Privacy policy

Scope and audience

This policy applies to visitors, correspondents, and customers who interact with Smyxaronghol through the website, email, or telephone. It explains categories of personal data, purposes, retention, security measures, and the rights you can exercise. If you are a representative of an organization, we may process your business contact details under both this policy and any separate agreement.

Controller and representative

The data controller is Smyxaronghol, located at 169 Roncesvalles Ave, Toronto, ON M6R 2L3, Canada. Email: ask@smyxaronghol.world. Telephone: +1 416-537-3700. For EU data subjects, you may contact us at the same address; we respond in English and may request additional information to verify your identity before fulfilling certain requests.

Categories of personal data

Depending on how you use our services, we may process:

• Identity and contact data: name, email address, and message content when you send a contact form or email.
• Technical data: IP address, browser type, operating system, language preference, approximate region, timestamps, referring URL, and pages viewed, collected through server logs or optional analytics tools when you consent.
• Preference data: cookie consent choices stored in your browser using local storage and, where applicable, strictly necessary cookies.
• Transaction data: if you purchase services or goods, we may process billing identifiers, delivery address, and order history as described in the return policy.

We do not ask for sensitive categories of data through the website. Please do not include health-related or other sensitive information in free-text fields unless you choose to do so voluntarily.

Purposes and legal bases

We process personal data on the following legal bases under GDPR Article 6: (1)(a) consent for optional cookies and optional marketing communications where you opt in; (1)(b) steps necessary to respond to your contact request or pre-contractual inquiries; (1)(c) compliance with legal obligations such as tax or accounting records; and (1)(f) legitimate interests in securing the site, preventing abuse, maintaining backups, and improving reliability, balanced against your rights through technical and organisational measures.

Retention periods

Contact form and email correspondence records are retained for up to twenty-four months after the last substantive message in a thread unless a longer period is required by law, dispute resolution, or your ongoing relationship with us. Server logs containing personal data are typically rotated within ninety days unless a security incident requires a limited extension. Cookie preference records remain on your device until you clear site data or change choices. Financial records follow applicable statutory retention rules in Canada.

Recipients and processors

We use hosting, email delivery, and infrastructure providers that process data on our instructions. Some providers may be located in Canada, the European Economic Area, the United Kingdom, or the United States. Where transfers occur outside the EEA or UK, we rely on adequacy decisions, standard contractual clauses, or other approved mechanisms. We do not sell personal data and we do not share data for targeted advertising beyond what you consent to under marketing cookies.

Security measures

We implement access controls, encryption in transit where supported, credential hygiene, least-privilege administration, and regular review of vendors. Staff and contractors with access to personal data are bound by confidentiality obligations. No system is perfectly secure; we monitor for common risks and respond to incidents according to internal procedures and legal requirements.

Your rights

Subject to applicable law, you may request access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You may lodge a complaint with a supervisory authority, including the Dutch Autoriteit Persoonsgegevens if Dutch law applies to your situation, or the Office of the Privacy Commissioner of Canada for matters under Canadian law.

Canada: PIPEDA and provincial laws

For individuals in Canada, our practices are designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), where it applies to our activities. Depending on your province or territory, additional laws may apply (for example Alberta’s and British Columbia’s private-sector privacy statutes, or Quebec’s modernized framework). We provide access and correction mechanisms consistent with these obligations and respond to requests in a timely manner.

If you have concerns you cannot resolve with us directly, you may contact the Office of the Privacy Commissioner of Canada (OPC) or your provincial privacy commissioner or ombudsman, as applicable. Links and guidance are available on the OPC website at priv.gc.ca.

International visitors

If you access the site from outside Canada, your data may be processed in Canada and other jurisdictions as described above. We aim to provide comparable protections through contracts and configuration choices. Provincial privacy laws in Canada may apply alongside this policy for residents of those provinces.

Changes to this policy

We update this policy when our practices change. The hero section displays the current calendar date when you load the page so you can see when you last reviewed it. Material changes will be communicated through the site or by email where appropriate.

Contact and requests

For privacy questions or requests, email ask@smyxaronghol.world or write to the postal address above. Include enough detail for us to identify your request and verify your identity. We respond within the timeframes required by applicable law.