Privacy Policy

Who we are, and what this covers

GTA TV Wall Mounting (“GTA TV Wall Mounting”, “we”, “us”, “our”) is a TV mounting and AV installation business based at 111 Inverlochy Blvd, Unit 903, Thornhill, Ontario, working across the Greater Toronto Area.

This policy explains how we handle personal information — yours, and anyone else’s whose details end up with us. It covers the website at gtatvwallmounting.ca, and it covers the phone calls, emails and site visits that come out of it. In other words, the whole relationship, not just the browser part.

The law we work under is Canada’s federal private-sector privacy statute, the Personal Information Protection and Electronic Documents Act — PIPEDA for short. It applies to businesses like ours in Ontario, and it’s the frame for everything below.

“Personal information” means information about an identifiable individual. Your name, your phone number, your email address, your home address, photos of your living room wall. Not the business’s name and address of a company we deal with — that’s business contact information, which PIPEDA treats differently.

The short version

The rest of this page is the detail, because “trust us” isn’t a policy.

What we collect when you contact us

There are four ways your information reaches us, and they’re all ones you start.

About the contact form

The form — the one that opens when you click any Get a Quote button, and the same one sitting on our contact page — asks for six things: your first name, your last name, your email, your phone number, the address where the work would happen, and a description of the job. All but the job description are required.

Along with what you type, the form records which page you were on when you sent it, which button you clicked, and — if you arrived from an ad or a search campaign — the campaign tags in that link. That is so we know what you were reading when you got in touch. It also logs the IP address the submission came from, which we use to rate-limit spam and nothing else.

Here’s the part most privacy policies would quietly skip. That form now does go somewhere. Submissions are written to a file on our own server that isn’t reachable from the web, and emailed to us so we can reply. A copy of your request is also emailed back to you as a confirmation. We don’t sell it, we don’t hand it to advertisers, and nothing about it feeds a tracking profile.

Spam filtering on the form is Google reCAPTCHA, which is covered in our cookie policy. It loads only once you open the form, not when you land on a page.

If you’d rather not use the form at all, call us or send an email — both reach the same people.

Photos of your place

Our technicians may photograph a completed installation for our own records, for quality checks and for warranty purposes. Those photos can show the inside of your home, so we treat them as personal information. We won’t publish a photo of your home or business in our gallery, on social media or in any marketing without asking you first — that’s in our service agreement too, and it’s a promise, not a formality.

Other people’s information

Sometimes you’ll give us someone else’s details — a tenant, a property manager, a family member who’ll be home when we arrive. If you do, please make sure they’re fine with it. We’ll use those details only to arrange and carry out the job.

What the website itself collects

Very little, and none of it deliberately identifies you.

Server logs. Like essentially every website on the internet, the server that hosts our pages keeps a log of requests it receives. A log line typically records the IP address the request came from, the date and time, which page was asked for, the browser and operating system reported by that browser, and the page you came from if there was one. This is how web servers work — it happens automatically, we don’t switch it on and off, and we don’t use it to work out who you are or to follow you around. Its purpose is keeping the site running and dealing with security problems.

No analytics. This site runs no Google Analytics, no Google Tag Manager, no Meta or Facebook pixel, no session-recording or heatmap tool, and no advertising trackers of any kind. There is no visitor counter. Nobody is watching a replay of your mouse.

No cookies of our own. gtatvwallmounting.ca sets no first-party cookies. There’s no login to remember, no cart to keep and no preference to store. There isn’t a cookie consent banner either, because there’s nothing here to consent to.

The embedded Google map. Our contact page, home page and area pages embed a Google map. When that map loads, your browser talks to Google directly, and Google can set its own cookies inside that frame under its own rules. We can’t see them and can’t control them. The maps load lazily, so on most pages nothing loads until you scroll down to one. The full detail is in our cookie policy.

What we don’t collect

Worth listing plainly, because a privacy policy that only tells you what a business does take isn’t telling you much.

• No accounts, no logins, no passwords. There’s nothing to sign up for on this site, so there’s no password of yours for us to lose.
• No payment card details on the website. There’s no cart, no checkout and no payment field anywhere on gtatvwallmounting.ca. The site processes no money. If a page ever asks you for a card number, it isn’t us — close the tab and tell us. Payment for a job is arranged directly with us, off the website, as set out in the service agreement.
• No tracking or advertising profiles. We don’t build a profile of you, we don’t retarget you with ads, and we don’t follow you to other sites.
• No sensitive information we have no business holding. We don’t ask for your Social Insurance Number, your date of birth, your banking credentials, your health information, or anything about your background. We don’t run credit checks. Please don’t send us any of it.
• No bought lists. We don’t buy, rent or scrape contact lists, and we don’t sell, rent or trade yours.

Why we collect it

PIPEDA says a business has to identify why it’s collecting something, at or before the time it collects it, and then stick to that. So here are our reasons, in full:

• To answer your question and get back to you.
• To work out what the job involves and give you a quote.
• To book the appointment, route a technician and let you know when we’re coming.
• To actually do the work — which means knowing the address, the access, and what we’re mounting.
• To invoice you and take payment.
• To honour our one-year material and workmanship warranty, which means keeping a record of what we installed for you and when.
• To deal with a problem, a complaint, a warranty call-back or an insurance claim if one ever comes up.
• To keep the business records we’re required by law to keep, such as invoices for tax purposes.
• To keep this website up and secure.

That’s the list. If we ever want to use your information for something that isn’t on it, we’ll ask you first.

Your consent, and taking it back

Under PIPEDA we need your consent to collect, use or disclose your personal information, and it has to be meaningful — you have to reasonably understand what you’re agreeing to. Consent comes in two flavours, and we use both.

Implied consent covers the obvious. When you phone us for a quote, email us about a job, or let a technician into your home to mount a TV, you’re plainly agreeing that we can use those details to do exactly that. We don’t ask you to tick a box before we’re allowed to write your address on the schedule.

Express consent is for anything beyond the obvious. Publishing a photo of your home in our gallery or on social media is the main one, and we ask for that separately, every time.

Withdrawing consent. You can change your mind. Tell us — by phone, by email, or in writing to the address in section 20 — and we’ll stop using your information for whatever you’ve withdrawn consent for, and delete it where we can. Two honest caveats: withdrawing consent before a job means we probably can’t do the job, since we can’t install a TV at an address we’re not allowed to know; and we can’t delete records we’re legally required to keep, like a paid invoice. We’ll tell you plainly which of those applies rather than just going quiet.

Withdrawing consent isn’t retroactive — it doesn’t undo something we lawfully did while we had it.

Who else sees your information

Short list, and no surprises on it.

• Our own people. The technician doing your job needs your address and phone number. Whoever books and invoices needs the same. Nobody who doesn’t need it gets it.
• Google, because our email is a Gmail address. Our published email address runs on Google’s Gmail service, so anything you email us is received, stored and processed on Google’s systems, under Google’s terms. That’s worth knowing before you email us something you’d rather nobody stored.
• Our web host. Whoever runs the server this site sits on necessarily handles the server logs described in section 4. They provide hosting; they aren’t given a customer list.
• Our insurer, if there’s a claim. If something gets damaged and a claim is made, we’ll have to share what’s relevant to it. That’s covered in the service agreement.
• Professional advisors. An accountant or a lawyer, where they need it to advise us, and bound by their own confidentiality obligations.
• When the law requires it. A court order, a warrant, a subpoena, or another legal obligation. We won’t hand anything over voluntarily just because somebody asked politely on letterhead.
• If the business is ever sold or transferred. Customer records could form part of that transfer. Any buyer would be bound to use them for the same purposes set out in this policy.

That’s the whole list. No CRM vendor, no booking platform, no email marketing service, no data broker, no advertising network. We don’t sell, rent or trade your information to anyone, for any price.

Sites we link to

Our pages link out to places we don’t control — Google, HomeStars, and our profiles on the usual social and directory sites. This privacy policy doesn’t apply to any of them. Once you click through, you’re under their privacy policy, not ours, and it’s worth a read. Same point is made in our terms of service.

Where your information is kept

Some of it leaves Canada, and you should know that rather than find out later.

Because our email address is a Gmail address, email you send us is stored on Google’s infrastructure, which spans data centres outside Canada. That’s not something we can localise without changing email providers.

When information is stored in another country, it’s subject to that country’s laws — which can include lawful access by that country’s courts, law enforcement and national security agencies, on terms that may differ from Canada’s. PIPEDA doesn’t prohibit that; it requires us to tell you it happens and to remain accountable for the information regardless of where it sits. We are.

If you’d rather not have your details sitting in a foreign-hosted inbox, call us instead of emailing. That’s a completely reasonable preference and we’re not going to argue with it.

How we protect it

We’re a TV mounting company, not a bank, and we’re going to describe our safeguards at the size they actually are rather than borrow language from someone else’s policy.

The protections that genuinely apply here are these: we collect as little as the job needs in the first place, which is the single most effective safeguard there is; access to customer details is limited to the people who need them to do the work; we don’t publish, post or pass around customer information; the website is served over an encrypted HTTPS connection; and because the site holds no accounts, no passwords and no payment data, there is no customer database on it to breach in the first place.

What we are not going to claim: we hold no security certification, we aren’t audited against any security standard, and we’re not going to tell you our data is encrypted at rest when the honest answer is that it lives in an email account and on working devices. No method of transmitting or storing information is completely secure, and anyone who tells you otherwise is selling something.

If you’re about to send us something you’d be unhappy to see leaked, the right answer is to not send it. Nothing about mounting a TV requires it.

How long we keep it

The principle we work to is the one PIPEDA sets: we keep personal information only as long as it’s needed for the purposes in section 6, and we don’t hoard it past that.

In practice that means an enquiry that never turns into a job doesn’t need keeping indefinitely; a completed job’s records need keeping at least as long as the one-year warranty runs, because that’s how we honour it; and financial records — invoices, payment records — have to be kept for as long as tax and business law requires, which is longer than either of us would choose.

When information no longer serves a purpose and no law requires us to hold it, we delete it or destroy it. If you want to know what we currently hold about you, section 13 tells you how to ask — and if the honest answer is “an email thread from 2023 and an invoice,” that’s the answer you’ll get.

Your rights under Canadian privacy law

PIPEDA gives you real, enforceable rights over your own information. Here they are, in plain terms:

• Access. You can ask us whether we hold personal information about you, what it is, how we’ve used it, and who we’ve disclosed it to. We’ll tell you, and give you a copy.
• Correction. If something we hold about you is wrong or incomplete, you can have it corrected. If we disagree that it’s wrong, we’ll record your objection alongside it.
• Withdrawing consent. Covered in section 7 — you can take back your consent at any time, subject to legal and contractual limits we’ll explain.
• Knowing who’s accountable. You can ask who is responsible for personal information in this business, and get a straight answer.
• Challenging what we do. You can question our compliance with this policy or with PIPEDA, and we have to take the challenge seriously and investigate it.
• Being told about a breach. If something goes wrong in a way that could really harm you, you have the right to be told. See section 16.

There are narrow situations where the law says we can’t hand something over — for example, where doing so would reveal another person’s personal information, or where the information is subject to solicitor-client privilege. If we ever refuse a request, we’ll tell you why in writing and tell you how to complain about it.

How to make a privacy request

No forms, no portal, no ticket number. Contact us using any of the details in section 20 and say what you want — access, correction, deletion, withdrawal of consent, or just a question about what we hold.

A few practical notes so it goes smoothly:

• Put it in writing if you can. Email is fine. It gives both of us a record of what was asked and when.
• We may need to confirm you’re actually you before handing over personal information. That’s protecting you, not stalling you, and we’ll ask for the least we can get away with.
• Tell us roughly what you’re looking for — a date, an address, a job. It makes the search faster.
• PIPEDA gives us 30 days to respond to an access request. We’ll usually be a lot quicker than that. If we genuinely need an extension, the law requires us to tell you, and we will.
• Access requests are free. If a request would somehow involve a real cost, we’d tell you what it is and let you decide before doing anything.

If you’re not happy with our answer

Come back to us first. Most privacy complaints are misunderstandings, and we’d rather fix one directly than have you go to the trouble of escalating it. Tell us what went wrong, we’ll investigate it properly, and we’ll write back with what we found and what we’ve done about it.

If that doesn’t satisfy you, you have the right to complain to Canada’s privacy regulator. That’s the Office of the Privacy Commissioner of Canada, and complaining is free:

We’re telling you this because you’re entitled to know it, not because we’re expecting you to need it.

Children’s information

Our services are sold to adults — homeowners, tenants, landlords, property managers and businesses. This website isn’t aimed at children, has nothing on it designed to appeal to children, and we don’t knowingly collect personal information from anyone under 18.

If you’re under 18, please don’t send us your details — get a parent or guardian to make the enquiry. If you’re a parent or guardian and you think a child has sent us personal information, tell us and we’ll delete it.

Children live in the homes we work in, and our technicians sometimes take photos of a finished installation. Where a photo happens to include a person, it stays in our internal records and never goes anywhere public without asking — and we simply don’t publish photos with children in them.

If there’s ever a breach

PIPEDA doesn’t leave this to our discretion, and that’s a good thing. If personal information in our control is lost, stolen or accessed by someone who shouldn’t have it, and it creates a real risk of significant harm to you — identity theft, fraud, financial loss, damage to your reputation or relationships, humiliation, loss of employment — then we are legally required to:

• report the breach to the Office of the Privacy Commissioner of Canada;
• notify you directly, as soon as feasible, with enough detail for you to understand the risk and take steps to reduce it;
• notify any other organisation that could help reduce the risk to you; and
• keep a record of the breach.

We also have to keep a record of every breach of security safeguards, including the ones that don’t meet that threshold, and hand those records to the Commissioner on request.

You won’t get a vague “an incident may have occurred” email from us. If something happens that affects you, you’ll get told what happened, what was involved, and what to do about it.

Visitors from outside Canada

We’re an Ontario business serving the Greater Toronto Area, so PIPEDA is the law that governs everything on this page. But the web doesn’t stop at the border, and if you’re reading this from the European Economic Area, the United Kingdom or Switzerland, the GDPR (or UK GDPR) may give you rights over the information we hold about you.

We don’t target or market to the EEA or the UK, and we don’t offer installation services there, so those laws generally won’t apply to us. Rather than argue the point, our approach is simpler: if you’re in the EEA or the UK and you make a request, we’ll deal with it in the same spirit as a Canadian one. That means we’ll honour requests to access, correct, erase, restrict the use of, object to the use of, or receive a copy of your information, on the same footing described in sections 12 and 13.

We collect only what’s necessary for the enquiry or job in front of us, we don’t profile anyone, and we take no automated decisions about you. There is nobody behind the curtain scoring you.

Changes to this policy

We’ll update this page when what we do changes — if we add a tool, wire up the contact form, start using analytics, or the law shifts under us. The “Last updated” date at the top of the page moves whenever it does.

If a change is significant — a genuinely new use of your information rather than a wording tidy-up — we’ll be up front about it, and where the change needs your consent, we’ll ask for it rather than assume it from a date stamp.

There’s no mailing list for policy updates, because there’s no mailing list at all. Check the date if you want to know whether anything has moved.

Our other legal documents

This page covers personal information and nothing else. The rest lives in its own document, and each one governs its own subject — so if this page and one of those ever seem to disagree, the specialist document wins on its own topic.

• Terms of Service — the rules for using this website: what you can do with our content and photos, our copyright, links out, and the law that governs it. This page used to carry a stub “Terms and Conditions” heading and a copyright paragraph; both now live there in full.
• Service Agreement — the terms for the actual installation work: scope, the one-year material and workmanship warranty, on-site liability, insurance and payment.
• Cancellation Policy — the notice we ask for and how rebooking works after a cancellation. That page is the controlling one on cancellations; we deliberately don’t restate its terms here, so the two can never drift apart.
• Cookie Policy — the detailed version of section 4: cookies, browser storage, the embedded Google map, and how to control all of it from your browser.

How to reach us

Privacy questions, access requests, corrections, withdrawals of consent, complaints — all of it comes here. A real person reads it.

If your question is about the work rather than your information, the contact page is the faster route.