Privacy policy

Summary

What we collect

Information you give us

When you submit an enquiry, request an audit, ask for our company profile or subscribe to the newsletter, we collect what you type: your name, business name, email address, phone number if you provide one, your website address, and whatever you tell us about your situation.

Information collected automatically

Our hosting and security providers process your IP address and basic request information in order to serve the site and prevent abuse. We store a hashed version of your IP address with form submissions for rate limiting, which cannot be reversed to identify you.

Information we do not collect

We do not collect payment card details on this website. We do not use advertising trackers, social pixels or session recording. We do not buy contact lists.

If you become a client

We will hold business contact details for the people we work with, and we will have administrative access to systems you ask us to manage. What we can see in those systems depends on what you are asking us to do, and is set out in the engagement rather than here.

Why we use it

• To reply to your enquiry and carry out anything you asked for, such as an audit
• To deliver services you have engaged us for
• To send marketing emails, where you have given consent, and to keep the record proving you gave it
• To keep the site working and to prevent abuse
• To meet legal, tax and accounting obligations

We do not use your information to build a profile of you, and we do not make automated decisions about you.

Legal basis

If you are in Canada

Under PIPEDA we rely on your consent. Submitting a form is express consent for us to reply to you about it. Consent for marketing email is separate, explicit, and can be withdrawn at any time. Quebec residents have additional rights under Law 25, including the right to be informed before information is used for a new purpose.

If you are in the EU, the EEA or the UK

Under GDPR and UK GDPR we rely on:

• Consent — for marketing email, which you can withdraw at any time
• Contract — to respond to an enquiry and to deliver services
• Legitimate interests — to secure the site and prevent abuse, balanced against your rights
• Legal obligation — for records we are required to keep

If you are in the United States

State privacy laws in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana give you rights over your personal information. We honour those rights for every visitor rather than checking where you live first.

Cookies and storage

This website currently sets no cookies.

There is no analytics, no advertising and no tracking. That is why you were not shown a consent banner — there is nothing to consent to. If that changes, a banner will appear before anything is set, and you will be able to decline.

We do use two small pieces of browser local storage, which stay on your device and are never sent to us:

• teczila-mode — Remembers whether you chose the warm, light or dark appearance
• teczila-first-touch — Records which page you first arrived on, so that if you later get in touch we know where you came from

The full cookie and storage policy has the detail.

Who we share with

We do not sell personal information and we do not share it for advertising. We use a small number of service providers to operate, each with access only to what their function requires.

Our sub-processors are named publicly, with what they do and where they are. We give 30 days' notice before adding one, and clients may object.

See the current sub-processor list.

We may also disclose information where the law requires it, or to establish or defend a legal claim. If we are ever compelled to disclose client information, we will tell the client unless we are legally prohibited from doing so.

International transfers

TecZila is a Canadian company working with clients across Canada, the United States and Europe. Personal information may be processed outside the country you are in.

Our personnel operate from:

• Canada — Primary delivery, client contact, administrative access

Where EU or UK personal data is involved, transfers are made under Standard Contractual Clauses with a transfer impact assessment. Everyone with access to client systems is bound by written confidentiality terms no weaker than those we owe the client.

Clients may designate categories of data as in-jurisdiction only. Access is then restricted to personnel in that jurisdiction and recorded in the engagement documentation.

How long we keep it

Actual periods, rather than "as long as necessary":

When a period ends, information is deleted or irreversibly anonymised.

Security

• Form submissions are transmitted over HTTPS and stored outside the public web root
• Access to client systems uses delegated administrative access rather than shared passwords wherever the platform allows it
• Credentials are held in a password manager with multi-factor authentication, never in documents or messages
• Access is removed when someone leaves or no longer needs it
• Anyone with access to client systems is subject to written confidentiality obligations

No system is perfectly secure, and we will not claim otherwise. What we will do is tell you quickly if something goes wrong — see below.

Your rights

Wherever you are, you can ask us to:

• Tell you what personal information we hold about you
• Give you a copy, in a portable format
• Correct anything inaccurate
• Delete it, where we are not required to keep it
• Stop using it for a particular purpose
• Withdraw consent you previously gave

Email privacy@teczila.com. We respond within 30 days, and we do not charge for it. We will ask you to confirm your identity first, using information we already hold, and we delete whatever you send for that purpose once you are verified.

If you are unhappy with our response, you can complain to the Office of the Privacy Commissioner of Canada, to the Commission d'accès à l'information du Québec, or to your local supervisory authority in the EU or UK.

Who is accountable

TecZila has designated a Privacy Officer who is accountable for our compliance with this policy. Questions, access requests and complaints all reach that person at privacy@teczila.com.

We identify that individual by name on request rather than printing the name here, which is what PIPEDA's accountability principle asks of us. Ask at the same address and we will tell you who it is.

Marketing and CASL

Canada's Anti-Spam Legislation is strict, and rightly so. We do not send marketing email to anyone who has not asked for it.

• Ticking the marketing box on a form is express consent, and we record when you gave it
• Every marketing message identifies us, gives our contact details, and has a working unsubscribe link
• Unsubscribes take effect immediately
• We never buy, rent or scrape contact lists

Replying to your enquiry is not marketing, and happens regardless of whether you ticked the box.

Children's data

This site is for businesses. We do not knowingly collect information from anyone under 16. If you believe a child has sent us information, email us and we will delete it.

If something goes wrong

Where a breach affects client data, TecZila notifies the client within 48 hours of becoming aware. Regulatory notification follows the applicable law — PIPEDA to the Privacy Commissioner of Canada where there is real risk of significant harm, and GDPR within 72 hours where applicable.

We will tell you what happened, what information was involved, what we are doing about it, and what you should do — in plain language, not a press statement.

Changes

We update this policy when what we do changes. The last-updated date at the top always reflects the current version. If a change materially affects your rights, we will say so prominently rather than quietly reposting.