Privacy Policy

1. Introduction

Xestful Consulting ("Xestful," "we," "us," or "our") operates the website xestful.com.

This Privacy Policy explains what personal information we collect, how we use it, how we protect it, and the choices you have. It applies to xestful.com, all of our subdomains, and all forms, landing pages, surveys, and booking calendars we operate under this domain.

We are committed to protecting your privacy in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia's Personal Information Protection Act (PIPA), and Canada's Anti-Spam Legislation (CASL). Our practices follow the ten fair information principles set out in Schedule 1 of PIPEDA: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance.

By using our website or submitting information through any of our forms, you consent to the practices described in this policy. If you do not agree, please do not use our website or submit your information.

2. Who We Are

Legal Business Name: Muhammad Zohaib Anwar Business Structure: Sole proprietorship registered in British Columbia, Canada Operating / Brand Name: Xestful Consulting Business Address: 64-5867 129 St, Surrey, BC V3X 0J4, Canada Email: [email protected] Phone: +1 604-363-4104 Website: https://xestful.com

This website is owned and operated by Muhammad Zohaib Anwar, a sole proprietor registered in British Columbia, Canada, doing business as Xestful Consulting. "Xestful Consulting" is the operating and brand name of that sole proprietorship — the two names refer to one and the same business. Xestful Consulting is the only name we trade under, and it is the name used in our SMS consent checkboxes, in our text messages, in our Terms of Use, and throughout xestful.com. We have no affiliates, parent company, or related brands.

Privacy Officer. As required under PIPEDA and BC PIPA, we have designated an individual accountable for our compliance with this policy. You can reach our Privacy Officer at [email protected] or by mail at the address above.

3. Personal Information We Collect

We collect only the personal information reasonably necessary for the purposes identified in this policy, plus limited technical data collected automatically when you browse our site.

3.1 Information You Provide Directly

When you fill out a contact form, request a quote, book a call, subscribe to updates, or become a client, we may collect:

Full name

Business name

Email address

Mobile or business phone number

Appointment preferences and booking details

Messages, questions, and any other details you include in a form or reply

Your consent selections regarding text message communications

3.2 Information Collected Automatically

When you visit xestful.com, we may automatically collect:

IP address and general geographic region

Browser type and version, device type, and operating system

Pages viewed, time spent on pages, and referring website

Date and time of your visit

Cookie and tracking identifiers (see Section 9)

3.3 Client Information

If you engage us as a client, we may access and process information within the platforms and accounts you authorize us to work in. We act as a service provider in respect of that information, treat it as confidential, and use it solely to deliver the services you have retained us to perform.

4. Purposes for Which We Use Your Information

In accordance with PIPEDA's "identifying purposes" principle, we use the personal information we collect only for the following purposes:

To respond to your enquiries, quote requests, and support messages

To schedule, confirm, remind you about, and follow up on appointments and consultations

To deliver the services you have requested or purchased

To send you service updates, account information, estimates, invoices, and payment confirmations

To send you commercial electronic messages, but only where you have given us express consent as required under CASL

To improve our website and customer experience

To maintain records, prevent fraud, and comply with our legal, tax, and regulatory obligations

If we ever intend to use your personal information for a new purpose not listed here, we will identify that purpose and obtain your consent before doing so.

5. Consent

Express consent. We rely on your express, opt-in consent to send you marketing and promotional communications by email or text message, as required by CASL. You give this consent by voluntarily ticking a clearly worded, unticked consent checkbox on one of our forms.

Implied consent. Where you contact us directly, request a quote, or conclude a transaction with us, CASL permits us to send you messages relating to that existing business relationship for the period allowed by law.

Withdrawing consent. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. To withdraw consent, email [email protected], use the unsubscribe link in any email, or reply STOP to any text message. Withdrawing consent may limit our ability to provide certain services to you.

We do not make your consent to receive marketing communications a condition of supplying a product or service.

6. SMS and Text Messaging

This section explains our practices specifically for mobile phone numbers and text message communications.

6.1 How You Opt In

We only send text messages to individuals who have expressly opted in. You opt in by entering your phone number on a form on xestful.com and voluntarily ticking one or both of the consent checkboxes presented on that form.

Both consent checkboxes are optional.

Neither checkbox is pre-ticked.

You can submit any of our forms without ticking either checkbox, and we will still respond to your enquiry by email or phone.

We send you only the categories of messages matching the checkbox or checkboxes you selected.

We retain a record of your consent — including the date, time, and the exact wording you agreed to — as required under CASL and applicable messaging regulations.

6.2 Mobile Information Is Never Shared

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

In addition:

No mobile information will be shared with third parties or affiliates for marketing/promotional purposes.

Text messaging originator opt-in data and consent will not be shared with any third parties, except for aggregators and providers of the Text Message services.

We do not sell, rent, trade, or lease your phone number or your consent data to anyone, under any circumstances.

6.3 Opting Out and Getting Help

You can stop receiving text messages from us at any time by replying STOP to any message we send you. We will send one confirmation message and then stop. Unsubscribe requests are honoured promptly and in any event within the period required by CASL. If you would like to receive messages again, you can opt in again through a form on our website or by replying START.

For assistance with our messaging program, reply HELP to any message, or contact us at [email protected] or +1 604-363-4104.

Message frequency may vary. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

7. Disclosure of Personal Information

We do not sell, rent, or trade your personal information. Consistent with PIPEDA's limiting use and disclosure principle, we disclose personal information only in these circumstances:

Service providers and subcontractors. We use trusted vendors to operate our business — for example, our CRM and automation platform, website hosting, email delivery, calendar and scheduling tools, payment processors, and analytics providers. These providers may process your information only on our instructions and only to perform services for us. They are contractually bound to protect it and are prohibited from using it for their own purposes.

Telecommunications providers. Where you have opted in to text messages, your number and consent record are passed to the messaging aggregators and carriers required to deliver those messages, and for no other purpose.

Legal requirements. We may disclose personal information where permitted or required under PIPEDA, BC PIPA, or other applicable Canadian law — including in response to a subpoena, warrant, court order, or lawful request by a government institution or law enforcement agency, or where necessary to investigate a breach of an agreement or contravention of law.

Business transfer. If our business is sold, merged, or restructured, personal information may be disclosed to the acquiring party as permitted under PIPEDA, provided it is used solely for purposes consistent with this policy. Opt-in and consent data will continue to be governed by this policy.

We do not disclose your information to affiliates for marketing or promotional purposes, and we do not participate in any lead-sharing, lead-selling, or lead-buying arrangements.

8. Safeguards

As required by PIPEDA's safeguards principle, we protect personal information using security measures appropriate to its sensitivity, including:

Encryption of data in transit using HTTPS/TLS across xestful.com and all subdomains

Access controls limiting internal access to personal information on a need-to-know basis

Use of reputable, security-vetted platform providers with their own encryption and access controls

Strong authentication and two-factor authentication on business accounts where available

Periodic review of access permissions and removal of access when no longer required

Secure destruction or anonymization of records that are no longer required

No method of transmission or storage over the internet is completely secure. In the event of a breach of security safeguards involving a real risk of significant harm, we will report to the Office of the Privacy Commissioner of Canada and notify affected individuals as required under PIPEDA.

9. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to function properly and to help us understand how visitors use the site.

We use:

Essential cookies — required for the website, forms, and booking calendars to work.

Analytics cookies — help us understand which pages are visited and how the site performs, so we can improve it.

Marketing and advertising cookies — where enabled, these help us measure the performance of our advertising and, in some cases, show relevant ads.

You can control cookies through your browser settings, including blocking or deleting them. Disabling essential cookies may prevent parts of our website, forms, or booking system from working correctly.

We honour browser "Do Not Track" signals where technically supported.

10. Retention

Consistent with PIPEDA, we retain personal information only as long as necessary to fulfil the purposes for which it was collected, or as required by law:

Enquiry and lead information: retained while we are in active contact and for a reasonable follow-up period afterwards

Client records: retained for the duration of the engagement and afterwards as required for legal, tax, and accounting purposes under Canadian law

CASL and SMS consent and opt-out records: retained for as long as required to demonstrate compliance with Canadian messaging regulations

Website analytics data: retained in accordance with the retention settings of our analytics providers

If we have used personal information to make a decision about you, we will retain it long enough to allow you reasonable access to it. When information is no longer required, we securely destroy, erase, or anonymize it.

11. Your Rights: Access, Correction, and Complaints

Under PIPEDA and BC PIPA, you have the right to:

Access — request confirmation of whether we hold personal information about you, and receive an account of how it has been used and to whom it has been disclosed

Correction — request correction of personal information that is inaccurate or incomplete

Withdraw consent — withdraw consent for marketing emails or text messages at any time

Challenge compliance — raise a concern about our handling of your personal information

To make a request, contact our Privacy Officer at [email protected]. We will respond within 30 days of receiving your request, as required under PIPEDA, or notify you if we require an extension. We may need to verify your identity before acting on your request. Access is provided at minimal or no cost; if a cost applies, we will inform you in advance.

In limited circumstances permitted by law, we may be unable to provide access — for example, where doing so would reveal personal information about another individual or is subject to solicitor-client privilege. If we refuse a request, we will explain why and how you may challenge our decision.

Filing a complaint. If you are not satisfied with our response, you may contact:

Office of the Privacy Commissioner of Canada — 1-800-282-1376, priv.gc.ca

Office of the Information and Privacy Commissioner for British Columbia — 1-800-663-7867, oipc.bc.ca

12. Children's Privacy

Our website and services are directed at business owners and are not intended for children. We do not knowingly collect personal information from anyone under the age of majority in their province or territory. If you believe a minor has provided us with personal information, please contact us and we will delete it.

13. Third-Party Websites

Our website may contain links to third-party websites, tools, or resources. We are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policy of any website you visit.

14. Storage and Processing Outside Canada

Some of the service providers we use store or process data on servers located outside Canada, including in the United States. When personal information is stored or processed in another country, it may be accessible to the courts, law enforcement, and national security authorities of that country under the laws in force there.

We remain accountable for personal information transferred to a third party for processing, and we use contractual and other means to ensure it receives a comparable level of protection while in that provider's hands. If you would like more information about our transfer practices, contact our Privacy Officer at [email protected].

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable Canadian law. When we do, we will write the updated policy and date of it's update. Material changes will be communicated where required. Your continued use of our website after an update constitutes acceptance of the revised policy.

16. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or how we handle your personal information, please contact our Privacy Officer:

Xestful Consulting Email: [email protected] Phone: +1 604-363-4104 Address: 64-5867 129 St, Surrey, BC V3X 0J4, Canada Website: https://xestful.com