Privacy Policy

1. Introduction

This Privacy Policy describes how Bonesbeauty ("we," "us," or "our") collects, uses, stores, shares, and protects personal data when you visit our website at bonesbeauty.world (the "Website") or interact with our smart meal planning services. We are committed to protecting your privacy and processing personal data in accordance with applicable data protection legislation, including the General Data Protection Regulation (GDPR) where applicable, the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, and other relevant international privacy frameworks.

By accessing or using the Website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please discontinue use of the Website and refrain from submitting personal data through our contact forms or other channels.

2. Data Controller Information

The data controller responsible for your personal data is:

Bonesbeauty
486 Front Street W
Toronto, ON M5V 0V2
Canada
Phone: +1 416-306-8306
Email: touch@bonesbeauty.world

For any privacy-related inquiries, requests to exercise your data subject rights, or complaints regarding our data processing practices, please contact us using the details above. We aim to respond to all privacy inquiries within thirty calendar days.

3. Personal Data We Collect

3.1 Information You Provide Directly

When you use our contact form, request meal planning services, or communicate with us by email or phone, we may collect the following categories of personal data:

Full name
Email address
Phone number (if provided voluntarily)
Message content and inquiry details
Household and food preference information shared during consultations
GDPR consent confirmation and timestamp

3.2 Information Collected Automatically

When you browse the Website, we may automatically collect certain technical data through cookies and similar technologies, subject to your consent preferences:

IP address (anonymized where possible)
Browser type and version
Operating system
Referring URL and exit pages
Date and time of visit
Pages viewed and time spent on each page
Device type and screen resolution

3.3 Payment Information

If you purchase meal planning services, payment processing is handled by third-party payment processors. We do not store complete credit card numbers on our servers. Payment processors may collect billing name, billing address, and transaction details in accordance with their own privacy policies.

4. Purposes of Data Processing

We process your personal data for the following specific purposes and on the following legal bases:

Responding to inquiries: To read, evaluate, and respond to messages submitted through our contact form or direct email correspondence. Legal basis: consent and legitimate interest in communicating with prospective clients.
Service delivery: To prepare, customize, and deliver meal planning materials based on information you provide during consultations. Legal basis: performance of a contract or pre-contractual steps at your request.
Website functionality: To ensure the Website operates correctly, including cookie consent management and form validation. Legal basis: legitimate interest and, where applicable, consent.
Analytics: To understand how visitors interact with the Website and improve content and navigation, only when you have consented to analytics cookies. Legal basis: consent.
Marketing: To send promotional communications about our services, only when you have consented to marketing cookies or explicitly opted in to receive marketing emails. Legal basis: consent.
Legal compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests. Legal basis: legal obligation.
Fraud prevention: To detect and prevent fraudulent transactions or unauthorized access to our systems. Legal basis: legitimate interest.

5. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law. Our standard retention periods are as follows:

Contact form submissions: Twelve months from the date of submission, unless an ongoing service relationship exists.
Client service records: Three years from the date of last service delivery, to support potential follow-up requests and maintain service continuity records.
Payment and invoicing records: Seven years, in accordance with Canadian tax and accounting requirements.
Cookie consent preferences: Twelve months, after which we will request renewed consent.
Analytics data: Twenty-six months from the date of collection, when analytics cookies are accepted.
Marketing consent records: Until you withdraw consent, plus an additional three years to demonstrate compliance with consent requirements.

When retention periods expire, personal data is securely deleted or anonymized so that it can no longer be associated with an identifiable individual.

We do not sell your personal data to third parties. We may share personal data with the following categories of recipients, strictly for the purposes described in this policy:

Service providers: Hosting providers, email delivery services, payment processors, and analytics platforms that process data on our behalf under data processing agreements.
Professional advisors: Lawyers, accountants, or auditors when necessary for legal compliance or business operations.
Law enforcement: When required by applicable law, court order, or governmental authority.

All third-party processors are contractually obligated to implement appropriate technical and organizational security measures and to process personal data only according to our documented instructions.

7. International Data Transfers

Your personal data is primarily processed and stored on servers located in Canada. If we transfer personal data to countries outside the European Economic Area (EEA) or to countries without an adequacy decision, we implement appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or rely on other lawful transfer mechanisms to ensure your data receives an equivalent level of protection.

8. Security Measures

We implement technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

HTTPS encryption for all data transmitted between your browser and our servers
Access controls limiting personal data access to authorized personnel only
Regular security assessments of our hosting infrastructure
Secure password policies for internal systems
Encrypted storage for sensitive client records
Incident response procedures for potential data breaches

While we strive to protect your personal data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security but commit to notifying affected individuals and relevant authorities of any data breach as required by applicable law.

9. Your Data Subject Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Request correction of inaccurate or incomplete personal data.
Right to erasure: Request deletion of your personal data when it is no longer necessary for the purposes collected, or when you withdraw consent.
Right to restrict processing: Request that we limit how we use your personal data in certain circumstances.
Right to data portability: Receive your personal data in a structured, commonly used, machine-readable format.
Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent: Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
Right to lodge a complaint: File a complaint with a supervisory authority, such as the Office of the Privacy Commissioner of Canada or your local data protection authority in the EEA.

To exercise any of these rights, contact us at touch@bonesbeauty.world. We may request verification of your identity before processing your request. We will respond within thirty calendar days unless an extension is permitted by applicable law.

10. Children's Privacy

The Website and our services are not directed at individuals under the age of sixteen. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will take steps to delete such information promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The updated version will be posted on this page with a revised "Last updated" date. We encourage you to review this policy periodically. Material changes will be communicated through a notice on the Website or, where appropriate, by email to registered clients.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact:

Bonesbeauty
486 Front Street W, Toronto, ON M5V 0V2, Canada
Phone: +1 416-306-8306
Email: touch@bonesbeauty.world