Privacy

Data & Privacy Policy

We are committed to protecting your personal information. This policy explains what we collect, why, and what rights you have — under Canada’s PIPEDA and the EU’s GDPR.

What we collect

Information we may hold

• Contact inquiries. When you email us at hello@istaristrategy.com, we receive your name, email address, and the content of your message.
• Server logs. Our hosting provider automatically records standard web-server logs — IP address, browser type, referring page, date and time. These are retained for up to 90 days for security and diagnostics only.
• Browser preferences. We store your day/night mode preference in your browser’s localStorage under the key istari-citymode. This never leaves your device.
• Cookie consent choice. Your analytics consent preference is stored locally under the key istari-consent. This also never leaves your device.

We do not currently run any analytics, advertising, or third-party tracking scripts. If that changes, this policy will be updated before any tracking begins and you will be asked for fresh consent.

How we use it

Purpose and legal basis

• Responding to inquiries — legal basis: your consent (you contacted us) and our legitimate interest in providing the requested service.
• Site security and diagnostics — legal basis: our legitimate interest in keeping the site available and secure.
• Optional future analytics — legal basis: your explicit consent via the cookie banner, given separately before any tracking begins.

We will never use your information for automated decision-making or profiling that produces legal or similarly significant effects on you.

Cookies & local storage

What runs in your browser

You can clear these at any time through your browser’s developer tools or by clearing site data. You can also update your analytics preference here:

Your rights · Canada

Rights under PIPEDA

• Access. You may request a copy of the personal information we hold about you.
• Correction. You may ask us to correct inaccurate or incomplete information.
• Withdrawal of consent. You may withdraw consent for the use of your information at any time, subject to legal or contractual restrictions.
• Complaint. You may file a complaint with the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, contact us at hello@istaristrategy.com. We will respond within 30 days.

Your rights · Europe

Rights under the GDPR

• Right of access (Art. 15). Obtain confirmation of whether we process your data and receive a copy.
• Right to rectification (Art. 16). Have inaccurate personal data corrected without undue delay.
• Right to erasure (Art. 17). Request deletion of your personal data where no legitimate ground for retention exists.
• Right to restriction of processing (Art. 18). Ask us to limit processing to storage only while a dispute is resolved.
• Right to data portability (Art. 20). Receive your data in a structured, machine-readable format.
• Right to object (Art. 21). Object to processing based on legitimate interests.
• Right to lodge a complaint. Contact the German federal supervisory authority, the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI), or your local EU data protection authority.

Canada has received an EU adequacy decision under GDPR for organizations covered by PIPEDA, which means data transferred from the EEA to Canada benefits from equivalent protection. To exercise any GDPR rights, email hello@istaristrategy.com. We will respond within 30 days (or within 72 hours for data-breach notifications).

Retention & transfers

How long, and where

• Contact inquiries — retained for up to 3 years for relationship management, then deleted.
• Server logs — retained for up to 90 days by our hosting provider, then automatically purged.
• Browser preferences — stored on your device; cleared when you clear site data.

Our infrastructure is hosted in Canadian cloud regions. Our Düsseldorf studio may access contact inquiry data where required for client engagements. This transfer is covered by the EU–Canada adequacy decision referenced above.

Contact

Privacy inquiries

Questions, corrections, or requests to exercise your rights.