Privacy Policy

Candor ("Candor," "we," "us," or "our") is operated by Artem Furman, Vancouver, British Columbia, Canada.

1. About this policy

Candor provides B Corp and Climate Neutral certification consulting to small businesses. Trust is the product we sell, so the way we handle your personal information matters to us as much as the work we do.

This policy explains, in plain language, what personal information we collect through candorcertified.com (the "Site") and through our consulting services, why we collect it, how we use and share it, how long we keep it, and the rights you have.

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA). Where those laws apply, they govern.

2. Who is responsible for your information

Candor is a small, owner-operated business. The person accountable for your personal information is:

Direct any privacy question or request to that email.

3. Scope

This policy applies to personal information we collect:

• Through the Site, including the free certification self-assessment tool;
• When you contact us by email or contact form;
• When you subscribe to our newsletter; and
• In the course of providing consulting services to clients.

It does not apply to third-party websites we link to, which have their own privacy policies.

4. What personal information we collect

We collect only what we need.

4.1 Information you give us

Please don't send us sensitive information (government IDs, financial account numbers, health data) unless it's genuinely necessary for an engagement and we've agreed how to handle it.

4.2 Information collected automatically

When you visit the Site:

See Section 7 for cookies and your choices.

5. Why we use your information

We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate, namely to:

• Score your assessment and send you your results;
• Respond to your enquiries;
• Provide consulting services you've engaged us for;
• Send newsletters to subscribers who've opted in;
• Understand how the Site is used and improve it;
• Keep the Site and your information secure; and
• Meet our legal, tax, and accounting obligations.

Our basis for processing is your consent — express or implied depending on the sensitivity of the information and the circumstances — together with the limited exceptions PIPEDA and BC PIPA permit. We won't use your information for a materially new purpose without telling you and, where required, getting your consent.

The assessment tool gives you an informational readiness score. Any actual recommendation involves a human (Artem) reviewing your situation — it is not an automated decision made about you.

6. How and with whom we share your information

We share personal information only:

• With the service providers listed in Section 8, who process it on our behalf under contract;
• For legal reasons — where required by law or a lawful request, or to protect our or others' rights and safety;
• In a business transfer — if Candor is sold or merged, subject to this policy; and
• With your consent or at your direction.

We do not sell your personal information, and we do not disclose it to advertisers or data brokers.

7. Cookies and analytics

We keep cookies to a minimum.

Cookies we set. The Site sets a single cookie:

This cookie is first-party, contains no personal identifier, and is necessary for the Site to behave as intended, so it does not require your consent.

Analytics without cookies. We use Google Analytics to understand how the Site is used, but it is configured not to store cookies or other tracking identifiers on your device. Analytics still processes some information when you visit — including your IP address, approximate location, and device and browser type — to produce aggregate usage statistics. We do not use it to identify you individually or to track you across other websites.

Your choices. You can:

• Opt out of Google Analytics across all sites using Google's browser add-on: tools.google.com/dlpage/gaoptout;
• Block or clear cookies in your browser settings (blocking loaderSeen may cause the intro animation to replay); and
• We honour a valid Global Privacy Control (GPC) signal from your browser where required by law.

8. Service providers

We use these third parties to run our business. Each processes personal information only as needed to provide its service, and each has its own privacy policy.

9. Information stored outside Canada

Several of our service providers are located in the United States, which means your personal information may be stored and processed there and could be subject to the laws of that country, including lawful access by U.S. authorities. We remain accountable for your information under Canadian law and rely on our providers' contractual and security commitments to protect it. If you have questions about where your information is held, contact us using the details in Section 16.

10. How long we keep your information

We keep personal information only as long as necessary for the purposes above, or as required by law.

When we no longer need information, we securely delete or anonymize it.

11. How we protect your information

We use reasonable safeguards appropriate to the sensitivity of the information, including:

• Access controls and strong authentication on accounts that store personal information;
• Encryption in transit (HTTPS across the Site);
• Limiting access to those who need it; and
• Relying on reputable providers with their own security programs.

No system is perfectly secure, so we can't guarantee absolute security. If a breach occurs that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada, as PIPEDA requires.

12. Your privacy rights

Under PIPEDA and BC PIPA, you have the right to:

• Access the personal information we hold about you and learn how it's been used and disclosed;
• Correct information that is inaccurate or incomplete;
• Withdraw your consent at any time, subject to legal or contractual limits and reasonable notice; and
• Make a complaint about how we handle your information.

To make a request, email candorcertified@gmail.com with the subject "Privacy Request." We'll verify your identity to protect your information, respond within 30 days (and tell you if we need more time), and won't charge you except where a request is excessive, as the law permits.

If you're not satisfied with our response, you can contact:

• The Office of the Privacy Commissioner of Canada — priv.gc.ca; or
• The Office of the Information and Privacy Commissioner for British Columbia — oipc.bc.ca.

13. Children's privacy

The Site and our services are intended for businesses and adults. We don't knowingly collect personal information from children. If you believe a child has given us information, contact us and we'll delete it.

14. Third-party links

The Site may link to other websites (for example, B Lab or Climate Neutral). We're not responsible for their privacy practices — please review their policies before sharing information with them.

15. Changes to this policy

We may update this policy from time to time. When we do, we'll revise the "Last updated" date above, and we'll give more prominent notice if the changes are significant.

16. Contact us

We take privacy seriously and will work with you to resolve any concern.

This policy reflects Candor's actual data practices and is provided for transparency. It is not legal advice.