Effective date: September 28, 2026
I'm Zach Toutounjian, a real estate agent with Big City Realty Inc., Brokerage, and this is my personal website. I collect as little of your information as I can get away with: whatever you type into the contact form, plus anonymous analytics and ad measurement. There's no cookie wall, nothing is sold, and you can opt out anytime via the Cookie Preferences link in the footer of every page. This policy explains the details in plain English, in line with Canada's PIPEDA, Quebec's Law 25, and the EU's GDPR.
How consent works depends on where you are. If you're visiting from the EU, EEA, the UK, Switzerland, or Quebec, nothing analytics- or ads-related runs until you actively opt in, you'll get a banner with a real choice, and declining is a single click. Everywhere else, including the rest of Canada, analytics and ad measurement start on under the opt-out (implied consent) model that PIPEDA permits for non-sensitive purposes. You'll see a notice saying so on your first visit, and you can switch them off at any time. Either way, the site works exactly the same.
Contact and showing forms (Netlify Forms). When you send me a message or request a showing through a form on this site, I get whatever you enter, usually your name, email, phone number, and your message. Submissions are handled by Netlify, the company that hosts this site, which stores them on my behalf. I use it to reply to you and help you with your real estate question. That's it. The form also tells me how you found the site, for example my Instagram link, a Google search or ChatGPT, and the page you first landed on, so I know which of my channels are worth the time. Your browser only remembers it from page to page where analytics is allowed, see ztr_src below.
Analytics (Google Analytics 4). Google Analytics tells me things like which pages get visited, roughly where visitors come from, and how long people stay. It's aggregate and anonymous to me. I never see who you are. In the EU/EEA/UK/Switzerland and Quebec it runs only if you opt in; elsewhere it runs unless you opt out. The moment you opt out, GA switches to a cookieless, consent-denied mode and sets no analytics cookies on your device. Separately, when you arrive through one of my social profile links, the site adds one anonymous tally for that platform (for example "one visit from TikTok"), with no cookie and nothing that identifies you.
Ad measurement (Meta Pixel). I run occasional ads on Facebook and Instagram, and the Meta Pixel helps me see whether they actually work. In the EU/EEA/UK/Switzerland and Quebec the pixel never loads at all unless you opt in, not even in the background. Elsewhere it loads unless you opt out, and opting out stops it immediately.
Region detection. To know which of those two rules applies to you, the site asks my own server for a coarse location before anything else loads. It returns only a country code and, in Canada, a province code (no city, no coordinates, no IP address), and that result is stored on your device, not on my servers. Nothing about it is logged or shared.
Server logs. The site is hosted on Netlify, which keeps standard short-lived server logs (IP address, request time, pages requested) for security and to keep the site running. Listing data and photos are served from Supabase, which sees the same kind of standard request data when your browser loads a listing.
Here is everything this site can put on your device. In the EU/EEA/UK/Switzerland and Quebec, the Google and Meta entries only appear after you opt in. Everywhere else they're set on arrival and removed from future use the moment you opt out.
Consent covers analytics and ad measurement, and you can withdraw it at any time. In the EU/EEA/UK/Switzerland and Quebec that consent is express: nothing runs until you opt in, as GDPR and Law 25 require. Elsewhere in Canada it's implied, which PIPEDA permits for non-sensitive purposes like these provided the notice is clear and opting out is easy. Legitimate interest covers replying to messages you send me, keeping basic server logs for security, and making sure the site works. Where we end up working together on a purchase, sale, or lease, handling your information becomes necessary to provide that service and to meet the record-keeping rules real estate brokerages are subject to in Ontario.
If you're in the EU, EEA, the UK, Switzerland, or Quebec: on your first visit a banner asks what you're comfortable with: Accept all, Decline, or Only analytics. Nothing runs until you pick. Declining is one click and costs you nothing; the site works exactly the same.
Everywhere else, including the rest of Canada: analytics and ad measurement start on, and a notice on your first visit tells you so and points you here. Opting out is one click from that notice, or from the footer link below, at any time.
Whichever applies, your choice is stored on your own device (the ztr_consent entry above), not on my servers, and an explicit choice always overrides the regional default, including if you travel.
To change your mind later, click Cookie Preferences, in the footer of every page, and the full banner opens. Opting out stops future tracking immediately; to remove cookies already set, you can also clear them in your browser settings. If you're technically inclined, the same control is exposed on every page as window.ztrConsent.
Contact form messages are kept while I'm helping you and for a reasonable period afterward. If you become a client, transaction records are kept as long as Ontario's real estate regulations require. Google Analytics data retention is set on Google's side (currently up to 14 months for user-level data); Netlify's server logs are short-lived. The consent record itself lives only in your browser.
I do not sell, rent, or trade your personal information. Ever. Data is handled by a small set of service providers acting on my behalf: Google (analytics), Meta (ad measurement), Netlify (hosting and form submissions), Netlify (hosting), and Supabase (listing data). Each processes data under its own privacy policy and safeguards. If we work on a transaction together, relevant information is shared with Big City Realty Inc. as required to complete the deal. Beyond that, I disclose information only if the law requires it.
Everyone (PIPEDA, Canada). You can ask me what personal information I hold about you, ask me to correct it, withdraw consent to its use (subject to legal and contractual limits), and ask me to delete it where applicable. If you're not happy with how I handle a request, you can complain to the Office of the Privacy Commissioner of Canada (OPC).
Quebec residents (Law 25). You additionally have the right to be told how your information is used, to access and rectify it, to ask that it stop being shared, and to complain to the Commission d'accès à l'information du Québec (CAI).
EU/EEA and UK visitors (GDPR). You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, plus the right to withdraw consent at any time without affecting the site's usability. You can lodge a complaint with your local data protection authority.
To exercise any of these rights, email me at contact@zachtherealtor.ca. I'll respond within 30 days.
Some of the providers above (Google, Meta, Netlify, Supabase) store or process data outside Canada, primarily in the United States and the EU. Where data leaves Canada or the EU, it's protected by those providers' contractual safeguards, including standard contractual clauses and equivalent mechanisms recognized under GDPR.
This site is meant for adults dealing in real estate, not for anyone under 18. I don't knowingly collect information from children, and if I learn I have, I'll delete it promptly.
If I change this policy, the new version goes up on this page with a new effective date. Material changes to how consent works will re-trigger the consent banner.
Questions, requests, or complaints about privacy, come straight to me:
Zach Toutounjian
Big City Realty Inc., Brokerage
20 Crown Steel Dr, Unit 16, Markham, ON
contact@zachtherealtor.ca
+1 (647) 370-4496