JJHicks.com (“JJHicks”, “I”, “me”, “my”) provides business technology coaching in person in Northeastern British Columbia and remotely. This policy explains what personal information I collect, why I collect it, how I use and protect it, and the choices you have.
I follow British Columbia’s Personal Information Protection Act (PIPA), and Canada’s Anti-Spam Legislation (CASL) for email. Other privacy laws may also apply, depending on where you live.
Who is responsible
[Legal business name], operating as JJHicks.com, is responsible for the personal information described here. My privacy officer answers privacy questions and handles access requests and complaints:
John Hicks, Privacy Officer
Email: [email protected]
Phone: [Phone number]
Mail: [Business mailing address], British Columbia, Canada
Information I collect
Information you give me
- Free Business Tech Check-In request: your first and last name, email address, and community. Optionally your phone number, business name, type of business, preferred session format (in person or remote), topics of interest and any message you include.
- Business Technology Readiness Checklist: your first name and email address.
- Email, phone and coaching sessions: what you tell me while we arrange or work through a coaching engagement. That can include details about your business, your staff contacts, and the tools and systems you use.
Information collected automatically
- Website server logs: my web host records basic technical information for security and troubleshooting, such as your IP address, browser type, the pages you request and the date and time.
- Spam protection: the forms use Cloudflare Turnstile to tell real people from automated bots. Turnstile processes technical signals such as your IP address and browser details. It is not used for advertising.
- Email activity: if you are on my mailing list, Brevo records whether messages are delivered, opened or clicked. I use this to keep the list healthy and the emails useful.
I do not use advertising cookies or sell personal information. [If you add analytics, describe it here, e.g. “I use privacy-focused analytics that do not set cookies.”]
Information I avoid collecting
My coaching is about helping you understand and control your own technology. I will never ask you to send me your passwords, multi-factor codes or recovery keys. When we work hands-on, you sign in yourself. Where I need temporary access, we set up a separate account or delegated access that you can remove at any time.
Please don’t put passwords, payment card numbers or other sensitive information in the website forms.
How I use your information
- To reply to your check-in request, arrange a time and deliver the coaching you ask for
- To send you the checklist you requested and any follow-up emails you agreed to
- To prepare plain-language notes, summaries and recommendations for your business
- To send invoices and keep the business records the law requires
- To protect the website and forms from spam, abuse and security threats
- To improve my services, using summary information that doesn’t identify you
I only use personal information for the purposes described here, or for other purposes you agree to, or where the law permits or requires it.
Consent
I collect, use and disclose personal information with your consent, except where PIPA allows otherwise. You give consent when you submit a form, sign up for the checklist, or contact me and share information for a stated purpose.
You can withdraw your consent at any time by contacting me. If you do, I will explain any effect this has, for example that I can’t continue a coaching engagement without a way to contact you. Some records may still need to be kept for legal or tax reasons.
Email and CASL
I only send marketing emails, such as tips, updates or offers, if you have given express consent. For the checklist, that means confirming your sign-up through the link in a confirmation email (double opt-in).
If you request a check-in, I will reply about that request. That reply is not marketing, and requesting a check-in does not sign you up for my mailing list.
Every marketing email includes my business name, contact information and an unsubscribe link. Unsubscribe requests are processed within 10 business days, as CASL requires, and usually right away.
Who I share information with
I do not sell, rent or trade personal information. I share it only with service providers that help me run the business, and only as much as they need:
| Provider | Purpose | Where data is stored |
|---|---|---|
| Brevo | Contact forms, contact database and email delivery | European Union (France, Germany and Belgium) |
| Cloudflare, Inc. | Spam and bot protection on forms (Turnstile) | Global network; may include the United States |
| [Web host name] | Website hosting and server logs | [Country] |
| [Email provider, e.g. Microsoft 365 or Google Workspace] | Business email and files | [Country/region] |
| [Accounting or booking software, if used] | Invoicing or scheduling | [Country] |
These providers may store or process information outside Canada. That means it may be accessible to authorities in those countries under their laws. I choose providers with strong security practices and contractual privacy commitments.
I may also disclose personal information when the law requires it, for example in response to a court order or subpoena, or as PIPA otherwise permits.
How long I keep information
- Check-in requests that don’t become clients: up to 24 months, then deleted
- Client records and coaching notes: for the length of the engagement plus up to 7 years, to meet tax and business-record obligations
- Mailing list contacts: until you unsubscribe. After that, I keep only a record of the unsubscribe so you are not emailed again.
- Website server logs: as long as my web host keeps them, normally [30 to 90] days
If I use your personal information to make a decision that directly affects you, I keep it for at least one year after that decision, as PIPA requires. When information is no longer needed, I securely delete it or make it anonymous.
How I protect information
Protecting business information is central to what I teach, and I apply the same practices myself:
- Multi-factor authentication on every account that holds client or contact information
- A password manager and unique passwords for every system
- Encrypted devices, automatic screen locks and up-to-date software
- Access limited to the people who need it, which today is me
- Encrypted connections (HTTPS) for the website and forms
- A written plan for responding to a suspected privacy breach
No system is perfectly secure. If a privacy breach happens that creates a real risk of significant harm to you, I will notify you and the appropriate authorities as the law requires, and explain what I’m doing about it.
Your rights
You can ask to see the personal information I hold about you, how it has been used, and who it has been disclosed to. You can also ask me to correct it if it is wrong or incomplete.
To make a request, email or write to my privacy officer with enough detail for me to find the information. I will respond within 30 business days, as PIPA requires. If I need more time, I will tell you why and when to expect a response. There is usually no charge.
Questions and complaints
If you have a concern about how I’ve handled your personal information, please contact me first. I will look into it and respond.
If you’re not satisfied with my response, you can contact the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca.
Children
My services are for businesses and organizations. I do not knowingly collect personal information from children under 16.
Links to other websites
My website and emails may link to other sites, such as software vendors or government resources. Their privacy practices are their own, so please review their policies.
Changes to this policy
I may update this policy as my services or the law change. The effective date at the top shows when it was last updated. If a change significantly affects how I use information you’ve already given me, I will tell you and ask for your consent where required.