1. Scope and acceptance
This policy explains how Thornwell Media ("Thornwell", "we", "our") handles personal information collected through thornwellmedia.com, our newsletters, our proposals, and our client engagements. By using this site or contacting us, you accept the terms of this policy. If you do not agree, please do not use the site or send us inquiries.
We operate as a Canadian agency and follow the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), and applicable provincial privacy law. Where a client engagement is governed by GDPR, CCPA, or another regime, the engagement-specific data processing addendum will apply alongside this policy.
2. Information we collect
We collect three categories of information:
- Information you give us. Name, company, role, email, phone, and the contents of any brief or message you send through our forms, by email, or in working sessions.
- Information collected automatically. IP address, browser type, device, referring URL, pages viewed, and approximate geographic region. We use this to operate the site, prevent abuse, and improve content.
- Information from clients. Where we operate marketing programs on behalf of a client, we may handle data the client has authorized us to access (analytics views, ad accounts, CRM exports). We process that data only for the engagement and under the agreement signed with the client.
3. How we use information
We use personal information for the following purposes:
- Responding to inquiries and preparing tailored briefs.
- Sending newsletters and updates you have asked to receive.
- Operating, securing, and improving the site.
- Delivering services under a signed engagement agreement, including analytics, content, advertising, and reporting.
- Meeting legal, accounting, and audit obligations, and enforcing our agreements.
We do not sell personal information. We do not buy lists. We do not run undisclosed reputation campaigns or astroturf reviews on behalf of a client.
5. Third-party processors
We rely on a short list of vetted processors to operate the site and deliver services. These currently include:
- Hosting and content delivery. Vercel (United States) for site hosting and edge delivery.
- Email and CRM. Standard business email and CRM tooling for inquiries and proposals.
- Analytics. Privacy-respecting analytics where deployed.
Each processor handles data under its own published terms and only for the purpose we have engaged it for. We do not authorize processors to repurpose your data.
6. Retention
We retain inquiry and proposal data for up to twenty-four months after last contact, and engagement records for as long as the relationship is active plus seven years for accounting and audit. You can request earlier deletion at any time using the contact below.
7. Your rights
You have the right to:
- Access the personal information we hold about you.
- Request correction of inaccurate information.
- Request deletion of information, subject to retention obligations.
- Withdraw consent for marketing communications at any time, by replying "unsubscribe" to any newsletter or by emailing us.
- File a complaint with the Office of the Privacy Commissioner of Canada.
8. Security
We use access controls, encryption in transit, and internal review before any new processor is added. No system is perfectly secure. If a breach affects your information, we will notify you and the relevant authority on the timeline required by law.
9. Children
The site and our services are not directed to children under sixteen. We do not knowingly collect information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
10. Changes to this policy
We may update this policy as our processors, services, or legal obligations change. The version date below indicates the most recent revision. Material changes will be communicated by a notice on this page or by email if we hold one.
11. Contact
For privacy questions, data access requests, or complaints, contact us at hello@thornwellmedia.com. We respond within one business day and aim to resolve formal requests inside thirty days.