This Privacy Notice explains how The Conversion Berg (“we”, “us”) collects, uses, stores, and shares personal data when you visit our website, submit an enquiry, use the client portal, sign an agreement, pay an invoice, or otherwise deal with our team. The Conversion Berg is the controller for website, marketing, and customer-relationship data described here. Where we process personal data solely on a client’s documented instructions in a delivery engagement, the Data Processing Addendum and the signed order describe those processor duties.
Who we are
The Conversion Berg provides conversion-focused websites, ecommerce, search, paid media, local growth, and related digital services from published offices in Calgary, Toronto, Austin, and the United Kingdom. You can reach us using the contact details at the end of this notice. If you deal with us through a company, partnership, or other organisation, we still treat the individuals we speak to as people with privacy rights.
Personal data we collect
We collect identity and contact data such as name, job title, organisation, email address, telephone number, and postal or billing address. We collect commercial and service data such as the services you ask about, proposal and invoice history, project files, approvals, comments, and support tickets. We collect account data when a portal or staff workspace is created, including login identifiers, role, and authentication events. We collect payment and billing data needed to issue invoices and record payment status; card or bank details are handled by the payment provider where one is used, not stored in full in our CRM. We collect communication data from forms, email, SMS where you have opted in, calls you request, and messages in the portal. We collect device and usage data such as IP address, browser type, approximate location derived from IP, pages viewed, and cookie identifiers as described in the Cookie Policy.
We obtain this information directly from you, from people at your organisation who are authorised to deal with us, from public business sources you point us to, and from our systems when you use the website, portal, or signing links. We do not buy consumer marketing lists for cold SMS.
Purposes and lawful bases
We use personal data to answer enquiries, prepare proposals, enter and perform contracts, deliver services, operate the client portal, collect payment, keep security logs, meet tax and accounting duties, and handle complaints. The lawful bases we rely on are contract (or steps at your request before a contract), legitimate interests in running and securing a professional services business, legal obligation, and consent where the law requires consent — in particular for non-essential cookies and for promotional email or SMS under PECR and, where applicable, CASL.
Legitimate interests include keeping a record of what was agreed, detecting abuse of forms or signing links, defending legal claims, and improving how our public pages perform. We do not use legitimate interests to override rights that require consent. You may object to processing based on legitimate interests; we will stop unless we have compelling grounds or the processing is needed for a legal claim.
Cookies and similar technologies
Strictly necessary cookies support security, load balancing, form submission, and remembering essential preferences. Analytics, functional, and advertising technologies run only after the consent required in your jurisdiction. The Cookie Policy explains categories, the banner, and how to withdraw optional consent. Cookie choices do not stop us processing an enquiry you have already submitted.
Sharing
We share personal data with staff and contractors who need it to do their job, under confidentiality and access controls. We share data with subprocessors who host the website, send email, process payments, provide analytics after consent, or support security. The Subprocessor List describes production categories. We may share data with professional advisers, insurers, or a competent authority when the law requires it or when we must protect the company, our customers, or the public. We do not sell personal data.
International transfers
Some providers store or access data outside the United Kingdom. Where a restricted transfer occurs, we use an approved mechanism such as the UK International Data Transfer Agreement or Addendum, the EU standard contractual clauses where they remain a lawful bridge, and supplementary technical and organisational measures. Canadian residents should expect that data may be processed in the United Kingdom, the European Economic Area, the United States, or other locations used by the named providers.
Retention
Enquiry records that do not become customers are kept only as long as needed to complete the conversation, meet limitation periods, and detect repeat abuse. Contracts, invoices, tax records, and signed agreements are kept for the statutory and contractual periods that apply, typically at least six years after the end of the relevant accounting period in the United Kingdom unless a longer legal hold applies. Portal logs, authentication events, and signing evidence are kept for security and audit for a documented period and then deleted or anonymised. Marketing consents and withdrawals are kept as evidence for as long as we may need to show that we respected your choice. When a retention period ends, we delete or irreversibly anonymise the data unless a legal hold or court order requires continued protected storage.
Your rights
Subject to applicable law, you may request access to your personal data, correction of inaccurate data, erasure, restriction, objection, and data portability. You may withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal. You may complain to the Information Commissioner’s Office in the United Kingdom. Canadian residents may complain to the Office of the Privacy Commissioner of Canada or the competent provincial authority, including in Quebec under Law 25. We may need to verify your identity before fulfilling a request. Some rights are limited where we must keep data for a contract, a legal duty, or a claim.
Children
Our website and services are aimed at businesses and adult decision-makers. We do not knowingly collect personal data from children for marketing. If you believe we have collected a child’s data in error, contact us and we will delete it unless the law requires us to keep a limited record of the request.
Security
We use role-based access, hashed signing tokens, TLS in transit where the hosting stack provides it, and audit logging in Berg Ops. No method of transmission or storage is perfectly secure. You must protect portal passwords, recovery codes, and any signing link sent to you. Tell us promptly if you suspect unauthorised access.
Changes to this document
We may update this document when our services, tools, or legal duties change. Material changes are issued as a new version with an effective date. The version shown at the foot of this page is the current public text. A signed proposal, statement of work, or agreement remains governed by the version incorporated into that order unless the parties lawfully agree otherwise. Minor corrections that do not change your rights may be published without a separate email notice.
Governing framework
Contracts use the law of England and Wales as the primary governing framework unless the signed order expressly states another governing law. Mandatory local protections continue to apply where they cannot lawfully be excluded, including protections under UK GDPR, the Data Protection Act 2018, PECR, and, where a Canadian resident is involved, PIPEDA, CASL, and applicable provincial privacy law.
Contact
Questions, cancellation notices, accessibility requests, and complaints should be sent to info@theconversionberg.com or support@theconversionberg.com, or using the details on our Contact page. Published office numbers: Calgary +1 587-997-9019; Toronto +1 437-889-9756; Austin +1 737-363-3384; United Kingdom +44 7474 769450.