Privacy Policy

1. Who We Are#

WhyCrew is the organization responsible for your personal data collected through whycrew.com.

• Legal entity name: WhyCrew
• Registered address: 105 Consumers Drive, Unit #2, Whitby, ON L1N 1C4, Canada
• Phone: +1 289 483 0388
• Privacy contact: legal@whycrew.com
• EU representative: WhyCrew has not appointed a formal EU representative under GDPR Article 27. Our engagements with EU-based clients arise from individual projects sourced through third-party platforms rather than systematic, ongoing solicitation in the EU. See the note below for why this may qualify for an exemption, and why that determination still needs to be confirmed with legal counsel.

If you have any questions about this policy or how we handle your data, contact us at the email address above.

2. What Personal Data We Collect#

We collect personal data in a few different ways, depending on how you interact with our site.

Data you give us directly

When you fill out a contact form, request a consultation, subscribe to updates, or otherwise reach out to us, we collect what you provide: your name, email address, company name, job title, phone number (if given), and the content of your message.

Data we collect automatically

When you browse whycrew.com, our analytics tools automatically collect certain technical and usage data, including your IP address (anonymized where configured), browser type and version, device type, pages visited, time spent on the site, referring website, and general location data derived from your IP address. See our Cookie Policy for full details on the cookies this involves and the specific tools currently in use.

Data from third parties

We do not currently purchase or receive personal data about you from third-party data brokers. If this changes, we will update this policy.

We do not knowingly collect any special category data (such as health information, political opinions, or religious beliefs) through our website.

3. Why We Collect Your Data (Purpose and Legal Basis)#

Under PIPEDA, we collect, use, and disclose personal data only for purposes a reasonable person would consider appropriate, and only with your knowledge and consent. If you are in the EU, we also identify the specific GDPR legal basis for each purpose, since GDPR requires that in addition to consent. Here is how each purpose breaks down:

You can withdraw consent at any time (see Section 7, Your Rights). Marketing emails are also subject to CASL, so every message we send includes a way to unsubscribe, and we won't email you commercially without your prior express or implied consent.

4. How We Share Your Data#

We do not sell your personal data. We share data only with:

• Service providers (processors) who help us run our website and business, such as our hosting provider, analytics tools, and any email or CRM tools we use to manage inquiries. These providers only process data on our instructions and are bound by data processing agreements. Our Cookie Policy lists the specific tools active on the Site at any given time.
• Legal and regulatory authorities, where required to comply with a legal obligation, court order, or to protect our rights, property, or safety, or that of our users.
• A successor entity, in the event of a merger, acquisition, or sale of assets, subject to the same protections described in this policy.

5. International Data Transfers#

WhyCrew is based in Canada, so personal data we collect is generally processed and stored in Canada or by service providers operating there. Some of our service providers, including the analytics and business tools we rely on to run the Site, may process data outside Canada, including in the United States or elsewhere, where those providers operate. Data may therefore be accessible to, and subject to the laws of, other jurisdictions.

If you are located in the EEA or UK, this means your data is transferred outside the EEA/UK when it comes to us or to our service providers. Where this happens, we rely on appropriate safeguards recognized under GDPR, such as the European Commission's Standard Contractual Clauses, to ensure your data receives an equivalent level of protection regardless of where it's processed.

6. How Long We Keep Your Data#

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

• Contact form and inquiry data: retained for 24 months after your last interaction with us, if it doesn't lead to a client relationship, or as needed to maintain business records.
• Analytics data: retained according to our analytics provider's default settings, typically 14 to 26 months depending on configuration; see our Cookie Policy and cookie preference centre for the current setting.
• Client and contract data: retained for the duration of our engagement plus any period required by applicable tax, accounting, or contractual record-keeping obligations.

7. Your Rights#

If you are located in Canada, PIPEDA gives you the right to:

• Access the personal data we hold about you and know how it's being used
• Correct inaccurate or incomplete data
• Withdraw consent at any time, subject to legal or contractual restrictions, though this may limit our ability to provide certain services to you
• Challenge our compliance with PIPEDA and file a complaint with the Office of the Privacy Commissioner of Canada (OPC) if you believe we have not handled your data properly

If you are located in the EEA, UK, or another jurisdiction with GDPR-equivalent protections, you additionally have the right to:

• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten"), subject to certain exceptions
• Restrict how we process your data
• Object to processing based on legitimate interest, including for direct marketing
• Data portability, to receive your data in a structured, machine-readable format
• Lodge a complaint with your national data protection supervisory authority if you believe we have not handled your data properly

If you are located elsewhere in the world, outside Canada and the EEA/UK, local privacy law may give you similar or additional rights depending on where you live. We honor requests to access, correct, or delete your personal data to the extent required by the law that applies to you, regardless of your location, contact us using the details below and we'll confirm what applies and assist accordingly.

To exercise any of these rights, contact us at legal@whycrew.com. We will respond within the timeframe required by applicable law, generally within 30 days under PIPEDA or one month under GDPR of a verified request.

8. How We Protect Your Data#

We use appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction, including encrypted connections (HTTPS), access controls, and regular review of the third-party tools we rely on. No system is completely secure, and we cannot guarantee absolute security, but we work to minimize risk at every stage.

9. Children's Privacy#

Our website and services are intended for business use and are not directed at, nor knowingly collect data from, individuals under the age of 16. If we become aware that we have inadvertently collected data from a child, we will delete it promptly.

10. Changes to This Policy#

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated version here with a revised “Last updated” date. Material changes will be communicated more prominently where appropriate.

11. Contact Us#

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your data, contact us at: