Privacy Policy

Effective Date: July 6, 2026

1. Introduction and Company Information

This Privacy Policy explains how NorthPeak Social Studio (“NorthPeak Social Studio,” “we,” “us,” or “our”) collects, uses, discloses, stores, and protects personal information in connection with our social media marketing and studio services (the “Services”). We are committed to protecting personal information in accordance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, substantially similar provincial privacy laws.

NorthPeak Social Studio is located at:

NorthPeak Social Studio
245 King Street West, Suite 1800
Toronto, ON M5V 1J5
Canada

Contact details:

• Email: [email protected]
• Phone: +1 (416) 782-5943

This Privacy Policy applies to personal information we collect through our website, email communications, social media channels, client onboarding, project management tools, advertising platforms, analytics tools, and any other interactions related to our Services.

2. Data Collection and Processing

We may collect, use, and process the following categories of personal information, depending on how you interact with us:

• Identification and contact information: name, email address, phone number, company name, job title, mailing address, and other contact details.
• Account and communication information: messages, inquiries, feedback, support requests, meeting notes, and correspondence.
• Business and project information: brand materials, campaign objectives, content preferences, audience details, approvals, and related business data provided by clients.
• Technical and usage information: IP address, browser type, device identifiers, operating system, pages viewed, referring URLs, timestamps, and interaction data collected through cookies or similar technologies.
• Social media and advertising data: profile information, engagement metrics, campaign performance data, audience insights, and platform analytics obtained through authorized integrations.
• Billing and transaction information: invoicing details, payment status, and records necessary for accounting and tax purposes.

We generally collect personal information directly from you, from your authorized representatives, from our clients, from service providers acting on our behalf, and from third-party platforms or tools that you or our clients authorize us to use.

We may also process personal information using automated tools for analytics, campaign optimization, audience segmentation, reporting, fraud prevention, and service improvement. Where required by law, we will obtain appropriate consent before using cookies or similar technologies that are not strictly necessary.

3. Purpose of Data Processing

We use personal information for the following purposes:

• to provide, manage, and improve our Services;
• to communicate with clients, prospects, and website visitors;
• to create, manage, and optimize social media and marketing campaigns;
• to analyze performance, engagement, and audience trends;
• to personalize content, recommendations, and user experiences;
• to process payments, issue invoices, and maintain accounting records;
• to administer contracts, onboarding, and client relationships;
• to maintain security, prevent fraud, and protect our systems and users;
• to comply with legal, regulatory, tax, and record-keeping obligations;
• to enforce agreements and protect our legal rights;
• to send administrative updates, service notices, and, where permitted, marketing communications;
• to conduct internal reporting, business planning, and service development.

4. Legal Basis for Processing

We process personal information only where permitted under applicable law. Depending on the context, our legal bases may include:

• Consent: where you have given clear consent for us to process your personal information for a specific purpose, including certain marketing communications and optional cookies.
• Performance of a contract: where processing is necessary to enter into or perform a contract with you or our client.
• Legal obligation: where processing is necessary to comply with applicable laws, regulations, court orders, or lawful requests.
• Legitimate interests: where processing is reasonably necessary for our business operations, provided such interests are not overridden by your rights and interests. This may include service improvement, fraud prevention, analytics, and security.
• Other lawful grounds: as otherwise permitted under Canadian privacy laws.

Where consent is the basis for processing, you may withdraw that consent at any time, subject to legal or contractual restrictions and reasonable notice.

5. Data Sharing and Third Parties

We may disclose personal information to third parties in the following circumstances:

• Service providers: hosting providers, cloud storage providers, analytics providers, email delivery services, payment processors, accounting tools, customer relationship management platforms, project management tools, and IT/security providers.
• Advertising and social media platforms: platforms used to run, measure, or optimize campaigns, subject to their own terms and privacy practices.
• Professional advisors: lawyers, accountants, auditors, insurers, and consultants.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar transaction.
• Legal and regulatory authorities: where required or permitted by law, including to respond to lawful requests or protect rights, safety, and property.
• Clients and authorized stakeholders: where necessary to deliver Services, report on campaign performance, or obtain approvals.

We require third parties that process personal information on our behalf to use appropriate safeguards and to process personal information only for authorized purposes. However, some third-party platforms may independently collect and use information under their own privacy policies.

6. Data Transfer to Third Countries

Some of our service providers, platforms, or tools may be located outside Canada, including in the United States or other jurisdictions. As a result, personal information may be transferred to, stored in, or accessed from countries outside Canada.

When personal information is transferred outside Canada, it may be subject to the laws of those jurisdictions and may be accessible to courts, law enforcement, or regulatory authorities in those countries. We take reasonable steps to ensure that appropriate contractual, technical, and organizational safeguards are in place to protect personal information during such transfers, in accordance with applicable Canadian privacy requirements.

7. Storage Duration

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, to comply with legal, accounting, or reporting obligations, to resolve disputes, and to enforce agreements.

Retention periods may vary depending on the type of information and the context in which it was collected. In general:

• client and contract records are retained for the duration of the relationship and for a reasonable period thereafter;
• billing and tax records are retained as required by applicable law;
• marketing and communications data are retained until no longer needed or until you withdraw consent or object where applicable;
• technical logs and analytics data are retained for a limited period necessary for security, troubleshooting, and performance analysis.

When personal information is no longer required, we will securely delete, destroy, anonymize, or de-identify it, as appropriate.

8. User Rights

Subject to applicable law, you may have the following rights regarding your personal information:

• Access: to request confirmation of whether we hold personal information about you and to obtain a copy of that information.
• Rectification: to request correction of inaccurate, incomplete, or outdated personal information.
• Erasure: to request deletion of personal information, where permitted by law.
• Restriction: to request that we limit the processing of your personal information in certain circumstances.
• Data portability: to request a copy of certain personal information in a structured, commonly used, and machine-readable format, where applicable.
• Objection: to object to certain processing activities, including processing based on legitimate interests or direct marketing, where applicable.

To exercise any of these rights, please contact us using the details provided in Section 12. We may need to verify your identity before responding. We will respond within the time required by applicable law or, if no specific period applies, within a reasonable time.

9. Withdrawal of Consent

Where we rely on your consent to process personal information, you may withdraw that consent at any time by contacting us or by using any available unsubscribe or preference-management mechanism.

Please note that withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. In some cases, we may still be permitted or required to continue processing personal information on other legal grounds.

10. Right to Complain

If you have concerns about our privacy practices, we encourage you to contact us first so we can try to resolve the issue.

You may also have the right to file a complaint with the Office of the Privacy Commissioner of Canada or, where applicable, a provincial privacy regulator. For more information, please visit the relevant privacy commissioner’s website or contact the appropriate authority in your jurisdiction.

11. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification. These measures may include:

• access controls and role-based permissions;
• password protection and multi-factor authentication where available;
• secure storage and encrypted transmission where appropriate;
• staff confidentiality obligations and privacy training;
• monitoring and logging of system activity;
• vendor due diligence and contractual safeguards.

However, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee absolute security, but we take reasonable steps to reduce risk and respond appropriately to suspected incidents.

12. Contact Information

If you have questions, requests, or concerns about this Privacy Policy or our handling of personal information, please contact:

NorthPeak Social Studio
245 King Street West, Suite 1800
Toronto, ON M5V 1J5
Canada
Email: [email protected]
Phone: +1 (416) 782-5943

13. Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations. When we make material changes, we will take reasonable steps to notify you, such as by posting the updated policy on our website or by other appropriate communication methods.

The updated Privacy Policy will be effective as of the date indicated at the top of this page unless otherwise stated. We encourage you to review this Privacy Policy periodically to stay informed about how NorthPeak Social Studio protects personal information.