Privacy Policy

1. Introduction and Scope

Dft Sustainable Solution Inc. respects the privacy of every person who visits this website, contacts our office, takes part in a field program or engages us for professional services. This policy describes the personal information we handle, the reasons we handle it, the choices available to you and the safeguards we apply. The developer and operator of this website is DFT Sustainable, working as part of Dft Sustainable Solution Inc. from the Ottawa office. The policy applies to the website located at dftsustainable.hair, to our email and telephone channels, to our audit and retrofit engagements, to community walk desks and to school visit sittings.

We handle personal information in accordance with the privacy laws that apply to our operations in Canada, including the Personal Information Protection and Electronic Documents Act and applicable provincial privacy legislation. Where a client engagement is subject to additional contractual privacy terms, those terms apply alongside this policy and, in the event of a conflict, the stricter protection prevails.

This policy does not apply to third party websites that we do not control, even where we link to them. It also does not cover information that has been fully anonymised so that no individual can be identified, because anonymised information is not personal information.

2. Who We Are

The organisation responsible for the personal information described in this policy is Dft Sustainable Solution Inc. Our registered and operating address is 637 Makwa Pvt, Ottawa - K1K 5A3, Canada (CA). Our contact email address is alert@dftsustainable.hair and our contact telephone number is +17318793884.

Dft Sustainable Solution Inc. is a computer systems design and professional sustainability services practice. We design integrated systems that record, organise and report on environmental measurements, and we deliver field programs including waste audits, retrofit plans, community walks, energy checks, grant reviews and school visits. This combination means that we handle two broad categories of information: information about people who interact with our business, and information contained in the audit records we produce for clients.

Our privacy lead can be reached through the contact details above. Requests relating to access, correction, deletion or withdrawal of consent should be directed to the privacy lead and will be acknowledged promptly.

3. Information We Collect

We collect only the information that is necessary for the purpose at hand. The categories below describe what we may collect, depending on how you interact with us.

Contact information

When you send a message through our contact form, write to our email address or telephone the office, we may receive your name, email address, telephone number, organisation name, job title and the content of your message. The contact form on this website prepares a message in your own email client; it does not transmit your details to a server operated by us.

Engagement information

When you engage us for a program, we collect the information needed to deliver it, including site addresses, facility contact details, utility records, hauler invoices, building schedules and any prior reports you choose to share. This information is used to plan field work, prepare deliverables and maintain the audit trail associated with your engagement.

Field participation information

Participants in community walk desks and school visit sittings may provide their name, a contact detail, a class or group identifier and their observations recorded on paper sheets or tablets. We do not collect images, audio or video of participants unless a separate written consent has been obtained for a specific purpose.

Technical information

Our web host may record standard technical information such as browser type, approximate region, referring page and the pages requested. This information is used for security, performance and aggregate reporting and is not used to build individual visitor profiles.

4. How We Collect Information

We collect personal information directly from you in most cases. You provide it when you complete a contact form, send an email, telephone the office, register for a community walk, enrol a class in a school visit sitting or sign an engagement agreement. We may also collect information indirectly when a client provides the details of its staff so that we can arrange site access, and when a public partner provides participant lists for a jointly organised walk.

In field programs we collect observations in two forms at once. Participants record notes on a printed sheet, and our staff enter the same observations into a digital log while the session is still in progress. The paper sheet is the working record during the walk and the digital log is the record we retain, which allows us to resolve unclear notes with the person who wrote them before the group disperses.

We do not purchase personal information from data brokers, and we do not collect personal information from social media profiles as part of our normal operations.

5. Why We Use Personal Information

We use personal information for the following purposes. Each purpose is limited to what is reasonably necessary, and we do not repurpose information for an unrelated purpose without a new basis for doing so.

• To respond to enquiries, schedule visits and manage the relationship with clients and partners.
• To plan, deliver and document audit programs, retrofit plans, walks, energy checks, grant reviews and school visits.
• To prepare deliverables such as reports, tracking systems and dashboards, including aggregated measurements that do not identify individuals.
• To issue invoices, maintain financial records and meet accounting and tax obligations.
• To protect the security of our systems, prevent misuse and investigate incidents.
• To meet legal obligations, respond to lawful requests and enforce our agreements.
• To send service updates and, where consent has been given, occasional information about new program offerings.

Where information is used for reporting, we aggregate and de-identify it. A waste audit report names a facility and the weight of each stream; it does not name the custodian who carried the bags or the residents who took part in a walk.

6. Legal Bases for Processing

We rely on consent, contract, legal obligation and legitimate interest as the bases for processing personal information. Consent is the basis for optional communications, for participation in community walks and for the collection of any information that is not required to deliver a service. Contract is the basis where processing is necessary to perform an engagement we have agreed with you or with your organisation. Legal obligation applies to records we must keep for tax, accounting and regulatory purposes. Legitimate interest applies to the security of our systems and to the improvement of our professional services, and we balance that interest against your rights before relying on it.

You may withdraw consent at any time where consent is the basis for processing. Withdrawal does not affect processing that already took place, and it may mean that we can no longer provide an optional program, for example a community walk in which you had registered to take part.

7. Field Programs and Community Walks

Community walk desks are public events, and some incidental observation is unavoidable in any public setting. Our staff are instructed not to record the identity of residents who are not taking part, not to photograph private property and not to note personal details that are not relevant to the route observations. Walkers who register in advance provide contact details so that we can send them a summary of the route findings.

The observations collected during a walk concern the built environment rather than people. Walkers record the condition of bins, crossings, drainage, shade and litter on a printed sheet, and these observations become mapped data. Where a walker writes a personal note on a sheet, our staff remove the note before entry unless the walker has expressly asked us to keep it.

If a walk is co-hosted with a municipality or community association, we share the mapped results and the prioritised list of improvements, not the names of individual participants. The partner receives what it needs to act on the findings and nothing more.

8. School Visit Sittings and Minors

School visit sittings involve students, and students are frequently minors. We take particular care with information relating to children. A school books the session through a teacher or administrator, and that adult remains the point of contact for the session. We ask the school to obtain whatever permission its own policy requires before students take part.

During a sitting, students record the contents of a lunchroom waste stream on a tablet that we provide. The tablet form collects the weight of a sorting category, not the identity of the student. A class or group identifier may be entered so that the school can compare results across terms, and a student name is not required for that comparison.

We do not create profiles of individual students, we do not use school data for marketing, and we do not retain student identifiers after the term summary has been delivered to the school unless the school requests otherwise in writing. Any information we do hold about a student is available to a parent or guardian on request through the school.

9. Cookies and Website Technology

This website is built as a set of plain documents and load a single stylesheet and a single script. We do not set advertising cookies, we do not use cross-site tracking pixels and we do not embed third party analytics services that build behavioural profiles. The web host may record ordinary server logs for security and reliability purposes, and those logs may contain the technical information described in section three.

The script on the site handles navigation, reveal animations, the expandable questions on the contact page and the preparation of a mail draft from the contact form. It does not transmit form contents to a server and it does not store anything in your browser beyond the memory of the current page session.

If our practices change and a cookie becomes necessary, we will describe the purpose in this policy before the cookie is set and, where consent is required, ask for it.

10. Sharing With Service Providers

We share personal information with a small number of service providers that help us operate. These include our email provider, our web hosting provider, accounting support and, where an engagement requires it, specialist laboratories or certified technicians. Each provider receives only the information needed for its function and is bound to use it only for that function.

We do not sell personal information. We do not trade contact lists. We do not share information with advertisers. Where a client engagement requires us to work alongside another consultant, we will ask the client before sharing any information that is not already part of the agreed scope.

We may disclose personal information where we are required to do so by law, by a court order or by a lawful request from a public authority, and where disclosure is necessary to protect a person from serious harm. In the event of a restructuring of the business, information may be transferred to a successor entity that agrees to be bound by this policy.

11. Client Data and Audit Records

Audit records belong to the client on whose site the audit takes place. Dft Sustainable Solution Inc. acts as a service provider for that data and processes it under the engagement agreement. The client decides what the records may be used for beyond the agreed deliverables. If you are an employee of a client and you have a question about information recorded during an audit of your workplace, you should direct the question to your employer in the first instance, and we will cooperate with any request the employer makes.

Our own copies of audit records are kept so that we can respond to questions, re-measure a baseline on a return visit and demonstrate the integrity of our work. We retain these copies only for as long as the engagement and the applicable records policy require, as described in the next section.

Where a client asks us to design a tracking system that holds records on its own infrastructure, the records live in the client environment and our access is limited to the support arrangements set out in the agreement.

12. Retention of Information

We keep personal information only as long as it is needed for the purpose for which it was collected. Contact enquiries that do not lead to an engagement are generally kept for twelve months so that we can answer follow-up questions, and are then deleted. Engagement records, including audit deliverables and financial documents, are kept for seven years in line with ordinary accounting and tax practice, and may be kept longer where a contract requires it.

Community walk registration details are kept until the route summary has been sent, after which they are deleted unless the participant has asked to hear about future walks. School term summaries are retained by the school and by us for the school year in which they were produced, and are then reduced to anonymous aggregates.

When a retention period ends, information is deleted or made permanently unreadable. Backups that contain the information are overwritten on their own cycle, which is short and does not exceed thirty days.

13. Security Measures

We protect personal information with administrative, technical and physical safeguards. Access to engagement files is limited to staff who need it for their role. Accounts are protected with strong passwords and multi factor authentication where the provider supports it. Devices are encrypted. Paper field sheets are kept in a locked area while in use and are scanned and shredded once the digital record has been verified.

Our field staff are trained to handle participant information carefully and to leave no paper behind on site. Deliverables sent by email are transmitted over encrypted connections where the recipient supports them, and larger data sets are shared through an access controlled link.

No safeguard is perfect. If a privacy breach occurs and it creates a real risk of significant harm, we will notify affected individuals and the appropriate regulator without unreasonable delay, and we will describe what happened and what we have done about it.

14. Your Privacy Rights

You have the right to be informed about the personal information we hold, to request access to it, to ask for corrections and to withdraw consent where consent is the basis for processing. You also have the right to ask us to delete information that we no longer have a lawful reason to keep, and to object to processing that relies on legitimate interest.

To exercise a right, contact the privacy lead using the email address or telephone number in this policy. We may need to confirm your identity before acting on a request, and we will tell you what we need. We respond to access requests within thirty days, and we will contact you if a request is unusually complex and more time is required.

There is no charge for a reasonable access request. Where a request is manifestly unfounded or excessive, for example a request repeated within a short period without new grounds, we may decline it and explain why.

15. Access and Correction Requests

An access request should describe the information you are looking for and the period it relates to, so that we can locate it efficiently. We will provide a copy in a readable format and explain any information we have withheld and the reason for withholding it.

A correction request should identify the information you believe is inaccurate and provide the correct details. Where we agree, we will correct the record and, if the record has already been shared with a third party, take reasonable steps to inform that party. Where we do not agree, we will note your objection against the record so that the disagreement is visible to anyone who later relies on it.

Requests made on behalf of another person require written authority from that person, unless the request is made by a parent or guardian for a minor in their care or by a person holding a valid power of attorney.

16. International Transfers

Our office and records are located in Canada. Some service providers, such as our email host, may store data in another country. Where information is transferred outside Canada, we take reasonable steps to ensure that it remains protected by a comparable standard, whether through the provider contractual terms, a recognised adequacy decision or another lawful mechanism.

If an engagement requires information to travel across a border, for example where a client site is outside Canada, the engagement agreement describes the arrangement and the protections that apply. We do not transfer personal information to another country for any purpose that is not connected to the service we provide.

17. Marketing and Communications

We send service updates to clients and partners as part of an engagement. These updates relate directly to scheduled visits, deliverables and deadlines and are not marketing. We send information about new programs only where you have asked to receive it, and every such message includes a clear way to stop receiving it.

You can stop optional messages at any time by replying to the message, contacting the office or using the link included in every newsletter. A request to stop marketing does not prevent us from sending essential service messages about an active engagement, because those messages are necessary to deliver the service you have asked for.

We do not rent, sell or exchange contact lists, and we do not add walk participants or school contacts to a marketing list without their express request.

18. Third Party Links

This website and our reports may link to external resources such as grant portals, municipal services and partner organisations. Those websites operate under their own privacy policies, and we are not responsible for their practices. We encourage you to read the privacy notice of any site you visit before providing personal information.

Where a grant program requires you to submit information directly to a funding body, that body controls the information you submit. We can advise on what a program requires and help you prepare a submission, but we do not handle the submission on your behalf unless the engagement agreement says that we do.

19. Changes to This Policy

We review this policy at least once a year and whenever a significant change occurs in our practices, our service providers or the law. When we make a material change, we update the effective date at the top of the policy and, where the change affects an active engagement, we tell the client directly.

Continued use of this website after a change has been published indicates that you accept the updated policy. If you do not accept a change, you may contact us to discuss the matter or stop using the website. This policy is provided in English, and any translation is offered for convenience only, with the English version prevailing.

20. Complaints and Contact

If you are unhappy with how we have handled your personal information, please tell us first. We take complaints seriously and will investigate promptly. Send your complaint to the privacy lead at alert@dftsustainable.hair or telephone +17318793884, and include enough detail for us to understand what happened and when.

We aim to resolve complaints within thirty days and will write to you with the outcome. If you remain dissatisfied, you may contact the Office of the Privacy Commissioner of Canada or the privacy regulator in your province. We will cooperate fully with any investigation.

Written contact

This policy is published by Dft Sustainable Solution Inc. and forms part of the terms on which we offer our website and professional programs. It should be read together with our Terms of Service.