Privacy policy

This policy explains what personal information YPK TECH collects through this website, why we collect it, how long we keep it and what rights you have. It is written to meet the requirements of the Personal Information Protection and Electronic Documents Act (PIPEDA).

Who we are

This website is operated by YPK TECH, trading as YPK TECH, in Ontario, Canada. Questions about this policy or about the personal information we hold can be sent to .

What we collect

• Information you give us. When you submit the contact form we collect your name, company, email address, an optional phone number, the service you selected and the content of your message.
• Consent evidence. With each submission we record the date and time, your IP address, the page address, your browser user agent, the exact consent wording shown to you and the version of the form. This is kept so that we can demonstrate the basis on which we contacted you.
• Attribution. If you arrived through a tagged link we record the campaign parameters and the referring page, so we know which channels bring enquiries.
• Server logs. Our hosting provider records standard web server logs, including IP address, request path, response code and user agent.

We do not ask for and do not want payment card numbers, government identification numbers, health information or any other sensitive category of personal information through this website.

Why we collect it

To answer your enquiry, to prepare a quote or proposal you asked for, to keep a record that you consented to be contacted, to protect the form from automated abuse, and to keep the site running securely. We do not use website enquiries for unrelated marketing, and we do not sell, rent or trade personal information to anyone.

How long we keep it

• Enquiries that do not become a client relationship: 24 months from the last contact, then deleted.
• Enquiries that become a client relationship: retained for the life of the relationship and for 7 years afterwards, to meet Canadian record keeping obligations.
• Consent records: retained for as long as we rely on them, and for 24 months afterwards.
• Web server logs: retained according to our hosting provider's standard schedule.

Cookies and tracking

This website sets one strictly necessary cookie, which carries the security token that protects the contact form from cross site request forgery. It contains no personal information and expires when you close the browser.

We load no advertising cookies, no analytics scripts, no session replay, no heat mapping, no chat widget and no social media pixels by default. If we ever add an optional analytics or advertising tag, the banner shown at the bottom of the page will ask first, rejecting will be exactly as easy as accepting, and nothing will load until you choose.

We honour the Global Privacy Control. If your browser sends the Sec-GPC signal we treat it as an instruction not to share or sell your information for advertising purposes, without asking you to confirm.

Your preference is stored locally in your own browser. Clearing your browser storage will make the banner appear again.

Where your information is held

Enquiry data is stored on servers operated by our hosting provider. Where the location of processing matters to you, ask us before submitting the form and we will tell you exactly where the data sits.

Who we share it with

Our hosting provider, as a processor, because the website and its database run on their infrastructure. Our email provider, because replying to you sends mail through it. Professional advisers or a regulator, where we are legally required to disclose. Nobody else.

How we protect it

The site is served only over HTTPS with HTTP Strict Transport Security. Form submissions are validated on the server, rate limited by address and protected by a cross site request forgery token and a timing check. Database queries use prepared statements. Credentials are stored outside the web root and are never present in anything sent to your browser.

Your rights

Under PIPEDA you may ask what personal information we hold about you, ask for a copy, ask for a correction, and withdraw consent for future contact. Write to us at the address above and we will respond within 30 days. If you are not satisfied with our answer you may complain to the Office of the Privacy Commissioner of Canada.

Breach notification

If a breach of security safeguards creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as required. We keep a record of every breach of security safeguards for 24 months, including those we assess as not reportable.

Text messages

We send text messages only to a number you supplied together with a separate, unticked consent box on the form. Consent to text messages is never a condition of any purchase. Message and data rates may apply. Reply STOP to any message to opt out, and we will stop within 10 business days at the latest, normally immediately.

Children

This website is intended for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 13. If you believe a child has submitted information through this site, contact us and we will delete it.

Changes

If this policy changes, the revised version is published here with a new last updated date. Material changes affecting how we use information already collected will be notified directly where we hold a contact address for you.