Privacy Policy

Effective date: 2026-09-28

We collect very little, we use it only to answer you and to do the work you asked about, and we do not sell or trade it. This policy explains that in detail, including the one piece of technical information we do record and why.

1. Who we are

MK Build is a property maintenance and exterior construction business serving the Greater Toronto Area (the GTA). For the purposes of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), we are the organisation responsible for the personal information described in this policy.

Our privacy contact is the Privacy Officer, reachable at [email protected], or by phone at (905) 536-6173.

Accountability. Someone in our business is responsible for compliance with this policy. If you are not satisfied with how a request was handled, ask for it to be escalated and it will be reviewed by the owner.

2. What this policy covers

This policy covers personal information handled through this website, over the phone, by text message, by email, and in the course of quoting and performing work. It does not cover information held by other companies you deal with, or information we are required by law to handle differently.

3. The personal information we collect

Information you give us. When you call, text, email or send a quote request, we may collect:

• Your name
• One contact detail, depending on how you ask us to reach you: a phone number, a mobile number for text, or an email address
• The city or town where the work is needed
• The type of property (residential, commercial, multi-residential or other)
• Which service you need and how urgent it is
• What you tell us about the problem, including any photos you choose to send
• A record that you agreed to be contacted about your request

Information recorded automatically. When the quote form is submitted, our hosting provider (Cloudflare) passes us the network address the request came from, together with routine security information such as the time and a request identifier. We use the network address for one purpose only — counting how many requests come from the same connection so the form cannot be used to spam us — and we do not store it in readable form. See section 6.

What we do not collect. This website does not ask for and we do not want: payment card numbers, bank details, social insurance numbers, health information, government identification, or any other sensitive personal information. Payment for work is arranged directly with you, outside this website.

4. Why we collect it

• To respond to your enquiry, using the contact method you chose
• To assess the work, quote it, schedule it and carry it out
• To keep a record of the work we did and what it cost, so we can answer questions later
• To meet our legal, tax, insurance and workplace safety obligations
• To prevent spam, fraud and abuse of our contact form

We collect only what is necessary for those purposes. We do not use your information to build advertising profiles, and we do not use automated decision-making that produces legal or similarly significant effects about you.

5. Consent

We ask for your consent directly. The quote form requires you to confirm the statement: “I agree that MK Build may contact me about this request. I understand my information is used only to respond to this enquiry.” Calling or texting us is also taken as consent to respond to you in that way.

You may withdraw your consent at any time, subject to legal and contractual restrictions, by telling us. Withdrawing consent may mean we can no longer respond to your request or continue work, and we will explain that if it applies. You can also ask us to stop contacting you by text or email and to use only a different method.

We do not require you to consent to receive marketing as a condition of buying anything. We do not run marketing email or text campaigns.

6. Spam prevention and your IP address

To keep the quote form usable, we limit it to 3 requests per day from the same connection. To do that, we take the network address the request came from, combine it with a secret key held on our server, and store only the resulting one-way hash for up to 24 hours. The hash cannot be reversed to recover an address, and it is discarded automatically. We do not use it to identify you, to build a profile, or for any purpose other than counting requests.

We also run a hidden field and a timing check in the form, plus optional Cloudflare Turnstile bot protection, so automated submissions never reach our inbox.

7. Cookies and tracking

This website does not use advertising cookies, tracking pixels, social media buttons or third-party embeds. The photographs are served from our own domain, so no other company sees your visit. See the Cookie Policy for the full detail.

8. Who we share information with

We do not sell, rent or trade personal information, and we do not give it to anyone for their own marketing. We share it only with service providers who help us operate, and only as much as they need:

• Cloudflare, Inc. (website hosting and content delivery)
• Resend (transactional email delivery for quote requests)
• Professional advisers and insurers, where needed for a specific matter
• Law enforcement, regulators or courts, where we are legally required to disclose

These providers may only use the information to provide their service to us. We do not authorise any other use.

9. Storage outside Canada

Our website and email providers store and process data in data centres that may be located outside Canada, principally in the United States. When information is held outside Canada, it is subject to the laws of that country, and may be accessible to its courts, law enforcement and national security authorities under a lawful order. Our providers are bound by contract to protect it and to use it only for the services they provide to us.

10. How long we keep information

• Quote requests, and the enquiries that follow from them, are kept for up to 13 months after our last contact with you, and are then deleted
• Records relating to completed work (scope, invoices, payments) are kept as long as required for tax, insurance and warranty purposes, and then deleted
• Spam-prevention hashes are kept for up to 24 hours, then expire automatically
• Records of a privacy breach are kept for at least 24 months, as required by PIPEDA

When information is no longer needed, it is deleted or destroyed in a way that prevents reconstruction.

11. How we protect information

• The website is served over HTTPS with strict transport security, and a strict content security policy that blocks unauthorised scripts
• Form submissions are validated and length-limited on the server, and submission errors are logged without exposing internal detail to visitors
• API keys, email credentials and other secrets are held as encrypted secrets on the hosting platform — they are never placed in the website code or sent to your browser
• Access to enquiry information is limited to the people who need it to quote and do the work
• Only the single contact detail you choose is collected, so there is less to lose if something goes wrong

No system is perfect. If we ever discover a breach of security safeguards involving your information, we will assess it, report it to the Office of the Privacy Commissioner of Canada where there is a real risk of significant harm, notify affected individuals directly, and keep a record of it.

12. Accessing and correcting your information

You can ask what personal information we hold about you, how it has been used and to whom it has been disclosed. You can also ask us to correct anything that is wrong or incomplete. Contact (905) 536-6173 or [email protected]. We may ask enough questions to confirm your identity before releasing information, and we will respond within 30 days as PIPEDA requires. If we cannot give you something, we will tell you why and what you can do about it.

13. Challenging our compliance and making a complaint

If you have a concern about how we handled your personal information, tell us first — most issues are resolved quickly that way, and we will explain what we did and why. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada:

• Toll-free 1-800-282-1376
• priv.gc.ca — report a concern

You can also contact the Office of the Information and Privacy Commissioner of Ontario about provincial matters, although private-sector businesses in Ontario are generally governed by PIPEDA.

14. Electronic messages (Canada’s Anti-Spam Legislation)

Commercial electronic messages require consent, clear identification and a working unsubscribe mechanism. We follow that: we send messages only in response to your enquiry or in the course of work you have engaged us for, every message identifies us and tells you how to reach us, and any message that is not a direct reply to you includes a way to opt out. We do not add people to mailing lists because they asked for a quote.

15. Children

This website is intended for adults arranging property work. We do not knowingly collect personal information from anyone under 18. If you believe a minor has sent us information, contact us and we will delete it.

16. Links to other websites

If we link to another company’s website, this policy stops at the edge of ours. Their privacy practices are their own responsibility, and it is worth reading their policy before you share information with them.

17. Changes to this policy

If this policy changes, we will update the effective date below and post the new version here. Material changes affecting how we use information already collected will be communicated to affected individuals.

This document is written in plain language to be genuinely readable. It is not legal advice to you, and it does not limit any right you have under the laws of Ontario or Canada, including the Consumer Protection Act, 2002 and the Personal Information Protection and Electronic Documents Act (PIPEDA).