Who is responsible
15919169 Canada Inc., which publishes Chalkline, is responsible for your personal information collected through chalklinekits.com. Contact us at [email protected] or by post at 36 Moorcroft Pl, Brampton, ON L6P 4P6, Canada.
We are a Canadian business and follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL). Where you are in the European Economic Area or the United Kingdom, we also describe our approach under the GDPR and UK GDPR.
What we collect and why
| When | What | Why (legal basis) |
|---|---|---|
| You buy a product | Name, email address, billing country or address, the product bought, payment status (not your card number) | To take payment, deliver your files, send your receipt, calculate tax and keep records (contract and legal obligation) |
| You download a file | Order reference, download count and time, a download token, and technical request data such as IP address | To deliver files securely and limit misuse (contract and legitimate interests) |
| You join the email list | Email address, the time and the consent you gave | To send the free calendar and occasional updates (consent) |
| You contact us | Your email address and message | To reply and help (legitimate interests) |
| You visit the site | IP address, browser and device details, pages requested, in server and security logs | To run and secure the site (legitimate interests) |
| You accept analytics cookies | Pseudonymous usage data such as pages viewed and approximate location | To understand which pages are useful (consent) |
We do not sell your personal information and we do not use it for automated decisions that have legal effects on you.
Who helps us handle it
We use trusted service providers who process information on our behalf:
- Stripe processes payments, and may calculate and collect sales tax. Stripe collects your card and billing details directly under its own privacy policy. We receive your name, email, billing country or address and payment status.
- Brevo sends our emails: order delivery emails and, if you subscribe, newsletter and calendar emails. It stores your email address and your subscription status.
- Cloudflare hosts the website, provides security and content delivery, and stores order records and the private product files. It processes technical request data such as IP addresses.
- Google Analytics 4 may be used to measure how the site is used, only after you accept analytics cookies. See the cookie notice.
- Etsy and Gumroad, if you buy there, handle your order under their own privacy policies and share the order details with us that we need to support you.
Where information is stored
These providers operate globally, so your information may be processed in countries other than your own, including Canada, the United States and the European Union. Where required, we rely on safeguards such as standard contractual clauses or provider commitments. Information held outside Canada may be accessible to courts and authorities in those countries.
How long we keep it
- Order and tax records: for as long as the law requires. In Canada this is generally six years.
- Download links and logs: for a short period after they expire, then deleted or anonymised.
- Email list: until you unsubscribe. We keep a minimal record that you unsubscribed so we do not email you again.
- Support emails: as long as needed to help you and handle any follow-up.
Email and consent
We only send marketing email with your express consent, and we use double opt-in: you confirm your address by clicking a link. Every email includes our identity and contact details, and an unsubscribe link. You can withdraw consent at any time. Order and delivery emails are not marketing, and we send them to complete your purchase.
Your rights
You can ask us to give you access to the personal information we hold about you, correct it, delete it where we are not required to keep it, or stop using it for a purpose you did not agree to. Under the GDPR you may also object to processing, ask us to restrict it, and ask for a portable copy. Email [email protected] and we will reply within 30 days. We may need to confirm who you are first.
If you are unhappy with our response, you can complain to the Office of the Privacy Commissioner of Canada, or, if you are in the EEA or UK, to your local data protection authority.
Security
We limit access to personal information, use encrypted connections, keep product files in private storage, and use unguessable, expiring download links. No system is perfectly secure, so we cannot guarantee absolute security. If a breach creates a real risk of significant harm, we will tell affected people and the regulator as the law requires.
Children
Our products are for adults and the site is not directed at children under 16. Please do not send us a child's personal information.
Changes
We may update this notice, and we will change the date at the top when we do.