Privacy Policy
This is the privacy policy of The Content Panel Ltd, trading as CanPop Media ("we", "us", "our"). It explains what personal information we collect, why we collect it, how long we keep it, and the rights you have over it. It covers this website (canpopmedia.ca), the local lifestyle websites and social media accounts we publish, and the Google and Meta developer services we use to run those accounts.
1. Who we are
CanPop Media is a trading name of The Content Panel Ltd, a company registered in England and Wales (company number 11573795; registered office 20-22 Wenlock Road, London N1 7GU, United Kingdom), which publishes a network of Canadian local lifestyle websites and their social media accounts.
For data-protection law, The Content Panel Ltd is the "controller" of the personal information described in this policy. You can reach us at editor@canpopmedia.ca or by post at our Canadian address or the registered office, both listed in section 17.
2. Which laws apply
We are a company registered in the United Kingdom publishing for readers in Canada, so two sets of privacy rules apply to us and we follow both:
- In the United Kingdom, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
- In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA), and for readers in Quebec, the Act respecting the protection of personal information in the private sector as amended by Law 25.
Where the rules differ, we apply the stronger one.
3. This website (canpopmedia.ca)
This site is a few plain pages. It sets no cookies, has no user accounts, no forms and no analytics. Our hosting provider, Microsoft Azure, may keep standard connection logs (your IP address, the time, the page requested and your browser type) for security and to keep the service running. We do not use those logs to identify visitors.
4. Our local lifestyle websites
Server logs
Like almost every website, our sites keep connection logs (IP address, time, page requested, browser type, and the page you came from) for security, to fix problems, and to understand overall traffic. We keep them for up to 90 days.
Analytics and advertising pixels
Our sites can use Google Analytics 4 and the Meta Pixel to understand which articles people read and to measure our own social media posts. These only run if you accept them in the consent banner. You can change your mind at any time through the banner or your browser settings. Google and Meta process that data under their own privacy policies.
Social media click counter
Links in our social media posts pass through a short link on our websites that counts clicks. For each click we store the time, which post the click came from, and a scrambled version of your IP address (a keyed hash that cannot be turned back into the address). We never store the IP address itself. This lets us count clicks and ignore repeats without keeping anything that identifies you.
Comments and things you send us
If a site lets you comment or send us a tip, a photo or a listing, we keep what you send, with the name or handle you give, for as long as it is published or needed to deal with it.
Embedded content
Some pages embed posts, maps or videos from other platforms, such as Facebook, Instagram, YouTube or Google Maps. When an embed loads, that platform may set its own cookies and collect data under its own privacy policy.
5. Our social media accounts
We run pages and accounts on platforms including Facebook, Instagram, Threads, Bluesky, YouTube, X, TikTok and Pinterest. When you follow, like, comment on, share or message one of our accounts, the platform shows us that activity under its own privacy policy. We use it to reply to you, to moderate (we may hide or remove comments that break the platform's rules or ours), and to understand what readers enjoy. We keep messages for as long as we need to deal with them. We do not download follower lists or build profiles of individual people.
6. Google and YouTube API Services
We use YouTube API Services and other Google API Services to upload videos to, and manage, our own YouTube channels, and to read statistics about our own channels. Through these services we access only data about our own Google account and our own channels. We do not use them to collect information about you or about other YouTube users, and we do not sell or share the data we receive from them.
Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. When you watch our videos on YouTube, you are also covered by the YouTube Terms of Service and the Google Privacy Policy. We do not currently ask anyone to grant our applications access to their Google account; if that ever changes, you can revoke access at any time from the Google security settings page.
7. Meta developer services
We use Meta's developer tools (the Graph API) to publish posts to our own Facebook Pages, Instagram accounts and Threads accounts, and to read and reply to comments and messages sent to them. The data we receive that way is about our own accounts and the people who interact with them, and we handle it as described in section 5. We do not use it to build advertising audiences and we do not share it with anyone else.
8. Advertisers
If you advertise with us, we keep your contact and billing details for as long as the arrangement lasts and for as long as tax law requires afterwards (currently six years). We use them only to run and invoice the campaign.
9. Email
If you email us, we keep the correspondence for as long as we need to deal with it, and for up to two years afterwards for our records.
10. Why we are allowed to use your information
Under UK GDPR, our legal bases are:
- Legitimate interests: running and securing our websites and accounts, replying to you, moderating comments, and understanding what readers enjoy.
- Consent: analytics and advertising pixels on our websites. You can withdraw consent at any time.
- Legal obligations: keeping business records and responding to legal notices.
Under PIPEDA and Quebec law, we collect only what a reasonable person would consider appropriate for these purposes, and we ask for your consent where the law requires it.
11. Who we share it with and where it is stored
We share personal information only with the providers that help us run things: hosting and content delivery (such as Microsoft Azure and Cloudflare), email (Google Workspace), analytics (Google and Meta), and the social media platforms themselves. We also share it when the law requires us to, for example in response to a valid legal request. We do not sell personal information.
Our providers store data in Canada, the United States, the United Kingdom and the European Union. When information moves between countries, we rely on the safeguards UK and Canadian law require, such as adequacy regulations, the UK-US data bridge, or standard contractual clauses.
12. How long we keep it
| Information | Kept for |
|---|---|
| Server logs | Up to 90 days |
| Social media click counter (hashed, never the IP itself) | Up to 13 months |
| Analytics data (Google Analytics) | Up to 14 months |
| Advertiser contact and billing details | Up to six years after the arrangement ends |
| Emails and messages | Up to two years after we last dealt with them |
| Published comments and submissions | While they are published |
13. Your rights
Wherever you live, you can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Depending on the law that applies to you, you also have these rights:
- UK GDPR: access, correction, erasure, restriction of processing, data portability, objection, and withdrawal of consent. You can complain to the Information Commissioner's Office at ico.org.uk.
- PIPEDA: access, correction, and the right to challenge how we comply. You can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
- Quebec (Law 25): access, rectification, withdrawal of consent, and in some cases the right to ask that a link to your personal information be de-indexed or no longer spread. You can complain to the Commission d'accès à l'information at cai.gouv.qc.ca. The person in charge of the protection of personal information at CanPop Media is the Editor, reachable at editor@canpopmedia.ca.
To use any of these rights, email editor@canpopmedia.ca. We reply within one month, and we may ask you to confirm who you are first.
14. Children
Our websites and accounts are written for general audiences and are not directed at children. We do not knowingly collect personal information from anyone under 13. If you think a child has given us personal information, email us and we will delete it.
15. Security
All our websites use HTTPS. Access to our systems is limited to the people who need it. Where we can, we store scrambled values instead of the original information, as we do with IP addresses in the click counter.
16. Changes to this policy
If we change this policy, we will post the new version here with a new "last updated" date.
17. Contact
Email: editor@canpopmedia.ca
Canadian address: CanPop Media, 145 1/2 Church Street, Unit 5, Toronto, Ontario M5B 1Y4, Canada
Registered office: The Content Panel Ltd, 20-22 Wenlock Road, London N1 7GU, United Kingdom