Privacy Policy

1. Introduction & Controller Identity

This Privacy Policy describes how TATY Services Canada collects, uses, and safeguards personal data in connection with our administrative skills training, office operations education, and related professional development offerings for Canadian workplaces. It applies to information collected through our website, forms, and direct communications.

For the purposes of applicable privacy laws, the data controller is:

• Legal entity: TATY Services Canada Inc.
• Business name: TATY Services Canada
• Address: 200 Bay Street, Suite 1300, Toronto, ON M5J 2J2, Canada
• Email: [email protected]
• Phone: +1 416 645 9827

Effective Date: March 12, 2026.

2. Personal Data We Collect

We collect only the information needed to operate the site, respond to requests, and improve how our educational content is delivered. Depending on how you interact with the website, we may collect:

• Identity & contact data: name, email address, phone number, and organization name (if provided).
• Form content: your message, program selection, timing preferences, and any context you share about your learning goals or operational workflows.
• Technical data: IP address, browser type/version, device type, operating system, language settings, and approximate location derived from IP (city/province level).
• Usage data: pages visited, time on page, referral source, and interaction patterns such as link clicks.
• Cookies & identifiers: cookie identifiers and consent preferences described in Section 4 and our Cookie Policy.
• Conversion events: signals indicating that a form was submitted or a key page was reached, used for measuring the effectiveness of content and advertising once consent is given.

We do not intentionally collect special-category data (for example health information, religious beliefs, political opinions), financial account details, or government-issued identification numbers through this website. Please do not include sensitive personal data in free-text fields.

3. Why We Process Personal Data & Legal Basis

We process personal data for defined purposes and, where applicable, rely on recognized legal bases such as consent, contract necessity, legitimate interests, and legal obligations. If you are located in a jurisdiction that uses GDPR-style legal bases, we generally rely on:

• Responding to contact requests: to answer inquiries, recommend appropriate programs, and coordinate scheduling and delivery (Art. 6(1)(b) contract necessity and/or Art. 6(1)(a) consent).
• Site analytics (optional): to understand usage and improve content structure and navigation (Art. 6(1)(a) consent).
• Marketing measurement and remarketing (optional): to measure conversions and show relevant ads (Art. 6(1)(a) consent).
• Security and fraud prevention: to protect the site, limit abuse of forms, and detect malicious traffic (Art. 6(1)(f) legitimate interests).
• Legal obligations: to comply with applicable laws and respond to lawful requests (Art. 6(1)(c)).

Automated Decision-Making (GDPR Art. 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Any program recommendations are based on the information you provide and are reviewed by staff.

4. Cookies & Tracking

We use cookies and similar technologies to keep the website working, remember your preferences, and (if you opt in) measure traffic and advertising performance. Cookies are small text files stored on your device. Some are set by us (first-party) and some may be set by third parties we use for analytics or advertising.

Cookie categories

• Essential cookies (always active): required for core site functions such as session continuity and saving consent preferences. Examples include _site_session and cookie_consent. Retention ranges from session to 12 months.
• Analytics cookies (optional): used to understand which pages are helpful and how visitors navigate the site. When enabled, we may use Google Analytics 4 with IP anonymization. Example cookies include _ga and _ga_XXXXXXXXXX. Typical retention: up to 2 years for identifiers; reporting retention: 14 months.
• Marketing cookies (optional): used for conversion measurement, remarketing, and audience creation (such as lookalike audiences) once consent is provided. Example cookies include _gcl_au, _fbp, and _fbc. Typical retention: 90 days.

Beyond cookies, advertising and analytics can use pixel tags and similar mechanisms. If enabled after consent, these technologies may collect device identifiers derived from browser and network signals (for example IP address and user agent) and may support server-side measurement configured by us or our partners. Where applicable, identifiers used for server-side measurement may be hashed before being transmitted.

You can review and change your cookie preferences at any time using the “Manage cookie preferences” link in the footer. You can also manage cookies through browser settings. For details, see our Cookie Policy.

5. Consent (EEA/UK visitors)

Users in the EEA and UK receive a consent notice under GDPR/UK GDPR. Analytics and marketing cookies activate only after explicit, informed, freely given consent (Art. 6(1)(a)). Consent is recorded in the cookie_consent browser cookie (12 months). You may withdraw consent via the “Manage cookie preferences” link in the footer or by clearing cookies. Withdrawal does not affect the lawfulness of processing before withdrawal.

6. Sharing With Advertising & Service Partners

We use a small number of service providers to operate and protect the website and, if you consent, to measure performance and advertising. Depending on your consent choices, information may be shared with:

• Google LLC: Google Analytics 4, Google Ads measurement, and tag management. Data may include cookie identifiers, page views, and conversion events. Privacy information: https://policies.google.com/privacy
• Meta Platforms, Inc.: measurement and advertising audiences (for example, remarketing and conversion attribution). Data may include page views, conversion events, and cookie identifiers (when enabled). Privacy information: https://www.facebook.com/privacy/policy
• Cloudflare, Inc.: content delivery and security services that help protect against malicious traffic and abuse. Privacy information: https://www.cloudflare.com/privacypolicy/

We do not sell personal data. Where we use service providers, we aim to limit data shared to what is necessary for the stated purpose. These providers may not use site data for their own independent commercial purposes.

7. International Transfers

TATY Services Canada is based in Canada. Some service providers (for example Google and Meta) may process data in the United States or other countries. Where international transfers occur and safeguards are required, we rely on appropriate mechanisms such as:

• EU–US Data Privacy Framework (primary, since July 2023), including the UK Extension and Swiss–US framework where relevant.
• Standard Contractual Clauses (EU 2021/914) as a fallback mechanism.
• UK International Data Transfer Agreement (UK IDTA) as applicable for UK transfers.

Transfer mechanisms and safeguards can evolve. If you need more information about safeguards for a specific transfer, contact us using the details in Section 18.

8. Retention

We keep personal data only as long as needed for the purpose for which it was collected, and then we delete or anonymize it unless we must keep it to comply with legal obligations. Typical retention periods are:

• Contact submissions: up to 2 years from the last interaction, unless a longer period is needed to manage a training relationship.
• Email correspondence: for the duration of the relationship plus 1 year, to support continuity and follow-up.
• Server and security logs: typically 90 days.
• Analytics data: 14 months (reporting retention), with cookie lifetimes as described in Section 4 if you consent.
• Cookie consent records: up to 3 years for audit and compliance purposes.
• Legal and tax records: retained as required by applicable law (often 6–10 years for certain business records).

9. Your Rights

Privacy rights vary by jurisdiction. Depending on where you live and which laws apply, you may have rights such as access, correction, deletion, portability, and the right to withdraw consent. If GDPR/UK GDPR applies, rights include:

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction (Art. 18)
• Data portability (Art. 20)
• Objection (Art. 21)
• Withdraw consent (Art. 7(3))
• Lodge a complaint (Art. 77)

To exercise a request, email [email protected]. We typically respond within 30 days. For complex requests, we may extend the period by up to 60 additional days where permitted.

If you are in Canada, you may also have rights under applicable Canadian privacy laws. For example, you can request access to personal information we hold about you and request corrections where appropriate. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca/en/.

If you are in the EU/UK and want general supervisory authority guidance, you can consult: https://edpb.europa.eu/ (EU) and https://ico.org.uk/ (UK).

10. Children

This website is not directed at individuals under 16. We do not knowingly collect personal information from minors. If we learn that we have collected personal information from a child under 16 without verifiable parental consent, we will delete it promptly.

11. Do Not Track

This website does not respond to “Do Not Track” (DNT) browser signals. Third-party providers may have their own DNT or opt-out mechanisms.

12. Data Deletion Requests

If you would like us to delete personal information we hold about you, email [email protected] with the subject line “Data Deletion Request”. To protect privacy, we may ask for information to verify your identity before completing the request. Where deletion is not possible due to legal obligations, we will explain what we must retain and why.

13. Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction. If such a transfer materially changes how personal information is used, we will provide notice on the website.

14. California (CCPA / CPRA)

If you are a California resident, you may have rights to know, delete, correct, and opt out of the “sale” or “sharing” of personal information under the CCPA/CPRA. In the past 12 months, we may have disclosed the following categories:

• Identifiers: name, email, IP address, cookie identifiers (shared with service providers and ad partners if you consent).
• Internet/network activity: browsing and interaction data (shared with analytics and advertising providers if you consent).
• Inferences: interests or preferences inferred from site activity (used for advertising audiences where enabled).

We do not sell personal information as defined by the CCPA. We may share information for cross-context behavioral advertising when marketing cookies are enabled; California residents may opt out using our cookie preferences panel. To submit a request, email us with the subject “California Privacy Request”. We will verify your request before responding. Authorized agents must provide proof of authorization.

15. Virginia (VCDPA)

If you are a Virginia resident, you may have rights to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising. To submit a request, email us with the subject “Virginia Privacy Request”. We do not sell personal data or engage in profiling that produces legal or similarly significant effects.

If we decline to act on a request, you may appeal by emailing with the subject “Appeal of Refusal — Privacy Request”. We respond to appeals within 60 days. If unresolved, you may contact the Virginia Attorney General.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing us with the subject “Nevada Do Not Sell Request”. We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in practices, technologies, or legal requirements. Material changes will be announced via a site notice at least 14 days before the change takes effect. The “Last Updated” date at the top of this page reflects the most recent revision.

18. Contact

If you have questions about privacy, cookies, or how we handle personal information, contact: