Privacy Policy

ELI R. BROWN VENTURES LTD. doing business as Kitchen Bath Marketing (“KBM,” “we,” “us,” or “our”)

Effective date: 1 November 2021

Last updated: 25 September 2026

Registered office: 4880 Bennett Street, Burnaby, British Columbia V5H 0C1, Canada

Privacy contact: hello@kitchenbathmarketing.com (request that the message be directed to the privacy contact)

Telephone: +1 (604) 842-8855

Site: https://www.kitchenbathmarketing.com and related domains (the “Site”)

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information. It also describes the rights that may be available to you under Canadian federal and provincial privacy law, applicable U.S. state privacy laws, and, where it applies, the GDPR/UK GDPR.

It should be read with our Terms of Use and Service at https://www.kitchenbathmarketing.com/legal/terms.

If you do not agree with this Policy, do not use the Site and do not provide us with personal information.

‍

1. Who is responsible

1.1 The controller (the organization that decides why and how personal information is processed for KBM’s own purposes) is:

ELI R. BROWN VENTURES LTD.

Canada Business Corporations Act corporation number 13397611

Business number 773441407RC0001

4880 Bennett Street, Burnaby, British Columbia V5H 0C1, Canada

1.2 We also process personal information on behalf of our business customers (“Clients”) when we run ads, call tracking, missed-call texting, booking, CRM, or analytics for them. In that role we are a processor / service provider. The Client is the controller / business. If you are a homeowner who filled out a dealer’s form or called a dealer’s number that we help operate, see Section 5.

1.3 We serve Clients in Canada, the United States and Mexico. Our servers, vendors, and advertising Platforms may process information in Canada, the United States, and other countries where those vendors operate.

‍

2. Scope

This Policy applies to personal information we collect:

• through the Site, including forms, chat, booking tools, and downloadable kits;
• when you email, text, or call us;
• when you apply to become a Client or buy a Program;
• when we run advertising and analytics;
• when we process Client Customer Data as a service provider (see Section 5);
• offline, if we write it down or record it in connection with the same relationship.

It does not apply to third-party websites we link to, or to Platforms acting as independent controllers (Google, Meta, Microsoft, and similar) under their own policies.

‍

3. Personal information we collect

We collect the categories below. We do not need every category for every person.

3.1 Information you give us

• Identifiers and contact data: name, company, role, email, phone, mailing or showroom address, city / region of interest.
• Commercial data: services you asked about, budget ranges you volunteer, notes from calls, contracts, billing details, last four digits of a card if a processor shows them to us.
• Content: messages, attachments, voicemails, form field entries, testimonials, logos you send.
• Account credentials you choose to share so we can operate ad accounts, websites, or CRM (you should prefer role-based access; do not send passwords in Slack or email if a better method exists).
• Payment data is collected by our payment processor, not stored by us in full card-number form.

3.2 Information collected automatically

• Device and log data: IP address, browser type, device type, operating system, referring URL, pages viewed, timestamps, approximate location derived from IP.
• Cookie and pixel identifiers, advertising IDs, and similar.
• Session-replay and heatmap data if Microsoft Clarity or a similar tool is running, which can include mouse movements, clicks, scrolling, and in some configurations text entered into forms. See Section 8.
• Call-detail data if you call us or if a Client routes calls through tracking numbers: calling number, called number, time, duration, recording if recording is enabled and lawfully disclosed.

3.3 Information from third parties

• Advertising Platforms (Google, Meta, Microsoft Advertising, and similar): campaign performance, match keys, conversion events.
• Analytics and session tools (including Microsoft Clarity).
• Scheduling tools, CRM, email tools, SMS gateways, and call-tracking vendors.
• Public business records, your website, Google Business Profile, social pages, and reviews, when we evaluate a market or a Client.
• Payment processors and banks (payment success / failure).
• Your representatives (owners, staff, agencies you authorize).

3.4 Information we do not want

Do not send us social insurance / social security numbers, driver’s-licence scans, health information, or payment-card PAN/CVV except through a designated payment page. If you send that information unsolicited, we will delete it when we find it, unless we must keep it to report a security issue.

We do not knowingly collect information from children. See Section 14.

‍

4. How we use personal information (KBM as controller)

When we act as controller, we use personal information to:

• operate, secure, and debug the Site;
• respond to inquiries and book calls;
• decide whether a Territory is open and whether we will take you as a Client;
• quote, contract, bill, collect, and account;
• deliver Programs you buy;
• send service messages (invoices, outages, appointment reminders);
• send marketing messages where we have consent or another lawful basis, including CASL for Canadian recipients;
• measure and improve creative, offers, and the Site;
• prevent fraud, abuse, and chargebacks;
• create aggregated industry benchmarks that do not reasonably identify a person;
• protect our rights, defend claims, and comply with law;
• evaluate a sale, financing, or reorganization of the business.

We do not use personal information to make solely automated decisions that produce legal effects about individuals in the sense contemplated by GDPR Article 22. Scoring a business lead for fit (industry, geography, size) is ordinary B2B qualification.

‍

5. Client Customer Data (KBM as processor / service provider)

5.1 If you are a person who called, texted, or submitted a form to a kitchen or bath dealer (or other Client) that uses our Programs, the dealer is the organization that decided to collect your information. We process it to provide the Program they bought: for example, texting you after a missed call, logging the inquiry, booking an estimate, measuring whether an ad led to a booked appointment, and reporting a Scoreboard to the dealer.

5.2 For that data we follow the Client’s instructions, this Policy to the extent it describes our subprocessors and security, and our contract with the Client. We do not sell Client Customer Data. We do not use it to market our Programs to homeowners.

5.3 To exercise privacy rights in Client Customer Data, contact the dealer you dealt with first. We will assist the dealer. You may also email hello@kitchenbathmarketing.com and we will route the request.

5.4 Clients are responsible for giving their own customers a privacy notice, for cookie banners on their sites, for call-recording announcements, and for SMS consent. We supply tools; we do not become the dealer.

‍

6. Lawful bases and Canadian privacy principles

6.1 Canada (PIPEDA and substantially similar provincial laws, including B.C. PIPA where it applies)

We collect, use, and disclose personal information for purposes a reasonable person would consider appropriate in the circumstances, and with consent where required. Consent may be express or implied depending on sensitivity and reasonable expectations. You may withdraw consent subject to legal or contractual restrictions and reasonable notice. If you withdraw consent for a purpose that is required to deliver a Program, we may have to stop that Program.

We identify the purposes above. We limit collection, use, disclosure, and retention to what we need. We strive for accuracy of information we use to make decisions. We use reasonable safeguards. We are accountable for personal information in our custody, including information transferred to a service provider.

6.2 CASL (Canada’s Anti-Spam Legislation)

Commercial electronic messages to Canadian recipients are sent only with consent (express or implied as CASL defines it) or as otherwise permitted (for example, certain quotes and warranties). Every CEM includes sender identification and an unsubscribe mechanism. Unsubscribe requests are processed within the statutory period.

6.3 United States

We process personal information as described in this Policy and as permitted by applicable state privacy statutes. For California and other state-law detail, see Sections 11 and 12. Telephone and SMS communications are also subject to the TCPA, the Telemarketing Sales Rule, and state telemarketing statutes; our allocation of responsibility with Clients is in the Terms.

6.4 GDPR / UK GDPR (only if it applies)

If we process personal data of a person in the EEA or UK in circumstances where GDPR/UK GDPR applies, our bases are: Article 6(1)(b) contract; 6(1)(c) legal obligation; 6(1)(f) legitimate interests (B2B sales, Site security, product improvement, fraud prevention, limited direct marketing to business contacts); and 6(1)(a) consent where we rely on it (certain cookies and optional marketing). We do not operate an EU establishment and we do not generally target EU consumers. If you believe GDPR applies to you, contact us.

‍

7. How we disclose personal information

We disclose personal information to:

• Service providers / processors who host the Site, send email or SMS, process payments, provide CRM, analytics, session replay, call tracking, scheduling, document signing, accounting, and security. They are contracted to use the information for our instructions, not for their own unrelated marketing.
• Advertising and measurement Platforms such as Google, Meta, and Microsoft, when you interact with our ads or when we upload hashed conversion events. Those Platforms also act as independent controllers for their own advertising networks. Read their policies.
• Clients, when the information is about that Client’s own leads or account.
• Professional advisors (lawyers, accountants, insurers) under confidentiality.
• Authorities and counterparties when we believe disclosure is required by law, court order, or to protect rights, safety, or the integrity of the Site.
• A buyer or successor if we negotiate or complete a merger, acquisition, financing, or sale of assets. We will require appropriate protection of personal information.

We do not sell personal information for money in the ordinary sense. See Section 11 on “sale” and “sharing” under California law.

‍

8. Cookies, pixels, Microsoft Clarity, and advertising

8.1 We use first-party and third-party cookies, pixels, SDKs, and similar technologies.

Strictly necessary. Load balancing, security, form-submission integrity, consent storage.

Functional. Remembering form progress or preferences.

Analytics. Understanding which pages work. This includes Microsoft Clarity, which produces heatmaps and session replays. Clarity may record interactions with the Site. We use this to fix friction and to improve marketing of our own Programs. Microsoft’s policy: https://privacy.microsoft.com/privacystatement

Advertising / measurement. Google Ads, Meta Pixel / Conversions API, Microsoft Advertising, and similar tools that help us attribute form submits and calls to campaigns and that may be used to build audiences and measure ads across the web.

8.2 You can block cookies in your browser. Blocking necessary cookies will break parts of the Site. Platform-level opt-outs include:

• Google Ads Settings and https://adssettings.google.com
• Meta ad preferences
• Microsoft privacy dashboard
• Digital Advertising Alliance / DAAC tools in Canada and the U.S.
• Global Privacy Control (GPC) signals — where a statute requires us to treat GPC as an opt-out of “sale” or “sharing,” we will do so for that jurisdiction when we have a reliable way to associate the signal with a person or browser.

8.3 We will implement a cookie / advertising-preference control on the Site. Until that control is visible on a given page, use the tools above and email hello@kitchenbathmarketing.com with the subject line “Do Not Sell or Share” or “Cookie Opt-Out.”

8.4 Session replay can capture personal information typed into forms. We configure tools to mask password fields and we instruct vendors not to use Site session data to advertise to you across unrelated properties where the contract so allows. Do not type payment-card PAN or government ID into Site forms that are not a payment page.

‍

9. Cross-border transfers

We are based in British Columbia. Many processors and all major ad Platforms store or access information in the United States. U.S. law is not identical to Canadian law. By using the Site or buying a Program, you understand that your information may be processed in the United States and in other countries where our vendors operate, where it may be available to courts, law enforcement, and national-security authorities under the laws of those countries.

When we transfer personal information outside Canada, we remain accountable for it under PIPEDA and we use contracts and vendor diligence that we consider appropriate for the sensitivity of the data.

If GDPR applies to a transfer from the EEA/UK, we use an approved mechanism (typically the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum) where required.

‍

10. Retention

We keep personal information only as long as we need it for the purposes above, unless a longer period is required or permitted by law.

Typical periods (which we may adjust for a live dispute, a legal hold, or a statutory requirement):

• Site logs and analytics: approximately 13–26 months, unless a tool’s default is shorter.
• Sales inquiries that do not become Clients: up to 24 months after last meaningful contact.
• Client contracts, invoices, and tax records: at least 7 years after the end of the engagement (Canada Revenue Agency and ordinary limitation periods).
• Client Customer Data in active tools: for the life of the Program plus a short wind-down (typically 30–90 days), then deletion or return on the Client’s instruction, subject to backups that age out on a rolling cycle.
• SMS opt-out records: as long as needed to honour the opt-out.
• Case-study assets you authorized: until you revoke future use plus a reasonable takedown period.

Backups are overwritten on a cycle. We do not promise instantaneous erasure from every backup.

‍

11. Your privacy rights — Canada

Subject to exceptions in PIPEDA, PIPA, and other applicable statutes, you may:

• request access to personal information we hold about you;
• request correction of information that is inaccurate or incomplete;
• withdraw consent for optional purposes;
• complain to us and, if unresolved, to a supervisory authority.

How to ask. Email hello@kitchenbathmarketing.com with “Privacy Request” in the subject, and tell us which right you want to exercise. We will need enough information to identify you. We will respond within the statutory time (generally 30 days under PIPEDA, extendable as the statute allows).

We may refuse a request as permitted by law (for example, solicitor-client privilege, disclosure that would reveal another person’s information, or a request that is frivolous or vexatious). We will give reasons if we refuse.

Supervisory authorities

Office of the Privacy Commissioner of Canada — https://www.priv.gc.ca

Office of the Information and Privacy Commissioner for British Columbia — https://www.oipc.bc.ca

If you are in Alberta or Québec, the OIPC Alberta or the CAI, as applicable.

‍

12. Your privacy rights — United States

This Section applies to residents of U.S. states that have enacted comprehensive consumer privacy statutes, including (as in force from time to time) California (CCPA/CPRA), Colorado, Connecticut, Virginia, Utah, Oregon, Texas, Montana, Tennessee, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Minnesota, and any similar state law. Rights and scope vary by statute. Some statutes exempt personal information collected in a B2B or employment context; we will apply those exemptions where they exist.

12.1 Rights that may be available

• Know / access categories and specific pieces of personal information collected, sources, purposes, and categories of recipients.
• Delete personal information, subject to exceptions (including completing a transaction, security, legal compliance, and internal uses that are reasonably aligned with expectations).
• Correct inaccurate personal information.
• Portability of information you provided, where the statute requires it.
• Opt out of sale, sharing, or targeted advertising, as those terms are defined by statute.
• Limit use of sensitive personal information (California), if we use sensitive PI for purposes that trigger the right. We do not seek sensitive PI. If a session-replay or form tool captures it by accident, we treat that as an incident to be minimized, not as a product feature.
• Appeal a refusal, where the statute requires an appeal.
• Non-discrimination for exercising a right.

12.2 Our position on “sale,” “share,” and targeted advertising

We do not sell personal information for cash.

We do use advertising and analytics cookies and we may send hashed event data and identifiers to Google, Meta, Microsoft, and similar Platforms so we can measure campaigns and, in some cases, build or suppress audiences. Under California law that can be “sharing” or “cross-context behavioral advertising.” Under some other state laws it can be “targeted advertising” or a “sale” as defined (even if no money changes hands).

To opt out of that use for our Site:

• email hello@kitchenbathmarketing.com with the subject “Do Not Sell or Share My Personal Information”;
• use any “Your Privacy Choices” or cookie-control link we display;
• enable a legally recognized opt-out preference signal such as GPC, which we will honour for the browser that sends it where required.

Opting out does not stop strictly necessary processing, B2B contract processing, or ads that are not targeted using your cross-site profile.

12.3 How to submit a U.S. request

Email hello@kitchenbathmarketing.com or write to the registered office. You may use an authorized agent where the statute allows; we will require proof of authorization and may still need to verify you. We will verify using information we already hold (for example, matching an email and a recent inquiry). We will respond within 45 days, or longer if the statute allows an extension, and we will explain an extension if we take one.

If we refuse, and the statute gives you an appeal, reply to our decision with “Privacy Appeal.”

12.4 Notice at collection (California)

We collect the categories in Section 3: identifiers, commercial information, internet / electronic-activity information, professional / employment-related information (business role), audio information if a call is recorded, and inferences about business fit. Sources, purposes, and recipients are described in Sections 3, 4, 7, and 8. Retention is described in Section 10. We do not collect government-ID numbers or precise geolocation as a product feature.

12.5 Shine the Light (California Civil Code § 1798.83)

We do not disclose personal information to third parties for their own direct marketing in a manner that requires a separate Shine the Light list. Requests may still be sent to hello@kitchenbathmarketing.com.

12.6 Nevada

We do not sell covered information as Nevada defines that term. Nevada residents may email hello@kitchenbathmarketing.com with “Nevada Do Not Sell.”

‍

13. GDPR rights (if applicable)

If GDPR or UK GDPR applies to you, you may have rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. You may also lodge a complaint with your supervisory authority. We will respond within one month, extendable as the regulation allows. We may charge a reasonable fee for unfounded or excessive requests as the regulation permits. We do not currently appoint an EU or UK representative because we do not consider that Article 27 is triggered by our ordinary operations. If that changes, we will update this Policy.

‍

14. Children

The Site and Programs are for businesses. They are not directed to children under 16 (or under 13 for COPPA). We do not knowingly collect personal information from children. If you believe we have, email us and we will delete it.

‍

15. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information: access control, least-privilege vendor access, TLS in transit on the Site, MFA on administrative accounts where the vendor supports it, and staff need-to-know limits.

No method of transmission or storage is secure against every attack. We cannot guarantee absolute security. You are responsible for the security of accounts you control (your email, your ad accounts, your CMS).

If we confirm a breach that applicable law requires us to report, we will notify affected persons and regulators as required.

‍

16. Automated tools and AI

We use ordinary analytics, rules-based scoring of business leads, and software agents that help operate advertising campaigns inside limits a human sets. We may use large-language-model tools to draft copy, summarize calls, or classify inquiries. Those tools are operated under vendor contracts. Do not submit information to a public consumer chatbot and assume it is part of our record. Human staff remain responsible for Client-facing strategy we control.

We do not use Client Customer Data to train a public foundation model. If a vendor’s default would allow that, we will use a setting or contract that turns it off where the vendor offers that control.

‍

17. Third-party sites and Platforms

This Policy does not govern Google, Meta, Microsoft, Apple, LinkedIn, or other Platforms. Their use of personal information is described in their own statements. We are not responsible for their practices.

‍

18. Changes to this Policy

We will post the updated Policy on this page and change the “Last updated” date. If a change is material — for example, a new category of recipients, a new use that is not reasonably expected, or a change in controller identity — we will give additional notice (a Site banner, an email to Clients, or both) and, where the law requires consent, we will obtain it.

The current Policy applies from the effective date stated above. The prior version remains available on request for a reasonable period.

‍

19. Contact

Questions, access requests, corrections, withdrawals of consent, do-not-sell requests, and complaints:

ELI R. BROWN VENTURES LTD.

Attention: Privacy

4880 Bennett Street

Burnaby, British Columbia V5H 0C1

Canada

hello@kitchenbathmarketing.com

+1 (604) 842-8855

If we cannot resolve your complaint, you may contact the Office of the Privacy Commissioner of Canada, the B.C. OIPC, or your U.S. state attorney general, as applicable.