Privacy
Policy.

Through our contact form, quotation requests, and the enquiry forms on our landing pages, we collect the information you choose to give us. This typically includes:

• Your name, email address, and company or brand.
• A description of your project and any message you send us.
• Your budget range and your intended project timing.
• The service and market you enquired about, and the page you submitted from.

We also generate a private reference code tied to your enquiry. If you book a consultation, the scheduling is handled by our booking provider and any details you enter there are collected by that provider under its own privacy policy.

Like most websites, we automatically collect certain technical and usage data when you visit, including your IP address (used for security and rate limiting), device and browser type, the pages you view, the site that referred you, and approximate location.

When you arrive from a marketing campaign, we also record campaign attribution parameters (such as utm_source, utm_medium, utm_campaign, utm_content, utm_term, and utm_id) and advertising click identifiers (gclid, gbraid, and wbraid). We store this limited attribution data in your browser's storage so we can understand which of our campaigns and pages brought you to us.

We use the information we collect to:

• Respond to your enquiry, provide a quotation, schedule a consultation, and deliver our services.
• Assess whether a project is a good fit so we can be honest about scope and pricing.
• Send you the emails you request — a booking link, a confirmation, or a courtesy reply — and notify our team of new enquiries.
• Understand how our website and advertising perform, in aggregate, and improve our content.
• Keep records of our communications, protect against spam and abuse, and meet our legal and accounting obligations.

Where the GDPR applies, we process your personal information on the following legal bases: your consent (for analytics cookies and marketing communications); the performance of a contract or steps taken at your request before entering into one (responding to your enquiry and delivering our services); our legitimate interests (operating, securing and improving our business, and preventing abuse); and compliance with legal obligations.

Where Canadian law applies, we rely on your consent and on the exceptions permitted by PIPEDA. You may withdraw your consent at any time, subject to legal or contractual restrictions, by contacting us.

We use Google Tag Manager, Google Analytics 4, and Google Ads to measure site usage and the performance of our advertising. These tools may set cookies and similar technologies and process data in accordance with Google's privacy policy. We use this data in aggregate to understand traffic and to gauge whether our marketing is working; we do not sell it.

Our site also uses a small amount of browser storage (sessionStorage and localStorage) to remember attribution and to avoid counting the same action twice. You can control or delete cookies through your browser settings, and you can opt out of personalised advertising through Google's Ads Settings. Where required by law, we obtain consent before setting non-essential cookies.

We do not sell your personal information. We share it only with service providers who help us operate the website and our business, under contract and only as needed for the purposes described in this policy. These providers currently include:

• Our cloud hosting and database provider (Base44), which stores the enquiry records we collect.
• Our email delivery provider (Resend), which sends enquiry, confirmation, and booking emails.
• Our scheduling provider (Calendly), which handles consultation bookings.
• Google, for analytics and advertising measurement.

We may also disclose information where we are required to do so by law, or to protect the rights, property, or safety of our business, our clients, or others.

We keep enquiry and quotation records for as long as needed for the purposes described above and for our legitimate business records — typically up to three years from our last contact — after which we delete or anonymise them. Aggregate analytics data is retained according to the retention settings of our analytics provider.

If you unsubscribe from our communications, we keep only the minimum record needed to honour your request.

We use appropriate technical and organisational measures to protect your personal information, including access controls so that enquiry data is visible only to authorised team members, encryption of data in transit, and rate limiting to reduce abuse. No method of transmission or storage is completely secure, so while we work hard to protect your information, we cannot guarantee absolute security.

We operate across Canada, the United States, and Europe, and our service providers may store or process your information in those regions. Where personal information is transferred out of the EU/EEA, we rely on appropriate safeguards and the safeguards offered by our providers to ensure your information remains protected.

Subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete your personal information.
• Object to or ask us to restrict certain processing.
• Withdraw consent, including unsubscribing from our emails at any time.

To exercise any of these rights, email us at hello@bwmproduction.com. We will respond within the timeframes required by law (within 30 days under PIPEDA). You may also lodge a complaint with the Office of the Privacy Commissioner of Canada, or, in the EU, with your local supervisory authority.

If you are a California resident, you have rights under the CCPA/CPRA, including the right to know and to request deletion. We do not sell personal information. Some analytics and advertising activity may be considered "sharing" under California law; you may opt out of personalised advertising as described above.

Our services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. When we do, we will revise the "last updated" date at the top of this page. We encourage you to review it periodically.

For any question about this policy or how we handle your personal information, contact us at hello@bwmproduction.com and we will direct your request to the appropriate person on our team.