Privacy Policy
Version 2026.11 · Effective October 10, 2026
Privacy contact: privacy@mk-way.com
Website: https://mk-way.com/privacy-policy/
Mike Kwal Digital Inc. operating as MK-Way ("MK-Way", "we", "us" or "our") respects the privacy of people who visit our sites, inquire about or purchase our services, sign our proposals, subscribe to updates, or communicate with us. This Privacy Policy describes our collection, use, disclosure, protection, retention and international transfer of personal information, and explains available privacy choices and rights.
This Policy covers our business websites, including mk-way.com and proposals.mk-way.com, our electronic proposal and sign-off service, customer communications, and our own customer relationship and marketing activities. It does not replace a separate privacy notice for a product with materially different data practices or a Data Processing Agreement ("DPA") governing personal data we process for a client as a service provider.
1.Who We Are and How to Reach Us
The organization responsible for personal information collected for its own business purposes is:
Mike Kwal Digital Inc. operating as MK-Way
171 Queens Avenue, Unit 501, London, Ontario, Canada
Person responsible for privacy: Mike Kwal, CEO
Privacy inquiries: privacy@mk-way.com
Website: https://mk-way.com
MK-Way is ordinarily the organization controlling its own website, sales, proposal, contract, billing and business-contact data. When we handle personal information solely on behalf of a client to deliver that client's website, automation or other contracted service, our role may instead be that of a service provider or processor and the client's privacy notice and applicable DPA may govern that processing.
If applicable law requires an EU or UK representative, MK-Way will identify that representative and provide the required contact information in this Policy or an accessible supplementary notice before the relevant processing begins.
2.The Information We Collect
We collect only information reasonably relevant to the purposes described below, which may include:
2.1 Contact and business identity data. Name, company name, business email, phone number, job title, business address, country, professional role, and information submitted through a form, email, meeting or project inquiry.
2.2 Proposals, contracts and signatures. The signer's typed name, company, position or signing authority if supplied, drawn signature image, initials, acceptance checkboxes, exact accepted agreement and incorporated Terms version, signed-copy or receipt identifiers, payment references, server and device timestamps, IP address, approximate city/country inferred from IP, browser and device metadata, and a document integrity hash or similar verification record. A signature is personal information; a signature image is not automatically treated as biometric-identification data unless actually processed for biometric identification.
2.3 Service and project information. Client instructions, supplied logos and files, website content, documents, feedback, approvals, design and engineering notes, user credentials or access tokens provided for a project, and records of our work and handover. Client-controlled personal data within a project may be covered by a separate DPA.
2.4 Payment and accounting information. Transaction amount, currency, paid/unpaid status, invoice details, billing contact and address, transaction reference, payment method type, masked card information made available by our processor, tax information where required, and refund or dispute information. Card payments are processed by Stripe; we do not ordinarily receive or store full card numbers or security codes in our proposal service.
2.5 Technical and website data. IP address, approximate location, device and browser type, referral source, visited pages, event and error logs, security and fraud-prevention signals, and cookie or similar identifiers where used. Particular analytics and marketing tools depend on current site configuration and your choices.
2.6 Communications and marketing data. Emails, form messages, subscription preferences, consent records, client-support communications, and meeting recordings or transcripts when a recording has been lawfully made with appropriate notice and consent where required.
We do not intentionally ask website visitors to supply sensitive personal information unless it is specifically needed for an agreed service with appropriate safeguards. If you send us unnecessary sensitive information, contact us so that we can address it appropriately.
3.How We Collect Information
We collect information directly from you when you contact us, complete a form, sign a proposal, pay an invoice, submit project materials, or communicate with our team. We also collect limited information automatically from our websites and security systems. We may receive business contact details from an organization you represent, a referral, a public professional source, or an authorized business partner where lawfully permitted. Our providers may return transaction, delivery, security or analytics information needed to operate the services.
4.Why We Use Information and Applicable Legal Bases
We use personal information for the following purposes, and where EU or UK GDPR applies we rely on the legal bases identified below as appropriate to the person and processing activity:
| Purpose | Examples | Potential EU/UK GDPR basis |
|---|---|---|
| Handle inquiries and business relationships | Reply to requests, develop quotes, communicate with representatives | Legitimate interests; contract steps where the individual is personally a contracting party |
| Enter and administer agreements | Capture signatures, accept Terms, schedule delivery, approve work | Contract necessity when applicable; otherwise legitimate interests in contracting with represented organizations |
| Preserve commercial evidence | Maintain signed copies, audit events, delivery proof, defend claims and payment disputes | Legitimate interests in prevention of fraud and establishment/defence of legal claims; legal obligation where required |
| Provide contracted services | Collaborate with clients, deliver outputs and support | Contract necessity where applicable; otherwise legitimate interests or applicable client DPA instructions |
| Process payments and keep books | Stripe payments, refunds, invoices, tax documentation | Contract necessity where applicable; legal obligations; legitimate interests for billing and fraud prevention |
| Secure systems | Detect abuse, investigate incidents, protect access | Legitimate interests in security and fraud prevention; legal obligations where applicable |
| Improve websites and services | Troubleshooting, essential operational analytics | Legitimate interests where lawful; consent for nonessential cookies or trackers where required |
| Send promotions or marketing | Newsletters, retargeting, advertising audiences | Consent where required; otherwise an applicable legitimate interest or other permitted basis subject to marketing laws |
| Comply with law | Regulatory inquiries, lawful requests, records obligations | Legal obligation; establishment/defence of legal claims |
Where consent is the basis for processing, you can withdraw it prospectively through the mechanism supplied or by contacting us. Withdrawal does not invalidate earlier lawful processing. Where legitimate interests are used, we consider the necessity of the activity and the rights of affected individuals, and recognize applicable objection rights.
5.Electronic Proposals and Signing Records
When you electronically sign or accept a proposal, we create a record intended to show what was presented and accepted, who provided the signature, the date and time, the terms and selections accepted, and the document's integrity. Our system may collect the information described in Section 2.2, including signature image, initials, IP address, device information and approximate location. We use it to administer the agreement, deliver signed copies, deter fraudulent execution, prove contractual acceptance, meet record-keeping obligations and respond to disputes.
Proposal pages and sign-off processing use Cloudflare services. Signed files and sign-off metadata are stored in private Cloudflare storage and in Google Drive under restricted business access. An internal Slack notification may contain the signer's name, relevant offer, price, general location and links or references to the record. Stripe handles payment and may receive an associated sign-off receipt identifier to link the accepted proposal to the transaction.
A signed-copy link may be accessible to a person who possesses that link. Do not forward it to anyone who should not see the proposal. We aim to use appropriate access restrictions and may revoke or replace links where necessary. A link being excluded from search engines does not, by itself, prevent an unauthorized recipient of the link from accessing the file.
If the Client identifies an error in the signed agreement, we preserve the original record and document an amendment rather than altering the executed record without an audit trail.
6.How We Share Personal Information
We disclose personal information only as reasonably necessary for the purposes described here, as instructed by a client in a processing role, or as required or permitted by law. Recipient categories may include:
- Cloudflare: website hosting, proposal/sign-off infrastructure, security and private object storage.
- Google Workspace and Google Drive: business email, collaboration and retention of signed agreements and supporting files.
- Stripe: payment processing, payment records, refunds, fraud screening and transaction disputes.
- Slack: limited internal notifications and business collaboration.
- Analytics and advertising providers: Google Analytics, the Meta pixel, Microsoft Clarity, LinkedIn Insight and Microsoft Bing, on mk-way.com only, used under applicable consent and privacy rules.
- Other delivery providers: authorized staff, independent contractors, cloud or AI providers, hosting platforms, financial advisers, professional counsel and other service providers reasonably involved in the contracted work, under suitable access and confidentiality arrangements.
We do not sell personal information for money. Certain advertising disclosures may be treated as a "sale" or "sharing" under particular US state privacy laws even without payment; where such laws apply, we provide the legally required notices, options and rights.
We may disclose information to comply with valid legal process, protect our rights, investigate suspected fraud or safety incidents, and in connection with a legitimate business reorganization or acquisition subject to applicable law. We do not provide mobile-message opt-in or consent records to third parties for those third parties' own promotional campaigns.
7.Cookies, Analytics and Advertising
Cookies and similar technologies can be used to maintain site functionality, understand performance, prevent abuse and, where enabled, measure campaigns or deliver advertising. The following categories may apply:
- Necessary technologies: security, load balancing, essential session state, fraud prevention and maintaining choices needed to operate the service.
- Analytics technologies: measuring website use and diagnosing experience issues, where enabled.
- Advertising and remarketing technologies: helping measure campaigns or tailor ads, where enabled.
Where law requires prior consent for nonessential cookies or similar technologies, we will not activate them before obtaining the required consent. Refusing optional cookies will not prevent access to ordinary site content, although certain optional features may work differently.
Browser settings may offer additional cookie controls. Browser-level "Do Not Track" signals do not necessarily operate as a universal legally sufficient opt-out, and MK-Way will honor legally required opt-out preference signals where applicable and technically required. Analytics and advertising vendors may separately process information under their own policies.
We will maintain and, where required, disclose an up-to-date cookie inventory reflecting tools actually installed on mk-way.com and proposals.mk-way.com. We do not claim that a particular Meta or Google advertising feature is active unless it has been verified.
8.Marketing Communications
We may send service communications needed to administer a relationship, and marketing messages where permitted by applicable law. Depending on location, requirements may include Canada's CASL, US CAN-SPAM and relevant EU/UK electronic-marketing and privacy rules. Where consent is needed, we will obtain it and retain appropriate evidence. Marketing messages will identify the sender and provide a functioning unsubscribe method where required. Opting out of marketing does not stop necessary contractual, transactional, security or legal notices.
9.International Processing and Transfers
MK-Way operates in Canada and works with service providers that may process information in Canada, the United States and other countries in which they or their approved subprocessors operate. Data protection laws in those locations may differ from those in your location.
Where EU or UK GDPR applies to a restricted international transfer, MK-Way will use an available lawful transfer mechanism, such as an applicable adequacy decision, a relevant Data Privacy Framework certification where valid for the specific recipient and transfer, or suitable standard contractual clauses and supplementary measures where required. Canada's EU adequacy position does not automatically authorize onward transfers by every vendor. We will provide further information about applicable transfer safeguards on request where the law requires.
10.Retention and Deletion
We retain personal information no longer than necessary for its purposes, taking account of legal accounting requirements, limitation periods, active client obligations, reasonably anticipated disputes, legal holds and security needs. We apply different retention schedules to different record categories rather than keeping all records indefinitely.
| Category | Retention approach |
|---|---|
| Executed agreements and supporting acceptance evidence | Ordinarily up to seven years after the engagement ends, or longer when legally required or subject to a documented hold; financial records must also satisfy applicable tax-year retention requirements. |
| Invoices, tax and payment accounting records | Normally at least six years from the end of the last tax year to which they relate, and longer where law requires. |
| Short-lived security and raw technical logs | Kept for up to 90 days, then deleted or de-identified, unless needed for a documented incident or claim. |
| Ordinary inquiries and communications | Kept for up to 24 months after the last contact, then deleted, archived or anonymized. |
| Marketing records | Until lawful unsubscribe, deletion or cessation of the relevant purpose, subject to retaining a minimal suppression/consent record where needed to respect choices. |
| Client project information | The applicable Agreement, DPA, lawful instructions and necessary retention or legal-hold obligations determine return and deletion. |
Deletion from active systems may be followed by later expiry of backup copies under a documented backup cycle, subject to lawful exceptions. We may preserve minimal necessary evidence of a suppression request, fraud investigation or legal claim without using it for incompatible new purposes.
11.Information Security and Access
We take reasonable organizational and technical steps appropriate to the information held, including limiting staff access, using reputable infrastructure providers, controlling authorized access to client workspaces, and evaluating security issues. No Internet-based service or transmission can be guaranteed completely secure. Please notify us if you believe a signed-copy link, account or shared project credential has been disclosed to the wrong person.
We assess and respond to suspected personal-information incidents and provide notifications to clients, affected individuals and authorities when required by applicable law. Our legal duties depend on our role as controller or service provider, the applicable jurisdiction and the nature of the incident.
12.Your Rights and Choices
Subject to applicable law and exceptions, you may have the right to request access to personal information about you, correct inaccurate information, withdraw consent, object to certain processing, request deletion or restriction, or request portability of certain data. If EU or UK GDPR applies, you may also have rights to object to marketing and certain legitimate-interest processing, and to complain to your supervisory authority. Rights vary by jurisdiction and are not unlimited.
To make a request, email privacy@mk-way.com with "Privacy Request" in the subject line. We may verify your identity or authority before disclosing or changing records. We respond within the time required by applicable law and explain any lawful limitation on a request. A request to delete a signed contract will not necessarily require us to erase evidence we must legally retain to establish contractual rights or comply with accounting law.
You may withdraw marketing consent by using the unsubscribe link in a message. Where a working cookie-preferences tool is offered, use it to change optional tracking choices. We do not discriminate against people for exercising privacy rights in circumstances where nondiscrimination protections apply.
13.Special Notices for Canada, the EEA, UK and United States
Canada. MK-Way's commercial data practices are governed by PIPEDA and applicable provincial private-sector privacy requirements where those laws apply. Certain Canadian laws provide rights and obligations concerning access, consent, accountability, privacy-impact assessments, cross-border processing and breach records or notices. You may contact MK-Way or, where appropriate, the Office of the Privacy Commissioner of Canada or a relevant provincial privacy regulator.
European Economic Area. Where EU GDPR applies, you may exercise applicable GDPR rights and complain to a supervisory authority in the EEA state of your habitual residence, work or the alleged infringement. Our processing purposes, lawful bases, recipients, retention and transfer information are described above. Whether an Article 27 EU representative must be appointed depends on our activities and relevant exceptions; if required, the representative's contact details will be supplied before relevant processing.
United Kingdom. Where UK GDPR applies, corresponding rights and the UK international-transfer rules apply. You may raise a complaint with the Information Commissioner's Office (ICO). UK representative requirements, where applicable, will be met and the contact details supplied.
United States. State privacy rights depend on the individual's location, the nature of processing and whether the business meets the statute's applicability thresholds. Where applicable, MK-Way will provide access, deletion, correction, appeal, targeted-advertising opt-out or other required rights. We do not assert that a single state statute applies to every transaction or that all US privacy laws create identical rights.
14.Children
Our business services and proposal system are intended for adults acting on their own behalf or on behalf of organizations and are not directed to children under 16. We do not knowingly collect personal information from children for independent marketing. If you believe a child supplied information to us improperly, please contact us so we can investigate and take legally appropriate action.
15.Links and Third-Party Services
Our sites may link to independent websites and services such as Shopify, Stripe or social media platforms. Once you use a separate service in your own capacity, its privacy terms may apply. This Policy does not imply MK-Way controls an independent site's processing. When a provider processes information for MK-Way, our responsibilities under applicable law remain as described above.
16.Changes to This Policy
We may revise this Policy to reflect changes in our services, legal requirements or verified data practices. We will update the publication date and provide additional notice or seek consent when required by law. Revisions will not retroactively make processing lawful where notice or consent was required at the time of collection. An accessible copy of the then-current Policy will remain available.
17.Contact and Complaints
Mike Kwal Digital Inc. o/a MK-Way
171 Queens Avenue, Unit 501, London, Ontario, Canada
Privacy inquiries: privacy@mk-way.com
Please contact us first if you would like a copy of information we hold, need help with your privacy choices, or wish to raise a privacy complaint. You may also complain to the privacy regulator with jurisdiction over your concern where applicable.
Version 2026.11. Effective October 10, 2026.