Privacy Policy.

/01Introduction

This Privacy Policy explains how Cross-Border Wills & Estates (the “firm”, or “we”, “us”, “our”) collects, uses, discloses, and protects personal information when you visit the website operated under that name (the “Website”) or purchase memoranda, articles, or other written materials made available through it (collectively, the “Materials”).

This Privacy Policy is written to comply with the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”) and to acknowledge rights granted to data subjects under the European Union General Data Protection Regulation (“GDPR”), the United Kingdom GDPR, the California Consumer Privacy Act and California Privacy Rights Act (collectively, “CCPA/CPRA”), and Quebec’s Act respecting the protection of personal information in the private sector (Law 25), where applicable.

By using the Website or purchasing any Material, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Privacy Policy, you must not use the Website or purchase the Materials.

/02Who is responsible for your information

The firm is the data controller responsible for the personal information collected through the Website. The firm can be contacted at:

Cross-Border Wills & Estates
Attention: James S.H. Kim
Room 204, Suite 219, 4501 North Road
Burnaby, British Columbia, Canada V3N 4R7
Tel: [Phone TBD]
Email: [Email TBD]

For privacy-related questions, complaints, or requests to exercise your rights under applicable privacy law, please use the contact information above.

/03Information we collect

We collect personal information in the following categories:

We do not knowingly collect sensitive personal information — including information about race, religion, political opinions, health, sexual orientation, biometric data, or genetic data — through the Website. Please do not submit such information to us.

/04How we use your information

We use personal information for the following purposes:

• To process your purchase: verifying payment, delivering Materials, sending order confirmations and download links;
• To provide customer support: responding to your inquiries, resolving issues with downloads, providing replacement download links;
• To maintain our records: retaining transaction records as required by tax law, accounting standards, and professional regulation;
• To operate and secure the Website: diagnosing technical issues, preventing fraud, detecting unauthorized access, maintaining the integrity of our systems;
• To comply with legal obligations: responding to lawful requests by public authorities, complying with court orders, meeting tax-reporting and professional regulatory obligations;
• To enforce our terms: investigating and addressing breaches of our Terms & Conditions, our Disclaimer, or applicable law; and
• To improve our offerings: understanding which Materials are being read, identifying gaps in coverage, refining the Website’s user experience.

We do not use your personal information to send you marketing emails unless you have expressly opted in to receive them. We do not sell, rent, or trade your personal information.

/05Legal basis for processing

Under PIPEDA, we collect, use, and disclose your personal information based on your knowledge and consent, except where otherwise permitted or required by law. By using the Website or completing a purchase, you provide implied consent to the collection, use, and disclosure of your personal information for the purposes described in this Privacy Policy.

For users in the European Union, the European Economic Area, the United Kingdom, or otherwise subject to GDPR, we rely on the following legal bases:

• Performance of a contract — to process your purchase, deliver Materials, and provide customer support;
• Compliance with a legal obligation — to maintain transaction records, respond to lawful requests, and meet tax-reporting and regulatory obligations;
• Legitimate interests — to operate, secure, and improve the Website, and to detect and prevent fraud, where these interests are not overridden by your rights and freedoms; and
• Your consent — for any processing not covered by the bases above, including for non-essential cookies and any marketing communications.

/06Cookies and similar technologies

The Website uses cookies and similar tracking technologies. A cookie is a small text file stored on your device by your browser when you visit a website. We use the following categories of cookies:

• Strictly necessary cookies — required to operate the Website, including session cookies, authentication cookies, and shopping-cart cookies. These cannot be disabled without preventing the Website from functioning.
• Functional cookies — remember your preferences such as language, currency, and viewing history.
• Analytics cookies — help us understand how visitors use the Website (which pages are viewed, time on page, navigation patterns) so we can improve it.
• Performance cookies — set by our caching system to improve page-load speed.

Most web browsers are configured to accept cookies by default. You can configure your browser to refuse cookies, to alert you when cookies are being sent, or to delete cookies after each session. If you disable cookies, certain features of the Website — including checkout — may not function.

Some pages on the Website may load resources from third-party services (for example, web fonts from Google Fonts) that may set their own cookies or log your IP address. We use such services only as necessary to deliver the visual presentation of the Website.

/07Third-party service providers

We share personal information with the following categories of third-party service providers, each of whom is contractually obligated to use the information only for the purpose of providing services to us:

• Hosting and infrastructure providers — for hosting the Website and storing data;
• Payment processors — for processing your payment securely. Our payment processor is the controller of your full payment card data; we receive only confirmation of payment and limited transaction details;
• Email service providers — for delivering order confirmations, download links, and password-reset messages;
• Analytics providers — where used, to provide aggregated reports of Website usage;
• Backup and security providers — for backing up data and protecting the Website against intrusion; and
• Professional advisors — including accountants and legal counsel, where necessary to comply with our legal and regulatory obligations.

We do not sell, rent, or otherwise commercially transfer your personal information to third parties. We will only disclose your personal information to a third party where:

• The third party is one of our service providers and the disclosure is necessary for the service;
• You have consented to the disclosure;
• The disclosure is required by law, by court order, or by a request from a competent authority; or
• The disclosure is necessary to protect our rights, property, or safety, or those of our users or the public.

/08International transfers of personal information

Our service providers and infrastructure may be located in jurisdictions outside Canada, including in the United States and the European Union. When personal information is transferred outside the jurisdiction in which it was collected, that information becomes subject to the laws of the destination jurisdiction, including any access by foreign courts, government, or law-enforcement authorities under those laws.

We take reasonable steps to ensure that any third-party service provider to whom we transfer personal information provides a level of protection comparable to that required under PIPEDA, including by:

• Selecting service providers with appropriate technical and organizational security measures;
• Entering into data-processing agreements that contractually bind the service provider to protect the information; and
• Limiting transfers to those necessary for the purpose for which the information was collected.

For users in the European Union or the United Kingdom, transfers outside the EU/EEA/UK are made on the basis of standard contractual clauses, adequacy decisions, or other valid transfer mechanisms permitted under GDPR.

/09How long we keep your information

We retain personal information only for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. The following retention periods apply:

After the applicable retention period, we will securely delete or anonymize the personal information so that it can no longer be associated with you.

/10Your privacy rights

Subject to applicable law, you have the following rights with respect to your personal information:

• Right of access — to request a copy of the personal information we hold about you;
• Right of correction — to request that we correct any inaccurate or incomplete information;
• Right of deletion — to request that we delete your personal information, subject to our retention obligations;
• Right to withdraw consent — to withdraw your consent to our use of your personal information at any time, on reasonable notice, subject to legal or contractual restrictions;
• Right to restrict or object to processing — to ask us to limit how we use your personal information, or to object to certain uses;
• Right to portability — where applicable, to receive a copy of your personal information in a structured, commonly used, machine-readable format;
• Right to lodge a complaint — to file a complaint with us or with your local privacy regulator (in Canada, the Office of the Privacy Commissioner of Canada; in the European Union, your national data-protection authority; in the United Kingdom, the Information Commissioner’s Office; in California, the California Privacy Protection Agency; in Quebec, the Commission d’accès à l’information du Québec).

To exercise any of these rights, please contact us using the information in Section 2. We will respond to your request within thirty (30) days, or such shorter period as required by applicable law. We may need to verify your identity before responding. There is no charge for ordinary requests, but we may charge a reasonable fee for repeated, frivolous, or excessive requests as permitted by law.

/11Information for California residents

If you are a resident of California, the CCPA/CPRA grants you specific rights with respect to your personal information, including:

• The right to know what categories of personal information we have collected, the sources from which it was collected, the business or commercial purposes for which it was collected, and the categories of third parties with whom it has been shared;
• The right to request deletion of your personal information;
• The right to correct inaccurate personal information;
• The right to opt out of the sale or sharing of your personal information for cross-context behavioural advertising; and
• The right to non-discrimination in the exercise of these rights.

We do not sell or share your personal information for cross-context behavioural advertising. To exercise your CCPA/CPRA rights, please contact us using the information in Section 2.

/12Security

We implement reasonable physical, administrative, and technical safeguards designed to protect personal information from loss, theft, unauthorized access, disclosure, copying, use, or modification. These safeguards include:

• Encryption of data in transit using TLS;
• Encrypted storage of password credentials;
• Use of payment processors that comply with PCI DSS for card-data handling;
• Access controls limiting personal information to authorized persons;
• Routine system updates and security patches; and
• Regular review of our privacy and security practices.

Despite these measures, no method of transmission over the internet or method of electronic storage is fully secure. We cannot guarantee the absolute security of personal information transmitted to or stored on the Website. You transmit personal information to us at your own risk.

/13Children’s privacy

The Website is not directed to children. We do not knowingly collect personal information from children under the age of 16, or such other age as is the threshold for parental-consent requirements in the user’s jurisdiction.

If you are under that age, please do not use the Website or submit any personal information. If you are a parent or guardian and believe that we may have collected personal information from your child, please contact us using the information in Section 2 and we will take prompt steps to delete the information.

/14Third-party websites and links

The Website and the Materials may contain links to websites operated by third parties, including legislation databases, court decisions, and other reference resources. We are not responsible for the privacy practices or content of any third-party website. We encourage you to review the privacy policy of any third-party website you visit.

/15Do-not-track signals

Some browsers send a “do-not-track” signal indicating that the user does not wish to be tracked. There is no industry consensus on how to interpret these signals. Our Website does not currently respond to do-not-track signals. We treat all visitors consistently with this Privacy Policy.

/16Changes to this Privacy Policy

We may revise this Privacy Policy at any time. The revised version will be posted on this page with an updated effective date. Where the change is material, we will, where reasonably practicable, bring the change to your attention through a notice on the Website or by email if you have provided one.

Your continued use of the Website after the effective date of any revision constitutes your acceptance of the revised Privacy Policy. The version in effect at the time you provide personal information governs our handling of that information.

/17Governing law and jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of the Province of British Columbia and the federal laws of Canada applicable in British Columbia, without reference to conflict-of-laws principles. The application of mandatory consumer-protection or privacy legislation in your place of residence is preserved to the extent it cannot be excluded by agreement.

/18Contact

If you have questions, concerns, or complaints about this Privacy Policy or about our handling of your personal information, please contact us at the address provided under Section 2 of this agreement.