Home/Privacy
LegalPrivacy policy
How we handle personal information, written to be read rather than to be defended. Last updated 2026-09-24.
Who we are
This site is operated by HMG Hotels, the Canadian office of HORECA Management Group, at 2201 Bristol Circle, Oakville, ON L6H 0J8, Canada. We can be reached at info@hmghotels.ca or +1 (437) 779-8843.
We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Where a Quebec resident's information is involved, we apply the additional requirements of Quebec's Law 25.
What we collect
Information you give us
If you complete the contact form or write to us, we receive what you choose to send: your name, your company, your email address, your telephone number if you provide one, and whatever you tell us about your project. We ask for nothing else, and we do not require an account.
Information collected automatically
If — and only if — you accept analytics in the banner shown on your first visit, we use Google Analytics 4 to understand which pages are useful. Until you accept, Google Consent Mode holds analytics storage in a denied state and no analytics cookies are written. IP anonymisation is enabled.
Our host, Cloudflare, processes standard server request data such as IP address, user agent and requested URL in order to serve the site securely and to mitigate attacks. This is necessary to operate the website at all and is not used by us for profiling or advertising.
Cloudflare also records aggregate page-view measurements for this site. That measurement sets no cookies, stores nothing on your device and does not follow you between sites or sessions — it counts requests, not people — so it runs whatever you choose in the banner. The banner governs Google Analytics, which is the part that can identify a returning browser.
What we do not do
- We do not sell, rent or trade personal information. Ever.
- We do not run advertising or remarketing pixels on this site.
- We do not add enquiry contacts to a marketing list. If we ever wanted to send you something other than a reply, we would ask first — as CASL requires.
- We do not attempt to identify individual visitors from analytics data.
Why we use it, and on what basis
| Purpose | Information | Basis |
|---|---|---|
| Replying to your enquiry and, if it proceeds, discussing the engagement | Name, company, email, phone, project details | Your consent, given when you submit the form |
| Spam and abuse prevention on the form | IP address, Cloudflare Turnstile verification token | Legitimate interest in keeping the service usable |
| Understanding which pages are useful | Aggregate page views, referrer, approximate region, device type | Your consent, given in the cookie banner |
| Serving and securing the website | Standard server request data | Necessary to provide the service you requested |
Who else sees it
We use a small number of service providers, and only these:
- Cloudflare, Inc. — website hosting, security, cookieless page-view measurement and the form endpoint. Request data may be processed on servers outside Canada, including in the United States.
- Google LLC — Google Analytics 4, only after you accept analytics. Data may be processed outside Canada.
- Our email provider — delivers the contents of the contact form to our inbox.
Information held outside Canada is subject to the laws of the country where it is held, including lawful access by courts and authorities there. We do not disclose personal information to anyone else except where we are legally required to.
How long we keep it
- Enquiries that do not proceed — deleted within 24 months.
- Enquiries that become engagements — retained for the duration of the engagement and for seven years afterwards, which is the period business and tax records generally require.
- Analytics — retained by Google for 14 months from last activity in aggregate form.
Your rights
You may ask us to:
- tell you what personal information we hold about you;
- correct it if it is wrong;
- delete it, where we are not required to keep it;
- withdraw a consent you previously gave, at any time.
Write to info@hmghotels.ca and we will respond within 30 days. There is no charge. To withdraw analytics consent after accepting it, clear this site's data in your browser and choose “Essential only” when the banner reappears.
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to your provincial privacy regulator.
Cookies and similar technology
The site sets no cookies of its own. Your choice in the consent banner is stored in
your browser's local storage under the key hmg-ca-consent, so we do not have
to ask again. If you accept analytics, Google Analytics sets its own cookies; if you do
not, it sets none. Cloudflare may set a cookie strictly necessary for security.
Security
The site is served over HTTPS with HSTS and a strict content security policy. Form submissions are transmitted over TLS and are protected by a bot check. Only the people who need it have access to enquiry contents. No system is perfect, and we will not claim otherwise; if a breach ever created a real risk of significant harm we would notify you and the Privacy Commissioner as PIPEDA requires.
Children
This site is a business-to-business site and is not directed at children. We do not knowingly collect information from anyone under 18.
Changes
If we change this policy we will update the date at the top. Material changes to how we use information already collected would be notified to affected individuals directly.
Contact
Privacy questions and requests: info@hmghotels.ca, or write to HMG Hotels, 2201 Bristol Circle, Oakville, ON L6H 0J8, Canada.