Legal
Privacy policy
What we collect through this website, why we collect it, who else sees it, and how to have it removed.
Last updated
The short version
- The only personal information we ask for is what you type into the contact form or the HR Pulse Check: your name and email address (only if you choose to share them), organization if you give one, your message, and — for the Pulse Check — your self-assessment answers. If you subscribe to the blog, we also hold your email address until you unsubscribe.
- We also record the IP address a submission came from, to help us deal with spam and abuse of the form.
- We use it to reply to you. If you came to us through a Google ad, we also use Google Ads conversion measurement to understand whether the ad led to a successful enquiry. Enhanced conversions may use a one-way hashed version of contact data such as your email address to improve that attribution. We do not sell or rent your information.
- We use Cloudflare Web Analytics on every page to see how the site is performing and which pages get read. It's cookieless and reports traffic in aggregate. We also advertise on Google, and every page loads Google's ad tag so we can tell whether our ads lead to enquiries. It uses advertising cookies, which you can turn off at any time from "Cookie settings" at the bottom of every page — doing so changes nothing about how the site works. If you're in Quebec, they stay off unless you say yes. Clicking "Book a 30-Minute Call" loads Calendly's scheduler.
- You can ask us at any time what we hold about you, and ask us to correct or delete it: hello@workadvised.com.
Who this policy is from, and what it covers
This policy is published by Workadvised, operating as Work, Advised. ("we", "us", "our"), a fractional and on-demand HR consultancy. It explains how we handle personal information collected through the workadvised.com website, including the contact form.
We are based in Canada, and we handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy law. We serve clients across Canada, and we apply this policy to everyone who contacts us, wherever you are.
Personal information we receive in the course of a client engagement — for example, employee information shared with us during HR consulting work — is governed by the confidentiality and privacy terms of that engagement, not by this policy. This policy is about the website.
What we collect
Information you give us
When you submit the contact form, we receive:
- Your name and email address — both required, so we can reply.
- Your organization — optional.
- Your message — whatever you choose to tell us.
Please do not include sensitive details in the form — health information, a named employee's file, allegations about an identifiable individual. If your enquiry involves that kind of material, say so in general terms and we will arrange a more suitable way to discuss it.
If you email us directly instead, we receive whatever your email contains, including your address and any attachments.
The HR Pulse Check
When you complete the self-assessment, we receive your answers to the 12 questions and, only if you choose to provide them, your name and email address. Your result is shown to you immediately — an email address is not required to see it. If you do give one, we use it once, to send you a copy of your result, and for nothing else.
The HR Health Check (clients only)
The HR Health Check is a workbook we send to clients as part of a paid engagement. It is not publicly available: opening it means signing in with an email address we have approved, using a one-time code that Cloudflare Access emails to you. When you press "Send to Daniel," we receive everything you entered — your organization's details, your name, role, email and phone, every answer, and every note and written response — along with the email address you signed in with and your IP address. Until you send it, your answers are saved only in your own browser (so you can come back to them), and pressing "Clear this form" erases them.
Because it describes your workplace, it can contain sensitive material. We treat what you send as confidential client information and use it only to prepare for and carry out our work with you.
The Work, Considered. email list
If you subscribe to get new blog posts by email, the only thing we ask for is your email address. The sign-up form sends it directly to Buttondown, the service that runs the list; it does not pass through our website's servers. You are not added until you click the link in the confirmation email Buttondown sends you. We use your address only to email you when a new Work, Considered. essay is published, and every email has a one-click unsubscribe link. Like most email services, Buttondown records whether an email was opened and which links were clicked, which tells us which topics are useful.
The list is separate from the contact form: we never add anyone to it from an enquiry, an HR Pulse Check, or a client engagement.
Information collected automatically
- Your IP address, recorded with each contact form submission. We use it to investigate spam and abuse of the form, and it is included in the notification email we receive.
- Standard server logs kept by our hosting provider — IP address, the page requested, timestamp, browser user agent. These are generated for every website visit and are used for security and diagnosing faults.
- Aggregate analytics, on every page, through Cloudflare Web Analytics — approximate location (derived from IP address, which is not itself stored against you), browser and operating system, the page viewed, and page-performance timing (how quickly it loaded). This runs automatically at the hosting level rather than through a script we added, doesn't use cookies or any other persistent identifier, and isn't tied to your identity — we see traffic patterns, not individual visitor histories.
- Ad measurement, on every page, through the Google Ads tag. It tells Google that the page was viewed, the page you came from, whether you arrived from one of our ads, and basic browser and device details, along with your IP address as with any web request. With cookies on, it also sets Google Ads cookies so Google can connect a visit to the ad you clicked and may show you our ads elsewhere. With cookies off, it sends the same signals without cookies or any identifier, which Google uses only to estimate, in aggregate, how well our ads perform. See Cookies below.
- Google Ads conversion measurement — whether a successful contact-form submission followed an interaction with one of our Google ads, together with advertising or click identifiers and standard browser/device information. Enhanced conversions may also send a one-way hashed version of first-party contact data such as an email address so Google can improve conversion attribution. This follows the same cookie choice as ad measurement above.
We do not use social-media pixels, sell browsing data, or build our own advertising profile of individual visitors. Everything a page needs — fonts included — is served from workadvised.com rather than from someone else's CDN; the Google tag is delivered through Cloudflare's Google tag gateway, so it too loads from workadvised.com, though what it measures still goes to Google. The contact form and the HR Pulse Check also load Cloudflare's bot challenge, the contact page loads Calendly's scheduler only if you click "Book a 30-Minute Call," and the blog's email sign-up opens Buttondown in a new tab only when you press "Subscribe."
Why we collect it, and your consent
We use the information above only to:
- read and reply to your enquiry, and follow up about working together;
- email blog subscribers when a new essay is published;
- measure whether our Google advertising leads to enquiries and improve campaign performance;
- keep a record of enquiries we have received and how we responded;
- keep the website and the form secure, and block spam and abuse;
- meet our legal and professional record-keeping obligations.
Submitting the form is your consent to us using the information for those purposes. We will not use it for anything materially different without asking you first, and we will never sell it, rent it, or trade it. We do not send marketing email or newsletters from information collected through this form.
Who else handles your information
We do not share your information with anyone for their own purposes. It does pass through a small number of service providers who operate this website, deliver our email, schedule calls, run our email list, and measure advertising performance on our behalf, under terms that govern how they handle the information:
| Provider | What it does | What it handles |
|---|---|---|
| Cloudflare | Hosts and serves this website, runs the bot challenge on the contact form and the HR Pulse Check, provides aggregate, cookieless traffic analytics for every page, and runs the one-time-code sign-in (Cloudflare Access) for the client-only HR Health Check. | IP address, request details, browser and device signals from the challenge, contact form, HR Pulse Check and HR Health Check submissions in transit, the email address a client signs in to the HR Health Check with, and — for analytics — approximate location, browser/OS, and page-performance timing |
| Google Ads | Measures whether visits from Google advertising lead to successful contact-form submissions and helps us understand and improve advertising performance. Enhanced conversions may also be used to improve attribution. You can turn its cookies off at any time; in Quebec they are off until you accept them. | IP address, device and browser information, the page viewed and the page you came from, successful contact-form conversion events, advertising and click identifiers, a Google Ads cookie identifier (unless you have turned cookies off, or, in Quebec, until you accept them), and — where enhanced conversions applies — hashed first-party contact data such as an email address |
| Resend | Delivers the notification email a contact form or HR Pulse Check submission generates, the optional emailed copy of a Pulse Check result, and a client's completed HR Health Check. | Name, email address (where given), organization (contact form and HR Health Check), message or self-assessment answers, HR Health Check answers and written responses, IP address |
| Microsoft 365 | Hosts the mailbox that contact form notifications, completed HR Health Checks and direct emails arrive in. | Everything in your message, and anything you email us directly |
| Calendly | Runs the scheduler that opens if you click "Book a 30-Minute Call" on the contact page. | IP address, device and browser information, and whatever you enter to book a time (typically name and email) |
| Buttondown | Runs the Work, Considered. email list: takes the sign-up, sends the confirmation email and each new-post email, and handles unsubscribes. | Your email address, when you subscribed and confirmed, IP address and browser information at sign-up, and whether you open or click our emails |
Each provider's own privacy policy is linked above. We may also disclose personal information where the law requires it — for example, in response to a valid court order or a lawful request from a government authority.
Where your information is processed
Our service providers are United States companies and operate global infrastructure. Your information may therefore be stored or processed outside Canada, including in the United States. While it is in another country, it is subject to that country's laws, and may be accessible to that country's courts and law enforcement or national security authorities under those laws. We remain accountable for it, and use providers that commit to comparable protection.
Cookies, analytics, advertising measurement, the bot challenge, and booking a call
Cloudflare Web Analytics, described above, runs on every page without cookies and reports traffic in aggregate, without building a record tied to you specifically.
Google Ads measurement is different: it uses advertising cookies or similar identifiers, including ad-click information, to connect a successful contact-form submission with an earlier interaction with one of our ads, and they may be used to show you our ads on other websites. Where enhanced conversions applies, Google may also receive a one-way hashed version of first-party contact data such as an email address to improve attribution. We use this information to measure and improve advertising performance, not to send marketing email. The cookies are on by default, and you can turn them off. If you're in Quebec, they are off by default instead: on your first visit a short banner asks whether you accept them, and until you click "Accept" the tag runs without cookies or any identifier, as described above. To know whether to ask, the site checks once, using the approximate location Cloudflare derives from your IP address, whether you appear to be in Quebec. Only that yes-or-no answer reaches the page, and it and your cookie choice are saved in your own browser, not sent to us. You can change your choice at any time with , also at the bottom of every page; to remove cookies already set, clear this site's cookies in your browser. You can also manage how Google personalizes ads at My Ad Center.
The contact form and the HR Pulse Check are both protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a script. To do that it runs in your browser and examines signals about the browser and device itself — things like how it renders a page and how it responds to standard browser interfaces. It may store a short-lived token or cookie to record that you passed the check, so you are not asked again on the same visit. Cloudflare states that Turnstile does not use this to track individuals across websites and does not use the data for advertising. What it sees is covered by Cloudflare's privacy policy, linked in the table above.
The challenge is required in order to submit either form. If you would rather not run it, email us directly instead — the address is at the bottom of this page.
Signing in to the client-only HR Health Check sets a cookie from Cloudflare Access, which is what keeps you signed in while you work through it. It is used for nothing else, and expires on its own. The workbook also saves your answers in your browser's local storage as you go; that copy never leaves your device unless you send it.
The contact page also has a "Book a 30-Minute Call" button. Nothing loads until you click it — at that point, we load Calendly's scheduling widget, which runs in a pop-up over this page. From there you are dealing directly with Calendly: whatever you enter to book a time (typically your name and email) goes to them, not to us, until Calendly sends the booking details to our inbox. Calendly's own privacy policy, linked in the table above, covers what it collects and how it uses it. If you would rather not use it, the contact form or a direct email works just as well.
How long we keep it
- Enquiries that do not lead to work together: kept in our mailbox for up to 24 months, then deleted.
- HR Pulse Check completions: we don't keep a database of these — the only record is the notification email in our mailbox, kept on the same 24-month schedule as contact form enquiries.
- Completed HR Health Checks: kept as part of the client engagement they belong to, on the schedule below.
- Enquiries that become a client engagement: kept for the life of the engagement and afterwards for as long as our professional and legal record-keeping obligations require, then deleted.
- Email list subscriptions: kept until you unsubscribe. If you never confirm, you receive nothing beyond the one confirmation request, and you can ask us to delete the unconfirmed address.
- Server logs: retained by our hosting provider for a short period — typically a few days — and then discarded automatically.
You can ask us to delete your enquiry sooner. See below.
How we protect it
The whole site is served over HTTPS, so what you type into the form is encrypted in transit. Submissions are validated and length-limited, protected by a hidden anti-spam field and the Turnstile bot challenge, and delivered to a mailbox with access limited to the people who need it. Access to our hosting and email accounts is protected by strong, unique credentials and multi-factor authentication.
No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. This is why we ask you not to send sensitive details through the form.
Your choices and your rights
You can, at any time:
- Ask what we hold about you and how it has been used and disclosed.
- Ask us to correct anything inaccurate or incomplete.
- Ask us to delete your enquiry, subject to any records we are legally required to keep.
- Withdraw your consent to our use of the information, on reasonable notice. If you withdraw it, we may no longer be able to respond to your enquiry.
Email hello@workadvised.com and we will respond within 30 days. We may need to confirm your identity first, so that we do not disclose someone else's information to the wrong person. There is no charge for a reasonable request.
If you are not satisfied with how we have handled your information or your request, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.
Children
This is a business-to-business website and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information through this site, contact us and we will delete it.
Changes to this policy
We may update this policy as the site or our practices change. The revised version takes effect when posted here, and the "last updated" date at the top will change. Material changes affecting information we already hold will be brought to your attention directly where we can reasonably do so.
Contact us
Daniel LeBlanc is accountable for personal information at Work, Advised. For any privacy question, request, or complaint: