top of page

Privacy Policy

Galápagos Creative Inc. Last updated: April 3, 2026

1. Introduction

This Privacy Policy describes how Galápagos Creative Inc. ("Galápagos Creative," "we," "us," or "our"), a corporation incorporated under the laws of Ontario, Canada, collects, uses, discloses, retains, and protects personal information in connection with our website located at [www.galapagoscreative.com] (the "Site") and the creative and advertising services we provide (collectively, the "Services").

We are committed to protecting the privacy of individuals in accordance with applicable privacy legislation, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Ontario's Freedom of Information and Protection of Privacy Act (FIPPA) where applicable, and, to the extent required, the General Data Protection Regulation (GDPR) of the European Union and the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

By accessing or using our Site or Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the terms of this Policy, please discontinue use of the Site and Services immediately.

2. Definitions

For the purposes of this Privacy Policy:

  • "Personal Information" means any information about an identifiable individual, as defined under applicable law.

  • "Processing" means any operation performed on personal information, including collection, recording, storage, use, disclosure, transmission, or deletion.

  • "Controller" (under GDPR) / "Organization" (under PIPEDA) means Galápagos Creative Inc., which determines the purposes and means of processing personal information.

  • "Data Subject" means any identified or identifiable natural person whose personal information is processed.

  • "Third Party" means any entity other than Galápagos Creative Inc. and the Data Subject.

3. Information We Collect

We collect personal information only to the extent necessary for the purposes identified in this Policy. The categories of personal information we may collect include:

3.1 Information You Provide Directly

  • Contact and identification data: name, email address, phone number, job title, company name.

  • Communications data: content of messages sent through contact forms, email correspondence, or other direct communications.

  • Business information: details provided in connection with a project brief, scope of work, or service engagement.

3.2 Information Collected Automatically

When you visit our Site, we and our third-party service providers may automatically collect:

  • Technical data: IP address, browser type and version, operating system, device identifiers.

  • Usage data: pages visited, time spent on pages, referring URLs, clickstream data.

  • Cookie data: information collected through cookies, web beacons, and similar tracking technologies (see Section 8 below).

3.3 Information from Third Parties

We may receive personal information about you from third parties, including:

  • Referral partners who introduce prospective clients.

  • Publicly available professional profiles (e.g., LinkedIn) in the context of business outreach.

We do not knowingly collect personal information from individuals under the age of 16. If you believe we have inadvertently collected such information, please contact us immediately at the address in Section 13.

4. Purposes of Collection and Legal Basis for Processing

We collect and process personal information for the following purposes:

PurposeLegal Basis (PIPEDA / GDPR)

To respond to inquiries and provide requested informationConsent / Legitimate Interest

To enter into and perform service agreementsContractual Necessity

To manage client relationships and project deliveryContractual Necessity / Legitimate Interest

To send service-related communicationsContractual Necessity

To send marketing communications (where opted in)Consent

To improve and optimize our Site and ServicesLegitimate Interest

To comply with legal obligationsLegal Obligation

To protect the rights and security of Galápagos Creative and third partiesLegitimate Interest

Where we rely on consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

5. How We Use Your Information

We use the personal information we collect to:

  • Respond to your inquiries, requests, and proposals.

  • Negotiate, execute, and deliver on service agreements.

  • Issue and process invoices and payments.

  • Maintain and manage ongoing client and vendor relationships.

  • Communicate with you about projects, deliverables, and updates.

  • Send newsletters, case studies, or marketing materials where you have given consent.

  • Analyze Site usage to improve functionality, content, and user experience.

  • Comply with legal, regulatory, and contractual obligations.

  • Enforce our Terms of Service and other applicable agreements.

  • Detect, prevent, and respond to fraud, security threats, or unlawful activity.

We do not use your personal information to make automated decisions that produce legal or similarly significant effects without human review.

6. Disclosure of Personal Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

We may disclose your personal information to the following categories of recipients:

6.1 Service Providers

We engage trusted third-party service providers who process personal information on our behalf under data processing agreements, including providers of:

  • Website hosting and infrastructure

  • Email and communication platforms

  • Customer relationship management (CRM) software

  • Analytics and reporting tools

  • Payment processing

6.2 Professional Advisors

We may share information with lawyers, accountants, auditors, and other professional advisors as required for legal and compliance purposes.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, personal information may be transferred as part of that transaction, subject to appropriate confidentiality protections.

6.4 Legal Requirements

We may disclose personal information where required by law, court order, regulatory authority, or to protect the rights, property, or safety of Galápagos Creative, our clients, or others.

All third parties with whom we share personal information are required to maintain appropriate security measures and to process such information only in accordance with our instructions and applicable law.

7. Data Retention

We retain personal information only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law.

Typical retention periods are as follows:

  • Client and project records: 7 years from the end of the engagement (consistent with Ontario's Limitations Act and tax retention requirements under the Income Tax Act).

  • Prospect and lead data: 2 years from last meaningful contact, unless a service agreement is executed.

  • Marketing consent records: Duration of consent plus 2 years for audit purposes.

  • Website analytics data: 26 months from collection, unless aggregated and anonymized.

When personal information is no longer required, it is securely deleted or anonymized in a manner that prevents its reconstruction.

8. Cookies and Tracking Technologies

Our Site may use cookies, web beacons, pixels, and similar technologies to enhance your browsing experience and collect usage data.

8.1 Types of Cookies We Use

  • Strictly necessary cookies: Required for the Site to function. Cannot be disabled.

  • Analytical/performance cookies: Collect aggregate information about how visitors use the Site (e.g., Google Analytics).

  • Functionality cookies: Remember your preferences and settings.

  • Marketing/targeting cookies: Used to deliver relevant content and track campaign performance. These are only deployed with your prior consent.

8.2 Your Cookie Choices

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Site. Where required by law, we obtain your prior consent before deploying non-essential cookies via our cookie consent mechanism.

For more information on managing cookies, visit www.allaboutcookies.org.

9. Data Security

We implement appropriate technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, destruction, or loss. These measures include, but are not limited to:

  • Encryption of data in transit (TLS/SSL) and at rest where appropriate.

  • Access controls limiting personal information to authorized personnel on a need-to-know basis.

  • Regular review of security practices and systems.

  • Confidentiality obligations on contractors and employees who handle personal information.

While we take all reasonable steps to safeguard your information, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security.

In the event of a data breach that poses a real risk of significant harm, we will notify affected individuals and the relevant supervisory authority in accordance with applicable law, including the breach notification requirements under PIPEDA as amended by the Digital Privacy Act.

10. International Data Transfers

Galápagos Creative is based in Ontario, Canada. Some of our third-party service providers are located in the United States or other jurisdictions outside Canada. When we transfer personal information outside Canada, we ensure that appropriate safeguards are in place, including contractual protections that require recipients to provide a comparable level of protection to that required under PIPEDA.

If you are located in the European Economic Area (EEA), transfers of your personal information to Canada are permitted pursuant to the European Commission's adequacy decision in respect of Canada (in scope of PIPEDA). Transfers to the United States or other third countries are subject to Standard Contractual Clauses or other approved transfer mechanisms under the GDPR.

11. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

11.1 Rights Under PIPEDA (Canada)

  • Access: The right to request access to your personal information held by us.

  • Correction: The right to request that inaccurate or incomplete information be corrected.

  • Withdrawal of consent: The right to withdraw consent to certain processing, subject to legal and contractual limitations.

11.2 Additional Rights Under GDPR (EEA Residents)

  • Erasure ("Right to be Forgotten"): The right to request deletion of your personal information in certain circumstances.

  • Restriction of Processing: The right to request that we limit the processing of your personal information in certain circumstances.

  • Data Portability: The right to receive your personal information in a structured, commonly used, machine-readable format.

  • Objection: The right to object to processing based on legitimate interests or for direct marketing purposes.

  • Complaint: The right to lodge a complaint with your local supervisory authority.

11.3 Rights Under CCPA/CPRA (California Residents)

  • The right to know what personal information we collect, use, disclose, and sell.

  • The right to delete personal information, subject to certain exceptions.

  • The right to correct inaccurate personal information.

  • The right to opt out of the sale or sharing of personal information. We do not sell or share personal information as defined under the CCPA/CPRA.

  • The right to non-discrimination for exercising your privacy rights.

To exercise any of your rights, please submit a verifiable request to us using the contact details in Section 13. We will respond to all requests within the timeframes required by applicable law (generally 30 days, with extensions where permitted).

12. Links to Third-Party Sites

Our Site may contain links to third-party websites, platforms, or services that are not operated or controlled by Galápagos Creative. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party sites you visit. We are not responsible for the content, privacy practices, or security of external sites.

13. Contact Information and Complaints

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our Privacy Officer:

Galápagos Creative Inc. Privacy Officer: Luis Porras Email: [privacy@galapagoscreative.com] Mailing address: Toronto, Ontario, Canada

If you are not satisfied with our response, or believe we are processing your personal information in a manner inconsistent with applicable law, you have the right to file a complaint with the relevant supervisory authority:

  • Canada: Office of the Privacy Commissioner of Canada — www.priv.gc.ca

  • Ontario: Information and Privacy Commissioner of Ontario — www.ipc.on.ca

  • EEA: Your local Data Protection Authority

14. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. When we make material changes, we will update the "Last updated" date at the top of this page and, where required by law, provide you with notice of the changes (e.g., via email or a prominent notice on the Site).

Your continued use of the Site or Services following the posting of changes constitutes your acceptance of the updated Policy. If you do not agree to the revised Policy, you must discontinue use of the Site and Services.

This Privacy Policy was prepared in accordance with the requirements of PIPEDA, the GDPR (where applicable), and the CCPA/CPRA (where applicable). It does not constitute legal advice. Galápagos Creative Inc. recommends periodic review with qualified legal counsel to ensure ongoing compliance as applicable laws evolve.

bottom of page