Privacy notice
Effective 1 September 2026 · Candor Industries Inc.
This page explains what personal data we hold, where we got it, and what you can do about it. It is written for the people we contact in the course of business development — mostly engineers, technical leaders and sourcing managers at electronics companies in Europe — and for visitors to this website. We have tried to write it the way we would want to read it.
Who we are
Candor Industries Inc. is a printed circuit board manufacturer at 9-125 Martin Ross Avenue, Toronto, Ontario M3J 2L9, Canada. We are the data controller for everything described here. You can reach us about anything on this page at sunny@candorcircuitboards.com, or simply by replying to any email we have sent you.
Because we are established outside the EU but write to people in it, we have appointed a representative in the European Union under Article 27 GDPR: DataRep (Data Protection Representative Limited), 77 Camden Street Lower, Dublin, D02 XE80, Ireland. You can notify a data request to them at datarep.com/data-request or by post to any of their contact locations across the EU and EEA. You may contact them instead of us on any matter in this notice.
If we have written to you
We hold: your name, job title, employer, business email address, a note of where we found you, and any correspondence between us. Nothing else — no personal addresses, no browsing behaviour, no data from your private life.
Where we found you: your public professional profile (such as LinkedIn), your employer’s website, public business registries, industry directories, event listings and trade press. In some cases your business email address was confirmed or completed using an enrichment service that works from public sources. The first email we send you states the specific source for your record.
Why, and on what legal basis: we write to a small number of people whose professional role relates directly to circuit board design or procurement, to introduce our fabrication services to their company. We rely on our legitimate interest in business-to-business marketing (Article 6(1)(f) GDPR). We have carried out and documented a legitimate interest assessment, which our EU representative holds.
What we will never do with your data: sell it, share it with anyone other than the service providers below, use it for advertising networks, or build profiles. Our emails contain no tracking pixels and no tracked links — we do not know whether you opened them.
Stopping the emails
Reply “no” — or anything to that effect — to any email from us, or write to the address above. We stop the same day, remove your record, and keep only the minimum needed to make sure we never contact you again. This right to object to direct marketing is absolute (Article 21(2) GDPR): there is no balancing test and we will not ask why.
If you visit this website
Our web server records standard technical logs (IP address, pages requested, browser type) for security and operation of the site. We use Google Analytics to understand, in aggregate, how the site is used — which pages are visited and from which countries. Google Analytics sets cookies and processes your IP address; Google LLC acts as our processor and may process this data in the United States under the EU–US Data Privacy Framework. We use this information for site statistics only, on the basis of our legitimate interest in understanding our audience, and we do not use it for advertising. If your browser sends a Do Not Track or blocks cookies, the site works fully without them. Documents on this site download directly — we do not ask for your details in exchange.
Who processes data for us
Like most businesses we use service providers who process data on our instructions under Article 28 contracts: an email sending platform, an email enrichment provider, an email verification service, and IT and hosting suppliers. They may not use your data for their own purposes.
Where your data is processed
We are in Canada, so your data is processed there. The European Commission has recognised Canada’s federal private-sector privacy law as providing adequate protection for data handled by commercial organisations such as ours. Some of our service providers process data in the EU or the United States under appropriate safeguards.
How long we keep it
Prospect records are reviewed and deleted after 24 months if no business relationship has developed. Correspondence is kept as long as the matter it relates to. Suppression records — the do-not-contact list — are kept indefinitely, because deleting them would defeat their purpose.
Your rights
Under the GDPR you can ask us for a copy of your data, have it corrected or deleted, restrict how we use it, object to our use of it, and receive it in a portable form. Write to us or to our EU representative; we respond within one month. You can also complain to a data protection supervisory authority — your local one, or any in the EU.
Changes
If we change this notice we will change the date at the top. We will not quietly expand what we do with your data; anything material gets a fresh assessment first.