← Back to Bluebay Granite

Privacy Policy

Bluebay Granite & Marble Inc. — Last updated: (Policy version 2)

Bluebay Granite & Marble Inc. (“we”, “us”, “our”) is committed to protecting the privacy of visitors to www.bluebaygranite.ca. This policy explains what information we collect, how we use it, and what rights you have under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and its associated Digital Privacy Act amendments.

This policy covers only the public marketing website. It does not cover our in-store services, telephone conversations, or in-person interactions.

1. Privacy Officer (PIPEDA Principle 1)

Bluebay Granite has designated a Privacy Officer who is accountable for our compliance with this policy and with PIPEDA.

2. What We Collect

We use Google Analytics to understand how visitors use our website so we can improve it. Google Analytics processes the following data points:

No personal data collected via analytics. Google Analytics is configured with IP anonymisation enabled. We do not use Google Analytics for remarketing, advertising features, cross-site tracking, or any purpose other than understanding aggregate site usage.

Analytics data is only collected if you click Accept in the consent banner that appears on your first visit. If you click Reject, the Google Analytics script is never loaded, no cookies are set, and no data is sent. If you previously accepted and later reject, the analytics cookies (_ga, _gid) are deleted from your browser immediately.

3. What We Do Not Collect

To be unambiguous, we want to be clear about what this site does not do:

4. Purposes for Collection (PIPEDA Principle 2)

We collect analytics data for one purpose only:

We do not use analytics data for automated decision-making, profiling, or targeted advertising. Aggregate analytics data may be reviewed by Bluebay Granite staff and contractors who assist with website development.

Future: Quote submission and CRM integration. When we add a quote-submission form to this website (planned for a future release), it will collect personal contact details (name, email, phone, project description) solely to respond to your quote request. At that time, we will update this privacy policy, add an explicit PIPEDA consent checkbox to the form, and — only if you opt in — store your contact information in HubSpot, a CRM platform operated by HubSpot Inc. in the United States. We will disclose this cross-border transfer clearly in the form and in an updated version of this document. AWS SES will be used to send confirmation emails. These are planned future sub-processors; they are not active today.

5. Third-Party Sub-Processors

The following third-party organisations process data on our behalf. Each has been selected for its privacy posture and geographic data location.

Active sub-processors

Vendor Registered in Infrastructure Data processed Purpose
Google LLC (Google Analytics) United States Google Cloud infrastructure — United States Aggregate page-view and session data (see Section 2); cookies _ga, _gid Web analytics

Planned future sub-processors (not yet active)

When the quote-submission backend ships, the following sub-processors will become active. This policy will be updated and the consent banner will reappear for all returning visitors at that time.

Vendor Location Data (when active) Purpose (when active)
Amazon Web Services (AWS SES) Canada / United States Form submission contents (name, email, project details) Sending quote-confirmation emails
HubSpot Inc. United States Contact info + quote details (only if consented at form submission) CRM — responding to quote requests and follow-up

PIPEDA cross-border transfer disclosure: Google Analytics data is processed and stored on servers located in the United States. This data is transferred outside Canada. We have assessed Google LLC’s data-processing practices (including their Data Processing Addendum and Google Analytics Terms of Service) and are satisfied they provide appropriate safeguards for aggregate, anonymised analytics data. When future sub-processors become active, we will provide updated cross-border-transfer disclosure at the point of data collection.

6. Cookies

If you click Accept in our analytics consent banner, Google Analytics sets the following first-party cookies on your browser:

Cookie Purpose Expires
_ga Distinguishes returning visitors (contains a random identifier, not personal data) 2 years
_gid Distinguishes visitors within a 24-hour window 24 hours

If you click Reject — or revoke consent via the “Privacy settings” link in the footer — the Google Analytics script is not loaded and no analytics cookies are set. Any existing _ga / _gid cookies are deleted from your browser immediately on revoke.

The only other browser storage we use is localStorage to remember your analytics consent decision (accept or reject) so we don’t ask you again on every visit. This preference data never leaves your device.

7. Where Your Data Lives

8. How Long We Keep Your Data

9. Your Rights

Withdraw consent

You can change your mind at any time by clicking “Privacy settings” in the footer of any page on this site. If you change your mind and reject after previously accepting, we stop collecting analytics data from your future visits immediately — the Google Analytics script will no longer load on subsequent page views, and any existing _ga / _gid cookies are deleted from your browser right away.

Honest disclosure about already-sent data. If you accepted analytics and then later reject, data collected during your current visit before you changed your mind has already been sent to Google and cannot be recalled. This is an inherent technical limitation of how web analytics works. We do not force a page reload on reject — that would be disruptive. Aggregate analytics data (which is not personal information) may persist in Google Analytics for up to 26 months per Google’s retention policy.

Access and erasure

Because Google Analytics data is anonymised (IP anonymisation enabled) and aggregated, it cannot be attributed to a specific individual and therefore falls outside the scope of individual access and erasure rights under PIPEDA. We cannot identify “your” page views in the aggregate dataset.

When the quote-submission backend ships, you will have the right to request access to, correction of, and erasure of any personal information you submitted in a quote request. Contact info@bluebaygranite.ca with the subject line “Privacy”.

10. Data Breach Notification

In the event of a data breach affecting your personal information that creates a real risk of significant harm, Bluebay Granite & Marble Inc. will notify you and the Office of the Privacy Commissioner of Canada (OPC) as required by law under PIPEDA and the Digital Privacy Act.

Notification will describe the nature of the breach, the types of information involved, and the steps we are taking to mitigate harm.

11. Complaints Process

If you have a privacy concern or complaint, please contact our Privacy Officer first at info@bluebaygranite.ca (subject line: “Privacy”). We will acknowledge your complaint within 10 business days and work to resolve it.

If you are not satisfied with our response, you may also file a complaint with the Office of the Privacy Commissioner of Canada (OPC):

12. Policy Updates

We will update the Last updated date at the top of this page whenever we change how we collect or use your information. For material changes — such as adding new data categories, new sub-processors, or new purposes — the consent banner will reappear so returning visitors can review the new scope and re-decide.

Our consent system uses a POLICY_VERSION number embedded in your browser’s localStorage. When we bump this version number at deploy time, your stored consent record is automatically treated as superseded, and the banner re-shows on your next visit. You will never be silently opted in to a broader scope of data collection.

Non-material changes (grammar, formatting, clarifications that do not change what data is collected or how it is used) may be made without triggering a re-consent banner, but the Last updated date will still be revised.

13. Children’s Data

This site is intended for a general adult audience and is not directed at children. We do not knowingly collect personal information from children under the age of 13. If you believe a child under 13 has submitted personal information to us, please contact info@bluebaygranite.ca and we will take steps to delete it promptly.

14. Contact Us

For any privacy-related questions, requests, or concerns, get in touch with our Privacy Officer:

Bluebay Granite & Marble Inc.
1065 Matheson Blvd. East, Unit #4
Mississauga, Ontario
info@bluebaygranite.ca (subject: “Privacy”)
Tel: (905) 232-6388

← Return to Bluebay Granite