Privacy Policy
This policy explains what we collect when you visit this site or sign up for the course, why, who sees it, and what you can ask us to do with it. It is written for people in Canada (including Quebec) and the United States, which is where we offer the course.
Who we are
The site and course are run by Glew White, operating as Scotia Fin Art Academy, New Glasgow, NS, Canada. In this policy, “we” and “us” mean that business.
Person in charge of personal information: Glew White, Privacy Officer, [email protected]. Write here for any question or request about your information.
What we collect
| Information | Where it comes from | Why |
|---|---|---|
| First name, email address | The sign-up form | To give you course access and send the lessons you asked for |
| Country, experience level (optional) | The sign-up form | To know who the course serves and adjust the lessons |
| Your choice about news emails, and the wording you agreed to | The sign-up form | To send news only if you said yes, and to be able to prove it |
| Cookie choices, with date and a keyed hash of your IP address | The cookie banner | To respect and record your choices |
| Google click IDs (gclid, gbraid, wbraid) and campaign tags (utm) | The link of the ad you clicked, if any | To know which of our ads lead to sign-ups |
| Browser type, pages visited, approximate location from IP | Google Analytics and Google Ads cookies, only if you allow them | To measure visits and our advertising |
| Technical logs (IP address, browser, time) | Our web server | Security and keeping the site running |
We don’t ask for payment details, government ID numbers, health information or any other sensitive information, and we ask you not to send any.
Consent
By signing up, you agree that we use your name and email to give you the course. News and other promotional emails are separate: we send them only if you tick that box, which is never ticked for you. This is how we meet Canada’s Anti-Spam Legislation (CASL). Every email includes our mailing address and a one-click unsubscribe, which also covers the U.S. CAN-SPAM Act.
Measurement and advertising cookies stay off until you accept them in the banner. You can change your mind at any time with the link, which is also at the bottom of every page. You can withdraw any consent by writing to us; we will tell you what, if anything, stops working as a result.
Google services
When you allow them, we use Google Analytics and Google Ads conversion tracking. We use Google Consent Mode: before you choose, and after you refuse, Google tags set no cookies and receive only cookieless signals (such as the fact that a page loaded) that do not identify you. With your consent, when you sign up we send Google a one-way hash of your email so it can match the sign-up to an ad click (“enhanced conversions”). How Google uses information from sites that use its services is explained at policies.google.com/technologies/partner-sites. Details of each cookie are in our cookie policy.
Who we share it with
We don’t sell personal information for money. We share it only with service providers that help us run the course and the site, under contracts that limit their use to our instructions:
- our web host, which stores the site and the sign-up records;
- our email and course delivery providers, which send the access link and the lessons;
- Google, for analytics and advertising measurement, only with your consent.
We may also disclose information when the law requires it, or to protect the security of the site and its users.
Where it is stored
Your information may be stored and processed in Canada and in the United States, where some of our providers operate. It may then be accessible to authorities in those countries under their laws. Before sending information about Quebec residents outside Quebec, we assess whether it will be adequately protected, as Quebec law requires.
How long we keep it
- Sign-up details: while you are enrolled, and up to 24 months after the last email you opened or clicked. Then we delete them.
- If you unsubscribe or ask us to delete your data: we delete it, except your email address on a do-not-contact list, which the law needs us to keep to honour your request.
- Cookie choice records: 3 years, to be able to show what you agreed to.
- Server logs: usually 30 days.
Security
The site only works over an encrypted connection (HTTPS). Sign-up records are kept outside the public part of the server, IP addresses in our records are stored as keyed hashes, and access is limited to the people who run the course. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify you and the authorities as the law requires.
Your rights in Canada
Under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector (as amended by Law 25), you can:
- ask whether we hold information about you and get a copy;
- have inaccurate or incomplete information corrected;
- withdraw your consent;
- in Quebec, also ask that information be deleted or that it stop being shared, and receive computerized information you gave us in a structured, commonly used format.
We answer within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.
Your rights in the United States
California
Under the California Consumer Privacy Act as amended by the CPRA, California residents can ask us to tell them what personal information we collected, used and disclosed; to delete it; to correct it; and to opt out of its “sale” or “sharing.” We don’t sell personal information. Letting Google advertising cookies run may count as “sharing” for cross-context behavioural advertising, so you can opt out on our Your Privacy Choices page or by refusing advertising cookies. We honour the Global Privacy Control (GPC) browser signal as an opt-out. We don’t collect sensitive personal information, and we won’t treat you differently for using any of these rights.
Categories collected in the last 12 months: identifiers (name, email, keyed IP hash, Google click IDs); internet activity (pages viewed and ad interactions, with consent); approximate geolocation (country you select, region from IP when analytics is allowed). Sources and purposes are in the table above; retention is in “How long we keep it.”
Other states
Residents of states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia) can ask to access, correct, delete or get a copy of their personal data, and to opt out of targeted advertising. If we refuse a request, you can appeal by replying to our answer; we will respond to an appeal within the time your state’s law sets.
How to make a request
Email [email protected] from the address you signed up with, and say which right you want to use. We may ask for one more detail to confirm it’s you. An authorized agent can make a request for you with your signed permission. We reply within 45 days, or tell you if we need up to 45 more.
Children
The course is not meant for children under 13, and we don’t knowingly collect information from them. If you think a child under 13 signed up, write to us and we will delete the information.
Changes to this policy
If we change this policy, we update the date at the top. If the change affects how we use information you already gave us, we will email you or ask for your consent again where the law requires it.
Questions: [email protected]