser add-on: tools.google.com/dlpage/gaoptout; and
• Block or clear cookies and site data in your browser settings (the banner will simply ask you again).

Third-party services embedded on the Site — the Calendly booking page and Google Fonts — may receive your IP address when your browser loads them. Calendly only loads when you open a booking link.

8. Service providers

We use these third parties to run our business. Each processes personal information only as needed to provide its service, and each has its own privacy policy.

9. Information stored outside Canada

Several of our service providers are located in the United States, which means your personal information may be stored and processed there and could be subject to the laws of that country, including lawful access by U.S. authorities. We remain accountable for your information under Canadian law and rely on our providers' contractual and security commitments to protect it. If you have questions about where your information is held, contact us using the details in Section 16.

10. How long we keep your information

We keep personal information only as long as necessary for the purposes above, or as required by law.

When we no longer need information, we securely delete or anonymize it.

11. How we protect your information

We use reasonable safeguards appropriate to the sensitivity of the information, including:

• Access controls and strong authentication on accounts that store personal information;
• Encryption in transit (HTTPS across the Site);
• Limiting access to those who need it; and
• Relying on reputable providers with their own security programs.

No system is perfectly secure, so we can't guarantee absolute security. If a breach occurs that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada, as PIPEDA requires.

12. Your privacy rights

Under PIPEDA and BC PIPA, you have the right to:

• Access the personal information we hold about you and learn how it's been used and disclosed;
• Correct information that is inaccurate or incomplete;
• Withdraw your consent at any time, subject to legal or contractual limits and reasonable notice;
• Request deletion of your personal information — including assessment responses and your email address — which we carry out within 30 days unless we must keep a record for a legal, tax, or contractual reason (and we'll tell you if so); and
• Make a complaint about how we handle your information.

To make a request, email candorcertified@gmail.com with the subject "Privacy Request" (or "Data Deletion Request" if you want everything removed). We'll verify your identity to protect your information, respond within 30 days (and tell you if we need more time), and won't charge you except where a request is excessive, as the law permits.

If you're not satisfied with our response, you can contact:

• The Office of the Privacy Commissioner of Canada — priv.gc.ca; or
• The Office of the Information and Privacy Commissioner for British Columbia — oipc.bc.ca.

13. Children's privacy

The Site and our services are intended for businesses and for adults who have reached the age of majority in their province (19 in British Columbia). They are not directed at children, and we don't knowingly collect personal information from anyone under 13, or from any minor without a parent or guardian's consent. If you believe a child has given us information, contact us and we'll delete it.

14. Third-party links

The Site may link to other websites (for example, B Lab or The Change Climate Project). We're not responsible for their privacy practices — please review their policies before sharing information with them.

15. Changes to this policy

We may update this policy from time to time. When we do, we'll revise the "Last updated" date above, and we'll give more prominent notice if the changes are significant.

16. Contact us

We take privacy seriously and will work with you to resolve any concern.

This policy reflects Candor's actual data practices and is provided for transparency. It is not legal advice.