Legal

Privacy Policy

Last updated: [client to confirm]

1. Who this policy covers

This policy describes how HAPPISOFT INC. ("HAPPISOFT", "we", "us") handles personal information collected through this website and in the course of working with clients. HAPPISOFT is a digital agency based in Ottawa, Ontario, working with NGOs, SMEs and growing organizations across Canada. [client to confirm: the exact registered legal name and the business address to publish here.] [client to confirm: whether a named privacy contact should be listed, and who it is.]

It sits alongside our Terms and Conditions. If you are a client, this policy covers the personal information we hold about you and your team; where we handle personal information belonging to your users on your behalf, we do that on your instructions and your own privacy policy governs it.

2. What we collect

Four kinds of information, and only the first two come from simply visiting this site.

[client to confirm: the exact list of tools running on this site — analytics, tag manager, chat widget, advertising pixels, embedded video — decides what is actually collected. Confirm what is installed and name it here before this page is published.] [client to confirm: whether the contact forms store submissions in the WordPress database as well as emailing them.]

3. Why we collect it

We use what you send through a form to answer you, prepare a quote, and keep a record of what was agreed. We use analytics to see which pages people actually read and where the site confuses them, so we can fix it. We use client working material only to do the work you engaged us for. We use application material only to consider you for a role.

We do not sell personal information, and sending us a contact form does not put you on a mailing list — the newsletter is a separate, opt-in subscription with its own unsubscribe link.

4. The basis we handle it on

[client to confirm with counsel: which privacy legislation applies to HAPPISOFT, and how this section should be worded. The candidates worth raising: PIPEDA, the federal Personal Information Protection and Electronic Documents Act, which is the law usually relevant to a private-sector business in Ontario; the separate provincial statutes in Quebec, Alberta and British Columbia if clients or staff are there; CASL for commercial email; and the UK or EU GDPR if any visitor or client is in those regions. This page does not assert that HAPPISOFT complies with any of them — that is a determination for counsel.]

The intent we are describing is simple: we ask for personal information when we need it for a purpose we have explained, we rely on your consent where consent is what is required, we collect no more than the purpose needs, and we do not quietly repurpose it later.

5. Cookies and analytics

Cookies are small files a website stores in your browser. This site uses them to keep basic functions working and to measure traffic so we can see which pages are useful. Analytics data is looked at in aggregate — we are interested in which pages get read, not in who read them.

[client to confirm: which analytics product is installed, and whether IP anonymization is switched on.] [client to confirm: whether any advertising or remarketing pixels are installed — if they are, they must be named here and usually need a consent banner.] [client to confirm: whether a cookie banner is required, and what choices it should offer. The previous site's terms referenced a Cookie Policy page that never existed — decide whether to build one or fold it into this section.]

You can block or delete cookies in your browser settings at any time. Some parts of the site may stop behaving properly if you do.

6. Who else sees it

We do not sell personal information and we do not trade it. We share it with the service providers who help us run the business, and only what each one needs to do its job. In practice that means categories like:

[client to confirm: name each provider actually used, rather than leaving the list as categories. A named list is clearer for the reader and is what most privacy regimes expect.] We may also disclose information where the law requires it, or to establish or defend a legal claim.

7. How long we keep it

[client to confirm: the retention periods. Do not publish a number until it is one the business can actually keep to, and check whether tax and corporate record-keeping rules set a minimum for invoices and contracts. A published period you do not follow is worse than no period at all.]

The intent: we keep an enquiry while the conversation is live and for a period afterwards in case you come back; we keep records tied to paid work while the relationship lasts and for as long as business records have to be kept; and we return or delete client working files when an engagement ends unless you ask us to hold them. Analytics data is kept for whatever retention period the analytics tool is set to. [client to confirm: that retention setting.]

8. Where it is stored

Hosting, email and analytics providers commonly store or process data outside Canada, including in the United States, which means information can be subject to the laws of the country the servers sit in. That is worth knowing rather than glossing over. [client to confirm: where this site is actually hosted, and where each provider stores data — this section should describe the real setup, not a generic one.] [client to confirm: whether any client requires data to stay in Canada.]

9. How we look after it

We limit access to the people who need it for the work, use unique credentials with two-factor authentication wherever a service offers it, and prefer client-owned accounts with delegated access over shared passwords. No system is perfectly secure and we do not claim otherwise. [client to confirm: whether HAPPISOFT wants to state a breach-notification commitment here — breach reporting duties exist under Canadian privacy law and counsel should set the wording and the timing.]

10. What you can ask us to do

Write to [email protected] and you can ask us:

We may need to confirm who you are before we act on a request, so that we are not handing someone else's information to the wrong person. [client to confirm: the response window to commit to. Privacy legislation sets time limits for responding to an access request, and the number published here should be the legal one, not a guess.] [client to confirm: whether to name the Office of the Privacy Commissioner of Canada, or a provincial regulator, as the escalation route — counsel should confirm which regulator applies before it is named.]

11. Children

This website is aimed at organizations, not at children, and we do not knowingly collect personal information from children through it. If you believe a child has sent us personal information, write to [email protected] and we will remove it. [client to confirm: whether any client project involves data about minors, which would change what this section needs to say.]

12. Changes to this policy

We may update this policy — usually because a tool changed, not because our intentions did. The version on this page is the current one, and the date at the top shows when it last changed. [client to confirm: whether material changes should be announced to clients and subscribers directly rather than only posted here.]

13. How to reach us

Questions, requests or complaints about privacy go to [email protected]. HAPPISOFT is based in Ottawa, Ontario. [client to confirm: the postal address to publish here.] [client to confirm: whether a named privacy contact should be given, and whether privacy requests should go to a dedicated mailbox rather than the general one.]