This statement explains how kdt consulting collects, uses and protects personal information through smartchoices-betterdecisions.com, including through kdt-consulting.com, which forwards to it (the "Website"), and when you book with us.

1. Who we are

kdt consulting is the registered business name of Kimberley Dawn Tomasson, a sole proprietor in Vancouver, British Columbia, Canada ("we" or "us"). Kimberley Tomasson is our Privacy Officer: ktomasson@kdt-consulting.com.

Our main privacy law is British Columbia's Personal Information Protection Act (PIPA). Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) also applies to relevant commercial activities involving personal information that crosses provincial or national borders. Where the GDPR or similar laws apply, we are the "controller" of the personal information we decide how and why to use.

2. What we collect and why

• Website visits: Squarespace, our host, collects technical information such as your IP address, device, browser and the pages you view, to run and secure the Website. Fonts may load from Google Fonts or Adobe Fonts, which receive your IP address. Analytics cookies are placed only if you accept them, and you can decline them just as easily or change your choice at any time through Manage cookies. We do not use advertising cookies.

• Messages: your name, email address and what you tell us, so we can reply. Our email runs on Google Workspace.

• Introductory and organisational meetings: booked through our Google Calendar page, which gives us your name, email address, chosen time and any notes; meetings take place on Google Meet. For organisations, we also collect business contact details and what we need to plan, invoice and deliver the work.

• Private sessions and workshops: booked through Jane, which stores your client account, bookings and intake answers for us. Our Client Privacy Consent, which you accept in Jane before your first session, explains how we handle session information.

• Payments: by Helcim payment link or card terminal, Interac e-Transfer, or, for organisations, invoice or bank transfer. We never see or store your full card number.

• Sensitive information: you may choose to share your philosophical or religious beliefs or other personal matters. We use it only as needed to provide the Services you ask for, and with your explicit consent where required. You may withdraw consent, subject to legal requirements; this may affect our ability to continue some Services. Please share only what is relevant. We do not provide health care services.

We do not record or transcribe meetings without your permission. We do not sell personal information, use it for targeted advertising or automated decision-making, or send marketing emails unless you opt in.

Legal basis. In Canada, we ask for your consent where the law requires it. Where the GDPR or similar laws apply, we rely on your consent (analytics cookies), your explicit consent (sensitive information), on taking steps toward or performing a contract (bookings and Services), on our legitimate interests (running the Website and replying to you), or on legal obligations (financial records).

3. Who we share it with

We share personal information only with:

• Our service providers: Squarespace, Google, Jane and Helcim. Our booking buttons open these services in a new tab, where their own privacy policies and terms also apply. We remain responsible for the personal information we control, including what they hold for us.

• Professional advisers, such as an accountant or lawyer, who must keep it confidential.

• Others where the law requires it, or a buyer if our business is sold, where the law allows and with appropriate protections in place.

LinkedIn. If you visit our LinkedIn profile, LinkedIn may collect information about your visit and activity under its own privacy policy. We do not share your information with LinkedIn.

4. Where it is stored, for how long, and how we protect it

Our service providers store information in Canada, the United States and, for some services such as Google, other countries where they operate, where it may be accessible to local courts and authorities. Where a law requires safeguards for information sent to another country, we use the safeguards it requires.

We keep:

• website messages: 2 years after our last exchange;

• introductory meeting bookings: 1 year after the meeting;

• organisational contacts and records: 2 years after the work ends;

• payment and financial records: generally 6 years from the end of the last tax year they relate to, as Canadian tax rules require;

• analytics data: as set in Squarespace's settings.

We delete or de-identify personal information when it is no longer needed for these purposes, subject to legal retention requirements and reasonable technical limits, such as backups.

We protect information with reasonable safeguards, including password-protected accounts and two-factor authentication where available. Kimberley Tomasson is the only person with routine access to our business records; our service providers may also process information as described in this statement. No online system is completely secure, so please avoid sending highly sensitive information by email. If a security incident occurs, we will assess it, contain it, keep a record of it for at least 24 months, and notify you and the relevant regulator where the law requires.

5. Your rights and complaints

Wherever you live, you can ask us to tell you what personal information we hold about you and give you a copy, correct it, or withdraw your consent. Withdrawing consent may mean we cannot continue some Services, and we may still need to keep records the law requires. Depending on where you live, you may have more rights, such as deletion or portability, subject to that law's conditions.

To make a request, email our Privacy Officer at ktomasson@kdt-consulting.com. We may need to verify your identity. We respond within the time required by applicable law, generally within 30 days for access requests under BC's PIPA. We do not charge a fee unless the law permits it. If we refuse a request, we will explain why and identify any available review or complaint process.

You may contact the privacy regulator responsible for the law that applies to your situation at any time. In British Columbia, this is the Office of the Information and Privacy Commissioner for British Columbia. For matters governed by PIPEDA, it is the Office of the Privacy Commissioner of Canada. In Quebec, it is the Commission d'accès à l'information. Elsewhere, contact your local privacy regulator.

6. Children, changes and other languages

The Website and our Services are for adults aged 19 and over, or the age of majority where you live if higher. If you believe a minor has given us personal information, contact our Privacy Officer. We will assess the circumstances and take appropriate steps, including deletion where appropriate and permitted by law.

We may update this statement and will post the new version here with a new date. Where the law requires, we will tell you about significant changes directly and ask for your consent before any new use that needs it.

This statement is also available in French at smartchoices-betterdecisions.com/privacy-fr. Our Terms of Use are at smartchoices-betterdecisions.com/terms-en.

Last updated: October 20 2026