Privacy Policy

1. Scope of this policy

This policy covers the personal information that Ryu Associates Inc. handles when a person visits our website, sends us an enquiry, signs a survey engagement, walks a creek reach with our team, volunteers for a monitoring week or receives a deliverable such as a restoration plan or a grant application draft. It applies to information held in digital systems and to paper records kept at our survey office on Leckie Ave.

The policy does not cover the practices of third parties whose websites or tools you reach through a link from our pages. Those organisations publish their own policies, and we encourage you to read them before sharing information. The policy also does not cover aggregate information that cannot reasonably be linked to an individual, such as a regional count of creek outfalls.

Where a client supplies us with information about other people, for example the names of landowners along a reach, the client remains responsible for having a lawful basis to share that information. We handle it according to the terms of the engagement and the instructions we receive.

2. Who we are

Ryu Associates Inc. is a Canadian corporation based at 42 Leckie Ave, Stoney Creek - L8J 2S7, Canada (CA). The company combines creek survey work with computer systems design, and it operates the website at ryuassociates.mom as a record of the practice and a channel for enquiries. The developer name used throughout our materials is Ryu Associates, while the legal entity that contracts with clients and holds records is Ryu Associates Inc.

For the purposes of applicable privacy law, Ryu Associates Inc. acts as the controller of the information described in this policy. That means the company decides why the information is held and how it is used, and it is accountable for protecting it. Where we process information on behalf of a client under written instruction, we act as a processor and follow the clients documented directions.

Our office is open on weekdays, and a member of the team answers the published phone line during business hours. We do not operate a call centre and we do not route enquiries through an outsourced service.

3. Information we collect

The information we collect falls into a few clear groups, and we try to collect only what a task genuinely requires.

Contact and identity details

When you write to us or call, we may hold your name, your email address, your phone number, the organisation you represent and your role within it. A client engagement also requires a billing address and a purchase order reference where one applies.

Enquiry content

We keep the text of the messages you send, including the details of a creek reach, a mapping question or a funding deadline. If you attach photographs or documents, we store those as part of the same record.

Survey and field records

Survey work produces measurements, photographs, notes, station locations and, in some cases, the names of landowners who granted access. These records may include personal information where a landowner is identifiable, for example in an access consent or a photograph of a private bank.

Website technical data

Our web host records standard request information such as the page requested, the time of the request and a truncated network address. We use this data in aggregate to keep the site available and to detect abuse.

Payment and billing data

Payments are handled by a financial institution and its processing tools. We receive confirmation that a payment was made and the last few digits of an account reference, but we do not store full card numbers on our systems.

4. How information is collected

We collect information directly from you when you fill in the contact form, send an email, telephone the office or speak with a surveyor on site. The contact form on this website is designed to open a draft message in your own email application, which means the content travels from your device to our mailbox and does not pass through an intermediate form service.

We also collect information during a survey engagement. A landowner may give access permission in a short written note, and a volunteer may sign a field sheet at the start of a monitoring week. These records become part of the engagement file.

Finally, a limited amount of technical information is generated automatically when a browser requests a page from our host. We do not run advertising trackers and we do not build behavioural profiles of visitors.

5. Why we use information

We use personal information for a small number of connected purposes, each of which follows from the work of a survey office.

• To reply to an enquiry and to decide whether a survey engagement is a good fit.
• To prepare a scope, a fee range and a schedule for a client.
• To deliver survey services, including plans, audits, maps, planting schemes, monitoring records and grant drafts.
• To record land access consents and to respect the conditions a landowner sets.
• To issue invoices, keep accounting records and meet tax obligations.
• To keep the website available, secure and free of abuse.
• To inform you about a change to an engagement or a published policy.
• To improve our methods by reviewing anonymised records of how a survey was conducted.

We do not sell personal information, and we do not use it to make automated decisions that affect your rights. Where a task calls for judgement, a person on our team makes that judgement.

6. Lawful basis for processing

Under Canadian privacy law, and under comparable rules where they apply, we rely on a small set of lawful bases.

Consent. We rely on consent when you send an enquiry, agree to receive updates or permit a survey crew to enter your land. You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting the office.

Contract. We process information as needed to prepare and perform a survey engagement, including billing and delivery of a plan.

Legal obligation. We keep accounting and tax records for the period the law requires, and we may disclose information where a valid legal demand compels it.

Legitimate interests. We process limited technical data to keep the website secure and to improve the clarity of our published material, balancing that interest against your privacy.

7. Field data and survey records

Survey records deserve special mention because they often contain information about places rather than about people, yet the two can overlap. A photograph of an eroding bank may show a garden, a fence, a vehicle or a house number. An access note may name a landowner. A monitoring sheet may record the phone number of a volunteer who reads a gauge.

We keep field records accurate and we label every station so a reading can be traced to the day and the observer. Where a photograph is not needed to support a conclusion, we leave it out of the deliverable. Where a landowner asks that a property detail be kept out of a public report, we honour that request and use the detail only in the working file.

Survey deliverables often become public documents when a municipal client adopts a plan. Before a deliverable leaves our office we review it for personal details that serve no public purpose and remove them. This review is a normal part of production, not an exception.

8. Cookies and local storage

This website is built with plain static pages and a small script that handles navigation, reveal effects and the contact form. It does not set advertising cookies, it does not embed social media pixels and it does not use a third party analytics service that follows a visitor between sites.

The small script may keep a preference in your browsers local storage if a feature requires it, and that preference stays on your device. It is not transmitted to our office. Clearing your browser data removes it.

Our web host may place a security cookie to distinguish a genuine request from an automated attack. That cookie carries no personal profile and expires quickly. You can block cookies in your browser settings, and the pages will continue to work for reading and navigation.

9. Sharing and disclosure

We share personal information only where there is a clear reason and only to the extent needed.

With a client. During an engagement we share the records that belong to the engagement, which may include land access notes and the names of people who attended a walk. We share those details because the client needs them to maintain a working relationship along the reach.

With a subcontractor. A survey may require a specialist such as a structural engineer or a vegetation specialist. We share only the details needed for that task, and we require the specialist to protect the information in the same way we do.

With a service provider. We use an email host, a file storage service and an accounting tool. These providers process information on our instruction and under contract.

For legal reasons. We may disclose information where a court order, a warrant or a mandatory legal requirement compels disclosure, or where disclosure is necessary to protect a person from serious harm.

We do not sell, rent or trade personal information to any third party for marketing purposes.

10. Service providers

Our service providers are chosen for reliability and for a clear privacy posture. Each provider is bound by a written agreement that limits the use of information to the service we have asked for and requires appropriate safeguards.

Email is hosted by a commercial provider located in Canada. File storage for survey records uses encrypted storage with access limited to named team members. Accounting records are held in a Canadian bookkeeping system. Website hosting runs on a server that logs requests for security and availability.

When a provider changes, we review the new providers safeguards before moving any record. We do not move survey records to a provider that cannot meet the standard we set for the office.

11. Retention and deletion

We keep information only as long as it serves the purpose for which it was collected, or as long as the law requires.

• Enquiries that do not lead to an engagement are deleted within twenty four months.
• Engagement files are kept for seven years after the final invoice, which matches the period we must keep accounting records.
• Survey data that a client relies on for long term monitoring is retained for the period agreed in the engagement, after which it is offered to the client in an open format and then deleted.
• Website request logs are kept for ninety days and then removed in the ordinary course of hosting.

When a retention period ends, records are deleted or anonymised. Where a legal hold applies, deletion waits until the hold is lifted, and the reason for the hold is recorded.

12. How we protect information

Protecting a survey record is part of protecting the people along a creek. We use a set of practical safeguards.

Access control. Only team members who need a record can open it, and accounts are protected with strong passwords and a second factor. Access is removed when a person leaves the team.

Encryption. Files are encrypted in transit and stored in an encrypted container. Devices that leave the office for field work use full disk encryption.

Backup. Records are backed up nightly to a separate location, and a restore is tested at least once a quarter.

Physical security. Paper field sheets are kept in a locked cabinet at the Leckie Ave office and are scanned and shredded when the digital record is complete.

Incident response. If a breach occurs, we contain it, record what happened and notify affected people and the appropriate authority where the law requires. We do not wait for a perfect account before telling someone that their information may have been exposed.

13. Your privacy rights

Subject to applicable law, you have the right to ask what personal information we hold about you, to ask for a copy, to ask that an error be corrected and to ask that a record be deleted where no legal reason requires us to keep it.

You may also withdraw consent to a use that rests on consent, object to a use that rests on legitimate interests, and ask us to restrict a use while a question is resolved. To exercise a right, write to associates@ryuassociates.mom with enough detail to locate the record. We may ask for proof of identity so that we do not release a record to the wrong person.

We respond within thirty days. If a request is complex, we will tell you why more time is needed and keep you informed. There is no fee for a reasonable request, although we may charge a modest amount for repeated copies where the law allows.

If we cannot fulfil a request, we explain the reason in writing and point to the remedy available to you.

14. Privacy for Children

Our services are intended for organisations, professionals and adult residents. We do not knowingly collect personal information from a child under the age of sixteen, and we do not design any feature of this website for use by children.

School groups sometimes join a planting day on a creek. On those occasions the supervising teacher collects any consent needed from a parent or guardian, and we receive only a count of participants and the name of the supervising adult. We do not photograph identifiable children for a public report without written consent from a guardian.

If you believe that a child has sent personal information to our office, contact us and we will remove the record promptly.

15. International transfers

Our primary records stay in Canada. Some service providers run infrastructure in the United States or the European Union, which means a record may pass through or be stored in another country as part of a routine service such as email delivery.

Where information leaves Canada, we use contractual safeguards and we prefer providers that keep data in Canadian regions. We tell a client at the start of an engagement if a specific tool will store records outside Canada, so the client can decide whether that is acceptable.

Regardless of where a record is stored, our office remains responsible for it under this policy.

16. Marketing and communications

We send project updates to clients and, occasionally, a short note about a new reach or a planting window to people who have asked to hear from us. We do not send unsolicited marketing email to a person who has not opted in, and every note includes a way to stop.

We do not buy contact lists and we do not share a subscriber list with another organisation. If you ask to be removed, we remove the address from the list and keep only the minimum record needed to honour your request.

A service message about a live engagement, such as a change to a survey date, is not marketing and is sent regardless of marketing preferences.

17. Third party links

Our pages may link to a municipal map, a conservation authority report or a funding program page. Those sites are operated by other organisations and are governed by their own privacy policies. We do not control their content and we are not responsible for how they handle information.

We check that a link points to a legitimate source before publishing it, but a link is not an endorsement of everything on the destination site. If a link breaks or leads somewhere unexpected, tell us and we will correct it.

18. Changes to this policy

We review this policy at least once a year and whenever we change a tool, a provider or a practice that affects personal information. When a change is material, we update the date at the top of the page and, where we hold your email address for an engagement, we tell you in a short message.

A change never reduces the protection applied to information already held without a lawful reason. If you continue to use the website or an engagement after a change takes effect, the updated policy applies to the information described in it.

Earlier versions are kept in the office file for reference, and you may ask for a copy of the version that was in force when you shared information with us.

19. Complaints and contact

If you are unhappy with how we have handled your information, tell us first so we can put it right. Write to the Privacy Contact at the address below, describe the issue and tell us what outcome you would like. We acknowledge every complaint within five working days and aim to resolve it within thirty days.

If you are not satisfied with our response, you may raise the matter with the Office of the Privacy Commissioner of Canada or with the privacy authority in your own jurisdiction. We will cooperate with a regulator that investigates a complaint about our handling of personal information.

20. Glossary of terms

Personal information means information about an identifiable individual, such as a name, an email address, a phone number or a photograph that shows a person.

Controller means the organisation that decides why and how personal information is processed. Ryu Associates Inc. is the controller for the activities described in this policy, except where it acts on a clients documented instruction.

Processor means an organisation that handles information on behalf of a controller under a written agreement.

Consent means a clear permission given freely by a person after they receive the information they need to decide.

Retention period means the length of time a record is kept before it is deleted or anonymised.

Field record means a measurement, note or photograph created during a survey visit, together with the station and date that identify it.

This glossary is provided for clarity and does not narrow the meaning of a term as it is defined in applicable law.