Privacy notice

This notice explains how Black Castle collects, uses and protects personal information on www.black-castle.io. We collect as little as we can, we never sell it, and we use it only to answer you. It is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), and applicable US state privacy laws.

Who is responsible

Black Castle Consulting Services is responsible for the personal information described here. Our person in charge of the protection of personal information is William Pispico Ferreira, Founder and fractional CISO. Contact: info@black-castle.io.

What we collect

Information	When	Why
Name, email, company (optional), topic and your message	You send the contact form	To answer your request and follow up about it
IP address and the time you sent the form	You send the contact form	To block spam and abuse (no more than a few messages per hour from one address)
IP address, browser type, pages requested	Every visit (server logs)	To run the site securely and fix errors

We do not ask for sensitive information. Please do not include health, financial or other sensitive details about yourself or others in your message.

Cookies and tracking

The site sets one cookie, __session, only on the contact page. It protects the form against forged submissions and spam, and expires when you close your browser. It is strictly necessary, so it does not need consent.

We use no analytics, advertising or social media trackers, and no third-party cookies. Fonts and images are served from our own site. Links to other sites (such as LinkedIn) follow those sites' privacy policies.

Consent

By sending the contact form, you consent to us using your information as described here. You can withdraw your consent at any time by emailing us; we will then delete your information unless the law requires us to keep it.

Who we share it with

We do not sell, rent or trade personal information, and we do not share it for targeted advertising. We use service providers that process it on our behalf and under contract:

• Google Cloud and Firebase host the website and store contact messages. Messages are stored in Montreal, Canada.
• Google Workspace provides our business email. Each message is also emailed to our inbox so we can answer it.

Our providers may process information outside your province or country, including in the United States, where it may be accessible to authorities under local law. Before using a provider, we assess that it protects personal information to a standard equivalent to ours. We may also disclose information if the law requires it.

How long we keep it

• Contact messages: up to 24 months after our last exchange, unless you become a client, in which case our client agreement applies.
• Server logs: about 30 days.

After that, we delete the information.

How we protect it

Information is encrypted in transit (HTTPS) and at rest. Access is limited to the person who answers enquiries, protected by multi-factor authentication. If a confidentiality incident creates a risk of serious harm, we will notify you and the relevant privacy regulator as the law requires.

Your rights

You can ask us to:

• tell you what personal information we hold about you and how we use it, and give you a copy;
• correct information that is wrong or incomplete;
• delete your information, or stop using it;
• give you your information in a common, structured format (Quebec residents).

Email info@black-castle.io. We answer within 30 days, free of charge, and may ask you to confirm your identity first.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

US residents

We do not sell or share personal information, use it for targeted advertising or profiling, or collect sensitive personal information. Depending on your state, you may have the rights listed above. To use them, email us. We will not treat you differently for doing so.

Children

This site is for businesses. It is not directed at children, and we do not knowingly collect information from anyone under 16.

Changes to this notice

We will post any change on this page and update the date at the top.