Privacy Rights and Contact

1. How this fits with each site's Privacy page

tools.tnaado.ca, answers.tnaado.ca, travel.tnaado.ca and tnaado.ca share one Privacy page that says what they collect and how the analytics choice works. The other sites have their own. This page covers what is common to all of them: your rights, our contact, and how we handle requests. Sites: tools.tnaado.ca, answers.tnaado.ca, travel.tnaado.ca, dispatch.tnaado.ca, mrbuff.ca, cinematicaddict.com, tnaado.ca. Privacy pages for the others: dispatch, service, mrbuff.ca, cinematicaddict.com.

2. Contact and privacy officer

Privacy Officer, TNAADO Inc., 1050 King Street West, Toronto, Ontario M6K 0C7. Email: contact@tnaado.ca. Put "Privacy" and the site name in the subject. This is the only address TNAADO publishes for privacy requests, complaints and incident reports. The Privacy Officer is accountable for our compliance with PIPEDA and is the person in charge of the protection of personal information under Quebec law. Our general contact is the same address.

3. What the content sites collect

The content sites have no accounts, comments or checkout. We receive standard request data through our hosts (IP address, page, time, browser), measurement data through Google Analytics if analytics is on, and ad-serving data collected by Google where ads show, and any email you send us. Details are in each Privacy page, Cookies and Service providers. What you type into a tool stays in your browser, except the two IP lookup tools.

4. Your rights

4.1 Canada (PIPEDA) and Quebec (Law 25)

You can ask what personal information we hold about you, ask us to correct it, ask us to delete it, and withdraw consent to optional uses such as analytics. In Quebec you can also ask for your information in a portable format and ask about the people and tools involved. We do not make decisions about you using automated processing. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

4.2 EEA, UK and Switzerland

Our sites are aimed at the US and Canada. If the GDPR or UK GDPR applies to you, you have the rights to access, rectification, erasure, restriction, objection, portability and to withdraw consent, and to complain to your supervisory authority. We rely on your consent for analytics and non-essential cookies, and on our legitimate interest in running and securing the sites for hosting logs. We have not appointed an EU or UK representative. Data may be processed in the United States and Canada.

4.3 United States (California and other states)

Depending on where you live you may have the right to know, access, correct, delete, and opt out of the sale or sharing of personal information or its use for targeted advertising, and not to be treated worse for exercising these rights. We do not sell personal information for money. Where ads show, Google and its partners use cookies for advertising, which some state laws treat as "sharing" or "targeted advertising". To opt out, use the choices in Advertising, including Google Ads Settings, and send us a request. Google Analytics and Cloudflare Web Analytics respect Global Privacy Control and Do Not Track by staying off. On tools, answers, travel and Dispatch we do not show ads when your browser sends Global Privacy Control or Do Not Track, or when your region is in the gated list (EEA, UK, Switzerland, overseas territories) or cannot be determined.

5. Quebec: how to use your rights

Under Quebec's Act respecting the protection of personal information in the private sector, you can:

• Access the personal information we hold about you and ask how we use it.
• Correct information that is inaccurate, incomplete or equivocal.
• Erase or stop use. Ask us to cease disseminating your information or to delete it where the law gives you that right, and withdraw consent to analytics.
• Portability. Ask for your computerised personal information in a structured, commonly used technological format, for you or for another organisation you name.

To use a right, email the contact above with "Privacy" and the site name, say which right you want and what information it concerns, and we will confirm who you are before we act. We reply in writing within 30 days of receiving the request. If we refuse, we say why and what the law gives you next. You can complain to the Commission d'accès à l'information.

5.1 Confidentiality incidents

A confidentiality incident is unauthorised access to, use of or disclosure of personal information, or its loss. If a confidentiality incident occurs we assess it, take steps to reduce the risk of harm, and notify the Commission d'accès à l'information and affected people where the risk of serious injury requires it. Report a suspected incident to the contact above.

5.2 Transfers outside Quebec

The personal information these sites handle (request data, analytics data, ad-serving data collected by Google, and email you send us) is processed outside Quebec by providers in the United States and Canada, listed in Service providers. Before transferring personal information outside Quebec we consider the privacy protections in the destination. The information involved is of low sensitivity (IP address, page, browser, cookie identifiers, and messages you choose to send), the sites have no accounts or payments, and United States law can allow public authorities to request data held by those providers.

6. Region policy for analytics and ads

In Quebec, the EEA, the United Kingdom and Switzerland, Google Analytics and Cloudflare Web Analytics are off until you accept. Elsewhere they are on with an opt-out, and Global Privacy Control or Do Not Track keeps them off everywhere. Analytics stays off in Quebec until you accept. Ads still show in Quebec; see Advertising. On tools, answers, travel and Dispatch we do not show ads when your browser sends Global Privacy Control or Do Not Track, or when your region is in the gated list (EEA, UK, Switzerland, overseas territories) or cannot be determined. These choices control analytics only; ad cookies set by Google are covered in Advertising.

7. Legal bases and your representative (GDPR and UK GDPR)

The legal basis for each use is in the table in the shared Privacy page: consent for analytics and non-essential cookies in opt-in regions, and legitimate interests for hosting logs, security, region lookup and replying to email. We have not appointed an EU or UK representative under Article 27.

8. Email and CASL

The content sites (tools, answers, travel, tnaado.ca) have no newsletter, mailing list or marketing email. We reply by email to messages you send us. The Dispatch sends its own messages, described in the Dispatch privacy policy. If we send commercial messages from these sites, we will do it only with your consent, identify TNAADO as the sender and include a working unsubscribe link, as Canada's Anti-Spam Legislation requires. Under US law, our email carries a physical address and an opt-out where the CAN-SPAM Act applies.

9. Security and reporting a vulnerability

We use TLS, restricted access and provider-level security for our systems. To report a vulnerability or security concern, email contact@tnaado.ca with "Security" in the subject and give enough detail to reproduce it. Do not access or change other people's data, disrupt a site, or publish details before we have had a reasonable time to fix it. We welcome good-faith reports and will respond. Our machine-readable contact is at /.well-known/security.txt.

10. Children

Our sites are not directed to children and we do not knowingly collect personal information from children under 13 (or under 16 where the law sets that age). We do not use ad settings that target children. If you believe a child sent us information, contact us and we will delete it.

11. How we handle a request

Email the contact above. We may need to confirm who you are. We reply within the time the law sets (30 days in Canada and Quebec, one month under GDPR, 45 days in California, extendable where the law allows). We hold little: mostly email and what our providers keep in logs, which they hold under their own policies. There is no fee unless the law allows one.

12. Keeping and protecting data

The retention schedule is in the shared Privacy page. We use reasonable safeguards. If a breach creates a real risk of significant harm, we notify the people and regulators the law requires and keep a record of every breach of security safeguards.

13. Changes

We update this page and each site's Privacy page before changing what we collect. The date at the top of each page shows the current version.