Privacy Policy

1. Personal Information We Collect

We collect only information reasonably required for legitimate business, professional, administrative, security, or legal purposes.

Information you provide directly may include:

• first and last name;
• business email address;
• telephone number;
• organization or company name;
• job title or professional role;
• industry;
• information included in an inquiry or engagement request;
• resources or assessments requested;
• communication preferences and marketing consent;
• information submitted through professional-resource or assessment forms; and
• other information you voluntarily provide when communicating with us.

When you request a professional resource, we may also record information associated with that request, including the resource requested, source page, brand source, request category, consent wording version, and delivery status.

2. Information Collected Automatically

Our website and service providers may automatically receive limited technical information necessary to operate, secure, and improve the website.

This may include:

• IP address;
• browser and device type;
• operating system;
• referring page or website;
• pages or resources accessed;
• date and time of requests;
• error, security, and diagnostic information; and
• other standard server or application logs.

The website may also use browser storage for functional preferences, such as remembering the user's selected display theme.

We do not use technical information to make automated employment, eligibility, credit, insurance, or similar consequential decisions about website visitors.

3. How We Use Personal Information

We may use personal information to:

• respond to inquiries;
• evaluate potential consulting or advisory engagements;
• communicate regarding requested services;
• deliver professional resources requested by the individual;
• administer assessments or expressions of professional interest;
• maintain business and professional correspondence;
• operate and improve our website;
• maintain CRM and contact records;
• understand which resources and services generate professional interest;
• maintain consent and communication-preference records;
• prevent fraud, misuse, abuse, or security incidents;
• meet accounting, legal, contractual, regulatory, and recordkeeping obligations; and
• send marketing or informational communications where we have an appropriate basis to do so.

We do not use a request for a professional resource as automatic consent to receive unrelated marketing communications.

4. Resource Requests and Transactional Communications

When you request a professional resource, assessment, document, or other material, we may use the email address you provide to fulfil that specific request.

This type of communication is operational or transactional in nature and is separate from optional consent to receive marketing communications.

Where a form asks you to confirm delivery to the email address provided, that confirmation applies to the requested resource or related service communication. It does not by itself enrol you in promotional communications.

5. Marketing Communications

Where offered, consent to receive marketing information, insights, updates, invitations, or other promotional communications is optional.

Marketing consent:

• is presented separately from required resource-delivery or service communications;
• is not preselected;
• is not required in order to request a professional resource unless expressly stated for a separate lawful purpose; and
• may be withdrawn at any time.

Commercial electronic messages sent by Black & Right will include appropriate identification information and an unsubscribe mechanism where required by law.

Unsubscribe requests will be processed in accordance with applicable Canadian anti-spam requirements.

6. HubSpot and Other Service Providers

Black & Right uses third-party technology providers to operate portions of its website, communications, CRM, resource-request, hosting, security, and administrative infrastructure.

For example, HubSpot may be used to:

• display and process website forms;
• maintain contact records;
• record resource requests;
• maintain communication preferences and consent information; and
• support related customer relationship management activities.

Information submitted through a HubSpot form may therefore be processed through HubSpot systems in addition to Black & Right systems.

We may also use other service providers for website hosting, email, document delivery, security, infrastructure, professional services, or similar operational purposes.

Service providers are permitted to process information only for purposes reasonably related to the services they provide to us, subject to applicable contracts and law.

7. International and Cross-Border Processing

Some service providers may process or store information outside British Columbia or outside Canada.

As a result, personal information may be accessible to courts, law-enforcement authorities, regulatory bodies, or other governmental authorities under the laws of the jurisdiction where it is processed or stored.

Where personal information crosses provincial or national borders in connection with commercial activities, applicable Canadian privacy obligations continue to apply.

8. Cookies and Similar Technologies

Our website may use cookies, browser storage, embedded service technologies, or similar mechanisms necessary to:

• operate website functionality;
• remember user preferences;
• process forms;
• maintain security;
• prevent abuse; or
• provide requested services.

Third-party services embedded in the website, including HubSpot, may use their own cookies or similar technologies in accordance with their applicable privacy practices.

Where consent is legally required for non-essential tracking, advertising, or similar technologies, such technologies should not be activated until the applicable consent has been obtained.

Black & Right does not currently rely on undisclosed third-party advertising pixels as a condition of accessing professional resources.

9. Disclosure of Personal Information

We do not sell or rent personal information.

We may disclose personal information:

• to technology or professional service providers acting on our behalf;
• when necessary to fulfil a request or provide a service;
• where required or permitted by law;
• in connection with legal, regulatory, audit, insurance, or security requirements;
• to protect the rights, property, systems, or safety of Black & Right or others; or
• in connection with a legitimate corporate transaction, subject to applicable privacy requirements.

We do not disclose personal information to third parties for unrelated marketing purposes without an appropriate legal basis.

10. Retention

We retain personal information only for as long as reasonably required for the purposes for which it was collected and for applicable legal, contractual, accounting, security, dispute-resolution, and recordkeeping requirements.

Retention periods may differ depending on the type of information.

For example, records associated with:

• inquiries;
• resource requests;
• consent;
• client engagements;
• accounting;
• legal matters; and
• security events

may have different retention requirements.

When information is no longer required, we may securely delete, anonymize, or otherwise dispose of it in accordance with applicable requirements.

11. Safeguards

We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information in our custody or control.

These may include:

• access controls;
• authentication;
• encryption where appropriate;
• role-based access;
• secure service providers;
• system monitoring;
• backup and recovery controls; and
• controlled disposal of information.

No internet-connected system can be guaranteed to be completely secure. We therefore cannot guarantee absolute security.

12. Privacy and Security Incidents

If Black & Right becomes aware of a privacy or security incident involving personal information, we will assess and respond to the incident in accordance with applicable legal requirements and our internal procedures.

Where notification to affected individuals, regulators, or other authorities is legally required, we will make the required notification.

13. Access and Correction

Subject to applicable law and permitted exceptions, you may request:

• access to personal information we hold about you;
• information about how that information has been used or disclosed;
• correction of inaccurate or incomplete personal information; and
• information concerning our privacy practices.

We may need to verify your identity before responding to a request.

14. Withdrawal of Consent and Deletion Requests

Where processing is based on consent, you may withdraw that consent, subject to legal or contractual restrictions and reasonable notice.

You may also request deletion of personal information.

Deletion is not absolute. We may retain information where necessary to meet legal, regulatory, contractual, accounting, security, dispute-resolution, evidentiary, or other lawful requirements.

Withdrawal of marketing consent does not prevent us from sending communications reasonably necessary to fulfil an existing request, administer a current engagement, respond to an inquiry, or satisfy legal obligations.

15. Business Contact Information

Some information is provided to us in a professional or business capacity.

Applicable privacy legislation may treat business contact information differently where it is collected, used, or disclosed solely for communicating with an individual in relation to their employment, business, or profession.

We nevertheless handle professional contact information responsibly and limit its use to legitimate business purposes.

16. Third-Party Websites

Our website may contain links to websites or services operated by third parties.

Black & Right is not responsible for the privacy practices, security, availability, or content of third-party websites.

You should review the privacy policy of any third-party service before providing personal information to it.

17. Children

Black & Right's website and professional services are directed toward organizations and adult professionals.

We do not knowingly design our professional-resource or engagement services for children or intentionally solicit personal information from minors through those services.

18. Verto Claritas

Black & Right may provide information about Verto Claritas through this website.

The public Black & Right website does not, by itself, authorize participation in a controlled Verto Claritas pilot, create a pilot participant record, or establish acceptance of controlled pilot terms.

Any future Verto Claritas participant onboarding, consent, data-use, validation, or controlled-access process is governed separately by the applicable Verto Claritas terms, privacy notices, consent records, and release controls.

19. Changes to This Policy

We may revise this Privacy Policy periodically to reflect changes in:

• our services;
• website functionality;
• technology providers;
• legal requirements; or
• privacy practices.

The current version will be made publicly available together with its effective or last-updated date.

Material changes may be communicated through additional means where appropriate.

20. Privacy Questions, Requests and Complaints

Questions, access requests, correction requests, consent withdrawals, privacy complaints, or other privacy-related inquiries may be directed to:

We will review privacy inquiries and complaints and respond in accordance with applicable requirements.

Institutional privacy notice for website, resource-request, CRM and related digital-service interactions.