Hometown Websites (www.hometownwebsites.ca)
Effective date: October 21, 2026
Last updated: October 21, 2026
1. Who we are and what this Policy covers
This Privacy Policy (the "Policy") explains how Hometown Websites, a business of DB Capital Group (an unregistered sole proprietorship) ("Hometown Websites", "we", "us" or "our"), collects, uses, discloses, retains and safeguards personal information in connection with the website www.hometownwebsites.ca, our client portal, our website design, hosting and Care plan services, and our business-development outreach (together, the "Services").
"Personal information" means information about an identifiable individual, as defined in the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA") and the Personal Information Protection Act (British Columbia) ("PIPA"). We handle personal information in accordance with PIPA for collection, use and disclosure within British Columbia and in accordance with PIPEDA for commercial activities that cross provincial or national borders, and with any other privacy law that applies to a particular activity.
Client websites. When we build or host a website for a client, the client is responsible for the personal information collected through its own website (for example, through its contact form). We process that information only on the client's behalf and on its instructions, as described in our Website Design & Care Services Agreement.
2. Accountability and our Privacy Officer
We are responsible for personal information under our control, including information we transfer to service providers for processing. We have designated a Privacy Officer who is accountable for our compliance with this Policy and applicable privacy law.
Privacy Officer
Hometown Websites
Email: [email protected]
Phone: (778) 819-5696
Location: British Columbia, Canada
Please direct all privacy questions, access or correction requests, consent withdrawals and complaints to the Privacy Officer.
3. Personal information we collect
We collect only the personal information that is reasonably necessary for the purposes identified in section 4.
| Category | Examples | How we collect it |
|---|---|---|
| Enquiry information | Name, business name, email, phone number, package of interest, message, preferred contact time | Directly, through our contact form, email, phone or text |
| Client account and project information | Name, business name, role, email, phone, project brief, content and materials you supply, change requests, approvals | Directly, and through the client portal |
| Billing and payment information | Invoice details, amounts, payment method, payment confirmations, PayPal transaction references | Directly, and from PayPal or your financial institution (e-Transfer) |
| Business prospecting information | Business name, owner or manager name, business phone, business email and business address that are publicly listed (for example, on a Google Business Profile or the business's own website), plus notes of our calls and your contact preferences, including do-not-call and unsubscribe requests | From publicly available business sources and from our conversations with you |
| Technical information | IP address, browser and device type, pages visited, timestamps and security logs | Automatically, through our hosting and security provider |
We do not knowingly collect sensitive information such as health information, government identification numbers or full payment card numbers. Card and PayPal payments are processed on PayPal's own secure checkout; we never see or store your full card number. Cash payments are receipted.
4. Why we collect and use personal information
We collect, use and disclose personal information only for the following purposes, which we identify at or before the time of collection:
- To respond to enquiries and provide quotes;
- To enter into and perform our agreements, including building, hosting and maintaining websites and providing the Care plan;
- To operate the client portal, including secure one-time login links;
- To invoice, collect and record payments and meet tax and accounting obligations;
- To contact businesses about our services by phone, text or email in compliance with CASL and the CRTC Unsolicited Telecommunications Rules, and to honour do-not-call and unsubscribe requests;
- With your separate opt-in consent, to feature your completed website in our portfolio;
- To secure our systems, prevent fraud and abuse, and comply with law.
We will not use or disclose personal information for a new purpose without first identifying that purpose and, where required by law, obtaining your consent.
5. Consent
We obtain consent in a manner appropriate to the sensitivity of the information and your reasonable expectations. Consent may be express (for example, when you tick an unticked box to join our email list) or implied (for example, when you send us an enquiry and we reply to it). We rely on express consent for commercial electronic messages except where the Canada's Anti-Spam Legislation ("CASL") permits implied consent.
You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting the Privacy Officer or, for marketing messages, by using the unsubscribe mechanism in any message. We will explain the likely consequences of withdrawal (for example, that we may be unable to complete an order or project). We may collect, use or disclose personal information without consent only where PIPA or PIPEDA permits or requires it.
6. How we disclose personal information
We do not sell personal information. We do not rent or trade it. We disclose personal information only:
- to service providers that process it on our behalf under written terms that restrict their use of it to the services they provide to us and require appropriate safeguards (see the table below);
- where you direct us to do so;
- to professional advisers (such as accountants) under a duty of confidentiality;
- in connection with a business transaction (such as a sale or reorganisation of all or part of the business), subject to the protections in PIPA and PIPEDA; and
- where required or permitted by law, including to comply with a subpoena, warrant or court order, or to protect our legal rights.
Service providers (by category)
| Category | Provider(s) | What they do for us | Where data may be processed |
|---|---|---|---|
| Hosting, content delivery and security | Cloudflare, Inc. | Hosts our website, client portal and admin; protects against attacks; processes security logs | United States and global network |
| Business productivity and records | Google LLC (Google Workspace / Drive / Sheets) | Email, document storage, CRM and bookkeeping records | United States and other countries |
| Website fonts and maps | Google LLC (Google Fonts, Google Maps) | Delivers fonts and the embedded map; receives your IP address when the page loads | United States |
| Form delivery | FormSubmit (formsubmit.co) | Relays contact-form submissions to our email inbox | United States |
| Payment processing | PayPal Holdings, Inc. / PayPal Canada; your bank (Interac e-Transfer) | Processes card and PayPal payments; e-Transfers | Canada and United States |
| Domain registration | Cloudflare, Inc. (Cloudflare Registrar) or the registrar named in the client's agreement | Registers domain names in the client's name | United States |
Each provider's own privacy policy also governs its handling of information: Cloudflare (https\://www.cloudflare.com/privacypolicy/), Google (https\://policies.google.com/privacy), PayPal (https\://www.paypal.com/ca/legalhub/paypal/privacy-full) and FormSubmit (https\://formsubmit.co/).
7. Transfer of personal information outside British Columbia and Canada
Several of our service providers are located in, or store information in, the United States and other countries. When personal information is processed outside Canada it is subject to the laws of that jurisdiction and may be accessible to the courts, law enforcement and national security authorities of that jurisdiction. We use contractual and other measures to require a comparable level of protection while information is being processed by a provider, consistent with the Office of the Privacy Commissioner of Canada's Guidelines for processing personal data across borders (https\://www.priv.gc.ca/en/privacy-topics/airports-and-borders/gl_dab_090127/). You may contact the Privacy Officer for more information about our use of service providers outside Canada.
8. Retention and destruction
We keep personal information only as long as necessary to fulfil the purposes for which it was collected or as required by law, and then securely destroy, erase or anonymise it.
| Record | Retention period |
|---|---|
| Enquiries that do not become projects | 24 months after our last contact, then deleted |
| Client agreements, project files, invoices and payment records | For the term of the relationship and at least six years after the end of the last tax year to which they relate (Income Tax Act and Excise Tax Act record-keeping) |
| Prospecting records (business contact data and call notes) | 24 months after last contact, unless you become a client |
| Internal do-not-call list entries | At least 3 years and 14 days from the request, as the CRTC Unsolicited Telecommunications Rules require |
| CASL consent and unsubscribe records | For as long as we send messages to you and 3 years afterwards |
| Security logs | As set by our hosting provider, generally not more than 12 months |
| Breach records | At least 24 months |
Where we use personal information to make a decision that directly affects you, we retain it for at least one year after the decision, as PIPA s. 35 requires.
9. Safeguards
We protect personal information with security safeguards appropriate to its sensitivity, including: encrypted connections (TLS) on our websites; access limited to authorised personnel on a need-to-know basis; multi-factor authentication on administrative accounts; passwordless or strong authentication for client accounts where offered; reputable service providers with recognised security programs; and secure deletion when information is no longer required. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Privacy breach response
If we become aware of a breach of security safeguards involving personal information under our control, we will:
- Contain the breach immediately and take steps to limit further loss or access;
- Assess the type and sensitivity of the information, the number of people affected, and whether the breach creates a real risk of significant harm;
- Report the breach to the Office of the Privacy Commissioner of Canada as soon as feasible where PIPEDA requires it (https\://www.priv.gc.ca/en/report-a-concern/report-a-privacy-breach-at-your-organization/), and notify the Office of the Information and Privacy Commissioner for British Columbia where we determine it is appropriate or required;
- Notify affected individuals directly (or, where permitted, indirectly) as soon as feasible where there is a real risk of significant harm, explaining what happened, what information was involved, what we have done, and what you can do to reduce your risk;
- Notify any other organisation or government institution that may be able to reduce the risk of harm; and
- Record every breach, whether or not it is reportable, and keep that record for at least 24 months, as required by the Breach of Security Safeguards Regulations (https\://laws-lois.justice.gc.ca/eng/regulations/SOR-2018-64/).
11. Your rights: access, correction and complaints
Subject to the exceptions in applicable law, you have the right to:
- Access the personal information we hold about you, and be told how it has been used and to whom it has been disclosed;
- Correct personal information that is inaccurate or incomplete;
- Withdraw consent as described in section 5; and
- Complain about our handling of your personal information.
Send your request in writing to the Privacy Officer at [email protected]. We may need to verify your identity before responding. We will respond within 30 days (or within any other period that applicable law allows, including a permitted extension, of which we will notify you). Access is provided free of charge or at a minimal cost, which we will tell you in advance. If we refuse a request, we will explain why in writing and tell you how to challenge our decision. When information is corrected, we will, where appropriate, send the corrected information to organisations to which we disclosed it in the previous year.
If you are not satisfied with our response, you may contact:
- the Office of the Information and Privacy Commissioner for British Columbia (https\://www.oipc.bc.ca/); or
- the Office of the Privacy Commissioner of Canada (https\://www.priv.gc.ca/).
12. Cookies and similar technologies
Our website uses a small amount of browser storage (session storage) to remember interface preferences during your visit, and the client portal uses a strictly necessary session cookie to keep you signed in. We do not use advertising cookies or third-party analytics on hometownwebsites.ca at the date of this Policy. Embedded Google Fonts and Google Maps receive your IP address when a page loads. See our Cookie Notice for details and choices.
13. Electronic marketing
We send commercial electronic messages (email or text) only with your consent or where CASL permits implied consent, such as an existing business relationship or where your business email or number is conspicuously published and our message is relevant to your business role. Every message identifies Hometown Websites, provides our contact information and includes a working unsubscribe mechanism that we honour within 10 business days. We maintain an internal do-not-call list and honour do-not-call requests immediately during the call and in our records within 14 days.
14. Minors
Our Services are offered to businesses and are not directed to anyone under 19 (the age of majority in British Columbia). We do not knowingly collect personal information from minors.
15. Third-party websites
The Services may link to third-party websites and services that we do not control. Their privacy practices are governed by their own policies, and we encourage you to review them.
16. Changes to this Policy
We may update this Policy from time to time. We will post the updated Policy with a new "Last updated" date and, where changes are material, give reasonable notice (for example, by a notice on the website or by email). Changes apply prospectively.
17. Contact
Privacy Officer, Hometown Websites · [email protected] · British Columbia, Canada.
Official sources: PIPEDA (https\://laws-lois.justice.gc.ca/eng/acts/P-8.6/); PIPA (https\://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/03063_01); OPC (https\://www.priv.gc.ca/); OIPC BC (https\://www.oipc.bc.ca/); OPC cross-border guidelines (https\://www.priv.gc.ca/en/privacy-topics/airports-and-borders/gl_dab_090127/); OPC breach guidance (https\://www.priv.gc.ca/en/privacy-topics/business-privacy/breaches-and-safeguards/privacy-breaches-at-your-business/gd_pb_201810/); Breach of Security Safeguards Regulations (https\://laws-lois.justice.gc.ca/eng/regulations/SOR-2018-64/); CASL (https\://laws-lois.justice.gc.ca/eng/acts/E-1.6/).