Privacy Policy

What we collect through this site, why, where it goes, and the rights you have over it.

Last updated October 18, 2026

Who we are

This policy describes how 11893874 CANADA INC., operating as JCO ("JCO", "we", "us"), collects, uses, discloses and protects personal information through johnnychen.co (the "Site") and in our communications with prospective clients.

We comply with Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25 (the "Quebec Privacy Act"), Canada's Anti-Spam Legislation ("CASL") and, where it applies to you, the EU and UK General Data Protection Regulation ("GDPR").

Personal information we process on behalf of clients during an engagement is governed by that client's agreement with us and the client's own privacy notice, not this policy.

Person in charge of personal information

Under the Quebec Privacy Act, the person in charge of the protection of personal information at JCO is:

Contact this person with any question, request or complaint about how we handle your personal information.

What we collect

Information you give us

• Contact form. Your name, email address, company (optional) and the message describing your project.
• Scoping questions. On some pages, your answers to short scoping questions (for example the outcome you want, team size and timeline) may be saved as you go, linked to a random session identifier, before you give us an email address.
• Proposals. If you accept a proposal online, your name and email for the electronic signature.
• Calls and email. Whatever you share when you book a call through Calendly or write to us.

Information collected automatically

• Request data. Your IP address and the time of your submission are recorded with any form submission, and our hosting provider keeps standard server logs.
• Campaign pages. On some landing pages we record a visit with a random visitor identifier, the page, the referring site, campaign (UTM or ad click) parameters, screen size, whether you have visited before, and whether you booked a call. These pages may also use Google Ads conversion measurement [confirm whether the Google Ads tag is live].
• Cookies and local storage. Our core pages do not set advertising cookies. [Describe any cookies or local storage used, and the consent mechanism, before enabling ad tags]

How we use it

• To reply to your enquiry, scope your project and prepare a proposal.
• To schedule and hold calls.
• To understand which pages and campaigns bring enquiries, in aggregate.
• To protect the Site against spam, abuse and security threats, including rate limiting.
• To meet legal, accounting and contractual obligations.

We do not sell personal information, and we do not use it to train AI models.

Consent and legal bases

We collect personal information with your consent, which you give by submitting a form, booking a call or writing to us, and only for the purposes stated here. You may withdraw consent at any time, subject to legal or contractual limits.

Where the GDPR applies, we rely on your consent, on steps you ask us to take before entering into a contract, and on our legitimate interest in running and securing our business. [Confirm GDPR applicability and whether an EU/UK representative is needed]

Where it is sent

When you submit the contact form, your submission is:

• stored in our database on Google Cloud (Firestore) and recorded in our Google Cloud logs;
• emailed to our team through Twilio SendGrid.

We share personal information only with service providers that help us run the Site and our business, under contracts that require them to protect it and use it only for our purposes. The current list is in the subprocessors table on our Security page. We may also disclose information where the law requires it, or to a successor in a merger or sale of our business, subject to equivalent protections.

Transfers outside Quebec

Our service providers store and process information in the United States. Before communicating personal information outside Quebec, we assess whether it will receive adequate protection, as the Quebec Privacy Act requires, and we put contractual safeguards in place. [Confirm a privacy impact assessment has been completed for these transfers]

How long we keep it

• Enquiries that do not become engagements: [e.g. 24 months from last contact], then deleted or anonymized.
• Campaign visit records: [e.g. 13 months], then deleted or aggregated.
• Client records: for the engagement and as long as tax and commercial law requires afterward [e.g. 7 years].

How we protect it

We use administrative, technical and physical safeguards suited to the sensitivity of the information, including HTTPS everywhere, encryption at rest on our cloud provider, restricted and logged access, and secrets kept out of source code. See our Security page for detail.

Confidentiality incidents

If a confidentiality incident involving personal information occurs, we will take reasonable steps to reduce the risk of harm and prevent recurrence. Where an incident presents a risk of serious injury (Quebec) or a real risk of significant harm (PIPEDA), we will notify the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada, as applicable, and the affected individuals. We keep a register of all confidentiality incidents.

Your rights

Subject to applicable law, you may:

• access the personal information we hold about you and learn how it is used and to whom it has been disclosed;
• have inaccurate or incomplete information corrected;
• have your information deleted, or ask that we stop disseminating it or de-index it;
• receive information you provided in a structured, commonly used technological format;
• withdraw consent, or object to or restrict certain processing;
• be told about, and contest, any decision about you made exclusively by automated means.

To make a request, email privacy@johnnychen.co. We will respond within 30 days and may need to verify your identity first.

Email and CASL

We send commercial electronic messages only with your consent, express or implied as CASL allows, for example after you contact us or as part of an existing business relationship. Every marketing message identifies JCO, includes our mailing address and has a working unsubscribe option, which we honour within 10 business days.

Children

The Site is intended for businesses. We do not knowingly collect personal information from anyone under 14 (or under 16 where the GDPR applies).

Complaints

Please contact our person in charge first at privacy@johnnychen.co. If you are not satisfied, you may complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca), the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in the EU or UK, your local data protection authority.

Changes to this policy

We may update this policy. The date at the top shows the latest version, and we will give notice of material changes on the Site.

Contact

This policy is also available in French on request. [Quebec: consider publishing a French version]