Legal
Privacy Policy
Effective October 29, 2026
This Privacy Policy explains how Dynamic DFMA Inc. (“Dynamic DFMA”, “we”, “us”) collects, uses and protects personal information when you visit dynamicdfma.com, contact us, or sign in to our client portal. It is written to meet Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), the EU and UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
This policy covers our website only. Software we provide under a separate agreement, such as COILQ, has its own privacy policy.
1. Who we are
Dynamic DFMA Inc. is a company based in Vaughan, Ontario, Canada. For the GDPR, we are the controller of the personal information described here. Our Privacy Officer is responsible for how we handle personal information and can be reached at [email protected].
2. What we collect
Information you give us
- Contact form and email. Your name, company, email address, project stage, the kind of help you need and anything you write in your message.
- Client portal. If we give you access to our portal, your email address is used to sign you in, along with records of the files and drawings shared with you.
Information collected automatically
- Technical and security data. Your IP address, browser type, device and operating system, pages requested and the time of the request. Our hosting and security provider processes this to deliver the site and protect it from abuse.
- Analytics, only with your consent. If you accept analytics, Google Analytics and Microsoft Clarity record how the site is used, such as the pages visited, time on page, clicks and scrolling, approximate location derived from your IP address, and device type. Clarity may record anonymised replays of sessions; text you type into forms is masked.
We do not collect sensitive personal information through this website, and we ask you not to send it in your message.
3. How we use it
| Purpose | Information | Legal basis (GDPR) |
|---|---|---|
| Reply to your enquiry and discuss a possible project | Contact details, message | Steps at your request before a contract; legitimate interests |
| Provide the client portal | Email, portal activity | Performance of a contract |
| Run, secure and fix the website | Technical and security data | Legitimate interests |
| Understand how the site is used and improve it | Analytics data | Consent |
| Keep business records and meet legal duties | Correspondence, records | Legal obligation; legitimate interests |
We do not use personal information for automated decisions that have legal or similarly significant effects on you, and we do not use it for advertising.
4. Cookies and similar technologies
Our Cookie Policy gives more detail. Strictly necessary items are always on. Analytics stay off until you choose to allow them, and you can change your choice at any time from Your privacy choices, also found in the footer of every page.
| Name | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
| ddfma-consent (local storage) | Dynamic DFMA | Strictly necessary | Remembers your privacy choices | 12 months |
| __cf_bm, cf_clearance | Cloudflare | Strictly necessary | Bot protection and security | 30 minutes to 1 year |
| CF_Authorization | Cloudflare | Strictly necessary | Keeps you signed in to the client portal | Session, up to 24 hours |
| _ga, _ga_* | Analytics (consent) | Distinguishes visits for Google Analytics | Up to 13 months | |
| _clck, _clsk, CLID, MUID | Microsoft | Analytics (consent) | Groups page views into sessions for Microsoft Clarity | 1 day to 1 year |
Our pages also load fonts from Google Fonts and code libraries from cdnjs and jsDelivr. These services receive your IP address when your browser requests the files, but they do not set cookies for us. We do not use marketing or advertising cookies.
Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out, and analytics stay off. We do not respond separately to “Do Not Track” signals.
5. Who we share it with
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share it only with service providers who process it for us under contract, and only as needed:
- Cloudflare: website hosting, content delivery, security and portal sign-in.
- Web3Forms: delivers contact form messages to our inbox.
- Our email provider: stores and delivers our correspondence.
- Google: fonts, and Google Analytics if you consent.
- Microsoft: Microsoft Clarity, if you consent.
- cdnjs and jsDelivr: deliver open-source code libraries used by the site.
We may also disclose information where the law requires it, to protect our rights or the safety of others, or to a buyer or successor as part of a business transaction, under equivalent protections.
6. Where it is stored
We are based in Canada. Our service providers may process information in Canada, the United States and other countries where they operate, so your information may be transferred outside your province, state or country and may be accessible to authorities there under local law. Where the GDPR applies, transfers rely on an adequacy decision (the European Commission recognises Canada’s PIPEDA as adequate), the EU–US Data Privacy Framework where a provider is certified, or standard contractual clauses. Before transferring personal information of Quebec residents outside Quebec, we assess whether it will receive adequate protection.
7. How long we keep it
We keep enquiries and correspondence for as long as needed to respond and to manage any project that follows, and afterwards only as long as needed for our business records and legal obligations. Analytics data is kept for up to 14 months in Google Analytics and up to 13 months in Microsoft Clarity. When information is no longer needed, we delete it or make it anonymous.
8. Security
We use reasonable safeguards for the sensitivity of the information, including encrypted connections (HTTPS), access controls, and sign-in protection for the portal. No method of transmission or storage is completely secure. If a breach creates a real risk of significant harm, we will notify you and the relevant authorities as the law requires.
9. Your rights
Depending on where you live, you can ask to access your personal information, correct it, delete it, receive it in a portable format, restrict or object to its use, and withdraw consent at any time. Withdrawing consent does not affect processing that happened before. To make a request, email [email protected]. We may need to confirm your identity first. We will not treat you differently for exercising your rights.
10. Canada and Quebec
Under PIPEDA and Quebec law, you can access and correct the personal information we hold about you and withdraw your consent, subject to legal and contractual limits. We reply within 30 days. Quebec residents also have the right to data portability, to be informed of and to object to automated decisions, and to ask that information be de-indexed where its dissemination breaches the law. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d’accès à l’information.
11. EU, EEA and UK
If the GDPR or UK GDPR applies to you, you have the rights of access, rectification, erasure, restriction, portability and objection, including the right to object at any time to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time from Your privacy choices. We reply within one month. You can also complain to the data protection authority where you live or work.
12. California and other US states
If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect and how we use it, to access, correct and delete it, to opt out of its sale or sharing, and to limit the use of sensitive personal information. You also have the right not to be discriminated against for exercising these rights. We reply within 45 days. You can use an authorised agent to make a request on your behalf.
In the past 12 months we have collected these categories: identifiers (such as name, email and IP address); professional information (company and role); internet activity (pages viewed and site interactions, only if you allow analytics); and approximate location derived from IP address. We collect them from you and your device, for the purposes in section 3, and disclose them only to the service providers in section 5. We have not sold or shared personal information, and we do not knowingly sell or share the information of anyone under 16. We do not use or disclose sensitive personal information.
Residents of other US states with consumer privacy laws, such as Colorado, Connecticut, Virginia, Oregon and Texas, have similar rights and can use the same contact. If we decline a request, you can appeal by replying to our decision.
13. Children
This website is for businesses and professionals. It is not directed to children, and we do not knowingly collect personal information from anyone under 16.
14. Changes
We may update this policy. The effective date at the top shows when it last changed, and we will tell you about significant changes on this page or by other appropriate means.
15. Contact
Dynamic DFMA Inc.
[email protected]