Privacy Policy

This policy applies to:

• Website visitors who browse our Website or submit forms on it;
• Prospects and clients who request quotes, book consultations, or purchase our Services;
• CRM users, such as realtors, brokers, team members, and business owners who hold an account on our CRM; and
• End users of our clients, such as home buyers, sellers, and leads whose information is collected through websites, landing pages, advertising campaigns, or CRM tools we build or host for our clients (see Section 7).

We use personal information only for purposes a reasonable person would consider appropriate in the circumstances, including to:

1. Respond to inquiries, prepare quotes, and schedule consultations;
2. Design, develop, host, maintain, and support websites and digital assets;
3. Plan, run, monitor, and report on SEO, advertising, and social media campaigns;
4. Provide, operate, secure, and improve the CRM, including lead management, social media management, website management, messaging, and reporting features;
5. Create and manage user accounts and verify identity;
6. Process payments, send invoices, and maintain financial records;
7. Send service-related communications, such as project updates, security alerts, renewal notices, and changes to our terms;
8. Send marketing communications where we have your consent, as required by CASL;
9. Analyze Website and Service usage to improve performance and user experience;
10. Detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms & Conditions; and
11. Comply with legal, regulatory, tax, and accounting obligations.

We will not use personal information for a new purpose without first identifying that purpose and obtaining consent where required by law.

We obtain consent to collect, use, and disclose personal information, except where otherwise permitted or required by law. Consent may be express (for example, ticking a box or signing an agreement) or implied (for example, providing your email address so we can reply to your inquiry).

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us at contactus@builtdigitally.com. Withdrawing consent may affect our ability to provide certain Services.

We share personal information only as follows:

• Service providers: trusted vendors who perform services on our behalf, such as cloud hosting, data storage, email delivery, SMS and telephony, payment processing, analytics, customer support, and project management tools. These providers are contractually required to protect personal information and use it only to provide services to us.
• Platforms you connect: when you use the CRM or our marketing Services, information is exchanged with the platforms you authorize (such as Meta, Google, LinkedIn, and listing data providers) in accordance with those platforms' terms and privacy policies.
• Professional advisers: lawyers, accountants, auditors, and insurers, under confidentiality obligations.
• Business transactions: in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to appropriate confidentiality protections.
• Legal requirements: where required or permitted by law, such as to respond to a court order, subpoena, or lawful request from government authorities, or to protect the rights, property, or safety of Built Digitally, our clients, or others.

We use cookies, pixels, tags, and similar technologies to:

• Operate the Website (strictly necessary cookies, such as those that keep you logged in or remember cookie preferences);
• Understand usage (analytics cookies, such as Google Analytics);
• Measure and personalize advertising (marketing cookies and pixels, such as the Meta Pixel and Google Ads tags), including retargeting ads to people who have visited our Website.

You can manage cookie preferences through our cookie banner or your browser settings. You can also opt out of interest-based advertising through Google's Ads Settings, Meta's Ad Preferences, and the Digital Advertising Alliance of Canada's AdChoices program (youradchoices.ca). Blocking some cookies may affect how the Website functions.

When we build websites, run campaigns, or provide the CRM for our clients (such as realtors and brokerages), we often process personal information about our clients' own customers and leads (for example, a home buyer who submits a form on a realtor's website).

In these cases:

• Our client is responsible for that personal information and for obtaining any required consents, providing privacy notices to their contacts, and complying with privacy laws, CASL, and real estate regulatory and board/MLS® rules.
• We act as a service provider, processing that information only on our client's instructions and for the purpose of providing our Services.
• Individuals who wish to access, correct, or delete information held by one of our clients should contact that client directly. If you contact us, we will refer your request to the relevant client and assist them where appropriate.

Where the CRM accesses data from third-party platforms through their APIs, we use that data only to provide and improve the user-facing features you have enabled. We do not use such data to serve unrelated advertising, and we do not sell it.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You may revoke our access to connected accounts at any time through the CRM settings or through the security settings of the relevant platform.

Some of our Services or CRM features may use artificial intelligence tools (for example, to help draft social media posts, ad copy, email replies, or listing descriptions). Content you submit to these features may be processed by third-party AI service providers under agreements that restrict their use of that content. We do not use your confidential client data to train publicly available AI models. You are responsible for reviewing AI-generated content before publishing or relying on it.

Personal information is stored on secure servers operated by us or our service providers. Some service providers are located, or store data, outside your province or outside Canada, including in the United States. When information is processed outside Canada, it is subject to the laws of that jurisdiction and may be accessible to courts, law enforcement, and national security authorities there. We use contractual and other measures to provide a comparable level of protection. Where required by Quebec law, we assess the privacy implications before transferring personal information outside Quebec.

We keep personal information only as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements. As a general guide:

• Inquiry and prospect information: up to 24 months after our last interaction;
• Client and billing records: for the duration of the relationship and up to 7 years after, for tax and legal purposes;
• CRM data: for the duration of your subscription and up to 90 days after cancellation, after which it is deleted or anonymized unless you request an export or the law requires longer retention.

When personal information is no longer needed, we securely destroy, delete, or anonymize it.

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit (SSL/TLS), access controls and role-based permissions, secure password storage, regular backups, software updates and security patches, and confidentiality obligations for staff and contractors.

No method of transmission or storage is completely secure. If a breach of security safeguards involving personal information creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (and any applicable provincial regulator) as required by law.

Subject to applicable law, you have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Withdraw consent to certain uses of your information;
• Request deletion of your information where it is no longer required;
• Request data portability (where available under Quebec law); and
• File a complaint about our privacy practices.

To make a request, contact our Privacy Officer (Section 16). We may need to verify your identity before responding. We will respond within 30 days, or as otherwise permitted by law, and will explain any reason we cannot fulfil your request.

We send commercial electronic messages only with your express or implied consent, as permitted by CASL. Every marketing email or text we send identifies Built Digitally and includes a working unsubscribe mechanism. You may unsubscribe at any time using the link in our messages or by contacting us. We will process unsubscribe requests within 10 business days. You will continue to receive essential service-related messages while you remain a client.

Our Website and Services are intended for businesses and adults. We do not knowingly collect personal information from individuals under the age of majority in their province or territory. If you believe we have collected such information, please contact us so we can delete it.

We have designated a Privacy Officer who is accountable for our compliance with this policy and applicable privacy laws.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or your provincial privacy commissioner.

We may update this Privacy Policy from time to time to reflect changes in our practices, Services, or legal requirements. The “Last Updated” date at the top shows when it was last revised. If we make material changes, we will notify clients by email or through the CRM and/or post a notice on the Website before the change takes effect.