Privacy Policy

1. Introduction and Identity of the Organization

Conte Vending Co. is a sole proprietorship registered and operating in Ontario, Canada, owned and operated by Matthew Conte. Conte Vending Co. places interactive touchscreen vending machines in high-traffic commercial locations and offers screen advertising services to local businesses. We take the privacy of every individual who interacts with our business seriously, and we are committed to handling personal information with transparency, care, and full compliance with applicable Canadian law.

This Privacy Policy governs all personal information collected through the contevending.ca website, through QR-code-linked lead capture landing pages operated by Conte Vending Co., and through any other direct communications with the business, including contact form submissions, email correspondence, and phone inquiries.

Matthew Conte serves as the Privacy Officer for Conte Vending Co. All privacy-related inquiries, requests, and complaints may be directed to:

We are committed to responding to all privacy inquiries promptly and in good faith.

2. Scope of This Policy

This Privacy Policy applies to the following categories of individuals:

• (a) Visitors to the Conte Vending website — any person who accesses contevending.ca, regardless of whether they submit any information.
• (b) Individuals who submit contact forms on the website — any person who completes and submits the contact form available on contevending.ca, whether inquiring about advertising opportunities, vending placement, or any other matter.
• (c) Individuals who scan QR codes on Conte Vending advertising screens — any person who scans a QR code displayed on a Conte Vending machine and subsequently submits their information via a hosted lead capture landing page operated by or on behalf of Conte Vending Co.
• (d) Business representatives who inquire about or purchase advertising services — any individual acting on behalf of a business entity who contacts Conte Vending Co. in relation to advertising packages, rates, or service agreements.

This policy does not apply to third-party websites or services that may be linked from Conte Vending properties. Conte Vending Co. is not responsible for the privacy practices of any third-party website, and individuals accessing third-party sites through links on contevending.ca do so at their own discretion and subject to those third parties' own privacy policies.

3. What Personal Information We Collect

Conte Vending Co. collects personal information only to the extent necessary to fulfill the purposes described in this policy. The following categories of personal information may be collected:

• Contact information: Full name, email address, and phone number (when voluntarily provided). This information is collected when an individual submits a contact form on the website or contacts us directly by email or phone.
• Business information: Business name and industry sector, when voluntarily provided by individuals inquiring about or entering into advertising service agreements with Conte Vending Co.
• Inquiry content: The text and content of messages submitted through contact forms on the contevending.ca website, including any details, questions, or requests contained therein.
• Technical data: IP address, browser type, device type, and approximate geographic location collected automatically through website analytics tools when a visitor accesses contevending.ca. This data is collected in aggregated and anonymized form and is not used to identify individual users.
• Lead capture data: When individuals scan QR codes displayed on Conte Vending advertising screens and submit a lead capture form hosted on a landing page operated by Conte Vending Co., the following information is collected: full name, email address, and phone number (as entered by the individual on the form).
• Consent records: At the time of any form submission where CASL consent is provided, Conte Vending Co. records the timestamp of submission, the IP address from which the form was submitted, and the state of the consent checkbox at the time of submission. These records are retained to document that valid express consent was obtained, as required by Canada's Anti-Spam Legislation.

4. Why We Collect Personal Information — Purpose of Collection

Conte Vending Co. collects personal information for specific, identified purposes. In accordance with PIPEDA Principle 4 (Limiting Collection), we do not collect personal information beyond what is necessary to fulfill the purposes listed below. The purposes for which personal information is collected are as follows:

• To respond to inquiries: Contact information and inquiry content submitted through the website contact form are used solely to respond to the individual's inquiry in a timely and relevant manner.
• To fulfill advertising service agreements: Business contact information and service-related details provided by advertising partners are used to administer, deliver, and invoice for advertising services purchased from Conte Vending Co.
• To deliver leads to advertising partners: Contact information submitted via QR code lead capture landing pages is collected for the specific purpose of delivering that lead data to the advertising partner whose QR code was scanned. No other use of this data is made by Conte Vending Co.
• To send marketing communications: Where express CASL consent has been obtained through an affirmative, unchecked-by-default checkbox, Conte Vending Co. may send commercial electronic messages (email and/or SMS) regarding its services, advertising opportunities, and relevant updates. Marketing communications are never sent without prior express consent.
• To maintain consent records: Consent records are retained to demonstrate compliance with CASL's mandatory consent documentation requirements.
• To improve website performance: Aggregated, anonymized technical data collected through analytics tools is used to understand how visitors use the contevending.ca website, identify areas for improvement, and optimize the user experience. No personally identifiable information is extracted from analytics data for this purpose.

Conte Vending Co. does not collect personal information beyond what is necessary for these stated purposes, in accordance with PIPEDA's principle of limiting collection.

Accuracy of personal information: Conte Vending Co. makes reasonable efforts to ensure that personal information used to make decisions affecting individuals, or disclosed to third parties, is accurate, complete, and up to date. Individuals may request correction of inaccurate information at any time as described in the individual rights section of this policy.

Openness of privacy practices: Conte Vending Co. makes information about its privacy management policies and practices available to any individual upon request. This includes the name and full contact information of the Privacy Officer, the means by which personal information is collected, the purposes for which it is used, and how individuals may exercise their rights. Requests for information about our privacy practices may be directed to contevendingco@gmail.com or to the mailing address listed in this policy.

5. Legal Basis for Collection and Processing

All personal information collected by Conte Vending Co. is collected with the knowledge and consent of the individual, as required by PIPEDA Section 4.3. Individuals are informed of the purposes for which their personal information is being collected prior to or at the time of collection, through the contact form on this website and through the lead capture landing pages associated with Conte Vending's advertising screens.

Commercial electronic messages — including promotional emails and SMS messages — are only sent where express consent has been obtained as required by CASL Section 6. Express consent means an affirmative, deliberate action taken by the individual prior to receiving any commercial electronic message. On the Conte Vending website, express consent is obtained through a standalone checkbox that is unchecked by default and must be actively selected by the individual before the form can be submitted. The consent checkbox includes a clear description of what communications the individual is consenting to receive, who will send those communications, and how consent may be withdrawn.

Consent may be withdrawn at any time without penalty. Withdrawal of consent does not affect the lawfulness of any communications sent prior to the date of withdrawal. Instructions for withdrawing consent are provided in Section 9 of this policy and in every commercial electronic message sent by Conte Vending Co.

6. How We Share Your Information — Third-Party Disclosure

Conte Vending Co. treats the personal information of individuals with strict confidentiality. We do not sell, trade, rent, or otherwise monetize personal information under any circumstances. The following describes the limited circumstances under which personal information may be shared with third parties:

• Lead data shared with advertising partners: When an individual scans a QR code associated with a specific advertising partner and submits a lead capture form, their contact information (name, email address, and phone number) is shared with that specific advertising partner and no other party. The identity of the advertising partner is clearly disclosed on the lead capture landing page prior to the individual submitting their information, so that the individual knows to whom their data will be provided before consenting to submit it.
• Data Sharing Agreements with advertising partners: All advertising partners who receive lead data through Conte Vending Co.'s QR code program are required to enter into a Data Sharing Agreement with Conte Vending Co. as a condition of accessing lead data. This agreement contractually obligates the advertising partner to use lead data exclusively for the purpose of direct follow-up with the consenting individual, to honour all unsubscribe and opt-out requests immediately and without qualification, and to never resell, redistribute, broker, or otherwise transfer the lead data to any additional third party for any purpose.
• No sale of personal information: Conte Vending Co. does not sell personal information to any third party under any circumstances, including but not limited to data brokers, list vendors, advertising networks, marketing platforms, social media companies, or analytics providers that monetize personal data.
• Legal and regulatory disclosure: Personal information may be disclosed to law enforcement agencies, regulatory authorities, or other government bodies if required to do so by applicable Canadian law, court order, or legal process. In such cases, Conte Vending Co. will disclose only the information strictly required by the applicable legal obligation and will, where permitted by law, notify the affected individual of the disclosure.
• Business succession: In the event of a business sale, merger, asset transfer, or other succession event involving Conte Vending Co., personal information held by the business may be transferred to the successor entity, subject to the same privacy protections described in this policy. Affected individuals will be notified in advance of any such transfer and provided with an opportunity to withdraw their consent or request deletion of their information prior to the transfer taking effect.

7. Data Retention

Conte Vending Co. retains personal information only for as long as is necessary to fulfill the purposes for which it was collected, or as required by law. The following specific retention periods apply:

• Contact form submissions and inquiry records: Retained for 24 months from the date of submission, after which they are securely and permanently deleted from all systems.
• Lead capture data (QR form submissions): Retained for 24 months from the date of capture, after which they are securely and permanently deleted from all systems.
• CASL consent records: Retained for a minimum of 3 years from the date of consent, as required by CASL enforcement guidelines and consistent with the Canada Radio-television and Telecommunications Commission's (CRTC) guidance on consent record-keeping.
• Advertising partner business records: Financial and contractual records relating to advertising service agreements are retained for a minimum of 7 years from the end of the fiscal year in which the relevant transaction occurred, as required by the Canada Revenue Agency's record-keeping requirements under the Income Tax Act.

When personal information reaches the end of its applicable retention period, it is permanently and irreversibly deleted from all systems and storage locations used by Conte Vending Co. No archived or backup copies of deleted personal information are retained beyond this point.

8. Data Security and Safeguards

In accordance with PIPEDA Principle 7 (Safeguards), Conte Vending Co. takes reasonable and appropriate measures to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification. The following safeguards are in place:

• Secure platform storage: Personal data, including lead capture records and consent logs, is stored within platforms that maintain SOC 2 compliance (such as GoHighLevel CRM) or equivalent enterprise-grade security standards. These platforms employ encryption at rest and in transit, access controls, and audit logging to protect stored personal information.
• Access restrictions: Access to personal data is restricted to Matthew Conte (the sole proprietor and Privacy Officer of Conte Vending Co.) and, where applicable, the specific advertising partner to whom lead data pertains under the terms of a Data Sharing Agreement. No other individuals or entities are granted access to personal information held by Conte Vending Co.
• Secure storage practices: No personal data is stored in unencrypted files, personal email inboxes without access controls, or shared cloud storage environments that lack appropriate security measures. All data handling follows the principle of least privilege.
• Mandatory breach reporting: In the event of a data breach that poses a real risk of significant harm to one or more individuals, Conte Vending Co. will notify affected individuals and the Office of the Privacy Commissioner of Canada as required under PIPEDA's mandatory breach reporting requirements, which have been in force since November 1, 2018. Breach notifications will be issued within a reasonable period of time, not to exceed 72 hours of the discovery of a high-risk incident. Conte Vending Co. will also maintain a record of all security breaches, as required by the Breach of Security Safeguards Regulations.

Accountability for third-party processors: Conte Vending Co. remains fully accountable for the protection of personal information that has been transferred to third-party service providers for processing, including GoHighLevel, Inc. Conte Vending Co. takes contractual, technical, and organizational measures to ensure that all third-party processors maintain privacy and security standards that are equivalent to or greater than those required by PIPEDA. The transfer of personal information to a third-party processor does not diminish Conte Vending Co.'s obligations to the individual under this policy or under applicable Canadian law.

9. Transfer of Information Outside Canada

Conte Vending Co. uses GoHighLevel, Inc. (a company headquartered in the United States) as its customer relationship management (CRM) platform for storing and processing certain personal information, including lead capture data, consent records, and advertiser contact information. As a result, personal information collected by Conte Vending Co. may be transferred to, stored in, and processed in the United States.

Individuals whose personal information is transferred to the United States should be aware that their information may be subject to access by U.S. law enforcement, government agencies, courts, or national security authorities under applicable U.S. legislation, including but not limited to the USA PATRIOT Act and the Clarifying Lawful Overseas Use of Data (CLOUD) Act. Such access may occur without notice to the individual or to Conte Vending Co.

Conte Vending Co. remains accountable for the protection of all personal information transferred to GoHighLevel and takes contractual measures to ensure that GoHighLevel maintains privacy and security standards consistent with the requirements of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). GoHighLevel's own privacy policy is available at gohighlevel.com and governs how that platform handles data on its infrastructure.

By submitting personal information through the contevending.ca website or through any lead capture landing page operated by Conte Vending Co., individuals acknowledge and consent to the transfer of their personal information to the United States as described in this section. Individuals who do not wish their information to be transferred outside Canada should not submit personal information through Conte Vending Co.'s digital properties and should instead contact us directly by phone or postal mail.

If you have questions about how your personal information is handled after transfer to a third-party processor, please contact our Privacy Officer at contevendingco@gmail.com or at the mailing address above.

10. Your Rights as an Individual

In accordance with PIPEDA Principles 8 (Individual Access) and 9 (Challenging Compliance), individuals have the following rights with respect to their personal information held by Conte Vending Co.:

• Right of Access: You have the right to request a copy of all personal information that Conte Vending Co. holds about you, including information about how that information has been used and to whom it has been disclosed. Requests for access must be submitted in writing to contevendingco@gmail.com or to the mailing address below. Conte Vending Co. will respond to access requests within 30 calendar days of receipt. If access cannot be provided within 30 days, you will be notified of the delay and provided with a revised response date.
• Right of Correction: If any personal information held by Conte Vending Co. about you is inaccurate, incomplete, or out of date, you have the right to request that it be corrected. Correction requests should be submitted in writing to contevendingco@gmail.com or to the mailing address below, with sufficient detail to identify the information to be corrected and the nature of the correction required.
• Right of Withdrawal of Consent: You may withdraw your consent to receive marketing communications from Conte Vending Co. at any time, without penalty. Consent may be withdrawn through any of the following methods: (a) replying STOP to any SMS message received from Conte Vending Co.; (b) clicking the unsubscribe link included in any marketing email received from Conte Vending Co.; or (c) emailing contevendingco@gmail.com with the subject line "Unsubscribe". All withdrawal requests will be processed within 10 business days of receipt. Withdrawal of consent does not affect the lawfulness of any commercial electronic messages sent prior to the date of withdrawal.
• Right of Deletion: You may request the deletion of your personal information held by Conte Vending Co. by emailing contevendingco@gmail.com or writing to the mailing address below. Deletion requests will be fulfilled within 30 calendar days of receipt. Please note that certain records are subject to mandatory retention requirements under applicable law — specifically, CASL consent records (retained for a minimum of 3 years) and CRA financial records (retained for a minimum of 7 years) — and cannot be deleted prior to the expiry of those required retention periods.
• Right to File a Complaint: If you believe that Conte Vending Co. has violated your privacy rights or failed to comply with PIPEDA, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada. Complaints may be submitted online at priv.gc.ca, or by phone at 1-800-282-1376. We encourage individuals to contact us directly first so that we may attempt to resolve any concern informally.

All rights requests may be directed to our Privacy Officer at:

11. SMS Messaging Program

Conte Vending Co. operates an SMS messaging program through which contacts who have provided express written consent receive transactional and informational text messages. The following disclosures apply to this program:

Program description: Conte Vending Co. sends SMS messages for the following purposes: (1) confirmation messages sent immediately after a contact submits an opt-in form; (2) follow-up messages related to the specific inquiry or advertising offer the contact expressed interest in; (3) occasional updates about Conte Vending Co.'s services and advertising opportunities where consent has been provided.

How to opt in: Contacts opt in to receive SMS messages by actively checking an unchecked consent checkbox on a web form hosted at contevending.ca or on a landing page operated by Conte Vending Co. No SMS messages are sent to any contact who has not completed this affirmative opt-in action.

How to opt out: You may opt out of receiving SMS messages from Conte Vending Co. at any time by replying STOP to any message you receive from us. You may also opt out by emailing contevendingco@gmail.com with the subject line "Unsubscribe." All opt-out requests are processed within 10 business days. After opting out you will receive one final confirmation message and no further messages will be sent.

Help: Reply HELP to any SMS message for assistance, or contact us at contevendingco@gmail.com or 2544 Weston Rd, Unit #611, North York, ON M9N 2A6.

Message and data rates: Standard message and data rates may apply depending on your mobile carrier and plan. Conte Vending Co. does not charge any fee for SMS messages, but your carrier's standard rates apply.

Message frequency: Message frequency varies based on your inquiry and level of engagement. You will not receive unsolicited bulk messages.

No sharing of SMS opt-in information: Conte Vending Co. does not sell, share, rent, trade, or otherwise transfer your SMS opt-in information — including your phone number and consent status — to any third party for marketing purposes under any circumstances. Your SMS opt-in data is not shared with advertising partners, data brokers, or any other external party. This prohibition is absolute and unconditional.

Carrier liability: Mobile carriers are not liable for delayed or undelivered messages.

Age restriction: This SMS program is intended for individuals aged 18 and over. By opting in, you confirm that you are at least 18 years of age.

12. CASL Compliance — Commercial Electronic Messages

Conte Vending Co. is committed to full compliance with Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23). The following describes our practices with respect to commercial electronic messages:

• Express consent required: Conte Vending Co. sends commercial electronic messages — including promotional or informational emails and SMS messages — only to individuals who have provided express consent through a deliberate, affirmative action. On the contevending.ca website, this means an individual must actively check a standalone consent checkbox that is unchecked by default before submitting a contact form. Conte Vending Co. does not rely on implied consent as a basis for sending marketing communications.
• Message identification: Every commercial electronic message sent by Conte Vending Co. clearly identifies the sender as Conte Vending Co., includes the sender's full contact information, states the purpose of the message, and includes a clear and functional unsubscribe mechanism. The sender identification in all commercial electronic messages includes:
  Conte Vending Co.
  2544 Weston Rd, Unit #611
  North York, ON M9N 2A6
  Canada
  contevendingco@gmail.com
• Unsubscribe mechanism: Every commercial electronic message includes a clear and conspicuous mechanism by which the recipient can unsubscribe from future messages. This mechanism is functional for a minimum of 60 days after the date the message was sent, in compliance with CASL Section 11.
• Unsubscribe processing: All unsubscribe requests — whether submitted by replying STOP, by clicking an unsubscribe link, or by contacting us directly — are honoured within 10 business days of receipt, as required by CASL Section 11(3).
• Consent record-keeping: Conte Vending Co. retains records of all express consents obtained, including the timestamp of each consent, the IP address from which the consent was submitted, and the state of the consent form field at the time of submission. These records are retained for a minimum of 3 years from the date of consent.
• No sending on behalf of advertising partners without separate consent: Conte Vending Co. does not send commercial electronic messages on behalf of advertising partners. If an advertising partner wishes to send commercial electronic messages to leads captured through Conte Vending's QR code program, the advertising partner must obtain separate, express consent from each individual, with the advertising partner identified by name as the sender, prior to sending any such message. Conte Vending Co.'s consent does not extend to or authorize third-party messaging.

13. Cookies and Website Analytics

The contevending.ca website may use standard web analytics tools, including Google Analytics, to collect information about how visitors interact with the site. This information may include pages visited, time spent on each page, the type of device and browser used to access the site, the referring URL, and the approximate geographic region of the visitor (at the country or city level). All data collected through analytics tools is aggregated and anonymized — no personally identifiable information is collected through website analytics, and analytics data is never linked to an individual's contact information or identity.

Users who wish to opt out of Google Analytics tracking may do so by installing the Google Analytics Opt-out Browser Add-on, which is available at no cost at tools.google.com/dlpage/gaoptout. The add-on prevents the Google Analytics JavaScript (ga.js, analytics.js, and dc.js) from sharing information with Google Analytics about visit activity.

Conte Vending Co. does not use tracking cookies, advertising cookies, retargeting pixels, or any other tracking technology for the purpose of building individual behavioral profiles or delivering targeted advertising.

14. Children's Privacy

The services offered by Conte Vending Co. — including vending machine placement services and screen advertising packages — are directed exclusively at business owners, marketing professionals, and adults making commercial decisions. The contevending.ca website is not intended for use by individuals under the age of 18, and Conte Vending Co. does not knowingly collect personal information from minors.

If Conte Vending Co. becomes aware that personal information has been submitted by an individual under the age of 18, that information will be deleted immediately from all systems and will not be used for any purpose. Parents or guardians who believe their child may have submitted personal information through the contevending.ca website or a Conte Vending lead capture page are encouraged to contact us immediately at contevendingco@gmail.com so that the information can be promptly deleted.

15. Changes to This Privacy Policy

Conte Vending Co. reserves the right to update or amend this Privacy Policy at any time to reflect changes in our business practices, applicable law, regulatory guidance, or technology. Any changes will be reflected in an updated "Last Updated" date at the top of this page. We encourage all individuals who interact with Conte Vending Co. to review this policy periodically to remain informed of how their personal information is being handled.

For material changes to this policy — meaning changes that significantly affect the ways in which personal information is used, shared, or retained — Conte Vending Co. will make reasonable efforts to notify affected individuals directly, where contact information is available, prior to the changes taking effect.

Continued use of the contevending.ca website or submission of personal information through any Conte Vending Co. property after changes to this policy have been posted constitutes acceptance of the updated terms. If you do not agree to the updated policy, you should cease use of the website and contact us to request deletion of any personal information we hold about you.