Privacy Policy

    Last updated: September 11, 2026

    1. Introduction

    Blank Canvas Marketing ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

    We comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using our website, you consent to the data practices described in this policy.

    2. Data Controller

    Blank Canvas Marketing is the data controller responsible for your personal data. If you have any questions about this Privacy Policy or our data practices, please contact us at:

    3. Information We Collect

    Personal Data

    We may collect the following types of personal data:

    • Contact information (name, email address, phone number, messaging handles)
    • Business information (company name, website, social profiles, industry)
    • Communication preferences
    • Information provided through contact forms, our website chat, and the Marketing Clinic question form
    • Job application details (name, contact details, role applied for, work history, portfolio or CV content, and anything else you choose to share)
    • Client portal account data (email address, authentication credentials managed by our authentication provider, and files such as brand assets, contracts, and invoices)
    • Technical data (IP address, browser type, device information)

    Recruitment Data

    When you apply for a role through our careers pages, we process your application to assess your suitability for the position, to contact you about the role, and to keep a record of the hiring process. We rely on our legitimate interest in recruiting, and on your consent where you ask us to keep your details on file for future openings. Applications are visible only to team members involved in hiring.

    Client Portal Data

    The client portal is a restricted area available only to account holders. Files you upload or that we upload for you are stored in private storage and are accessible only to your account and to authorized members of our team. We process this data to perform our contract with you.

    Automatically Collected Data

    When you visit our website, we may automatically collect certain information including:

    • Log data (pages visited, time spent, referring URL)
    • Device information (device type, operating system)
    • Location data (country, city based on IP address)
    • Cookies and similar tracking technologies

    4. Legal Basis for Processing

    Under GDPR, we process your personal data based on the following legal grounds:

    • Consent: Where you have given explicit consent for specific purposes
    • Contract: Where processing is necessary for a contract with you
    • Legitimate Interests: Where we have a legitimate business interest that doesn't override your rights
    • Legal Obligation: Where we need to comply with legal requirements

    5. How We Use Your Information

    We use the information we collect to:

    • Provide and improve our marketing services
    • Respond to your inquiries and communication
    • Send marketing communications (with your consent)
    • Analyze website usage to improve user experience
    • Comply with legal obligations
    • Protect against fraud and unauthorized access

    6. Your Rights Under GDPR

    Under GDPR, you have the following rights:

    • Right of Access: Request a copy of your personal data
    • Right to Rectification: Request correction of inaccurate data
    • Right to Erasure: Request deletion of your personal data
    • Right to Restrict Processing: Request limitation of data processing
    • Right to Data Portability: Receive your data in a structured format
    • Right to Object: Object to processing based on legitimate interests
    • Right to Withdraw Consent: Withdraw consent at any time

    To exercise any of these rights, please contact us via our contact form.

    7. Data Retention

    We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. Typically, we retain data for:

    • Contact form, chat, and Marketing Clinic submissions: 3 years from last interaction
    • Marketing communications: Until you unsubscribe
    • Job applications: 12 months after the role is filled, unless you ask us to delete them sooner
    • Client portal accounts and files: Duration of contract plus 7 years, or until you ask us to delete them
    • Client data: Duration of contract plus 7 years
    • Website analytics: 26 months
    • Advertising and measurement data (Meta Pixel): Up to 3 months, per Meta's retention settings

    8. Data Security

    We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

    • SSL/TLS encryption for data transmission
    • Secure hosting with reputable providers
    • Regular security assessments
    • Access controls and authentication

    9. Third-Party Services

    We may share your data with trusted third-party service providers who assist in our operations:

    • Website hosting, database, authentication, and file storage providers
    • Analytics services (Google Analytics)
    • Advertising and measurement services (Meta/Facebook Pixel)
    • Transactional email providers used to notify us of form submissions
    • Scheduling tools used for booking calls
    • Email marketing platforms
    • CRM systems

    Meta/Facebook Pixel

    We use the Meta Pixel (ID 1130933806560960) to measure the performance of our advertising and to show relevant ads on Meta platforms. The Pixel loads only after you accept marketing cookies in our consent banner, and it does not run at all if you decline or ignore the banner. It may share your IP address, browser information, and the pages you view with Meta Platforms, Inc., which acts as an independent controller for that data. You can withdraw consent at any time by clearing your cookie preferences, and you can adjust ad personalization in your Meta account settings.

    All third parties are required to respect the security of your data and treat it in accordance with applicable law.

    10. International Data Transfers

    Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

    11. Changes to This Policy

    We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

    12. Contact Us

    If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

    You also have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated.