Privacy policy
Last updated: 8 August 2026
Mumford Advisory is a business name registered in Ontario and operated by Victoria Mumford, a sole proprietor. This policy explains how Mumford Advisory collects, uses, discloses, retains and protects personal information through this website and its advisory services.
Mumford Advisory is subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Where additional privacy obligations apply to a particular engagement, they will be addressed in the engagement agreement or applicable data-processing terms.
Victoria Mumford is responsible for Mumford Advisory's privacy practices.
Privacy contact: Victoria Mumford Email: info@mumfordadvisory.com Mailing address: Mumford Advisory, 109 Park Street South, Suite 1006, Peterborough, ON K9J 3R8, Canada
The short version
We intentionally collect very little information through this website. We do not use advertising trackers, behavioural analytics, tracking pixels or session-recording software. If you visit without contacting us, our hosting provider may still process basic technical information such as your IP address, browser type and requested page in order to deliver and secure the website.
What we collect
Website enquiries
The enquiry form collects your name, work email address, company name, role, support-team size, support tooling, and whatever you write in the free-text field. We use this to respond to you, assess whether an assessment would be worthwhile, and arrange a conversation. Submitting the form does not subscribe you to marketing.
Please do not submit passwords, authentication credentials, client operational data, customer records or other sensitive information through this form.
Email correspondence
We collect your contact information and the content of your correspondence in order to respond to you, discuss and administer engagements, maintain appropriate business records, and address legal or security matters.
Client engagement information
If you become a client, we receive operational evidence to carry out the assessment. Our standard request is ticket metadata rather than ticket conversations, with content requested only where metadata cannot answer the question and the scope is agreed with you in advance.
You are responsible for confirming that you have the authority to provide that information and that its collection and disclosure comply with applicable law, contractual obligations and your internal policies. Full detail is on How we handle your data.
Technical website information
Our hosting provider may process your IP address, browser and device type, the page requested, the referring page, access time and security-related request information, in order to deliver, secure and maintain this website.
Sensitive information
We do not intentionally request payment-card details, passwords, authentication tokens, government identification numbers, health information or other highly sensitive personal information. Please do not provide this information through the website, by email, or in client data transfers. If sensitive information is discovered in material provided to us, access will be restricted and we will work with you to remove or appropriately handle it.
What we do not do
- We do not sell, rent or trade personal information.
- We do not add enquirers to marketing lists without separate consent or another lawful basis.
- We do not use personal information or client confidential information to train our own or third-party AI models.
- We do not submit identifiable client operational data to general-purpose generative AI by default.
- We do not make decisions based solely on automated processing that produce legal or similarly significant effects about an individual.
- We do not use advertising trackers, behavioural analytics, tracking pixels or session-recording technology.
Service providers
| Provider | What it handles | Purpose | Processing location |
|---|---|---|---|
| Netlify | Website hosting, delivery and technical request logs | Serving and securing this website | Primarily United States, and potentially other jurisdictions |
| Namecheap Private Email | Contact information, contracts and correspondence | Business email | May occur outside Canada |
| Formspree | Website enquiry submissions only | Enquiry form handling and delivery | United States |
Some service providers process information outside Canada. Information processed in another country may be subject to the laws of that jurisdiction, including lawful access by courts, law-enforcement agencies or other authorities. Service providers receive only the information reasonably necessary to provide their services, and may use authorised subprocessors.
How long we keep it
| What | How long |
|---|---|
| Unsuccessful enquiries | 90 days from the last substantive contact |
| Client operational data, temporary databases, identifiable working files | 30 days after final delivery, unless the engagement agreement or law requires otherwise |
| Final deliverables containing client confidential information | 12 months, unless earlier deletion or another period is agreed |
| Routine engagement correspondence | Up to 12 months after closing, unless it forms part of a contract, accounting record, dispute or legal matter |
| Contracts, invoices and required accounting or tax records | Generally six years from the end of the relevant tax year, or longer where legally required |
| Security-incident records involving personal information | At least 24 months |
| Hosting and security logs | Per the provider's operational retention schedule |
How we protect it
The controls currently in operation are described on How we handle your data, where we describe only controls that actually operate. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Your privacy rights
You may ask us to:
- confirm whether we hold personal information about you
- give you access to that information
- explain how it has been used and to whom it has been disclosed
- correct information that is inaccurate or incomplete
- withdraw your consent, subject to legal and contractual limits
- delete information we no longer need
- investigate a privacy concern
We may need to verify your identity before completing a request. PIPEDA access requests are normally answered within 30 calendar days. Where PIPEDA permits an extension, written notice will explain the reason and the revised deadline. Access is normally provided at no or minimal cost; if a permitted charge applies, an estimate will be provided before we proceed.
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Commercial email
Mumford Advisory complies with Canada's Anti-Spam Legislation when sending commercial electronic messages. Where required, messages identify the sender, provide valid contact information and include a working unsubscribe method. Unsubscribe requests are processed without delay and no later than 10 business days after receipt. Unsubscribe mechanisms remain functional for at least 60 days after a message is sent.
Children
This website and Mumford Advisory's services are intended for businesses and business professionals. We do not knowingly collect personal information directly from anyone under 18 through this website. If we learn that such information was submitted, it will be deleted unless retention is legally required.
Changes
If we change this policy, the date at the top will change with it. Where a change materially affects how we use information already collected, and it is appropriate and practicable to do so, we will communicate it directly to those affected.