Privacy Policy

Effective date: May 9, 2026  |  Last updated: May 21, 2026

Tumbleweed Consulting (“we”, “us”, “our”) respects your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we share it with, and the choices you have. It applies to information collected through:

• our website at tumbleweedconsulting.ca;
• our contact form and fit-call requests;
• coaching, diagnostic, consulting, inspection, and project-management engagements;
• email and phone communications with us.

We are based in Langley, British Columbia, Canada. We comply with British Columbia’s Personal Information Protection Act (PIPA) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies.

1. Who is responsible for your information

Privacy Officer: Eddy Davis
Email: [email protected]
Phone: 250-938-7388
Mail: Tumbleweed Consulting, PO Box 487 Stn Ft Langley, Langley, BC V1M 2R8, Canada

If you have a question, complaint, or request about your personal information, contact our Privacy Officer using the details above. We respond to requests within 30 days as required by law.

2. Information we collect

We only collect information that we need to provide our services or run our business.

2.1 Information you give us directly

• From the contact / fit-call form: name, email address, phone number (if provided), company name, the type of service you’re inquiring about, your annual revenue range (if provided), and what you tell us about your business situation.
• From the blog subscription form (“The Builder’s Playbook”): your email address and, if you choose to provide it, your name. We also record the date and time of signup and the IP address used, as proof of your consent under Canada’s Anti-Spam Legislation (CASL). We do not subscribe you until you click the confirmation link in the email we send you (double opt-in).
• During engagements: business and financial information you share with us so we can do the work — for example, financial statements, job costing data, pricing, employee numbers, supplier and client information, and project details.
• For invoicing and payment: your billing name, business name, and email. Payment is by Interac e-Transfer through your own bank — we do not collect, see, or store your banking credentials, account number, or password.
• In signed agreements: your name, signature, and any details set out in the engagement schedule.

2.2 Information we collect automatically

When you visit our website, our web server may automatically log:

• IP address
• Browser type and version, device type, operating system
• Pages viewed, date and time of visit

This information comes from standard server logs and Google Analytics (see below). We use it to monitor site health and understand general traffic patterns.

2.3 Google Analytics

We use Google Analytics 4 (provided by Google LLC) to understand how visitors use our website. Google Analytics collects information such as pages viewed, time spent on page, referring website, browser type, device type, and approximate geographic location. This data is aggregated and anonymized — we do not use it to identify individual visitors.

Google Analytics uses cookies (small text files stored on your device) to distinguish unique visitors and sessions. These cookies are set by Google under the domain googletagmanager.com. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on, or by adjusting your browser’s cookie settings.

Google’s use of the collected data is governed by the Google Privacy Policy.

2.4 Cookies

Our website uses essential cookies needed for the site to function (for example, remembering your light/dark theme preference) and analytics cookies set by Google Analytics to help us understand traffic patterns. We do not use advertising cookies or third-party tracking pixels.

3. Why we collect your information

We collect personal information only for the following purposes:

• To respond to your inquiries and schedule fit calls;
• To provide coaching, diagnostic, consulting, inspection, or project-management services you’ve engaged us for;
• To prepare written deliverables, action plans, and inspection reports;
• To invoice you and process payments;
• To communicate with you about an active engagement;
• To meet legal, accounting, tax, and record-retention obligations;
• To improve the website and our services through aggregate traffic data;
• To respond to legal requests, court orders, and lawful requirements.

We do not sell or rent your personal information. We do not use your information for any purpose other than those listed above without obtaining your consent.

4. Legal basis for using your information

Under PIPA BC and PIPEDA, we need a lawful basis to collect, use, or disclose your information. The bases we rely on are:

• Consent — express consent when you submit our contact form; implied consent for the work necessary to provide a service you’ve engaged us for.
• Reasonable purposes — the limited information needed to operate our business, communicate with you, invoice, and meet legal obligations.

You can withdraw consent at any time (see Section 8), subject to legal or contractual requirements.

5. Who we share your information with

We share your personal information only with the third parties listed below, and only to the extent necessary for the purposes described above.

Provider type	What we share	Why
Email & document storage (Google Workspace)	Your name, email, signed agreements, deliverables, working files, and anything you send by email	To communicate with you and store engagement records securely
Website analytics (Google Analytics 4 / Google LLC)	Anonymized usage data: pages viewed, session duration, device type, approximate location	To understand traffic patterns and improve the website
Transactional email delivery (Resend, Inc.)	The email address you submit (in the contact form or blog subscription form), the contents of the resulting message, and metadata required to deliver it	To deliver contact-form submissions to us, and to deliver subscription confirmation and unsubscribe confirmation emails to you
Payment (Interac e-Transfer via your bank)	Your name and email (used to send the e-Transfer); we do not handle banking credentials	To accept payment
Accounting & tax (our bookkeeper / accountant)	Invoices, payments, business identifiers	For bookkeeping and tax filing
Legal advisors (our lawyer, in confidence)	Only as needed for a specific matter	For legal advice

Some of these providers store data outside of Canada, including in the United States. By using our website and services, you understand that your information may be transferred to and stored in jurisdictions whose data-protection laws differ from those in BC and Canada. We choose providers that maintain industry-standard security and contractual data-protection commitments.

We will only disclose personal information to other third parties if:

• you give us consent;
• we are legally required to (court order, subpoena, regulatory request);
• it is necessary to protect our rights, property, or safety, or that of another person; or
• the disclosure is part of a sale or restructuring of our business (in which case any acquirer would be bound by this Policy).

6. How we protect your information

We use reasonable physical, technical, and administrative safeguards, including:

• Encrypted storage on reputable cloud providers
• Two-factor authentication on accounts that store client information
• Strong, unique passwords managed in a password manager
• Limited access — only Eddy Davis and any explicitly engaged contractors with confidentiality obligations have access to client information
• Locked storage for any physical documents
• Secure deletion of files when no longer needed

No system is perfectly secure. If a privacy breach occurs that creates a real risk of significant harm, we will notify affected individuals and the Office of the Information and Privacy Commissioner for BC as required by law.

7. How long we keep your information

Type of information	Retention
Inquiries that don’t lead to engagement (form submissions)	Up to 2 years from your last contact, then deleted
Active engagement records	Duration of engagement
Signed agreements, invoices, and core engagement records	7 years after engagement ends (matches CRA tax-record requirements and BC limitation periods)
Session recordings	Duration of engagement plus 7 years
Server logs	Up to 90 days, then auto-rotated

After the retention period, information is securely deleted or anonymized.

8. Your rights

Under PIPA BC and PIPEDA, you have the right to:

• Access — request a copy of the personal information we hold about you;
• Correction — ask us to correct information that is inaccurate or incomplete;
• Withdrawal of consent — withdraw consent for any optional use (e.g., newsletter, recording of sessions going forward), subject to legal or contractual requirements;
• Complaint — complain to us first; if you’re not satisfied, you can contact the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca, or for matters under PIPEDA, the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise these rights, contact our Privacy Officer (Section 1). We respond within 30 days. We may need to verify your identity before responding.

There are limited cases in which we may decline a request — for example, where granting access would reveal someone else’s confidential information, where the information is subject to legal privilege, or where retention is required by law. If we decline, we’ll explain why.

9. Children’s privacy

Our services are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact our Privacy Officer and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top will reflect the date of the most recent change. For material changes, we’ll post a notice on our website. Continued use of the site or services after a change means you accept the updated policy.

11. Questions

If anything in this policy isn’t clear, or if you’d like to know more about how we handle your information, contact:

Eddy Davis, Privacy Officer
Tumbleweed Consulting
Email: [email protected]
Phone: 250-938-7388
Mail: PO Box 487 Stn Ft Langley, Langley, BC V1M 2R8, Canada