Privacy Policy

1. Who we are and scope

Banasco Group ("Banasco Group", "we", "us", or "our") is a management and digital consulting practice with operations in Toronto, Ontario, Canada and Miami, Florida, United States. We are the controller of the personal information described in this policy.

This policy explains how we handle personal information collected through banascogroup.com (the "Site") and through business communications such as email, calls and meetings. It does not cover personal information we process on behalf of a client during a consulting engagement, which is addressed in section 14.

Our contact address for privacy matters is hello@banascogroup.com.

2. Information we collect

2.1 Information you give us

When you complete the contact form or email us, we collect:

• your name;
• your company or organization;
• your email address;
• the area of interest you select;
• the content of your message and any later correspondence.

If we go on to work together, we may also collect business contact details, role and title, meeting notes and information needed for contracting, invoicing and payment.

2.2 Information collected automatically

When you visit the Site, we and our analytics provider collect:

• IP address, which is typically truncated or anonymized by our analytics provider;
• browser type, device type, operating system and screen size;
• approximate location at the city or region level, derived from IP address;
• pages viewed, time on page, scroll depth, clicks and navigation paths;
• referring URL, search terms where provided by the referrer and any campaign parameters in the link you arrived through;
• date and time of your visit.

We do not collect sensitive categories of personal information such as health data, biometric data, racial or ethnic origin, religious beliefs, precise geolocation, or government identifiers. Please do not send us information of that kind.

3. How we use information

We do not use automated decision making that produces legal or similarly significant effects about you. We do not sell your personal information and we do not share it for cross context behavioural advertising or targeted advertising.

4. Legal bases for processing

Where privacy law requires us to identify a legal basis, we rely on the following:

• Consent. You submit the contact form, or you accept analytics cookies where consent is required.
• Performance of a contract. Steps taken at your request before entering an engagement and the delivery of services under one.
• Legitimate interests. Running and improving our business and Site, keeping records of business correspondence and protecting against abuse, balanced against your rights.
• Legal obligation. Retaining financial and contractual records as required by law.

5. Cookies and analytics

We use a small number of cookies and similar technologies:

We do not use advertising or retargeting cookies.

You can control cookies through your browser settings, including blocking or deleting them. Blocking strictly necessary cookies may prevent parts of the Site from working. If you are in a region where prior consent is required for analytics cookies, we will ask before setting them and you can change your choice at any time through the cookie banner or by clearing your browser data.

Our Site does not currently respond to browser Do Not Track signals, as there is no common standard for interpreting them. Where required by applicable law, we honour Global Privacy Control signals as a request to opt out of sale or sharing, although as noted above we do not sell or share personal information for advertising.

6. How we share information

We share personal information only in the following circumstances:

• Service providers. Vendors that operate our infrastructure on our behalf, including website hosting, form processing, email, calendaring, cloud storage, website analytics and accounting. They may access personal information only to perform services for us and are bound by contractual confidentiality and security obligations.
• Professional advisers. Our lawyers, accountants, insurers and auditors, where necessary.
• Legal requirements. Where we are required by law, court order, or a valid request from a public authority, or where disclosure is necessary to protect our rights, safety, or property, or those of others.
• Business transfer. In connection with a merger, acquisition, financing, or sale of all or part of our business, subject to appropriate confidentiality protections and any notice required by law.

We do not sell, rent, or trade personal information.

7. International transfers

We operate in Canada and the United States and some of our service providers are located in the United States or elsewhere. Your personal information may therefore be stored or processed outside your country of residence, including in jurisdictions whose privacy laws differ from your own and it may be accessible to courts, law enforcement and national security authorities in those jurisdictions.

Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on an adequacy decision where one applies, or on Standard Contractual Clauses or the UK International Data Transfer Addendum together with appropriate supplementary safeguards. You may request a copy of the relevant safeguards by contacting us.

8. How long we keep information

We may keep information longer where required by law or where it is needed to establish, exercise, or defend a legal claim.

9. How we protect information

We apply safeguards appropriate to the sensitivity of the information, including encryption in transit using TLS, access controls limited to people who need the information to do their work, multi factor authentication on business systems, reputable vendors with their own security programs and periodic review of access and retention.

No method of transmission or storage is completely secure. Please do not send sensitive, regulated, or highly confidential information through the Site form or unsecured email. If we become aware of a breach affecting your personal information, we will notify you and the relevant regulators where required by law.

10. Your rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and why;
• access a copy of that information;
• correct information that is inaccurate or incomplete;
• delete information, subject to legal retention requirements;
• withdraw consent at any time, without affecting processing already carried out;
• object to or restrict certain processing;
• receive your information in a portable, machine readable format;
• opt out of any sale or sharing of personal information and of targeted advertising, which we do not engage in;
• be free from discrimination or degraded service for exercising these rights.

To exercise any of these rights, email hello@banascogroup.com with a description of your request. We will verify your identity by confirming details you have previously provided, respond within 30 days and tell you if we need more time or if an exemption applies. There is no fee for a reasonable request. You may use an authorized agent where the law allows, provided we can verify their authority.

11. Additional notice for Canadian residents

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Consistent with PIPEDA's ten fair information principles, we identify our purposes before or at the time of collection, obtain meaningful consent, limit collection to what is necessary, limit use and disclosure to the identified purposes, keep information accurate, apply appropriate safeguards, remain open about our practices, provide access on request and remain accountable for information transferred to service providers.

Our commercial electronic messages comply with Canada's Anti Spam Legislation (CASL). Any marketing message we send includes our identity, contact details and a working unsubscribe mechanism.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca, or your provincial privacy regulator.

12. Additional notice for United States residents

This section applies to residents of states with comprehensive privacy laws, including California, Colorado, Connecticut, Virginia, Texas, Florida and others as they take effect.

In the preceding 12 months we collected the following categories of personal information: identifiers such as name and email address, professional or employment related information such as company and role, commercial information such as inquiry history and internet or network activity such as analytics data. These are collected from you directly and automatically from your device, for the purposes set out in section 3 and are disclosed for a business purpose only to the service provider categories listed in section 6.

We have not sold personal information and we have not shared personal information for cross context behavioural advertising, in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16.

You have the rights described in section 10, including the right to appeal a decision we make about your request. To appeal, reply to our response or email us with the word "Appeal" in the subject line. We will respond to an appeal within 45 days and, if we deny it, tell you how to contact your state attorney general.

California residents may also request information about disclosures to third parties for direct marketing purposes under the Shine the Light law. We make no such disclosures.

13. Additional notice for EEA and UK residents

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information under the legal bases set out in section 4 and you hold the rights set out in section 10, including the right to lodge a complaint with your local supervisory authority. In the United Kingdom this is the Information Commissioner's Office at ico.org.uk. You also have the right to object at any time to processing based on our legitimate interests.

14. Client data during consulting engagements

During a consulting engagement we may access personal information held by our client, for example customer records in a CRM system or campaign audience data. In that context our client is the controller and we act as a processor or service provider on its documented instructions.

Our handling of that information is governed by the engagement agreement and any data processing addendum, which set out permitted purposes, confidentiality, security measures, subprocessor approval, breach notification and return or deletion at the end of the engagement. We do not use client data for our own purposes and we do not retain it beyond what the engagement requires.

If you believe your personal information was processed by us as part of a client engagement, please contact that organization directly, as it controls the information. We will support our client in responding to your request.

15. Children

The Site is intended for business audiences and is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

16. Changes to this policy

We may update this policy to reflect changes in our practices, technology, or legal requirements. The version posted on this page is the version in effect and the "last updated" date reflects the most recent revision. If a change materially affects how we use your personal information, we will provide prominent notice on the Site and, where required, seek your consent.

17. How to contact us and complain

For questions, requests, or complaints about privacy:

Banasco Group, Privacy Contact
Email: hello@banascogroup.com
Toronto, ON, Canada and Miami, FL, United States

We will acknowledge your message promptly and investigate every complaint. If you are not satisfied with our response, you may escalate to the Office of the Privacy Commissioner of Canada, your provincial or state regulator, or your local supervisory authority.