Privacy Policy
Effective date: January 2025 Last updated: July 17, 2026
1. Who we are and what this policy covers
ARTiViA is a premedia, packaging artwork, and creative production services business. This policy explains how we collect, use, disclose, and protect personal information.
The controller of personal information described in this policy is:
ARTiViA Inc., a Delaware corporation, with address 125 Omni Drive, Suite 1134, Toronto, Ontario, M1P 5A9, Canada.
Email: [email protected]
This policy covers: artiviainc.com and its subdomains; our marketing, advertising, and business-development communications; our commercial relationships with prospects, clients, vendors, and applicants.
This policy does not cover client production data. Where a client supplies us with files, artwork, assets, or datasets to perform services, ARTiViA acts as a processor / service provider on that client's instructions. That processing is governed by the master services agreement, statement of work, and data processing addendum between ARTiViA and the client, not by this policy. If your personal information appears in material a client sent us, please contact that client, who is the controller of it. We will support them in responding.
2. Information we collect
2.1 Information you give us
Contact and business identifiers: name, business email address, business phone number, employer, job title, postal address.
Communications: the content of emails, form submissions, meeting requests, call notes, and messages you send us.
Commercial and transaction information: services enquired about or purchased, quotes, scoping information, purchase orders, invoices, payment records.
Recruitment information: where you apply for a role, your CV, work history, references, and right-to-work information.
2.2 Information collected automatically
Device and usage information: IP address, browser type and version, operating system, device type, referring URL, pages viewed, time on page, links clicked, approximate location derived from IP.
Cookies and similar technologies: see Section 6.
2.3 Information we obtain from other sources
We obtain business contact information about individuals at companies we believe may have a professional interest in our services, from:
Business contact data providers, including Linkedin;
Publicly available professional sources, including company websites, professional networking sites, industry directories, trade association listings, and conference attendee lists;
Referrals from mutual contacts, partners, and existing clients;
Trade and industry organizations where we hold membership.
The information we obtain from these sources is limited to business contact and role information: name, employer, job title, business email address, business phone number, and professional profile links.
3. Why we use your information, and our legal bases
| What we do | Information used | Legal basis (EEA/UK) |
| Provide, operate, and support our services; manage the client relationship | Contact, commercial, communications | Contract; legitimate interests (servicing the account) |
| Respond to enquiries and requests | Contact, communications | Contract (pre-contractual steps); legitimate interests |
| Quote, invoice, collect payment, keep accounting records | Contact, commercial | Contract; legal obligation |
| Business development and direct marketing to business contacts | Contact, professional profile, engagement data | Legitimate interests in promoting relevant B2B services (Section 8); consent where required by local law |
| Digital advertising, including audience targeting and measurement with Google and other ad platforms | Hashed email address, device and usage data, cookie identifiers | Consent (EEA/UK and other consent jurisdictions); legitimate interests / opt-out where consent is not required |
| Website analytics and improvement | Device and usage data | Consent for non-essential cookies; legitimate interests for aggregate analysis |
| Security, fraud prevention, and protection of our systems and client data | Device and usage, contact | Legitimate interests; legal obligation |
| Recruitment | Recruitment information | Pre-contractual steps; legitimate interests; consent where required |
| Comply with law, respond to legal process, establish or defend legal claims | Any of the above | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. You may ask us for a summary of that assessment, and you may object at any time (Section 11).
We do not use your information for automated decision-making that produces legal or similarly significant effects about you.
4. Advertising and audience targeting
We advertise our services online. This section explains what that involves.
4.1 Customer Match and hashed email lists
We may share email addresses that you provided directly to us with advertising platforms, including Google, so those platforms can show our advertisements to you and to people with similar professional profiles, and so we can measure whether our advertising works.
Before we share an email address, it is converted into an irreversible cryptographic hash. The advertising platform compares that hash against hashes of its own account holders. Where there is a match, our advertisements may be shown to that account. Where there is no match, the platform is required to discard the data.
We only use email addresses collected in a first-party context for this purpose: addresses you gave us directly through our website, a form, a signed agreement, an event registration, or a direct business exchange with us. We do not upload email addresses obtained from third-party data providers or scraped from public sources to advertising platforms.
Where we instruct an advertising platform to process this data, it does so subject to that platform's data processing terms and on our instructions.
Your choices: you can opt out of this use of your email address at any time by emailing [email protected] with the subject line "Advertising opt-out". You can also control the ads Google shows you at https://myadcenter.google.com and https://adssettings.google.com.
4.2 Interest-based advertising and remarketing
Third-party vendors, including Google, show our advertisements on sites across the internet.
Third-party vendors, including Google, use cookies and device identifiers to serve advertisements based on your past visits to our website.
You can opt out of Google's use of cookies and device identifiers by visiting Google's Ads Settings at https://adssettings.google.com. You can opt out of participating third-party vendors' use of cookies by visiting the Network Advertising Initiative opt-out page at https://optout.networkadvertising.org or the Digital Advertising Alliance page at https://optout.aboutads.info.
4.3 Analytics and advertising features
We use Google Analytics, and its Advertising Features including Remarketing, Demographics and Interests Reporting. These features use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as Google advertising cookies) together to inform, optimize, and serve advertisements based on your past visits to our website.
You can opt out of Google Analytics using the browser add-on at https://tools.google.com/dlpage/gaoptout, and you can opt out of Google Analytics Advertising Features through Google's Ads Settings.
4.5 EEA and UK visitors
If you are in the EEA or the UK, we do not set non-essential advertising or analytics cookies, and we do not use your information for personalized advertising, unless you consent through our cookie banner. You can withdraw consent at any time (Section 6).
5. How we share information
We share personal information with the following categories of recipients:
| Recipient category | Purpose | Examples |
| Production and delivery partners | Performing premedia and artwork services on our behalf | Our affiliate and contracted production partners |
| Cloud, hosting, and IT providers | Hosting our website, files, and systems | Cloudflare |
| Business software providers | CRM, email, collaboration, accounting | Zoho, Microsoft 365 |
| Advertising and analytics platforms | A dvertising and measurement (Section 4) | |
| Business contact data providers | Sourcing and verifying business contact information | |
| Professional advisers | Legal, accounting, insurance, audit | Counsel, auditors |
| Payment processors and banks | Processing payments | Bank |
| Acquirers and investors | Corporate transactions, diligence, financing | Under confidentiality obligations |
| Government, regulators, courts | Where required by law or legal process | As legally compelled |
We require service providers to process personal information only on our instructions, to protect it appropriately, and not to use it for their own purposes.
We do not disclose personal information for money.
6. Cookies and similar technologies
We use:
Strictly necessary cookies, required for the site to function. These cannot be disabled.
Analytics cookies, to understand how the site is used.
Advertising cookies, to deliver and measure advertising.
Managing cookies. You can accept or reject non-essential cookies through our cookie banner. You can also configure your browser to refuse cookies, though parts of the site may not work correctly.
Global Privacy Control. Where we detect a Global Privacy Control (GPC) signal from your browser, we treat it as a valid request to opt out of the sale or sharing of your personal information and of targeted advertising, for that browser and device.
7. How long we keep information
| Information | Retention |
| Prospect and marketing contact data | 5 years from last meaningful engagement, then deleted or anonymized |
| Client relationship and communications | Term of the relationship plus 7 years for contractual and limitation purposes |
| Financial and tax records | 7 years, per applicable tax law |
| Website analytics data | 5 years |
| Advertising audience lists | Refreshed at least every 1 year; addresses removed on opt-out |
| Recruitment data | 2 years after the process closes, unless you consent to longer |
Where we no longer need information, we delete it or irreversibly anonymize it.
8. Marketing communications
We send business-development and marketing emails to individuals at organisations we believe have a professional interest in premedia and packaging artwork services.
Every marketing email identifies ARTiViA, includes a valid postal address, and includes a one-click unsubscribe. Unsubscribing takes effect within 3 business days and suppresses future marketing to that address permanently.
You can opt out at any time by using the unsubscribe link or emailing [email protected].
Canada. We send commercial electronic messages to Canadian recipients only where we have express or implied consent under Canada's Anti-Spam Legislation, and every message includes our identification and an unsubscribe mechanism.
EEA and UK. Where we contact you at a business email address about services relevant to your professional role, we rely on legitimate interests. You may object at any time, and we will stop.
9. International transfers
ARTiViA is headquartered in the United States and delivers production work through personnel and contracted production partners in India. Your personal information, and information contained in materials our clients send us, may be transferred to, stored in, and accessed from the United States, India, and Canada.
Where we transfer personal information from the EEA or the UK to a country without an adequacy decision, we rely on:
the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum or the UK IDTA, as applicable;
supplementary technical and organizational measures, including encryption in transit and at rest, access controls, and segregated environments;
documented transfer impact assessments.
You can request a copy of the relevant transfer mechanism by emailing [email protected].
10. Security
We maintain technical and organizational measures appropriate to the risk, including access controls on a least-privilege basis, encryption in transit and at rest, network segregation, logging and monitoring, contractual confidentiality obligations, and incident response procedures.
Production may be delivered through our partners holding SOC 2 Type II / ISO 27001 / G7 certification.
No system is perfectly secure. If a breach affecting your personal information occurs, we will notify you and the relevant authorities where required by law and within the applicable deadlines.
11. Your rights
Depending on where you live, you may have some or all of the following rights:
Access a copy of the personal information we hold about you
Correct inaccurate or incomplete information
Delete your personal information
Port your information to another provider in a machine-readable format
Object to processing based on legitimate interests, including profiling
Restrict processing in certain circumstances
Withdraw consent at any time, without affecting processing already carried out
Opt out of targeted advertising, and of the sale or sharing of personal information
Appeal a decision we make on your request
Be free from discrimination for exercising your rights
How to exercise them. Email [email protected] or write to us at the address in Section 1.
Verification. We will ask you for information sufficient to verify your identity and, if you are acting through an authorized agent, evidence of that authority. We will only use what you provide to process the request.
Timing. We respond within 45 days for requests under US state law (extendable once by a further 45 days with notice) and within one month for requests under GDPR or UK GDPR (extendable by two further months for complex requests, with notice).
Appeals. If we decline your request, you may appeal by replying to our decision with "Appeal" in the subject line. We will respond within 45 days as applicable and explain our reasoning. If we deny the appeal, you may contact your state Attorney General.
Complaints. If you are in the EEA or the UK, you may complain to your data protection supervisory authority. In the UK, that is the Information Commissioner's Office (ico.org.uk). If you are in Canada, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
12. Children
Our website and services are directed to businesses, not to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact [email protected] and we will delete it.
13. Third-party links
Our website may link to third-party sites. We do not control them and are not responsible for their privacy practices. Read their policies before providing information.
14. Changes to this policy
We may update this policy. We will post the revised version here with a new "Last updated" date. Where a change materially affects how we use personal information, we will provide additional notice by a site banner before it takes effect.
15. Contact us
ARTiViA Inc. 125 Omni Drive, Suite 1134, Toronto, Ontario, M1P 5A9, Canada
Email: [email protected]
