Privacy Policy

Last updated: 29 September 2026

This Privacy Policy explains how Thoughtful collects, uses, shares and protects personal information, and the choices and rights you have.

Contents

1. Who we are
2. What this policy covers
3. Information we collect
4. How we use your information
5. Marketing and business communications
6. Our legal basis and consent
7. Cookies and similar technologies
8. How we share information
9. International transfers
10. How long we keep information
11. How we protect information
12. When we process data for our clients
13. Your privacy rights
14. Complaints
15. Other important information
16. Contact us

1. Who we are

Thoughtful (“Thoughtful”, “we”, “us” or “our”) is a branding and digital growth agency serving small and mid-sized businesses and corporations worldwide, with offices in Canada, the United States and India. This Privacy Policy explains how we collect, use, share and protect personal information, and the choices and rights you have. It applies to all Thoughtful websites and regional versions, regardless of which office you deal with.

2. What this policy covers

This policy applies to personal information we handle through:

• our website at thoughtful.design, including its regional versions, and any related domains that redirect to it;
• emails, calls, video meetings, events and social media interactions with us;
• our business development and marketing activities; and
• our dealings with clients, prospective clients, suppliers and job applicants.

It does not cover personal information we process on behalf of our clients while delivering services to them. That situation is explained in Section 12.

3. Information we collect

Information you give us

• Contact and enquiry details: name, job title, company, business email, phone number, location and the details of your project or question when you fill in a form, book a call, email us or message us.
• Newsletter and content sign-ups: your email address and preferences.
• Client account details: contact information for your team, billing contacts, project communications, approvals and feedback. Payment is handled by our invoicing and payment providers; we do not store full card numbers.
• Job applications: your CV, portfolio, work history and anything else you choose to send.

Please do not send us sensitive information (such as health, financial account or government identification details) through our website or email unless we specifically ask for it.

Information collected automatically

When you visit our website, we and our technology partners collect technical and usage information such as IP address, approximate location (city or region), browser and device type, pages viewed, time on page, the website that referred you, and interactions with forms and buttons. This is collected through cookies and similar technologies described in Section 7.

Information from other sources

• Business contact sources: we may obtain professional contact details (such as name, job title, company and business email or phone) from business directories, professional networking sites, publicly available websites and B2B data providers, so that we can reach out to businesses that may benefit from our services.
• Advertising and analytics platforms: aggregated or campaign-level information about how people found and interacted with our ads and website.
• Referrals and partners: contact details passed to us by someone who recommended us, with your knowledge.
• Social media: information you make available when you follow, message, comment on or engage with our pages.

4. How we use your information

We use personal information to:

• respond to enquiries, prepare proposals and schedule consultations;
• deliver, manage and invoice client projects, and communicate about them;
• send newsletters, insights and marketing messages in line with the choices you have made and applicable anti-spam laws;
• contact businesses about services likely to be relevant to them (see Section 5);
• operate, secure, analyse and improve our website, content and services;
• measure and improve our advertising, including showing relevant ads to people who have visited our website;
• assess job applicants;
• prevent fraud and misuse, and protect our systems, clients and staff; and
• meet legal, tax, accounting and regulatory obligations, and establish or defend legal claims.

We do not use your personal information to make decisions that produce legal or similarly significant effects about you based solely on automated processing.

5. Marketing and business communications

We send commercial electronic messages only as permitted by applicable law, including Canada’s Anti-Spam Legislation (CASL) and the US CAN-SPAM Act. In Canada, this means we rely on your express consent, or on implied consent where the law allows it (for example, an existing business relationship, or where your business email address is published without a statement that you do not wish to receive unsolicited messages and our message is relevant to your role).

Every marketing email we send identifies us, includes our mailing address and contains a working unsubscribe link. We action unsubscribe requests promptly. After you opt out, we keep a minimal record of your email address on a suppression list so that we do not contact you again.

6. Our legal basis and consent

In Canada, we collect, use and disclose personal information with your consent, which may be express or implied depending on the sensitivity of the information and your reasonable expectations, or as otherwise permitted by law. You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting us (Section 16).

Where the EU or UK General Data Protection Regulation applies, we rely on: performance of a contract (to deliver services you asked for); legitimate interests (to run and grow our business, including B2B outreach, website analytics and security, where these are not overridden by your rights); consent (for non-essential cookies and certain marketing); and legal obligation (for tax and record-keeping).

Where India’s Digital Personal Data Protection Act, 2023 applies, we process digital personal data on the basis of your consent or for legitimate uses permitted by that Act, and we provide notices as the Act requires.

7. Cookies and similar technologies

Cookies are small files placed on your device. We use the following categories:

Where the law requires it, we ask for your consent before setting non-essential cookies. You can change your choices at any time through the cookie settings link in our website footer, and you can also block or delete cookies in your browser settings. Where applicable law requires it, we also honour recognized browser opt-out signals for advertising cookies.

8. How we share information

We do not sell personal information for money. We share personal information only as follows:

• Thoughtful offices: our entities in Canada, the United States and India work together to deliver projects. Our production team may access project information to carry out design, development, content and marketing work.
• Service providers: companies that provide website hosting, content delivery and security, CRM, invoicing and payments, email delivery, analytics, advertising, scheduling, file storage, communications and business-data services. They may use personal information only to provide services to us and must protect it.
• Advertising platforms: when you allow advertising cookies, our advertising partners receive information about your visit. Under some US state laws, this may be considered “selling”, “sharing” or “targeted advertising”. You can opt out using our cookie settings or the “Your Privacy Choices” link where available.
• Professional advisers: lawyers, accountants, auditors and insurers, under duties of confidentiality.
• Legal and safety reasons: where required by law, court order or a valid government request, or to protect rights, property or safety.
• Business transfers: in connection with a merger, acquisition, financing or sale of all or part of our business, subject to confidentiality protections.
• With your direction: for example, when you ask us to introduce you to a partner.

9. International transfers

Because we operate in Canada, the United States and India, and because some of our service providers are located elsewhere, your personal information may be stored or processed outside the country or province where you live, including in Canada, the United States and India. When it is, it may be accessible to courts, law enforcement and national security authorities in those countries.

We protect transferred information using contractual commitments, access controls and other safeguards appropriate to the sensitivity of the information. Where GDPR applies, we use recognized transfer mechanisms such as the European Commission’s Standard Contractual Clauses. For residents of Quebec, we assess transfers outside Quebec as required by Quebec law before they take place.

10. How long we keep information

We keep personal information only as long as we need it for the purposes described in this policy, or as the law requires. In general:

• enquiries and prospective client records are kept for a limited period after our last interaction, unless you become a client;
• client project and contract records are kept for the duration of the engagement plus a further retention period to meet legal and contractual obligations;
• invoices and accounting records are kept as required by tax and company law;
• marketing subscriber records are kept until you unsubscribe, after which a minimal suppression record is retained; and
• job applications and website analytics data are kept for a limited period appropriate to their purpose.

When information is no longer needed, we securely delete it or make it anonymous.

11. How we protect information

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encrypted connections (HTTPS), role-based access controls, multi-factor authentication on key business systems, confidentiality obligations for staff and contractors, and security measures from our hosting and content delivery providers. No method of transmission or storage is completely secure, but we work to protect your information and will notify you and the relevant regulators of a data breach where the law requires it.

AI tools. We use artificial intelligence tools to help with research, drafting, analysis and reporting. We take steps to use these tools responsibly and do not knowingly enter client confidential information into tools that do not meet our data-handling standards. People at Thoughtful review AI-assisted work before it is delivered.

12. When we process data for our clients

When we build websites, manage advertising, set up CRM or email systems, or run campaigns for clients, we may handle personal information about our clients’ own customers, leads or website visitors. In those cases we act as a service provider (sometimes called a “processor”) and follow our client’s instructions and our agreement with them. Our client’s privacy policy governs that information, and requests about it should be directed to the client. If you contact us about it, we will pass your request on and help our client respond.

13. Your privacy rights

Your rights depend on where you live. Wherever you are, you can contact us to ask what personal information we hold about you, correct it, or stop receiving marketing, and we will respond in good faith.

Canada

Under federal privacy law (PIPEDA) and provincial laws in Alberta and British Columbia, you can request access to your personal information, ask us to correct it, and withdraw consent. Quebec residents also have the right to be informed about how your information is used, to have information de-indexed or disseminated information stopped in certain circumstances, to receive computerized information in a structured, commonly used technological format, and to be informed of and submit observations about decisions made exclusively by automated processing.

United States

Depending on your state of residence, you may have the right to: know what personal information we collect and how we use and disclose it; access and receive a portable copy; correct inaccuracies; delete it; and opt out of the sale or sharing of personal information, targeted advertising and certain profiling. We will not discriminate against you for exercising these rights. You may use an authorized agent where your state allows it, and if we decline your request you may appeal our decision.

European Union and United Kingdom

You have the right to access, correct, delete, restrict or object to the processing of your personal information, to data portability, and to withdraw consent at any time. You may object to direct marketing at any time.

India

Under the Digital Personal Data Protection Act, 2023, you have the right to access a summary of your personal data and how it is processed, to correct, complete, update and erase it, to withdraw consent, to have your grievances addressed, and to nominate another person to exercise your rights in the event of death or incapacity.

How to make a request

You can make a privacy request using the contact details in Section 16. We may need to verify your identity before responding, and we will respond within the time required by applicable law. We do not charge for reasonable requests.

14. Complaints

If you have a concern, please contact us first so we can try to resolve it. You also have the right to complain to a regulator, including the Office of the Privacy Commissioner of Canada, your provincial privacy commissioner, your US state Attorney General or privacy agency, your EU data protection authority, the UK Information Commissioner’s Office, or, after using our grievance process, the Data Protection Board of India.

15. Other important information

Children. Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal information from children. If you believe we have, please contact us and we will delete it.

Third-party websites. Our website links to other websites and social media platforms, including client work we showcase. Their privacy practices are their own, and we encourage you to read their policies.

Changes to this policy. We may update this policy as our services, technology or legal obligations change. If we make significant changes, we will highlight them on our website or notify you directly where appropriate. We encourage you to review this policy periodically.

16. Contact us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us through the contact form on our website, thoughtful.design, or by emailing our privacy team.

↑ Back to top