What we collect, and what we don't.

Ottawa Agencies (ottawaagencies.com) is operated by 1001058521 Ontario Inc., an Ontario corporation based in Ottawa. 1001058521 Ontario Inc. is responsible for the personal information this site collects. Questions, corrections and complaints go to hello@ottawaagencies.com.

This policy is written for the two laws that apply to us: Canada's PIPEDA and Quebec's private sector privacy act (Law 25). Where they ask for different things, we follow the stricter one.

You can read every public page without an account and without telling us who you are.

We measure how the site is used with PostHog, a product-analytics service, so we know which pages, filters and agencies people look at and where the RFP builder loses them. It runs without cookies or any other storage in your browser, so each visit is counted on its own and nobody is recognised across visits or followed to other sites. It records the page, the action (a filter applied, a profile opened, a link clicked), your browser type and a coarse location derived from your IP address, which is then discarded. It never records what you type. We do not build profiles of visitors, and we honour the browser's “Do Not Track” setting. PostHog processes this data in the United States.

Our hosting provider keeps standard server logs: the IP address, browser type and pages requested. These exist to run the site and investigate abuse, are not joined to anything you type into a form, and are discarded by the host on its normal schedule (typically within 30 days).

Two things are saved in your own browser only, never sent to us until you choose to submit: the agencies you have shortlisted, and an RFP you have started but not sent. Clearing your browser's site data removes both. A sent RFP draft is cleared automatically.

The builder asks for your organization's name, type and website; the name, role, email and (optionally) phone number of the person agencies should reply to; and the brief itself: scope, budget band, dates and evaluation criteria.

Who sees it. The brief, including your contact details, is shown to the agencies you invited, in their dashboard on this site. If you chose to publish it on the open briefs board, a summary (title, organisation type, disciplines, budget band, requirements and dates, but not your organisation's name or contact details) is public, and the full brief can be read by any agency that is listed in the directory and signed in. The site operator can see every brief in order to run the service. Nobody else receives it. We do not sell, rent or trade briefs or contact details, and we do not use them for our own marketing.

How long we keep it. A brief stays on file while it is open and for 24 months after its decision date, so that the agencies you invited can refer back to it and so that you can ask us what was sent. You can ask us to delete it sooner at any time.

Applying to be listed, or claiming an existing profile, asks for the agency's name and website, the services it offers, and a contact name and email so we can verify that you speak for the agency. The agency's details become part of its public profile once approved. The contact name and email do not: they are kept privately and used only to verify and administer the listing.

Directory profiles describe businesses, not people, and are compiled from each agency's own public website and social accounts. We do not publish personal contact details, ratings or scores. If a profile names you and you want it changed or removed, email us and we will do it.

Only agencies managing a listing and the site operator need an account. Sign-in is provided by Clerk, which stores your email address, name and the session cookies needed to keep you signed in. Those cookies are strictly necessary and are not used for advertising. Clerk processes this data in the United States under its own privacy commitments; we have confirmed those are adequate for the purpose.

The site is paid for by Google AdSense advertisements. They are labelled “Advertisement”, kept apart from the listings, and have no influence on which agencies appear or in what order. No ads are shown on the RFP builder or in the agency and admin areas.

Google, and the advertisers it works with, may set cookies and read identifiers from your browser in order to show ads and measure them. Where the law requires it, including in Quebec and the European Economic Area, you will be asked for consent before any advertising cookie is set, and you can decline and still use the whole site. Google explains how it uses advertising data at policies.google.com/technologies/partner-sites. You can turn off personalised advertising at adssettings.google.com or through the Digital Advertising Alliance of Canada at youradchoices.ca.

Briefs, listing applications and agency profiles are stored in a database hosted by Supabase in Canada. The website itself is served by Netlify, and account sign-in by Clerk, both of which operate from the United States, so some information (server logs, account details) is processed there. We have assessed those transfers as required by Law 25 and limit them to what each provider needs to do its job.

Access to stored information is restricted to the site operator, is protected by individual sign-in, and is over encrypted connections only. The database is not reachable from the public internet.

You can ask us, at any time and free of charge, to tell you what personal information we hold about you, to correct it, to delete it, or to stop using it. Withdrawing consent to a brief means the agencies you invited will no longer see it. Email hello@ottawaagencies.com; we answer within 30 days.

If you are not satisfied with our answer you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca).

The person in charge of personal information at 1001058521 Ontario Inc., as Law 25 requires, can be reached at the same address.

Breaches. If a security incident creates a real risk of serious harm to you, we will tell you and the relevant regulator as the law requires.

Under 18. The site is for organizations buying agency services and is not directed at children. We do not knowingly collect information from anyone under 18.

Links. Agency profiles link to agencies' own websites and social accounts. Those sites have their own privacy practices, which we do not control.

Changes. When this policy changes we update the date at the top. A change that affects how we use information you have already given us will be announced on the site before it takes effect.