Privacy Policy

Our approach. We collect the minimum information needed to operate this site and respond to inquiries. We do not sell personal information for monetary consideration. We treat consent as a real signal rather than a click-through, honor the Global Privacy Control browser signal automatically, and provide working controls in the page footer to change your choices at any time. The full text below describes what we collect, who else sees it, why, and how long we keep it.

Who we are

Choice Online Marketing Group, Inc. (“Choice OMG”, “we”, “us”) operates choice.marketing. We are based at 8739 53 Ave NW, Edmonton, AB T6E 5E9, Canada. Peter Jaffray is the designated Privacy Officer.

Contact: general questions support@choice.marketing; privacy, consent, and security matters privacy@choice.marketing; phone 1-877-930-0955.

Information we collect

Information you provide

When you submit a contact or proposal form we collect your name, email address, message, and (optionally) phone number and company. The phone number, if provided, is validated for reachability before submission. Our forms also use Cloudflare Turnstile for bot protection, which collects your IP address and basic browser characteristics solely for that purpose.

Automatic collection

Standard web server logs include your IP address, browser type, referring URL, request timestamp, and pages visited. Our CDN (Amazon CloudFront) also infers the country and region (province or state) from your IP so we can show you the appropriate consent banner; that inference is used at request time and not stored beyond the request.

Cookies and identifiers

We use first-party cookies set by our own domain (choice.marketing) for analytics and, with your consent, for advertising measurement. Cookie data is processed through our self-hosted server-side Google Tag Manager (sGTM) at tagging-server.choice.marketing before being forwarded to Google Analytics 4 (GA4) and, where applicable, Google Ads and Meta. Routing through sGTM means tracking scripts load from our own domain rather than third-party domains, which improves privacy posture but does not change which third parties ultimately receive the data.

For form submissions, we additionally store the GA4 client identifier (a pseudonymous cookie ID) alongside the submission record so we can attribute conversions correctly across channels. We also compute SHA-256 hashes of the email, phone number, first name, and last name fields and send those hashes (not the plaintext values) to Google and Meta for Enhanced Conversions and the Conversions API. The plaintext values themselves are not transmitted to ad platforms.

Consent signals

We implement Google Consent Mode v2. Before any analytics or advertising tag fires, we set defaults for analytics_storage, ad_storage, ad_user_data, and ad_personalization based on your visiting region and any active Global Privacy Control signal. Quebec and unknown-region visitors default to denied for all four signals; other visitors default to granted unless their browser sends a Global Privacy Control signal, in which case the three advertising signals default to denied. You can change all of these via the Privacy Preferences link in the footer.

How we use your information

• Respond to inquiries. Replying to contact-form submissions, scheduling discovery calls, and following up on requests for marketing services. Legal basis: your consent (you submitted the form for this purpose).
• Provide services. Managing engagements with retained clients. Legal basis: performance of contract.
• Understand site performance. Aggregated analytics about which pages load, which paths visitors follow, and where the experience breaks. Legal basis: implied consent under PIPEDA for non-Quebec visitors; explicit consent for Quebec visitors.
• Measure advertising. When consented, attributing conversions back to the campaign that drove them, including via Enhanced Conversions and the Meta Conversions API using hashed identifiers. Legal basis: your consent.
• Protect against abuse. Bot detection (Cloudflare Turnstile), rate limiting, and pitched-message detection on incoming forms. Legal basis: legitimate interest in operating a usable site.
• Comply with legal obligations. Tax retention, breach notification, and lawful requests.

We do not sell, rent, or share your personal information with third parties for their independent marketing purposes. We do enable cross-context behavioral advertising through Google Ads and Meta when you consent; that activity is described as “sharing” under the California Privacy Rights Act and you can opt out using the controls in the footer or by sending a Global Privacy Control signal.

Who else sees your information

We share data with the following processors. Each processor is bound by a data processing agreement consistent with PIPEDA (the Personal Information Protection and Electronic Documents Act), Quebec Law 25, and where applicable, the CCPA/CPRA.

Google (Analytics 4, Ads, Tag Manager). Pseudonymous analytics events; hashed identifiers when consented; conversion data. Operates in the United States and on global infrastructure.

Meta (Pixel and Conversions API). Pseudonymous events and hashed identifiers, only when you consent to advertising cookies. Operates in the United States and on global infrastructure.

Cloudflare (Turnstile bot protection). IP address, browser characteristics, and page-interaction signals during a form submission. Operates on global edge infrastructure.

Amazon Web Services (CloudFront CDN, SES email). Request metadata for content delivery; outbound transactional email when we send form-submission notifications to ourselves. Operates in Canada (ca-central-1) and the United States.

Mailgun. Outbound transactional email when used for client notifications. Operates in the United States and the European Union.

Front (chat widget, when enabled). Chat content, IP address, and browser characteristics during a chat session. Operates in the United States. The chat widget loads only on pages where it is configured to appear.

Mattermost (self-hosted). Lead notifications routed to our internal sales channel. Hosted on Choice OMG infrastructure in Edmonton, Alberta.

Choice OMG infrastructure (Postgres database). Form submissions, the consent ledger, and the content database. Hosted on Choice OMG infrastructure in Edmonton, Alberta.

Google Workspace. Inbound email to Choice OMG team mailboxes after a notification has been sent. Operates on global Google infrastructure.

International transfers

Several of our processors (Google, Meta, Cloudflare, Mailgun, Front, AWS) are headquartered or operate in the United States and other jurisdictions outside Canada. Personal information processed by them may be subject to access requests by foreign governments under their respective laws. We have assessed each transfer for adequacy and necessity, in line with Quebec Law 25 §8.1 (which requires an impact assessment for the transfer of personal information outside Quebec), and rely on standard contractual mechanisms with each processor. The principal data store of record (the Postgres database that holds form submissions and the consent ledger) is hosted in Canada on infrastructure operated directly by Choice OMG.

How long we keep your data

• Form submissions: 24 months from collection unless you ask us to delete sooner.
• Web server logs: 90 days.
• Consent decisions (the audit ledger of what you consented to and when, including IP address and user agent): 24 months.
• Google Analytics 4 event data: 14 months from the most recent activity. Our property uses the “reset on new user activity” option, so a returning visitor's window resets on each visit.
• Google Analytics 4 user-level data: 2 months.
• Client account records: duration of the engagement plus 7 years for tax and legal compliance.

Your rights

Under PIPEDA and applicable provincial privacy legislation, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your data where no legal obligation requires us to retain it
• Withdraw consent to processing where consent is the legal basis
• Receive your data in a portable format (where Quebec Law 25 §27 applies)
• Make a complaint to your provincial privacy regulator or to the Office of the Privacy Commissioner of Canada

To exercise these rights, email privacy@choice.marketing or call 1-877-930-0955. We respond within 30 days under PIPEDA, and within 45 days for CCPA/CPRA requests. We may verify your identity using the minimum information needed to do so.

Children's privacy

This site is intended for adult business users. We do not knowingly collect personal information from anyone under 16 years of age. If you believe a minor has submitted personal information through our site, contact privacy@choice.marketing and we will delete it promptly.

Do Not Track and Global Privacy Control

Browsers communicate privacy preferences through two mechanisms. The older Do Not Track (DNT) header has no consensus interpretation and we do not act on it. The newer Global Privacy Control (GPC) signal is honored automatically: when your browser sends GPC, we treat it as a valid opt-out of advertising-cookie storage and cross-context behavioral advertising for the visit, and we record the opt-out in our consent ledger. You do not need to also use the cookie banner to make the same choice.

Security

All data transmission uses HTTPS with modern cipher suites. Access to personal data within our systems is restricted to team members who require it to perform their role and is logged. We conduct periodic reviews of our processors' security posture.

Suspected vulnerabilities can be reported to privacy@choice.marketing with the subject line “Security Disclosure”. We acknowledge reports within two business days.

Data breach notification

If we become aware of a breach of personal information that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (and the Commission d'accès à l'information du Québec for Quebec residents) as required by PIPEDA and Quebec Law 25. We maintain an internal record of all breaches in line with PIPEDA's record-keeping requirement, regardless of the notification threshold.

Third-party links

Our site contains links to third-party sites operated by other organizations. This Privacy Policy does not apply to those sites; consult each site's own policy.

Accessibility

If you would like this Privacy Policy in a different format (large print, plain-text email, or audio summary), email support@choice.marketing and we will provide one within a reasonable time at no charge.

Changes to this policy

We may update this policy as our services evolve or as legal requirements change. Material changes will be reflected in the change log below and in the “last updated” date. We will not apply changes retroactively to data collected under prior policy terms without your consent.

Change log

• May 9, 2026: substantive rewrite. Added explicit disclosures for the SHA-256 Enhanced Conversions hashing of form fields, the GA4 client_id linkage in form submissions, the Cloudflare Turnstile bot-protection flow, the Front chat widget, the AWS SES outbound notification path, and the self-hosted sGTM routing. Added Children's Privacy, Do Not Track / Global Privacy Control, International Transfers, Data Breach Notification, Third-Party Links, Accessibility, and Security Disclosure sections. Added Quebec Law 25 §27 portability right and §8.1 cross-border-transfer assessment reference. Harmonized form-submission retention to 24 months. Replaced the “default GA4 retention” claim with the property's actual configured values (14 months event data with reset on activity; 2 months user-level data).
• Earlier May 2026: added United States residents section covering CCPA/CPRA rights and Global Privacy Control honoring. Converted consent UI to native dialog elements; banner now suppressed outside Quebec and unknown regions, with footer Privacy Preferences and Do Not Sell or Share links serving as the opt-out controls elsewhere.
• Initial publication: prior to April 2026.

Last updated: May 9, 2026. Choice Online Marketing Group, Inc., 8739 53 Ave NW, Edmonton, AB T6E 5E9.

---

Quebec residents: Law 25 disclosures

If you are visiting from Quebec, the following supplemental disclosures apply under An Act respecting the protection of personal information in the private sector (Law 25). They sit alongside the rest of this Privacy Policy.

Information we collect and why

• Form submissions (name, email, phone, company, message): to respond to your inquiry and follow up about marketing services.
• Analytics (pages visited, referrer, device type, approximate region): to understand which pages help visitors and which are broken. Aggregated.
• Advertising (Google Ads / Meta cookies and hashed identifiers): only if you grant consent. To measure ad performance and, with your additional consent, to personalize ads on other sites.
• Region detection (country and province from your IP via CloudFront): to determine which consent banner to show. Not stored beyond the request.

Recipients

The full list of processors is in the main “Who else sees your information” section above. The processors most relevant for Quebec visitors are: Google (Analytics, Ads, Tag Manager), Meta (Pixel for advertising, only with consent), Cloudflare (Turnstile bot protection), Amazon Web Services (CloudFront CDN, SES outbound email), Mailgun and Mattermost (lead notifications), and the Postgres database hosted on infrastructure operated by Choice OMG in Edmonton, Alberta.

Cross-border transfers (Law 25 §8.1)

Several of these processors operate outside Quebec. We have completed the impact assessment required by §8.1 of Law 25 and rely on standard contractual mechanisms with each processor. The principal data store (form submissions and the consent ledger) is hosted in Canada on Choice OMG-operated infrastructure.

Retention

Form submissions are retained for 24 months from collection unless you ask us to delete them sooner. Consent decisions are retained for 24 months for audit. Analytics event data is retained for 14 months (with reset on activity); user-level analytics data is retained for 2 months.

Automated decision-making

We do not make automated decisions about you that have legal or similarly significant effects.

Withdrawing consent

You can withdraw or change your consent at any time by clicking Privacy Preferences in the site footer, or by emailing the Privacy Officer below.

Privacy Officer

Peter Jaffray, Privacy Officer
Choice Online Marketing Group, Inc.
privacy@choice.marketing
1-877-930-0955

Your rights

You may request access to, correction of, deletion of, or a portable copy of your personal information by contacting the Privacy Officer above. We respond within 30 days. If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec.

---

Résidents du Québec : divulgations en vertu de la Loi 25

---

United States residents: CCPA/CPRA and Global Privacy Control

If you are visiting from California, the following supplemental disclosures apply under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Residents of other US states with comparable consumer-privacy laws (Virginia, Colorado, Connecticut, Utah, and similar) may rely on the same controls described here.

Categories of personal information we collect

Identifiers (name, email, phone, IP address); commercial information (services inquired about); internet activity (pages visited, referrer); approximate geolocation (country and region inferred from IP, never precise GPS coordinates). We do not collect sensitive personal information as defined by the CPRA (Cal. Civ. Code §1798.140(ae)).

Sale and sharing

We do not sell personal information for monetary consideration. We do enable cross-context behavioral advertising through Google Ads and Meta when a visitor grants consent. Under the CPRA, that activity may qualify as “sharing” even when no money changes hands. You can opt out of that sharing using the controls described below.

Global Privacy Control (GPC)

We honor the Global Privacy Control browser signal. When your browser sends a GPC signal with a request, we treat it as a valid opt-out of sale and sharing for the duration of that visit, and we record the opt-out in our consent ledger. You do not need to also use the cookie banner to make the same choice; GPC is sufficient on its own.

Your CCPA/CPRA rights

• Right to know what personal information we have collected, used, disclosed, or shared
• Right to delete personal information we have collected, subject to legal retention requirements
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing of personal information (use the “Privacy Preferences” or “Do Not Sell or Share My Personal Information” link in the footer, or send a GPC signal)
• Right to limit use and disclosure of sensitive personal information (we do not collect sensitive PI as defined by the CPRA, so this right is structurally honored)
• Right to non-discrimination for exercising any CCPA/CPRA right

How to exercise your rights

Email privacy@choice.marketing or call 1-877-930-0955. We respond within 45 days as required by the CCPA. We may need to verify your identity before fulfilling the request; we will request only the minimum information needed to do so.

Authorized agents

You may use an authorized agent to submit a request on your behalf. We will verify both the agent's authority (signed permission) and your identity before fulfilling the request.