Privacy Policy

1. Who we are and what this covers

This Privacy Policy explains how archCTO ("archCTO", "we", "us", "our") collects, uses, stores and protects personal information when you visit archcto.com, contact us, book a call, or work with us as a client or prospective client. It applies to our website, our contact and booking forms, our email communications, and our consulting engagements unless a separate written agreement says otherwise.

archCTO operates from Canada and serves clients in Canada and the United States. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, and we respect the rights that United States state privacy laws (including California's CCPA/CPRA) grant to residents of those states.

2. Information we collect

We collect only what we need to respond to you, deliver our services and run our business.

• Information you give us: name, work email, phone number, company, industry, the service you are interested in, and anything you write in a message, booking or proposal discussion.
• Business and engagement information: project details, system information, documents and data that a client shares with us so we can perform agreed work.
• Technical information collected automatically: IP address, browser and device type, pages visited, referring page and approximate region, gathered through server logs and essential cookies. See our Cookie Notice for details.
• We do not collect payment card numbers on this website. Invoicing and payment are handled through separate, agreed channels.

3. How we use information

• To respond to your enquiry, schedule and hold calls, and prepare proposals.
• To deliver consulting, software, integration, automation and AI services under an agreement with you.
• To operate, secure, troubleshoot and improve the website.
• To send service-related messages, and, only with your consent, occasional insights or updates. Every marketing email includes an unsubscribe link, consistent with Canada's Anti-Spam Legislation (CASL) and the U.S. CAN-SPAM Act.
• To meet legal, accounting, tax and professional obligations, and to protect our rights, our people and our systems.

4. Legal basis and consent

We rely on your consent when you submit a form or ask us to contact you, on the performance of a contract when we deliver services, and on our legitimate business interests when we secure and improve our website or defend our rights. You may withdraw consent at any time by contacting us; this does not affect processing that already occurred or that we must keep for legal reasons.

5. How we share information

We do not sell, rent or trade personal information, and we do not share it with third parties for their own marketing. We share information only in these limited cases:

• Service providers that help us run the business (for example website hosting, email, scheduling, document storage and analytics). They may only use the information to provide services to us and must protect it.
• Professional advisers such as accountants, lawyers or insurers where necessary.
• Authorities or other parties where required by law, court order or to protect the safety, rights or property of archCTO, our clients or others.
• A successor organization if archCTO is reorganized, merged or sold, subject to this policy.

6. Where information is stored and international transfers

Our service providers may store or process information in Canada, the United States or other countries. When information leaves the country where it was collected, we use providers that offer contractual and security protections consistent with this policy. By using the website or working with us you understand that your information may be processed in these locations, where laws may differ from your own.

7. How long we keep information

• Enquiries and booking details: up to 24 months after our last contact, unless a relationship continues.
• Client engagement records: for the life of the engagement plus the period required for legal, tax and professional obligations (typically 7 years in Canada).
• Website logs: typically 90 days or less.
• We delete or anonymize information when it is no longer needed for these purposes.

8. How we protect information

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encrypted connections (HTTPS), access controls, least-privilege access to client systems, and vendor due diligence. No method of transmission or storage is completely secure; if we become aware of a breach that creates a real risk of significant harm, we will notify affected individuals and regulators as required by law.

9. Confidentiality of client materials

Documents, drawings, estimates, system credentials, data extracts and other materials that a client shares with us are treated as confidential and used only for the agreed engagement. We do not use client data to train AI models, and we do not disclose client identities or project details publicly without written permission. Our use cases and articles are anonymized for this reason. Any AI tools we use in delivery are configured so that client data is not retained or used by the tool provider for training, or are disclosed to the client in advance.

10. Your rights and choices

Depending on where you live you may have the right to:

• Access the personal information we hold about you and learn how it is used and shared.
• Correct information that is inaccurate or incomplete.
• Delete information, subject to legal retention requirements.
• Withdraw consent or object to certain uses, including marketing.
• Receive a copy of your information in a portable format.
• For residents of California and other U.S. states with privacy laws: know the categories of information collected, request deletion, and opt out of "sale" or "sharing". We do not sell or share personal information as those terms are defined in those laws, and we do not discriminate against anyone for exercising their rights.
• To exercise any right, email info@archcto.com. We will verify your identity using the information already on file and respond within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada, your provincial commissioner, or your state attorney general.

11. Cookies and analytics

We use essential cookies to make the site work and, where enabled, privacy-respecting analytics to understand which pages are useful. We do not use advertising cookies or cross-site tracking. Details and choices are in our Cookie Notice.

12. Children

Our website and services are for businesses and professionals. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

13. Third-party links and booking tools

Our site may link to third-party services such as a scheduling calendar, LinkedIn or other platforms. Those services have their own privacy policies and we are not responsible for their practices. Review their policies before providing information.

14. Changes to this policy

We may update this policy as our services or the law change. The "Last updated" date at the top shows the current version. Material changes will be highlighted on this page, and where required we will seek your consent again.

15. Contact

Privacy Officer, archCTO. Email: info@archcto.com. We are based in Ontario, Canada and serve clients across Canada and the United States.