Privacy Policy

1. Scope and accountability

All Business In Waterloo Region ("we", "us", or "our") operates the public directory at allbusinesswr.com. This policy explains how we handle personal information when you browse the site, use directory features, contact us, apply for a listing, or use an authorized account.

The Privacy Officer for the directory is responsible for questions and requests under this policy. Contact details are provided in section 12.

2. Information we collect

Information you provide

• Messages and reports: your name, email address, selected topic, message, and any information you include in a correction or report.
• Listing applications: business name, contact name, email address, phone number, category, business description, and other information you choose to submit.
• Public listings: approved business names, descriptions, categories, addresses, contact details, websites, social links, images, and services. A business contact name may also be public if it is included in approved listing content.
• Authorized accounts: name or username, email address, profile image where supplied by Google, password hash for password-based accounts, role, and multi-factor authentication settings.

Information collected when you use the site

• IP address and related network headers, browser and device information, approximate region, timestamps, pages or listings viewed, referring page, and session or cookie identifiers.
• Search terms, listing views, advertisement impressions and clicks, and broad device or regional reporting data.
• Diagnostic details when the site encounters an error, such as the page URL, browser information, error message and stack, timestamp, and an account identifier if you are signed in.
• Standard hosting, security, and server-log information used to deliver and protect the site.

For our internal daily view and advertisement measurement, an IP address is transformed with a keyed cryptographic hash before the event is stored. The event may also include browser information, approximate region, and a referring page. Hashing reduces direct identifiability, but we still protect this data as usage information.

Location

If you select "Find Businesses Near Me", your browser asks for permission to provide latitude and longitude. The coordinates are sent to our server to calculate nearby results and may appear in temporary request or security logs. They are not added to your account or a public business listing. You can deny or revoke location permission in your browser.

3. How we use information

• Provide, maintain, secure, troubleshoot, and improve the directory.
• Respond to questions, privacy requests, listing applications, corrections, and advertising enquiries.
• Review, publish, update, deactivate, or remove business listings.
• Authenticate authorized users, manage accounts, and prevent fraud or abuse.
• Measure searches, listing views, site usage, and advertisement performance.
• Comply with legal obligations and enforce our terms or protect our rights and users.

4. Public business information

The directory is designed to publish business information. If a listing is approved, its published fields are available to anyone and may be indexed, cached, copied, or archived by search engines and other third parties. Do not submit home addresses, personal contact details, or other information for publication unless you are authorized and comfortable making it public.

To correct or request review of a listing, use the listing correction and report form. We can update our directory, but cannot control copies already made by unrelated third parties.

5. Cookies and similar technologies

• Essential and preference storage: authentication and security cookies keep authorized users signed in and prevent request forgery. Local or session storage remembers theme preferences, temporary navigation state, and whether a listing view was already counted in the current session.
• Google Analytics: Google Analytics is optional and stays off unless you select "Allow analytics". If allowed, it helps us understand aggregate site use and may collect a client identifier, interactions, approximate location, and browser or device information, and may set cookies such as _ga. Google Analytics cookies may persist for up to two years unless you withdraw your choice, delete them, or block them.
• Google Maps and Google sign-in: embedded maps load content from Google. Authorized users may also choose Google to sign in. Google may receive device, network, interaction, account, and cookie information under its own privacy policy.
• Cloudflare Turnstile: our public forms use Turnstile to distinguish people from automated traffic. Cloudflare processes security signals such as IP address, user-agent, browser characteristics, TLS information, site key, and origin. We do not send your form fields to Turnstile.

You can change your Google Analytics choice at any time through Analytics preferences. You can also block or delete cookies through your browser, although essential features such as sign-in may stop working, or install the Google Analytics opt-out browser add-on. Learn more in the Google Privacy Policy and the Cloudflare Turnstile Privacy Addendum.

6. When information is disclosed

We may disclose information in these circumstances:

• Public directory: approved listing information is published as described above.
• Service providers: hosting, database, media storage, email delivery, security, analytics, mapping, authentication, and diagnostic providers process information as needed to provide their services.
• At your direction: for example, when you open a business website, map, social-media page, or advertisement operated by another party.
• Legal and safety reasons: when reasonably necessary to comply with law or legal process, investigate misuse, protect rights or safety, or secure the service.
• Organizational change: if responsibility for the directory is transferred, relevant information may be transferred subject to appropriate confidentiality and permitted-use requirements.

We do not sell or rent personal information to data brokers or advertisers. Directory advertisements are selected by placement and, where applicable, business category; we internally count impressions and clicks.

7. Processing outside Canada

Some service providers may process or store information in Canada, the United States, or other countries. Information handled outside Canada may be subject to the laws and lawful access processes of those jurisdictions. We remain responsible for personal information under our control and use providers for the purposes described in this policy.

8. Retention

We retain information only for as long as reasonably needed for the purposes described in this policy, including directory operations, record keeping, security, dispute resolution, and legal obligations. Retention depends on the type of information:

• Public listing information is kept while the listing remains part of the directory and may be retained for a reasonable period after removal in backups or administrative records.
• Messages and applications are generally kept in the receiving mailbox while the request is handled and as needed for follow-up and business records.
• Account records are kept while the account is active and as needed afterward for security, administration, or legal obligations. Authentication sessions are configured with a 30-day maximum age and may be renewed or end sooner.
• Internal search, view, advertisement, diagnostic, security, and server-log data is kept while useful for reporting, troubleshooting, abuse prevention, or legal obligations, then deleted or aggregated.
• Third-party services retain information under their own settings and retention policies. Google Analytics cookie duration is described in section 5; Google-side event retention depends on the directory's Analytics settings.

When information is no longer required, we delete, anonymize, or securely dispose of it, subject to backup cycles and legal requirements.

9. Safeguards

We use safeguards appropriate to the information we handle, including encrypted network connections, access controls, restricted administrative routes, password hashing, optional multi-factor authentication, anti-automation checks, and security monitoring. No Internet transmission or storage system is completely secure, so we cannot guarantee absolute security.

10. Your choices and privacy requests

Subject to applicable law, you may ask whether we hold personal information about you and request access, correction, or deletion. You may also withdraw consent to future use where consent is the basis for processing, subject to reasonable notice and legal, security, or service limitations.

• Submit a privacy request and describe the information or account involved.
• Use the listing correction form for public listing changes.
• Use Analytics preferences to allow or decline optional analytics, manage cookies and location permission in your browser, or use Google's opt-out tool linked in section 5.
• Authorized account holders can update available profile fields after signing in and can contact us about account deletion.

We may need to verify your identity before completing a request. Some hashed or aggregate analytics information cannot reasonably be linked back to an individual. If we cannot fulfill a request, we will explain why when required.

11. Children

The directory is intended for a general audience and for people acting on behalf of businesses. We do not knowingly ask children to create accounts or submit personal information. A parent or guardian who believes a child has provided personal information can contact us to request review or deletion.

12. Contact the Privacy Officer

Direct privacy questions, access or deletion requests, and complaints to:

We will review and respond to privacy enquiries within a reasonable time. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or another regulator with jurisdiction.

13. Changes to this policy

We may update this policy as the directory, providers, or legal requirements change. We will post the revised policy here and update its effective date. If a change materially affects how we use information previously collected, we will provide additional notice or seek consent where required.