Privacy policy

Who this applies to

Richmond Local is a local business directory for Richmond, BC, published at richmondlocal.ca. This policy covers everything the site does with personal information: the forms you can fill in, the traffic measurement running quietly in the background, and the business details published on the listing pages.

I handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, because the site is run from British Columbia, the province's Personal Information Protection Act (PIPA). The two overlap far more than they differ. Where they do differ, I apply whichever one is stricter.

What I collect

Personal information reaches me two ways, and only two.

Information you type into a form

The site runs three forms: contact, add a listing, and claim a listing. Between them they ask for a name, an email address, an optional phone number, the business details you want published, and whatever you write in the message box. You choose what goes in. Nothing is pre-filled from somewhere else, and I have never bought a contact list.

Information your browser sends on its own

The server records the requests it receives, the way every web server does: the page requested, the date and time, the referring page, your browser and device type, and your IP address. An analytics tool also counts visits and shows me which pages and search terms bring people here. That is how I decide what to write next.

I do not ask for financial information, government identifiers or health information, and I would have no use for them if you sent them. Please keep them out of the forms.

Why I collect it

• To write back to you, and to follow up on a correction.
• To review a listing submission or a claim, and to check that the person sending it is actually connected to the business.
• To publish the business information you asked me to publish.
• To keep the site running, spot abuse, and block automated spam.
• To see which pages are useful, so I write more of what people actually need.

I do not build advertising profiles, and I do not sell your email address. Not to a marketing list, not to a lead broker, not for any amount of money anyone has offered.

Consent, and how to withdraw it

Sending a form is your consent for me to use what is in it for the purposes listed above. If I ever want to use your information for something outside that list, I will ask you first.

You can withdraw consent whenever you like by writing through the contact form. Tell me what you want deleted and I will delete it, apart from anything I am legally required to hold on to. Withdrawing consent for a published listing takes the listing down with it.

Cookies and analytics

This site sets a session cookie and a security token cookie when you use a form. Both are strictly necessary: without them, a submission cannot be protected against cross-site request forgery. They hold no personal information and they expire when you close the browser.

The analytics measure traffic in aggregate rather than following individuals around. There are no advertising cookies here, no retargeting pixels and no social media tracking widgets, which is also why no consent banner is sitting on top of this page waiting for you to dismiss it.

You can block or delete cookies in your browser settings. Blocking them will not stop you reading anything on the site, though it may stop a form from submitting. Where your browser sends a Global Privacy Control or Do Not Track signal, I honour it.

Business listing information

Most of what gets published here is business contact information: a company name, an address, a phone number, opening hours, a website. Under PIPEDA and BC PIPA, business contact information collected and used solely to communicate with someone in relation to their business is treated differently from personal information, and that is the basis the directory is published on.

Listings are put together from publicly available sources and from submissions by business owners, then checked by hand. I do not publish an owner's or an employee's home address, personal phone number or personal email. If a listing has picked up something personal by mistake, tell me and it comes off the same day I read the message.

If you would rather your business was not listed at all, ask and I will remove it. I do not need a reason and I will not argue with you about it.

Who else sees it

Personal information goes to service providers only where they need it to keep the site working, and only for that:

• the company that hosts the server this site runs on;
• the network and security provider that sits in front of it and filters malicious traffic;
• the email service that carries my replies and the form notifications;
• the analytics provider that counts page views.

Each of them is bound to use the information only to provide that service. Past those four, I disclose personal information only where the law leaves me no choice: a court order, a warrant, or a legal obligation I cannot decline.

Where it is stored

Form submissions sit in a database on a server I control. Some of the providers above operate outside Canada, which means information passing through them may be stored in or accessed from another country, and may be subject to the laws of that country. If that concerns you, send less. The forms only need enough to write back to you.

How long I keep it

• Contact messages: kept while I am dealing with the matter and for up to two years afterwards, so I can see the history of a listing that has been corrected before.
• Listing submissions and claims: kept for as long as the listing is published, plus two years, so I can show why an entry says what it says.
• Server logs: rotated and deleted within 90 days.
• Analytics: aggregate figures only, kept indefinitely, because they no longer identify anyone.

Anything past its retention period is deleted rather than quietly archived somewhere.

How it is protected

The whole site is served over an encrypted connection. Access to the database and to form submissions is limited to the people who run the site, protected by key-based authentication rather than a shared password, and the software gets patched.

No system is perfect and I am not going to pretend otherwise. If a breach ever creates a real risk of significant harm to you, I will tell you and report it to the Privacy Commissioner, which is what PIPEDA requires.

Your rights

You can ask me to:

• tell you what personal information I hold about you and what I have done with it;
• correct anything that is wrong or out of date;
• delete what I hold, or take a listing down;
• stop contacting you.

Send the request through the contact form. I will respond within 30 days, which is the limit PIPEDA sets. Before I hand over a record I may ask a question or two to confirm you are who you say you are, and that check exists to protect you rather than me.

If you are not satisfied with how I handled it, you can complain to the Office of the Privacy Commissioner of Canada or, for a British Columbia matter, to the Office of the Information and Privacy Commissioner for British Columbia. Both accept complaints directly. Neither charges a fee.

Children

This site exists for adults looking up local businesses. I do not knowingly collect personal information from anyone under 13. If you think a child has sent something through a form, tell me and I will delete it.

Links to other sites

Listings link out to business websites, social profiles and mapping services. Follow one of those links and you are on somebody else's site, under somebody else's privacy policy. I have no control over what they collect, and this policy stops at the edge of mine.

Changes to this policy

When this policy changes, the effective date at the top changes with it. If a change materially affects how information already collected is handled, I will say so on the page instead of quietly editing a sentence and hoping nobody notices.

How to reach me

Privacy questions, access requests, corrections and removals all go to the same place. Use the contact form and say what you need. It reaches a person, not a ticket queue.

Richmond Local does not publish a postal address or a telephone number, because there is no public office and no phone line to publish. Everything here is handled in writing.