Privacy Policy

Last Updated: January 18, 2026

Thornbury ("we," "our," or "us") is committed to protecting the privacy and confidentiality of personal information collected through our consulting services and website. This Privacy Policy explains our practices regarding the collection, use, disclosure, and protection of your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian privacy legislation.

For questions about this policy or our privacy practices, contact us at [email protected].

1. Information We Collect

Personal Information Collected Directly

We collect personal information that you voluntarily provide when engaging our consulting services or using our website, including name, email address, phone number, business name, job title, and business address. When submitting inquiries through our contact forms, this information is collected to respond to your requests and provide consulting services.

Information Collected Automatically

Our website automatically collects certain technical information through cookies and similar technologies. This includes IP address, browser type and version, operating system, referral source, pages visited, time spent on pages, and access times. This information helps us improve website functionality and user experience.

Consulting Engagement Information

During consulting engagements, we may collect additional business information relevant to the services provided, including operational data, financial information (as necessary for assessments), organizational structure details, and strategic planning information. This information is collected only with your consent and used solely for delivering consulting services.

2. How We Use Your Information

We use personal information collected for the following purposes:

  • To provide consulting services and respond to inquiries about our offerings
  • To communicate regarding service delivery, appointments, and engagement updates
  • To process and respond to your requests, questions, and feedback
  • To improve our website, services, and client experience
  • To send service-related communications and updates (with your consent)
  • To analyze website usage and improve functionality through analytics
  • To comply with legal obligations and protect our legal rights

3. Legal Basis for Processing

We process your personal information based on the following legal grounds:

  • Consent: When you provide information voluntarily through our contact forms or engage our services
  • Contract Performance: To fulfill our consulting service agreements and deliver requested services
  • Legitimate Interests: To operate our business, improve services, and protect against fraud
  • Legal Compliance: To meet regulatory requirements and respond to lawful requests

4. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share information in the following limited circumstances:

Service Providers

We engage trusted third-party service providers to support business operations, including website hosting providers, email service providers, and analytics services. These providers are contractually obligated to protect your information and use it only for the purposes we specify.

Legal Requirements

We may disclose information when required by law, legal process, or governmental request, or when necessary to protect our rights, property, or safety, or that of our clients or others.

Business Transfers

In the event of a merger, acquisition, or sale of business assets, personal information may be transferred to the acquiring entity, subject to the same privacy protections.

5. Data Security

We implement appropriate technical and organizational security measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. Our security practices include:

  • Encryption of data in transit using SSL/TLS protocols
  • Secure storage of data on protected servers with access controls
  • Regular security audits and vulnerability assessments
  • Limited employee access to personal information on a need-to-know basis
  • Confidentiality agreements with employees and service providers

While we strive to protect your information, no security system is completely secure. We cannot guarantee the absolute security of data transmitted over the internet or stored on our systems.

6. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Retention periods vary based on the type of information and purpose:

  • Contact form inquiries: Retained for 2 years from date of inquiry
  • Client engagement records: Retained for 7 years following engagement completion
  • Financial records: Retained per Canadian tax law requirements (7 years)
  • Website analytics data: Retained for 24 months

When information is no longer needed, we securely delete or anonymize it to prevent unauthorized access or use.

7. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance user experience and analyze website usage. Cookies are small text files stored on your device that help us recognize you and remember your preferences.

Types of Cookies We Use

  • Essential Cookies: Necessary for website functionality and security
  • Analytics Cookies: Help us understand how visitors use our website
  • Preference Cookies: Remember your settings and preferences

You can manage cookie preferences through your browser settings or our Cookie Policy page. Note that disabling certain cookies may affect website functionality.

8. Your Privacy Rights

Under Canadian privacy legislation, you have the following rights regarding your personal information:

  • Right to Access: Request access to personal information we hold about you
  • Right to Correction: Request correction of inaccurate or incomplete information
  • Right to Deletion: Request deletion of your personal information, subject to legal retention requirements
  • Right to Withdraw Consent: Withdraw consent for processing where based on consent
  • Right to Object: Object to processing of your information for certain purposes
  • Right to Portability: Request transfer of your information to another service provider

To exercise these rights, contact us at [email protected]. We will respond to your request within 30 days.

9. Children's Privacy

Our services are intended for businesses and individuals aged 18 and over. We do not knowingly collect personal information from individuals under 18 years of age. If we become aware that we have collected information from someone under 18, we will promptly delete that information.

10. Third-Party Links

Our website may contain links to third-party websites for your convenience and information. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this policy and may provide additional notice through our website or email.

Continued use of our services after policy changes constitutes acceptance of the updated policy. We encourage you to review this policy periodically to stay informed about how we protect your information.

12. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Thornbury

Privacy Officer

100 King Street West, Suite 5700

Hamilton, ON L8P 4W9

Canada

Email: [email protected]

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.