Privacy Statement.

01

Who we are

Overstand operates overstand.ca from Toronto, Ontario, Canada, and is responsible for the personal information described here. Write to contact@overstand.ca about anything in this statement.

02

What we collect

When you fill in the contact form, we collect what you type into it: your name, your work email address, your phone number if you give it, your organization, your role, the platform or environment involved, any deadline you mention, and the outcome you describe.

If you email us directly, we hold that email and whatever is in it.

Our web server and our security software keep short technical logs of requests to the site, which include IP addresses, timestamps and browser information. These exist to keep the site running and to block attacks.

We use Google Analytics and HubSpot to understand how the site is used. Between them they record the pages you visit, roughly where in the world you are, how you arrived, and what kind of device and browser you have. HubSpot also keeps a cookie that lets it recognise a returning browser, so if you later fill in the form we can see which pages led up to it. This is ordinary web analytics, not a profile built from anything you did not do on this site.

The site has no account system, so there is nothing to register for and no password to give us.

03

What we do with it

We use what you send through the form or by email to answer you, to work out whether we can help, and to carry the conversation forward. If it turns into an engagement, it becomes part of the record of that engagement.

We use the technical logs to keep the site available and secure.

Our lawful basis is straightforward: you contacted us and we are responding, and we have a legitimate interest in protecting our own site.

04

What we do not do

We do not sell or rent personal information, and we do not share it for anyone else to market to you.

We do not run advertising on the site, and we carry no advertising or social media tracking pixels.

We keep the list of outside companies short. Apart from the analytics named above, a page on this site loads nothing from anyone else, and the fonts are served from our own server rather than from a font network.

We do not add you to a mailing list because you used the contact form.

05

Cookies

Google Analytics and HubSpot each set cookies that let them recognise a browser across pages and across visits, which is how a series of visits is counted as one person rather than many. They are analytics cookies, not advertising cookies: nothing here is used to target ads to you anywhere else.

WordPress and our security software also set a small number of strictly functional cookies, for example to keep a signed-in editor signed in or to let the firewall recognise a request it has already checked.

You can block or delete cookies in your browser settings, and you can turn off Google Analytics for every site using the browser add-on Google publishes. Doing either will not stop you reading this site.

06

Who else sees it

A small number of suppliers process information on our behalf: the company that hosts the website, the email provider that carries messages sent from the contact form, the security software that protects the site, Google for analytics, and HubSpot, which is where our customer records are kept and where an enquiry from this site becomes a contact we can follow up. They act on our instructions and only for these purposes.

We will disclose information where the law requires it, and we will say so unless we are not allowed to.

Some of these suppliers operate servers outside Canada, which means your information may be processed in another country and may be accessible to the authorities there under that country’s law.

07

How long we keep it

Contact form entries are kept while we are in conversation with you and for up to two years afterwards, so we can pick up a thread that resumes. Ask us and we will delete yours sooner.

Technical and security logs are kept for a short period, typically weeks rather than years, and then rotate out.

Analytics records are kept for as long as Google and HubSpot retain them under the settings on our accounts, and we do not keep a separate copy of them.

Records that belong to a signed engagement are kept for as long as that agreement and our professional and tax obligations require.

08

Your rights

You can ask us what personal information we hold about you, ask for a copy, ask us to correct it, and ask us to delete it. You can withdraw consent where we relied on it, and you can object to our use of it.

Write to contact@overstand.ca. We answer within 30 days, and sooner where we can. We may need to check who you are before we act, and we will not charge you.

If you are unhappy with our answer, you can complain to the Office of the Privacy Commissioner of Canada. If you are in the United Kingdom or the European Economic Area, you also have the rights their laws give you, including the right to complain to your own supervisory authority.

09

Keeping it safe

The site runs over HTTPS, sits behind a firewall, and is kept patched. Access to form entries is limited to the people who need it. No system is perfect, and we will tell you and the relevant regulator if a breach puts you at real risk of harm.

10

Children

This site is for people doing business with us. It is not directed at children, and we do not knowingly collect information about them.

11

Changes to this statement

If we change how we handle personal information we will update this page and change the date at the top of it. Where a change matters, we will say so here rather than leave you to spot it.