24 Carat Inc.
Website: 24caratinc.io
Effective Date: January 1, 2021
Last Updated: May 20, 2026
This Privacy Policy explains what personal information 24caratinc.io collects, how we use it, and the rights available to you. We are committed to transparency and to handling your data with care, particularly given the sensitive nature of the coaching and health-performance information you may share with us.
If you are located in the European Economic Area (EEA), United Kingdom, or Quebec, additional rights and obligations apply to you and are detailed throughout this Policy.
1. WHO WE ARE
24 Carat Inc. (“Company,” “we,” “us,” or “our”) is a boutique branding and peak performance agency operating at 24caratinc.io. We provide brand architecture, technical infrastructure development, founder performance coaching, and personal branding strategy to entrepreneurs and business leaders worldwide.
Privacy Officer / Person Responsible for the Protection of Personal Information
24 Carat Inc. has designated a Privacy Officer who is responsible for compliance with this Policy and all applicable privacy legislation, including Quebec’s Law 25.
Privacy Officer, 24 Carat Inc. Email: hello@24caratinc.io Subject line: “Privacy Rights Request” or “Privacy Inquiry” Location: Vancouver, British Columbia, Canada
We will acknowledge your request promptly and respond within 30 days. In complex cases or where permitted by law, we may extend this period by an additional 30 days and will notify you if that occurs.
2. INFORMATION WE COLLECT
We collect only information that serves a clear and legitimate purpose.
2.1 Information You Provide Directly
- Contact and inquiry data: name, email address, phone number, business name, and message content submitted via contact forms, discovery call bookings, or direct email.
- Client and coaching information: business goals, financial context, health and performance background, lifestyle information, and professional history shared during onboarding, intake forms, coaching sessions, or engagements.
- Payment information: billing name, billing address, and payment details. Full card numbers are never stored by us directly; payment processing is handled by PCI-DSS compliant third-party processors. Please verify your processor’s compliance directly with them.
- Account credentials: username and encrypted password where you create an account on our platforms.
- Communications: records of emails, messages, or other correspondence you send to us.
2.2 Information Collected Automatically
- Usage data: pages visited, time on site, clicks, navigation paths, and referring URLs.
- Device and technical data: IP address, browser type and version, operating system, device identifiers, screen resolution, and language settings.
- Cookies and tracking technologies: as described in Section 7 of this Policy.
- Advertising performance data: aggregated campaign metrics received from Meta (Facebook/Instagram) when you arrive via a paid advertisement.
2.3 Information from Third Parties
- Data from social platforms (LinkedIn, Instagram) when you interact with our content or connect your account.
- Referral data when a partner or affiliate directs you to our website.
- Publicly available professional information reviewed to prepare for a discovery call, at your request.
We do not purchase, rent, or source email lists. Every person in our database has had a direct interaction with 24 Carat Inc. or has voluntarily opted in.
3. SENSITIVE PERSONAL INFORMATION (HEALTH AND PERFORMANCE DATA)
When you engage with our coaching services, you may voluntarily share information about your health, physical performance, stress levels, energy, sleep, hormones, or related personal matters. This information may qualify as sensitive personal information under applicable law, including special category data under the GDPR, sensitive information under Quebec Law 25, and sensitive personal information under the CPRA.
We handle this category of information with the following enhanced standards:
- Explicit consent: We collect health and performance-related information only with your explicit, informed consent, separate from general service consent where required by law.
- Purpose limitation: This information is used solely to deliver the coaching or consulting service you have requested. It is not used for marketing, advertising, profiling, or to infer medical conditions.
- Right to refuse: You may decline to provide health or performance-related information. However, certain coaching services may not be fully deliverable without it. We will inform you of this at the time of collection.
- Access restriction: Health and performance data is accessible only to personnel directly delivering your service and is not shared with third parties except as strictly necessary to fulfill the service.
- Enhanced safeguards: This data is stored with additional security controls and subject to regular review to ensure it remains accurate and necessary.
- No automated profiling: We do not use health or performance data for automated decision-making or profiling of any kind.
Important disclaimer: 24 Carat Inc. is not a medical provider. Nothing shared in connection with our coaching services constitutes medical advice, diagnosis, or treatment. Health and performance information you share is used exclusively for coaching and performance optimization purposes. If you have medical concerns, please consult a qualified healthcare professional.
4. HOW WE USE YOUR INFORMATION
4.1 Service Delivery
- Providing and personalizing branding, coaching, and agency services
- Processing payments and maintaining billing records
- Delivering digital products, course materials, and resources you have purchased
- Scheduling and managing coaching calls and client engagements
- Responding to your inquiries and support requests
4.2 Marketing and Communications
- Sending newsletters and strategic content only to those who have opted in
- Running targeted advertising campaigns on Meta platforms using pseudonymized or aggregated audience data
- Notifying you of new offers, programs, or services relevant to you
4.3 Business Operations
- Improving our website, services, and content based on usage analytics
- Detecting, preventing, and addressing fraud or security incidents
- Maintaining legal and financial records as required by applicable law
- Enforcing our Terms and Conditions and other contractual agreements
We will never sell your personal data. Your information is used solely to serve you better or to comply with legal obligations.
5. LEGAL BASIS FOR PROCESSING (GDPR)
If you are located in the EEA or United Kingdom, our processing of your personal data is grounded in the following lawful bases under the GDPR:
- Contractual necessity: processing required to fulfill a service agreement, such as delivering coaching or branding services you have purchased.
- Explicit consent: for health and performance-related data, email marketing, and non-essential cookies. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
- Legitimate interests: where we have a justifiable business reason, such as fraud prevention, website security, or service improvement, provided your fundamental rights are not overridden.
- Legal obligation: where we must comply with applicable law, tax regulations, or valid court orders.
For sensitive personal information (health and performance data), our legal basis is always explicit consent under Article 9(2)(a) of the GDPR. You may withdraw this consent at any time by contacting hello@24caratinc.io.
6. SHARING AND DISCLOSURE
We do not sell, trade, or rent your personal information to any third party. We share data only in the following limited circumstances:
6.1 Service Providers
We engage trusted third-party vendors who process data on our behalf under strict data processing agreements, solely to support our operations. These include:
- Email marketing platforms (MailerLite)
- Payment processors (Stripe, PayPal, or equivalent)
- Website hosting and infrastructure providers
- Analytics platforms (Google Analytics)
- Advertising platforms (Meta Business Suite)
- Scheduling and CRM tools
- Course and funnel delivery platforms (WordPress, WooCommerce, WPFunnels)
6.2 Business Transfers
If 24 Carat Inc. is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction. You will be notified via email and/or a prominent notice on our website before your data becomes subject to a different privacy policy.
6.3 Legal Requirements
We may disclose your information if required by law or in response to valid requests by public authorities, or to protect the rights, property, or safety of 24 Carat Inc., our clients, or the public.
6.4 With Your Explicit Consent
In any other circumstance not described above, we will ask for your explicit consent before sharing your information.
7. THIRD-PARTY SERVICES
Our website and services integrate with the following key third-party platforms. Each operates under its own privacy policy, which we encourage you to review independently:
- Payment processing: Stripe (stripe.com/privacy) and PayPal (paypal.com/privacy) where applicable.
- Email marketing: MailerLite (mailerlite.com/legal/privacy-policy).
- Analytics: Google Analytics (policies.google.com/privacy). We use IP anonymization. You may opt out via tools.google.com/dlpage/gaoptout.
- Advertising: Meta Business Suite (facebook.com/privacy/policy). We may use the Meta Pixel and Custom Audiences using pseudonymized or aggregated data. Manage your ad preferences at facebook.com/settings/ads.
- Infrastructure: WordPress with WooCommerce and WPFunnels, hosted on secured, encrypted servers.
Third-party websites linked from our site are governed by their own privacy policies. We are not responsible for their data practices.
8. COOKIES AND TRACKING TECHNOLOGIES
8.1 Types of Cookies We Use
- Strictly necessary cookies: essential for the website to function. Cannot be disabled without affecting site functionality.
- Analytics cookies: help us understand how visitors interact with our site. Data is aggregated where possible.
- Marketing and advertising cookies: used to deliver relevant advertisements and measure campaign performance. Includes the Meta Pixel and Google Ads tags.
- Preference cookies: remember your settings to improve your browsing experience.
8.2 Your Consent and Cookie Choices
In compliance with GDPR, the UK ePrivacy Regulations, and Quebec Law 25, non-essential cookies are only activated after you provide explicit opt-in consent through our cookie consent banner. We do not assume consent from continued browsing. Strictly necessary cookies operate without consent as they are required for the site to function.
You may manage or withdraw cookie consent at any time through:
- Our cookie preference center (accessible via the banner or footer on our website)
- Your browser settings
- Google Analytics Opt-Out Add-on at tools.google.com/dlpage/gaoptout
- Meta ad preferences at facebook.com/settings/ads
We do not currently respond to Do Not Track (DNT) browser signals, as no consistent industry standard exists for interpreting them. You may use the opt-out tools listed above to limit tracking.
9. DATA RETENTION
We retain your personal information only as long as necessary for the purposes outlined in this Policy or as required by applicable law:
- Client and service records: 7 years post-engagement to meet legal, tax, and accounting obligations.
- Email marketing subscribers: retained while active. Suppressed upon unsubscription and purged within 12 months.
- Inquiry and contact form data: 2 years after your last interaction, then securely deleted.
- Website analytics data: up to 26 months in aggregated form.
- Payment records: minimum 7 years as required by financial regulations.
- Health and performance coaching data: retained for the active duration of your coaching engagement plus 2 years, unless you request earlier deletion.
When data is no longer required, it is securely deleted or anonymized so it can no longer be associated with you.
10. SECURITY
We implement industry-standard technical and organizational measures to protect your personal information, including:
- SSL/TLS encryption for all data in transit (HTTPS enforced site-wide)
- Encrypted storage for sensitive data at rest
- Role-based access controls limiting access to authorized personnel only
- Regular security reviews and software updates
- PCI-DSS compliant payment processing through third-party processors
- Two-factor authentication on administrative accounts
10.1 Data Breach Notification
In the event of a data breach likely to result in risk to your rights and freedoms, we will:
- Notify the relevant supervisory authority within 72 hours of becoming aware, where required under GDPR, PIPEDA mandatory breach reporting requirements, or Quebec Law 25.
- Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
- Maintain an internal record of all data breaches, regardless of whether notification is required.
No method of data transmission over the internet is 100% secure. If you suspect a security incident involving your data, contact us immediately at hello@24caratinc.io.
11. YOUR RIGHTS
Depending on your location, you have the following rights regarding your personal data:
- Right to access: request a copy of the personal data we hold about you.
- Right to rectification: request correction of inaccurate or incomplete data.
- Right to erasure: request deletion of your data, subject to legal retention requirements.
- Right to restriction: request that we limit processing in certain circumstances. (EEA/UK)
- Right to data portability: receive your data in a structured, machine-readable format. (EEA/UK)
- Right to object: object to processing based on legitimate interests or for direct marketing. (EEA/UK)
- Right to withdraw consent: withdraw any previously given consent at any time, including consent to process sensitive data.
- Right to lodge a complaint: contact your local supervisory authority (ICO in the UK, CNIL in France, OPC in Canada).
To exercise any right, contact our Privacy Officer at hello@24caratinc.io with the subject line “Privacy Rights Request.” We will not discriminate against you for exercising your rights.
11.1 Automated Decision-Making
We do not engage in automated decision-making or profiling that produces legal effects or similarly significant impacts on you. All significant decisions regarding your engagement with our services involve human review.
12. CHILDREN’S PRIVACY
Our website and services are directed exclusively at adults. We do not knowingly collect personal information from anyone under the age of 16 (or 18 where that is the applicable age of majority). If you believe your child has provided us with personal information without your consent, contact us at hello@24caratinc.io and we will promptly delete it upon verification.
13. INTERNATIONAL DATA TRANSFERS
24 Carat Inc. operates primarily from Canada. Our service providers may process your data in jurisdictions outside your home country, including the United States, where data protection laws may differ from those where you reside.
For transfers outside the EEA or UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, or Binding Corporate Rules where applicable.
For Quebec residents: when we transfer your personal information outside Quebec, including to the United States via services such as Stripe, Google, and Meta, we conduct a privacy impact assessment to evaluate the level of protection afforded to your data in the destination jurisdiction, taking into account the sensitivity of the information, the purpose of the transfer, the applicable legal framework, and the contractual safeguards in place. You may request information about these measures by contacting our Privacy Officer.
14. CALIFORNIA RESIDENTS (CCPA / CPRA)
If you are a California resident, you have the following rights:
- Right to know: request disclosure of categories and specific pieces of personal information collected, the sources, purposes, and who it is shared with.
- Right to delete: request deletion of personal information, subject to certain exceptions.
- Right to correct: request correction of inaccurate personal information.
- Right to opt-out of sale or sharing: we do not sell or share personal information for cross-context behavioral advertising. No action is required from you.
- Right to limit use of sensitive personal information: we use sensitive personal information only to deliver the services you have requested, not for inferring characteristics, advertising, or profiling.
- Right to non-discrimination: we will not discriminate against you for exercising any CCPA/CPRA rights.
To submit a verifiable consumer request, contact us at hello@24caratinc.io with “CCPA Request” in the subject line.
15. CANADIAN PRIVACY (PIPEDA AND QUEBEC LAW 25)
As a Canadian-based company, we comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation, including Quebec’s Act respecting the protection of personal information in the private sector (Law 25).
Under PIPEDA and Quebec Law 25, you have the right to:
- Access the personal information we hold about you
- Challenge the accuracy and completeness of your information and have it corrected
- Withdraw consent for non-essential processing with reasonable notice
- Be informed of our privacy practices in plain language
- Know the identity of third parties with whom your data has been shared
- Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca
Quebec residents have additional rights, including the right to request human review of any automated decision and enhanced data portability rights. We comply with these requirements in full.
Note on the Consumer Privacy Protection Act (CPPA): Canada’s CPPA is anticipated to replace PIPEDA for private-sector organizations when proclaimed in force. We will update this Policy to reflect its requirements upon enactment.
16. POLICY CHANGES
We reserve the right to update this Privacy Policy at any time. When we do:
- The “Last Updated” date at the top of this page will be revised.
- For material changes affecting how we handle your data, we will notify active subscribers by email and/or place a prominent notice on our website at least 14 days before the change takes effect.
- Your continued use of our website or services after a change takes effect constitutes your acceptance of the revised Policy.
17. CONTACT US
Privacy Officer 24 Carat Inc. Email: hello@24caratinc.io Website: 24caratinc.io Location: Vancouver, British Columbia, Canada Subject line: “Privacy Rights Request” or “Privacy Inquiry” Response time: Within 30 days; extensions may apply in complex cases as permitted by law.
If you are located in the EEA or UK and have an unresolved concern, you have the right to contact your local supervisory authority. In the UK: ico.org.uk. In Canada: priv.gc.ca.
Legal disclaimer: This Privacy Policy is intended to be comprehensive and accurate but does not constitute legal advice. For jurisdiction-specific legal concerns, we recommend consulting a qualified privacy lawyer.