Privacy Policy

1. Who we are

This Privacy Policy explains how Bowfinn Management Inc., a British Columbia company (the “Company”, “Bowfinn”, “we”, “us” or “our”), collects, uses, discloses and protects personal information through our website at bowfinn.com and any related pages (the “Site”), and in our dealings with people who contact us about our services.

Bowfinn is an asbestos, lead and hazardous-materials abatement contractor operating in British Columbia. We are licensed by WorkSafeBC for asbestos abatement and are a signatory contractor to UA Local 170. Our office is at #427-720 6th Street, New Westminster, BC V3L 3C5.

In this policy, “personal information” means information about an identifiable individual, as defined in the Personal Information Protection Act (British Columbia) (“PIPA”). “You” and “your” mean any individual who visits the Site or contacts us.

Privacy Officer

We have designated a Privacy Officer who is responsible for our compliance with PIPA (the “Privacy Officer”). You can contact the Privacy Officer at:

2. Laws that apply

As a BC private-sector organization, our handling of personal information is governed primarily by PIPA. Where we disclose personal information across a provincial or national border for consideration, the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) may also apply to that disclosure. We send commercial electronic messages only in line with Canada’s Anti-Spam Legislation (“CASL”). We also follow the guidance of the Office of the Information and Privacy Commissioner for British Columbia (the “BC OIPC”) and the Office of the Privacy Commissioner of Canada (the “OPC”) on meaningful consent and online behavioural advertising.

3. What personal information we collect

3.1 Information you give us through the enquiry form

When you request a consultation or quote, we collect the information you enter, which may include your name, company or organization, email address, phone number, project address, project type, your message and any file you choose to upload (for example, photos, drawings or an existing hazardous-materials report). Required fields are marked on the form.

Please do not upload documents that contain personal information about other people (such as tenants or occupants) or any health information, unless it is necessary for your enquiry and you have the authority to share it.

3.2 Emails, phone calls and other communications

If you email, call or message us, we collect your contact details and the content of the communication, and we keep notes of calls about your project.

3.3 Project and site information

To scope, quote and carry out work, we may collect information about the project site, such as the site address, building age and type, site-access arrangements, on-site contact names and phone numbers, photographs, and survey or hazardous-materials reports. Much of this is about property rather than people, but some (for example, the name and phone number of an occupant or site contact, or images in which a person can be identified) can be personal information. We handle it in accordance with this policy and any contract with you.

3.4 Analytics and cookie data

If we add analytics tags in future (see section 6), we and our analytics provider may automatically collect technical information such as your device and browser type, approximate location (derived from IP address, at city/region level), pages viewed, referring website, time on page and interactions such as form submissions. This would be collected through cookies and similar technologies (together, “Cookies”) as described in section 6. At present, the Site does not use analytics or advertising Cookies (see section 6).

3.5 Advertising tags (pixels)

The Site does not currently use advertising tags. If we add them in future, and you accept advertising Cookies, the Google Ads and LinkedIn Insight tags on the Site collect information such as an online identifier, the pages you visit, and whether you completed a form (a “conversion”). Google and LinkedIn may link this with information they already hold about you if you are signed into their services. We receive only aggregated reports and audience counts; we do not receive your browsing history on other websites.

3.6 Job applications

If you apply to work with us through the Careers page on the Site or by email, we collect your name, contact details, the trade or role you are interested in, your certifications and training (for example, asbestos abatement training or certification), any résumé you attach and any other information you choose to provide. We collect only what we reasonably need to assess you for work with us, and we ask that you not send your social insurance number, date of birth or age, health or disability information, photos, marital or family status or other sensitive information. We use your application only to assess you for current or future openings, to communicate with you and, if you are hired, to establish your employment, in which case it becomes part of your employee file. Applications sent through the Site are emailed to our office mailbox (Google Workspace), and a backup copy (including any résumé) is stored on our website host's server (Hostinger), separately from enquiries. We also record the IP address and browser type used, to protect the form from spam and misuse. Email is not a fully secure way to send information. Bowfinn is a signatory contractor to UA Local 170, and trades hiring is done in accordance with our collective agreement, which may include dispatch through the union hall. We do not ask about union membership in a general application. If we need union membership or dispatch information to hire you under the collective agreement, we collect it at that stage, use it only for hiring and managing your employment, and share it with the union only as the collective agreement requires.

3.7 Information we do not seek

We do not knowingly collect sensitive personal information (such as social insurance numbers, dates of birth, health or disability information, financial-account or government ID information, or photos of yourself) through the Site. Please do not include it in the enquiry or application forms or in any résumé you attach.

4. Why we collect and use personal information

We collect, use and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances, namely to:

• respond to your enquiry, assess your project, prepare a proposal or quote and follow up with you;
• perform and administer contracts, including scheduling, site access, safety planning, regulatory notifications and record-keeping required by WorkSafeBC or other laws, invoicing and collections;
• communicate with you about your project or our relationship;
• send you marketing emails, but only if you have consented as required by CASL (you can unsubscribe at any time);
• operate, secure, maintain and improve the Site, including, if we add analytics tags in future, measuring how the Site is used (analytics);
• if we add advertising tags in future, measure the effectiveness of our online advertising and, if you have accepted advertising Cookies, show our ads to people who visited the Site (remarketing);
• assess job applicants for current or future openings, communicate with them and, for applicants we hire, establish the employment relationship;
• protect our legal rights, prevent fraud or misuse, and comply with legal, regulatory, insurance and audit requirements.

If we want to use your personal information for a new purpose, we will tell you and, where required, obtain your consent before doing so.

5. Consent

5.1 How we obtain consent

Under PIPA we will obtain your consent before or at the time we collect personal information, unless PIPA permits otherwise. Consent may be:

• Express – for example, when you tick the optional box to receive marketing emails;
• Implied – for example, when you voluntarily send us an enquiry or email, you are deemed to consent to us using your information to respond and to prepare a quote (PIPA s.8(1)); and
• Opt-out – where we give you clear notice of a purpose and a reasonable opportunity to decline, and you do not decline (PIPA s.8(3)).

We will not make consent to unnecessary collection a condition of providing our services.

5.2 Withdrawing consent

You may withdraw or change your consent at any time on reasonable notice, subject to legal or contractual restrictions (PIPA s.9). To withdraw consent: use the unsubscribe link in any marketing email; use the opt-out tools in section 6.4; or contact the Privacy Officer. We will tell you about any likely consequences of withdrawing (for example, we may be unable to complete a quote without a site address). Withdrawing consent does not affect processing that already took place.

6. Cookies, analytics and advertising tags

6.1 If we add analytics or advertising tags in future

The Site does not currently use any of the tools in this table. They are the tools we would consider if we add analytics or advertising tags in future.

The Schedule at the end of this policy lists the Cookies these tools typically set if they are used.

6.2 Strictly necessary Cookies

The Site does not currently set any Cookies. If we add a cookie consent tool in future, it will set a strictly necessary Cookie to remember your choices; strictly necessary Cookies are always on.

6.3 Our Cookie banner

Because the Site does not currently use non-essential Cookies, there is no Cookie banner. If we add analytics or advertising Cookies in future, a banner will let you accept or reject them before they are set.

6.4 Other ways to opt out

• Google ad personalization: Google Ads Settings / My Ad Center – https://adssettings.google.com
• Google Analytics: the Google Analytics Opt-out Browser Add-on – https://tools.google.com/dlpage/gaoptout
• LinkedIn: LinkedIn advertising settings – https://www.linkedin.com/psettings/advertising (members) and https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out (non-members)
• Digital Advertising Alliance of Canada AdChoices – https://youradchoices.ca
• Your browser settings, which let you block or delete Cookies (some Site features may not work if you block all Cookies).

How Google uses information from sites that use its services is described at https://policies.google.com/technologies/partner-sites.

6.5 Limits we apply

We do not use Cookies to collect sensitive information and we do not knowingly target advertising to children. If we use Google Analytics, we will not send names, email addresses or other directly identifying information to it, and we will use aggregated or de-identified analytics data wherever practical. If we use Google Analytics, we will set data retention to 14 months.

7. Who we share personal information with

We do not sell personal information. We share it only as follows:

• Service providers acting on our behalf, such as our website host, form processor/CRM, email and office software provider, email marketing provider, consent platform, IT support, accountants and professional advisers. They may use the information only to provide services to us and must protect it.
• Advertising and analytics providers (Google and LinkedIn) as described in section 6, only if we add those tags in future and you have accepted those Cookies. Google and LinkedIn also act under their own privacy policies for some uses.
• Project participants, where needed to deliver your project – for example, consultants, hazardous-materials surveyors, laboratories, disposal facilities, subcontractors and the owner or general contractor – on a need-to-know basis.
• Regulators and authorities, such as WorkSafeBC, where required or authorized by law (for example, required notices of project or incident reporting).
• Insurers, lawyers and auditors, to manage claims, risk and legal compliance.
• A purchaser or successor, in connection with a proposed or actual sale, financing or reorganization of our business, subject to PIPA s.20 and appropriate confidentiality protections.
• Others, as otherwise required or permitted by PIPA, such as to comply with a subpoena, warrant or court order.

8. Storage and processing outside Canada

Some of our service providers may store or process personal information in the United States or other countries. These include our email and office software provider (Google Workspace), which receives enquiries and job applications, and our website host (Hostinger), which stores backup copies of form submissions. Google and LinkedIn may do the same if we add their tags in future. While outside Canada, personal information is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities. We use contractual and other measures to require these providers to protect personal information, but we cannot prevent lawful access by foreign authorities.

You may contact the Privacy Officer for more information about our use of service providers outside Canada.

PIPEDA note: Where personal information is disclosed across a provincial or national border in the course of commercial activity for consideration, PIPEDA may apply to that disclosure in addition to, or instead of, PIPA. The OPC treats a transfer to a service provider for processing as a “use” for the original purpose, not a new disclosure, but expects organizations to give notice that information may be processed in a foreign jurisdiction and accessed by its authorities. This section is intended to meet that expectation.

9. How long we keep personal information

We keep personal information only as long as needed for the purposes in this policy or as required by law. Where we use personal information to make a decision that directly affects you, we keep it for at least one year after that decision so you have a reasonable opportunity to request access (PIPA s.35). Our standard periods are:

When personal information is no longer needed, we securely destroy it or make it anonymous.

If we add analytics or advertising tags in future

If we use Google Analytics, we will set data retention to 14 months. Aggregated reports may be kept longer.

10. How we protect personal information

We make reasonable security arrangements to protect personal information against unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks (PIPA s.34). These include encrypted (HTTPS) transmission on the Site, access controls and multi-factor authentication on our business accounts, limiting access to staff who need it, confidentiality obligations for staff and service providers, and secure disposal. No system is perfectly secure; if you believe your information has been compromised, please contact the Privacy Officer immediately. We will notify affected individuals and regulators of a privacy breach where required by law.

11. Your rights: access and correction

Subject to limited exceptions in PIPA, you have the right to:

• Access – ask for your personal information under our control, information about the ways it has been and is being used, and the names of the individuals and organizations to whom it has been disclosed (PIPA s.23); and
• Correction – ask us to correct an error or omission in your personal information (PIPA s.24). If we make a correction, we will send it to organizations to which we disclosed the information in the prior year where appropriate. If we do not make the correction, we will annotate the information with the correction you requested.

Please make your request in writing to the Privacy Officer, with enough detail for us to identify the information. We may need to verify your identity. We will respond within 30 days, as “day” is defined in PIPA (excluding Saturdays and holidays – effectively 30 business days), unless PIPA permits us to extend the time limit, in which case we will tell you the reason and when you can expect a response. We do not charge for corrections; for access, we may charge a minimal fee permitted by PIPA and will give you a written estimate first. If we refuse a request, we will explain why and how to ask the BC OIPC to review our decision.

12. Questions and complaints

Please contact the Privacy Officer first with any question or complaint – we will investigate and respond. If you are not satisfied, you may contact the BC OIPC:

Under PIPA, a request for the Commissioner to review a response to an access or correction request must generally be made within 30 days after you are notified of our decision. Where PIPEDA applies, you may also contact the OPC (www.priv.gc.ca).

13. Children

The Site and our services are intended for businesses and adults. We do not knowingly collect personal information from children under 13, or direct advertising tracking at children. If you believe a child has provided us with personal information, please contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will post the updated version on the Site with a new “Last updated” date and, for significant changes, give more prominent notice (for example, a Site banner) and obtain any new consent required by law.

15. Contact us

Bowfinn Management Inc., Attention: Privacy Officer, #427-720 6th Street, New Westminster, BC V3L 3C5. Email: admin@bowfinn.com. Phone: (778) 827-1025.

Schedule – If we add analytics or advertising tags in future

The Site does not currently set any of these Cookies. The table lists the Cookies that the tools in section 6.1 typically set, if they are added in future.