Privacy Policy
Effective date: May 9, 2026 | Last updated: October 14, 2026
Tumbleweed Consulting (“we”, “us”, “our”) respects your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we share it with, and the choices you have. It applies to information collected through:
- our website at tumbleweedconsulting.ca;
- our contact form and discovery-call requests;
- coaching, diagnostic, and consulting engagements;
- email and phone communications with us.
We are based in Langley, British Columbia, Canada. We comply with British Columbia’s Personal Information Protection Act (PIPA) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies.
1. Who is responsible for your information
Privacy Officer: Eddy Davis
Email: info@tumbleweedconsulting.ca
Phone: 250-938-7388
Mail: Tumbleweed Consulting, PO Box 487 Stn Ft Langley, Langley, BC V1M 2R8, Canada
If you have a question, complaint, or request about your personal information, contact our Privacy Officer using the details above. We respond to requests within 30 days as required by law.
2. Information we collect
We only collect information that we need to provide our services or run our business.
2.1 Information you give us directly
- From the contact / discovery-call form: name, email address, phone number (if provided), company name, the type of service you’re inquiring about, your annual revenue range (if provided), and what you tell us about your business situation.
- From the blog subscription form (“The Builder’s Playbook”): your email address. We also record the date and time of signup and the IP address used, as proof of your consent under Canada’s Anti-Spam Legislation (CASL). We do not subscribe you until you click the confirmation link in the email we send you (double opt-in).
- During engagements: business and financial information you share with us so we can do the work — for example, financial statements, job costing data, pricing, employee numbers, supplier and client information, and project details.
- For invoicing and payment: your billing name, business name, and email. Payment is by Interac e-Transfer through your own bank — we do not collect, see, or store your banking credentials, account number, or password.
- In signed agreements: your name, signature, and any details set out in the engagement schedule.
2.2 Information we collect automatically
When you visit our website, our web server may automatically log:
- IP address
- Browser type and version, device type, operating system
- Pages viewed, date and time of visit
This information comes from standard server logs and Google Analytics (see below). We use it to monitor site health and understand general traffic patterns.
2.3 Google Analytics
We use Google Analytics 4 (provided by Google LLC) to understand how visitors use our website. Google Analytics collects information such as pages viewed, time spent on page, referring website, browser type, device type, and approximate geographic location. This data is aggregated and anonymized — we do not use it to identify individual visitors.
Google Analytics uses cookies (small text files stored on your device) to distinguish unique visitors and sessions. These cookies (for example _ga) are stored under our own website’s domain and read by Google. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on, or by adjusting your browser’s cookie settings.
Google’s use of the collected data is governed by the Google Privacy Policy.
2.4 Cookies
Our website uses essential cookies needed for the site to function (for example, remembering your light/dark theme preference) analytics cookies set by Google Analytics to help us understand traffic patterns, and advertising measurement cookies set by Google Ads (see 2.5).
2.5 Google Ads conversion tracking
We advertise on Google. To learn which ads lead to an inquiry, our website loads Google Ads conversion tracking through Google Tag Manager (both provided by Google LLC). When you arrive from one of our ads, Google stores a cookie (for example _gcl_au) that records the ad click. If you then send our contact form, the confirmation page tells Google that a conversion happened, so we can see how many inquiries each ad produced. We do not send Google your name, email, or anything you type into the form, and we do not use remarketing (ads that follow you to other websites).
You can control how Google uses this information in Google’s My Ad Center, or block these cookies in your browser settings.
3. Why we collect your information
We collect personal information only for the following purposes:
- To respond to your inquiries and schedule discovery calls;
- To provide coaching, diagnostic, or consulting services you’ve engaged us for;
- To prepare written deliverables and action plans;
- To invoice you and process payments;
- To communicate with you about an active engagement;
- To meet legal, accounting, tax, and record-retention obligations;
- To improve the website and our services through aggregate traffic data, and to measure how well our advertising works;
- To respond to legal requests, court orders, and lawful requirements.
We do not sell or rent your personal information. We do not use your information for any purpose other than those listed above without obtaining your consent.
4. Legal basis for using your information
Under PIPA BC and PIPEDA, we need a lawful basis to collect, use, or disclose your information. The bases we rely on are:
- Consent — express consent when you submit our contact form; implied consent for the work necessary to provide a service you’ve engaged us for.
- Reasonable purposes — the limited information needed to operate our business, communicate with you, invoice, and meet legal obligations.
You can withdraw consent at any time (see Section 8), subject to legal or contractual requirements.
5. Who we share your information with
We share your personal information only with the third parties listed below, and only to the extent necessary for the purposes described above.
| Provider type | What we share | Why |
|---|---|---|
| Email & document storage (Google Workspace) | Your name, email, signed agreements, deliverables, working files, and anything you send by email | To communicate with you and store engagement records securely |
| Website analytics (Google Analytics 4 / Google LLC) | Anonymized usage data: pages viewed, session duration, device type, approximate location | To understand traffic patterns and improve the website |
| Transactional email delivery (Resend, Inc.) | The email address you submit (in the contact form or blog subscription form), the contents of the resulting message, and metadata required to deliver it | To deliver contact-form submissions to us, and to deliver subscription confirmation emails, unsubscribe links and unsubscribe confirmation emails to you |
| Advertising measurement (Google Ads and Google Tag Manager / Google LLC) | Whether a visit that started from one of our ads went on to send the contact form, plus the ad-click identifier, browser and device data Google collects with it. Not your name, email, or form answers | To see which ads produce inquiries |
| Spam protection (Google reCAPTCHA / Google LLC) | Information about your browser and how you use the page, collected by Google’s reCAPTCHA script on the contact form and the blog subscription forms (on the blog it loads only when you click into an email box). Google’s Privacy Policy and Terms of Service apply. | To keep bots from abusing our forms — for example, signing up other people’s email addresses |
| Payment (Interac e-Transfer via your bank) | Your name and email (used to send the e-Transfer); we do not handle banking credentials | To accept payment |
| Accounting & tax (our bookkeeper / accountant) | Invoices, payments, business identifiers | For bookkeeping and tax filing |
| Legal advisors (our lawyer, in confidence) | Only as needed for a specific matter | For legal advice |
Some of these providers store data outside of Canada, including in the United States. By using our website and services, you understand that your information may be transferred to and stored in jurisdictions whose data-protection laws differ from those in BC and Canada. We choose providers that maintain industry-standard security and contractual data-protection commitments.
We will only disclose personal information to other third parties if:
- you give us consent;
- we are legally required to (court order, subpoena, regulatory request);
- it is necessary to protect our rights, property, or safety, or that of another person; or
- the disclosure is part of a sale or restructuring of our business (in which case any acquirer would be bound by this Policy).
6. How we protect your information
We use reasonable physical, technical, and administrative safeguards, including:
- Encrypted storage on reputable cloud providers
- Two-factor authentication on accounts that store client information
- Strong, unique passwords managed in a password manager
- Limited access — only Eddy Davis and any explicitly engaged contractors with confidentiality obligations have access to client information
- Locked storage for any physical documents
- Secure deletion of files when no longer needed
No system is perfectly secure. If a privacy breach occurs that creates a real risk of significant harm, we will notify affected individuals and the Office of the Information and Privacy Commissioner for BC as required by law.
7. How long we keep your information
| Type of information | Retention |
|---|---|
| Inquiries that don’t lead to engagement (form submissions) | Up to 2 years from your last contact, then deleted |
| Active engagement records | Duration of engagement |
| Signed agreements, invoices, and core engagement records | 7 years after engagement ends (matches CRA tax-record requirements and BC limitation periods) |
| Session recordings | Duration of engagement plus 7 years |
| Server logs | Up to 90 days, then auto-rotated |
After the retention period, information is securely deleted or anonymized.
8. Your rights
Under PIPA BC and PIPEDA, you have the right to:
- Access — request a copy of the personal information we hold about you;
- Correction — ask us to correct information that is inaccurate or incomplete;
- Withdrawal of consent — withdraw consent for any optional use (e.g., newsletter, recording of sessions going forward), subject to legal or contractual requirements;
- Complaint — complain to us first; if you’re not satisfied, you can contact the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca, or for matters under PIPEDA, the Office of the Privacy Commissioner of Canada at priv.gc.ca.
To exercise these rights, contact our Privacy Officer (Section 1). We respond within 30 days. We may need to verify your identity before responding.
There are limited cases in which we may decline a request — for example, where granting access would reveal someone else’s confidential information, where the information is subject to legal privilege, or where retention is required by law. If we decline, we’ll explain why.
9. Children’s privacy
Our services are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact our Privacy Officer and we will delete it.
10. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top will reflect the date of the most recent change. For material changes, we’ll post a notice on our website. Continued use of the site or services after a change means you accept the updated policy.
11. Questions
If anything in this policy isn’t clear, or if you’d like to know more about how we handle your information, contact:
Eddy Davis, Privacy Officer
Tumbleweed Consulting
Email: info@tumbleweedconsulting.ca
Phone: 250-938-7388
Mail: PO Box 487 Stn Ft Langley, Langley, BC V1M 2R8, Canada