Privacy policy
How personal information sent through tomgoldman.ca is collected, used, stored and protected, and how to access, correct or delete it.
Effective November 2026.
1. Who is responsible for your information
This policy applies to the website tomgoldman.ca and its subpages (the Site). The Site is operated by Tom Goldman, a sole proprietor registered in Poland (the Controller, also referred to as I or me). Full business registration details are listed on the Contact page.
Because the business is established in the European Union, personal information is processed in accordance with the EU General Data Protection Regulation (GDPR). For visitors and clients in Canada, I also follow the principles of the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25.
I am personally responsible for the protection of personal information in this business, including in the role of person in charge of the protection of personal information under Quebec law. No separate data protection officer has been appointed. Privacy questions and requests can be sent through the contact details on the Contact page.
2. What information I collect
I collect only information you provide or that is generated when you use the Site:
- Forms and briefs: your name, email address, phone or WhatsApp number, business name, website address, the service you are interested in, your message and a preferred time for a call.
- Consultation bookings: the details above plus the date and time you choose.
- Correspondence: messages you send by email, WhatsApp, Telegram or other messengers, and notes from calls.
- Technical data: IP address, browser and device information and pages visited, collected by the hosting infrastructure for security and, only with your consent, by analytics and advertising tools described in the cookie policy.
I do not ask for and do not wish to receive sensitive information, such as health or financial account details, through the Site.
3. Why I use it and on what basis
| Purpose | Legal basis under GDPR |
|---|---|
| Replying to your enquiry, preparing a proposal, holding a consultation | Steps taken at your request before entering into a contract (art. 6(1)(b)) or legitimate interest (art. 6(1)(f)) |
| Performing a contract for marketing services | Performance of a contract (art. 6(1)(b)) |
| Issuing invoices and keeping accounting records | Legal obligation (art. 6(1)(c)) |
| Site statistics and advertising measurement with cookies | Consent (art. 6(1)(a)) |
| Establishing, exercising or defending legal claims | Legitimate interest (art. 6(1)(f)) |
Under Canadian law, I rely on your consent, which is implied when you send an enquiry for the purpose of receiving a reply and express where required, for example for analytics cookies or marketing messages. Providing information is voluntary, but without it I cannot reply to you or provide services. You may withdraw consent at any time; withdrawal does not affect processing carried out before it.
I do not send marketing emails or text messages without the consent required by Canada's Anti-Spam Legislation (CASL).
4. Where your information is stored and who receives it
Enquiries submitted through the Site are stored in my customer relationship management (CRM) system. The Site is hosted and delivered through Cloudflare, which processes technical data such as IP addresses to deliver and protect the Site. Information may also be shared, only as needed, with:
- providers of email, messaging and video-call services used to communicate with you;
- my accountant and invoicing software provider;
- Google and Meta, for analytics and advertising measurement, only if you consent to the relevant cookies;
- trusted partners who deliver part of a client project (for example chatbots), limited to what is needed to perform the contract;
- public authorities, where required by law.
Service providers act on my instructions under data processing terms, or as independent controllers under their own policies.
5. Transfers outside the EU and outside Canada
Some providers, including Cloudflare, Google and Meta, may process information outside the European Economic Area and outside Canada, including in the United States. Where information leaves the EEA, transfers rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework) or on standard contractual clauses. Canada has an adequacy decision from the European Commission for commercial organizations subject to PIPEDA. For individuals in Quebec, I assess the protection offered before information is communicated outside the province, as Law 25 requires. Information processed in another country may be accessible to authorities of that country under its laws.
6. How long I keep it
- Enquiries that do not lead to a contract: up to 12 months from the last contact.
- Contract-related information: for the duration of the contract and then until claims are time-barred.
- Accounting records: for the period required by Polish tax law, generally 5 years from the end of the relevant tax year.
- Information processed on the basis of consent: until consent is withdrawn.
- Cookie data: for the periods stated in the cookie policy.
7. Your rights
You have the right to access your information and receive a copy, to correct it, to have it deleted, to restrict or object to its processing, to data portability and to withdraw consent. Under Quebec law you may also ask to be informed when a decision about you is based exclusively on automated processing; I do not make such decisions. To exercise any right, contact me using the details on the Contact page. I reply without undue delay and in any case within 30 days.
If you believe your information has been mishandled, you may lodge a complaint with the President of the Personal Data Protection Office in Poland. Individuals in Canada may also contact the Office of the Privacy Commissioner of Canada, and residents of Quebec the Commission d'accès à l'information du Québec. I would appreciate the chance to resolve the issue first.
8. Security and incidents
The Site uses an encrypted connection (HTTPS). Access to the CRM and other tools is protected by individual accounts and limited to people who need it. If a confidentiality incident creates a risk of serious injury or a high risk to your rights, I will notify you and the competent authorities as required by applicable law and keep a record of the incident.
9. Profiling and automated decisions
I do not make decisions with legal or similarly significant effects based solely on automated processing. Advertising tools from Google and Meta may personalize ads based on your interests only if you consent to marketing cookies.
10. Links to other sites
The Site links to client websites, social media profiles and other services. Their own privacy policies apply once you leave the Site.
11. Changes
I may update this policy when the law, the tools used or the way the Site works changes. The current version is always published on this page with its effective date.