MiRA Timber Privacy Policy

Effective Date: Oct 2026

MiRA Timber Frame respects your privacy. This Policy explains what personal information we collect when you visit miratimberframe.com, request a quote, work with us on a timber frame project, or otherwise deal with our business — why we collect it, who we share it with, how we protect it, and the rights you have over it.

We handle personal information in accordance with the privacy laws that apply to us in each place we do business. In Canada, these are the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta’s Personal Information Protection Act (PIPA) and Canada’s Anti-Spam Legislation (CASL). When we deal with individuals in the United Kingdom or Europe, we also apply the UK General Data Protection Regulation and Data Protection Act 2018 (together, the UK GDPR), the UK Privacy and Electronic Communications Regulations (PECR) and the EU General Data Protection Regulation (GDPR). When we deal with individuals elsewhere in North America, we comply with the applicable United States federal and state privacy and anti-spam laws, including the CAN-SPAM Act, and with Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties.

1. Who we are

MiRA Timber Frame is a family-owned timber frame design and manufacturing business established in 1998, operating from a design and manufacturing facility in Stony Plain, Alberta. We serve clients locally, across Canada, and internationally — throughout North America, including Alaska and the rest of the United States, and in the United Kingdom and Europe.

In this Policy, “we”, “us”, “our” and “MiRA Timber Frame” refer to MiRA Timber Frame. “You” means any individual whose personal information we handle — a website visitor, a prospective client, a client, a supplier or trade contact, or a job applicant.

For the purposes of the UK GDPR and the GDPR, MiRA Timber Frame is the “controller” of the personal information described in this Policy.

“Personal information” means information about an identifiable individual. It includes what the UK GDPR and GDPR call “personal data” and what United States and Mexican privacy laws call “personal information” or “personal data”; in this Policy we use “personal information” for all of them.

Under PIPEDA and Alberta PIPA, business contact information — your name, title, business address, business phone number or business email — is exempt where we collect, use or disclose it solely to communicate with you about your work. That exemption does not apply in the United Kingdom or Europe, where business contact details are personal data, so we protect them in the same way as any other personal information.

2. What this Policy covers

This Policy applies to personal information we collect:

• through our website at miratimberframe.com, including our contact form;
• by phone, email, text, or in person at our facility or on a job site;
• through design consultations, quotes, contracts, and project delivery;
• through our social media pages on Facebook, Instagram, YouTube, LinkedIn and Pinterest; and
• through recruitment and hiring.

It does not apply to the privacy practices of any third-party website or platform we link to. See Section 18.

3. Accountability — our Privacy Officer

MiRA Timber Frame is responsible for the personal information under our control, including information we transfer to a third party for processing on our behalf. We have designated a Privacy Officer who is accountable for our compliance with this Policy and with applicable privacy law.

You can reach our Privacy Officer at: 

Email: sales@miratimberframe.com

MiRA Timber Frame

11 Legend Trail, North Business Park, Stony Plain, Alberta  T7Z 0B1

Phone: 780-968-0330  |  Toll free: 1-888-968-0330

4. The personal information we collect

4.1  Information you give us

We only collect what we need. Depending on how you interact with us, that may include:

Please do not send us sensitive personal information — such as government identification numbers, banking credentials, or health information — through the website contact form or by unencrypted email. If we ever need information of that kind, we will ask for it through a secure channel and tell you why.

4.2  Information collected automatically when you visit our website

Our website runs on WordPress and uses Google Analytics (via the MonsterInsights plugin) and Jetpack-hosted image and media delivery. When you visit, the following may be collected automatically:

• Device and connection data — IP address (which may be truncated or anonymized by our analytics settings), browser type and version, operating system, device type, screen size, and language.
• Usage data — pages viewed, the plans and projects you looked at, time on page, scroll depth, the link or search that brought you to us, outbound link clicks, file downloads, and video plays.
• Cookies and similar technologies — small files stored on your device. See Section 10.

We use this information in aggregate to understand which pages and timber frame plans people find useful, to fix problems, to keep the site secure, and to measure our marketing. We do not use it to try to identify you personally.

4.3  Information from other sources

We may also receive personal information about you from:

• your architect, designer, builder, general contractor or engineer, where they are coordinating a project with us on your behalf;
• a family member or co-owner who is dealing with us about a shared property;
• referral sources, trade shows, home shows and industry events;
• publicly available sources, such as land title or municipal records, where necessary for a project; and
• our service providers, such as our analytics and email tools.

Where someone gives us your personal information, we expect them to have the authority to do so.

5. Why we collect, use and disclose personal information

PIPEDA and Alberta PIPA require us to identify the purposes for which we collect personal information at or before the time we collect it. The UK GDPR and GDPR also require us to have a lawful basis for each purpose (see Section 5.1). We collect, use and disclose personal information only for the following purposes:

• to respond to your enquiry, quote request or consultation request;
• to prepare designs, drawings, estimates, proposals and contracts;
• to manufacture, ship, deliver, install and raise your timber frame, and to coordinate with your builder, trades and site personnel;
• to schedule site visits, deliveries and crane or raising crews, and to arrange cross-border shipping and customs clearance where a project is outside Canada;
• to invoice you, process payment, and manage our accounts;
• to provide warranty support, service and after-sales assistance;
• to keep records of our projects, and — with your permission — to photograph completed projects for our portfolio, website, social media and award submissions;
• to send you information about our plans, services and events, where you have consented or where the law otherwise allows;
• to operate, secure, maintain and improve our website and our business;
• to assess job applications and to manage our employment relationships; and
• to meet our legal, regulatory, tax, insurance, safety and contractual obligations.

If we ever want to use your personal information for a new purpose that is not listed here, we will identify that purpose and obtain your consent before doing so, unless the law permits or requires otherwise.

5.1  Our lawful bases (United Kingdom and Europe)

If you are in the United Kingdom or the European Economic Area (EEA), we rely on the following lawful bases under the UK GDPR and GDPR:

• Contract — to respond to your quote or consultation request at your request, and to design, manufacture, deliver, install and support your timber frame under our agreement with you.
• Legitimate interests — to operate, secure and improve our website and business, coordinate with your project team, keep project records, and market to existing clients where the law allows. We balance these interests against your rights, and you can object at any time.
• Consent — for marketing emails where consent is required, for preference and analytics cookies, and for using photographs of your project in our promotional material. You can withdraw consent at any time.
• Legal obligation — to meet our tax, accounting, customs, health and safety and other legal requirements.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

6. Consent

We collect, use and disclose your personal information with your knowledge and consent, except where the law permits or requires us to act without it. In the United Kingdom and Europe, consent is one of several lawful bases we rely on (see Section 5.1); where we rely on it, we make sure it is freely given, specific, informed and unambiguous.

• Express consent — you tell us directly, in writing, verbally or by ticking a box. We ask for express consent for things such as marketing emails and using photographs of your project in our promotional material.
• Implied consent — we may infer consent where the purpose is obvious and you voluntarily provide the information. For example, if you fill in our contact form asking about a plan, you are consenting to us using your contact details to respond.

We do not require you to consent to the collection, use or disclosure of personal information beyond what is reasonably necessary to provide a product or service, and we will not refuse to deal with you for declining an optional use such as marketing.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Contact our Privacy Officer using the details in Section 3 or Section 21. We will explain the consequences of withdrawal — for example, if you withdraw consent to us using your contact information, we may no longer be able to design, manufacture or deliver your project, or to provide warranty support.

7. Limiting collection

We limit the personal information we collect to what a reasonable person would consider appropriate in the circumstances, and to what is necessary for the purposes set out in Section 5. We collect information by fair and lawful means, and we do not mislead or deceive anyone about the reason for collecting it.

8. How we share personal information

We do not sell, rent or trade your personal information. We may share it in the following circumstances:

We use contractual and other means to require our service providers to protect your personal information to a standard comparable to our own, to use it only for the purposes we specify, and to return or destroy it when it is no longer needed. Where the UK GDPR or GDPR applies, our service providers act as processors under written agreements that meet those laws’ requirements.

9. Where your personal information is stored and processed, and international transfers

We are based in Stony Plain, Alberta, and our records are principally held in Canada. However, some of our service providers — including website hosting, analytics, email and cloud storage providers — store or process personal information outside Canada, including in the United States. Where a project is located elsewhere in North America, in the United Kingdom or in Europe, we may also share limited information with carriers, customs brokers and installers in that country.

While personal information is outside Canada, it is subject to the laws of the country where it is held, and courts, law-enforcement and national-security authorities in that country may be entitled to obtain access to it under those laws. Alberta PIPA requires us to tell you this, and to tell you how to reach someone who can answer questions about it. You can contact our Privacy Officer at the address in Section 3 with any questions about our use of service providers outside Canada and the policies and practices we apply to that information.

Transfers from the United Kingdom and Europe

If you are in the United Kingdom or the EEA, your personal information will be transferred to us in Canada. The European Commission and the UK government both recognise Canada as providing an adequate level of protection for personal information handled by commercial organisations subject to PIPEDA. Where your information is transferred onward to a country without that recognition — for example, to service providers in the United States — we rely on an appropriate safeguard, such as the provider’s certification under the EU-U.S. Data Privacy Framework and its UK Extension, the European Commission’s Standard Contractual Clauses, or the UK International Data Transfer Agreement or Addendum. You can ask our Privacy Officer for more information about these safeguards.

10. Cookies, analytics and online tracking

Cookies are small text files placed on your device by a website. We use them to make the site work properly, remember your preferences, and understand how the site is used.

• Strictly necessary cookies — required for the site to function, including security and load balancing. These cannot be switched off.
• Preference cookies — remember choices such as language or previously viewed plans.
• Analytics cookies — set by Google Analytics to measure page views, traffic sources and site performance in aggregate.

You can control cookies through your browser settings — most browsers let you refuse new cookies, delete existing ones, or warn you before one is set. Blocking cookies may affect how parts of our website work.

If you visit from the United Kingdom or Europe, we will ask for your consent before placing preference or analytics cookies on your device, and you can change your choice at any time through our cookie settings. Strictly necessary cookies do not require consent.

We do not sell your personal information, and we do not share it for targeted or cross-context behavioural advertising, as those terms are defined in United States state privacy laws. If that changes, we will update this Policy, provide the opt-outs those laws require, and honour opt-out preference signals such as Global Privacy Control.

To opt out of Google Analytics specifically, you can install Google’s browser add-on at tools.google.com/dlpage/gaoptout. You can review Google’s privacy practices at policies.google.com/privacy.

Our website does not currently respond to “Do Not Track” browser signals, as no common standard for them has been adopted.

Note: if we add advertising or remarketing pixels — for example Meta Pixel, Google Ads conversion tracking or LinkedIn Insight Tag — this section must be updated to disclose them and the opt-outs that go with them. See Appendix A.

11. Marketing emails and anti-spam laws

We follow the anti-spam law of the country you are in. Canada’s Anti-Spam Legislation (CASL) governs commercial electronic messages sent to Canadian recipients; we send them only where we have your express consent, or where we can rely on implied consent — for example, because you are an existing client, or you have made an enquiry about our products or services within the timeframes CASL allows. In the United Kingdom and Europe, we send marketing emails only with your consent or, for existing clients, about similar products and services with a chance to opt out in every message, as PECR and the EU ePrivacy rules allow. In the United States, our messages comply with the CAN-SPAM Act.

Every commercial electronic message we send will:

• identify MiRA Timber Frame as the sender;
• include our mailing address and a working phone number or email address; and
• include a clear, working unsubscribe mechanism that takes effect within 10 business days.

You can unsubscribe at any time using the link in any marketing email, or by emailing sales@miratimberframe.com. Unsubscribing from marketing does not stop transactional or project-related messages, such as quotes, drawings, delivery schedules and invoices.

12. How we protect your personal information

We protect personal information with safeguards appropriate to its sensitivity. These include:

• Physical — controlled access to our Stony Plain office and manufacturing facility, and secured storage for paper files such as contracts and drawings.
• Technical — encryption in transit on our website (HTTPS), firewalls and up-to-date software, access controls and unique user accounts, strong password requirements, multi-factor authentication where available, and regular backups.
• Administrative — limiting access to personal information to staff who need it to do their jobs, confidentiality expectations for employees and contractors, privacy and security awareness for our team, and secure destruction of records at the end of their retention period.

No method of transmission or storage is completely secure. While we take our obligations seriously, we cannot guarantee absolute security, and information you send us by ordinary email travels over the open internet at your own risk.

13. Privacy breaches

We maintain procedures to contain, investigate and record any breach of security safeguards involving personal information.

• Under PIPEDA, where a breach creates a real risk of significant harm to an individual, we will report it to the Privacy Commissioner of Canada, notify the affected individuals as soon as feasible, and keep a record of the breach.
• Under Alberta PIPA, where a reasonable person would consider that a real risk of significant harm exists, we will notify the Information and Privacy Commissioner of Alberta without unreasonable delay and notify affected individuals as directed by the Commissioner.
• Under the UK GDPR and GDPR, where a breach is likely to result in a risk to individuals’ rights and freedoms, we will report it to the relevant data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it, and we will notify affected individuals without undue delay where the risk is high.
• In the United States and Mexico, we will notify affected individuals and any regulators as required by the applicable federal, state or national breach-notification laws.

We will also notify our clients, service providers or other partners where a breach affects information they entrusted to us.

14. Accuracy

We keep personal information as accurate, complete and up to date as is necessary for the purposes for which it is used. Accuracy matters in our work — an out-of-date delivery address, site contact or set of dimensions can affect a build. Please tell us promptly if your contact or project details change.

15. How long we keep personal information

We keep personal information only as long as necessary to fulfil the purposes it was collected for, and to meet our legal, tax, insurance, warranty and contractual obligations. In general:

When personal information is no longer needed, we destroy, erase or anonymize it securely. Where we have used your information to make a decision about you, we will retain it for at least one year after that decision so that you have a reasonable opportunity to request access to it.

16. Your right to access and correct your information

On written request, you have the right to:

• be told whether we hold personal information about you;
• be given access to that information;
• be told how it has been used and to whom it has been disclosed; and
• challenge its accuracy and completeness and have it corrected where appropriate.

To make a request, write to our Privacy Officer using the details in Section 21. Please give us enough detail to locate the information you are asking for. We may ask you for identification to confirm who you are before releasing anything. If you are in the United States, Mexico, the United Kingdom or Europe, you have additional rights, set out in Section 19.

What to expect

• Timing — we will respond within 30 days. If we need more time, we will tell you within that 30 days, explain why, and give you a new date. Alberta PIPA allows an extension of up to a further 30 days in defined circumstances. Where a different law applies to you, we will meet the timeframe it sets — for example, one month under the UK GDPR and GDPR, 45 days under most United States state privacy laws, or 20 business days under Mexican law.
• Cost — access to your own personal information is generally free. If a request requires substantial copying or production, we will give you a written estimate of any fee in advance and you can decide whether to proceed.
• Corrections — if we agree information is wrong, we will correct it and, where appropriate, notify third parties who have the incorrect version. If we disagree, we will record your objection alongside the information and, where appropriate, pass that annotation on.

In limited circumstances the law requires or permits us to refuse access — for example where disclosure would reveal personal information about another individual, would breach solicitor-client privilege, contains confidential commercial information, or was generated in a formal dispute-resolution process. If we refuse, we will tell you in writing, explain the reason and the provision relied on, and tell you how to complain.

17. Children

Our website and services are directed to adults. We do not knowingly collect personal information from children — including children under 13 in the United States, or under the age of digital consent in the United Kingdom (13) or the EEA (13 to 16, depending on the country). If you believe a child has provided us with personal information, contact our Privacy Officer and we will delete it.

18. Third-party websites and social media

Our website links to third-party sites and to our pages on Facebook, Instagram, YouTube, LinkedIn and Pinterest. Those platforms collect information about you under their own privacy policies, which we do not control and are not responsible for. When you comment on or message one of our social pages, the platform — not just us — receives that information. We recommend reviewing the privacy policy of any site or platform before providing personal information to it.

19. Your rights in other provinces, the United States, Mexico, the United Kingdom and Europe

We serve clients across Canada, throughout North America, and in the United Kingdom and Europe, and many of them have rights under privacy laws beyond Alberta PIPA and PIPEDA. To exercise any of the rights below, contact our Privacy Officer using the details in Section 21. We will not treat you differently for exercising them.

Other Canadian provinces

• British Columbia — residents may have rights under BC’s Personal Information Protection Act, which is substantially similar to Alberta’s.
• Quebec — residents may have additional rights under Quebec’s Law 25, including the right to data portability, the right to be informed about automated decision-making, and the right to have personal information de-indexed or ceased to be disseminated in defined circumstances. Contact our Privacy Officer to exercise them.

United States

A growing number of U.S. states — including California, Colorado, Connecticut, Oregon, Texas and Virginia — have comprehensive privacy laws. Depending on where you live and whether a law applies to us, you may have the right to:

• know what personal information we have collected about you, and obtain a copy in a portable format;
• correct inaccurate personal information;
• delete personal information we hold about you, subject to legal exceptions;
• opt out of the sale of your personal information, targeted advertising and certain profiling — although, as explained in Section 10, we do not sell your personal information or use it for targeted advertising; and
• appeal our decision if we decline your request, and contact your state Attorney General if you are not satisfied with the outcome.

You may make a request yourself or through an authorized agent, and we will verify your identity before responding. Even where a state law does not apply to us, we will consider and respond to reasonable requests from residents of any U.S. state.

Mexico

If you are in Mexico, you have the rights of access, rectification, cancellation and opposition (“ARCO rights”) under the Federal Law on the Protection of Personal Data Held by Private Parties. We will tell you our decision on an ARCO request within 20 business days and, if your request is granted, act on it within a further 15 business days.

United Kingdom and Europe

If you are in the United Kingdom or the EEA, the UK GDPR or GDPR gives you the right to:

• access your personal information and receive a copy of it;
• have inaccurate or incomplete information rectified;
• have your information erased where there is no good reason for us to keep it;
• restrict our processing of your information in certain circumstances;
• receive information you provided to us in a structured, machine-readable format, and have it transmitted to another organisation (data portability);
• object to processing based on our legitimate interests, and object at any time to direct marketing;
• withdraw your consent at any time, where we rely on consent, without affecting processing already carried out; and
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects — we do not make decisions of that kind.

We will respond within one month. For complex or numerous requests we may extend this by up to two further months, and we will tell you if we do. You also have the right to complain to a data protection authority — in the United Kingdom, the Information Commission, and in the EEA, the supervisory authority in the country where you live or work or where the issue arose. See Section 21.

Note: confirm whether MiRA must appoint a UK and/or EU representative under Article 27 of the UK GDPR and GDPR, and complete or delete the paragraph in Section 3. See Appendix A.

20. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, our technology or the law. The current version is always posted at miratimberframe.com, and the “Last updated” date at the top tells you when it last changed. Where a change is significant, we will take reasonable steps to bring it to your attention. Continuing to use our website or our services after a change means you accept the updated Policy.

21. Questions, concerns and complaints

Please raise any question, concern or complaint about your privacy with us first — we would rather resolve it directly and quickly.

Privacy Officer, MiRA Timber Frame

11 Legend Trail, North Business Park, Stony Plain, Alberta  T7Z 0B1

Phone: 780-968-0330  |  Toll free: 1-888-968-0330

Email: sales@miratimberframe.com

We will acknowledge your complaint, investigate it, and respond in writing with the outcome and any steps we have taken. If we find a complaint justified, we will take appropriate measures, including amending our policies and practices.

If you are not satisfied with our response, you may contact the applicable privacy regulator:

This Policy is provided for information purposes and does not create contractual rights. It should be read together with any written agreement between you and MiRA Timber Frame; where an agreement addresses confidentiality or the handling of information, that agreement governs.