Privacy Policy

1. Data Controller

The data controller for personal information collected through this website is:

This Privacy Policy applies to all personal information collected through the website at flatoutserver.com and describes our practices in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, and any applicable provincial privacy legislation.

2. Data Collected

Flatoutserver collects personal information through the following means:

Contact Form

When you use the contact form on this website, we collect the following information that you voluntarily provide:

• First and last name
• Organisation or company name (optional)
• Email address
• Phone number (optional)
• Type of service requested
• Message content

Browser Local Storage

This website stores one item in your browser's local storage:

• fos_consent_v1: a record of your cookie and storage preferences, stored locally in your browser for 365 days. This item contains only your preference choices (accepted/rejected categories) and does not contain any personally identifiable information.

We do not use tracking cookies, advertising pixels, analytics SDKs, or any other automated means of collecting personal information beyond what is described above.

3. Purposes and Legal Basis

We process your personal information for the following purposes, each with its applicable legal basis under PIPEDA:

• Responding to your enquiry (legal basis: contractual necessity / consent): We use your name, email, phone, and message to respond to your inquiry and, if applicable, to prepare and deliver a service quote.
• Service delivery (legal basis: contractual necessity): If you engage our services, we use your contact information and service-type data to administer the engagement, issue invoices, and deliver Deliverables.
• Legitimate business interests (legal basis: legitimate interest): We retain records of completed engagements to fulfil our legal obligations, resolve disputes, and maintain accounting records.
• Preference storage (legal basis: consent): We store your cookie/storage preferences in your browser to remember your choices on future visits.

We do not use your personal information for automated decision-making or profiling.

4. Retention Periods

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Contact inquiries (no engagement): 12 months from the date of last contact.
• Client records (completed engagements): 7 years from the date of the final invoice, as required by applicable tax legislation.
• Consent preferences (fos_consent_v1): 365 days from the date of your last preference update, stored solely in your browser's local storage.

At the end of the applicable retention period, personal information is securely deleted or anonymised. Paper records, if any, are shredded.

5. FormSubmit.co

The contact form on this website uses FormSubmit.co, a third-party form processing service operated by a US-based provider. When you submit the contact form, the data you enter is transmitted to FormSubmit.co's servers, which are located in the United States of America.

This transfer of personal information outside Canada is made pursuant to PIPEDA's provisions on cross-border transfers. Flatoutserver has satisfied itself that FormSubmit.co provides a comparable level of protection for personal information, and we take responsibility for ensuring your information receives adequate protection.

FormSubmit.co is used solely to transmit your form submission to Flatoutserver by email. We do not authorise FormSubmit.co to use your personal information for its own purposes. For more information, please consult FormSubmit.co's Privacy Policy.

6. AWS Canada Hosting

This website is hosted on Amazon Web Services (AWS) Canada infrastructure located in Toronto, Ontario, Canada. Your personal information submitted through this website is processed and stored on servers located in Canada.

AWS Canada operates in accordance with AWS's Data Processing Addendum and applicable Canadian privacy law. AWS does not access your personal data except as necessary to provide hosting services. For more information, see AWS's Privacy Notice and the AWS Canada Data Privacy information.

7. Third-Party Sharing

Flatoutserver does not sell, rent, trade, or otherwise disclose your personal information to any third parties, except:

• FormSubmit.co: as described in Article 5, solely to transmit form submissions to us.
• Amazon Web Services Canada: as described in Article 6, as our hosting provider.
• Legal requirement: we may disclose personal information if required to do so by law, court order, or governmental authority, or to protect the rights, property, or safety of Flatoutserver, our clients, or others.

We do not engage any other third-party processors, analytics providers, advertising networks, or data brokers. Your personal information is never sold.

8. Your Rights under PIPEDA

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the following rights with respect to your personal information:

• Right of access: You may request access to the personal information we hold about you and obtain information about how it is used and disclosed.
• Right to correction: If your personal information is inaccurate, incomplete, or out of date, you may request that we correct it.
• Right to withdraw consent: You may withdraw consent to the collection, use, or disclosure of your personal information at any time, subject to legal and contractual restrictions. Withdrawal of consent may affect our ability to provide services to you.

To exercise any of these rights, please contact us in writing at hello@flatoutserver.com. We will respond to all verified requests within 30 days of receipt. If we need additional time to comply, we will notify you within the 30-day period.

9. OPC Complaint

If you have concerns about how Flatoutserver handles your personal information that have not been resolved to your satisfaction, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC):

We encourage you to contact us first to attempt to resolve any privacy concerns before filing a formal complaint with the OPC.

10. Policy Updates

Flatoutserver may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or our services. For material changes that significantly affect how we handle your personal information, we will provide at least 30 days' advance notice by posting a prominent notice on this website.

The effective date at the top of this Policy indicates when it was last updated. Continued use of this website after the effective date of any updated Policy constitutes your acknowledgment of the changes.

We encourage you to review this Privacy Policy periodically.

11. Cookies and Local Storage

This website does not use tracking cookies. We use a single browser local storage item (fos_consent_v1) to remember your cookie and storage preferences. This item is stored in your browser and is not transmitted to any server.

For a complete description of the technologies we use and your choices regarding them, please see our Cookie Policy.

12. Contact

For any questions, concerns, or requests related to this Privacy Policy or your personal information, please contact our Privacy Officer:

We will acknowledge receipt of your privacy request within five (5) business days and respond fully within thirty (30) days, unless an extension is required, in which case we will notify you.