Privacy Policy

1. Introduction

Spinefresh ("we", "us", "our") is committed to protecting the privacy of individuals who visit our website at spinefresh.world and use our services. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in compliance with the General Data Protection Regulation (GDPR), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable privacy laws.

By using our website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with its terms, please discontinue use of the website.

2. Information We Collect

2.1 Information You Provide Directly

When you submit our contact form, we collect the following personal data:

• Full name
• Email address
• The content of your message
• Record of your GDPR consent

2.2 Automatically Collected Information

When you visit our website, we may automatically collect certain technical information, including:

• IP address (anonymised where possible)
• Browser type and version
• Pages visited and time spent on each page
• Referring URL
• Device type and operating system

This information is collected only if you have consented to analytics cookies. See our Cookie Policy for details.

2.3 Information We Do Not Collect

We do not collect sensitive personal data such as health information, financial data, or government identification numbers.

3. How We Use Your Information

We use the personal data we collect for the following purposes:

• To respond to your enquiries submitted via our contact form
• To improve the functionality and content of our website (analytics data)
• To comply with our legal obligations
• To maintain records of consent

We do not use your personal data for automated decision-making or profiling.

4. Legal Basis for Processing

We process your personal data under the following legal bases as defined by GDPR:

• Consent (Article 6(1)(a)): When you submit a contact form, you provide explicit consent. When you accept analytics or marketing cookies, you provide consent for that processing.
• Legitimate Interests (Article 6(1)(f)): We may process certain technical data to maintain website security and functionality, where this does not override your rights.
• Legal Obligation (Article 6(1)(c)): Where processing is required to comply with applicable law.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties. We may share information in the following limited circumstances:

• Service providers: We may engage third-party service providers (e.g., hosting, email delivery) who process data on our behalf under data processing agreements.
• Legal requirements: We may disclose data if required by law, court order, or government authority.
• Business transfers: In the event of a merger, acquisition, or asset sale, personal data may be transferred to the acquiring party.

Any third parties we engage are required to handle your data in accordance with applicable privacy laws.

6. Data Retention

We retain personal data only for as long as necessary for the purposes stated in this policy:

• Contact form submissions: Retained for up to 3 years from the date of submission to allow for follow-up and record-keeping.
• Analytics data: Retained for up to 26 months, after which it is aggregated or deleted.
• Cookie consent records: Retained for the duration of your browser's localStorage and reset upon clearing browser data.

Upon expiry of the retention period, data is securely deleted or anonymised.

7. Your Rights

Under GDPR and applicable Canadian privacy law, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data, subject to legal retention obligations.
• Right to restriction: Request that we limit processing of your data in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw previously given consent at any time, without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact us at online@spinefresh.world. We will respond within 30 days.

8. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction, including:

• HTTPS encryption for all data transmitted via the website
• Restricted access to personal data on a need-to-know basis
• Regular review of security practices

While we take reasonable steps to protect your data, no internet transmission is completely secure. We cannot guarantee absolute security.

9. Cookies

Our website uses cookies as described in our Cookie Policy. You can manage your cookie preferences at any time through the cookie settings available on the website.

10. International Data Transfers

Our website is operated from Canada. If you are located outside Canada, your data may be transferred to and processed in Canada, where privacy laws may differ from those in your jurisdiction. By using our website, you consent to this transfer.

11. Children's Privacy

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has submitted personal data, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal obligations. The updated date at the top of this page reflects the most recent revision. We encourage you to review this policy periodically.

13. Contact Us

For any questions or concerns about this Privacy Policy or to exercise your rights, please contact us: