RENEWTRACK PRIVACY POLICY

RenewTrack Solutions Inc. ("RenewTrack", "we", "us") is an Ontario corporation with its principal place of business at 901 King Street West, Suite 400, Toronto, Ontario M5V 3H5. This policy explains how we handle personal information for which we are responsible.

What this policy covers. It covers personal information we collect and use for our own purposes — from visitors to our websites, prospective customers, partner contacts, and the individuals who administer or use customer accounts.

What this policy does not cover. It does not govern the data our customers record inside their RenewTrack tenant. We process that data on our customers’ instructions and on their behalf, under our Enterprise Subscription Terms and Data Processing Addendum. If you are an employee or contact of a RenewTrack customer and have a question about data held in that customer’s tenant, please contact that organization directly — they decide what is collected and for how long it is kept.

1. PERSONAL INFORMATION WE COLLECT

1.1 Information you give us. Name, business email address, business telephone number, job title, employer, and the content of enquiries when you contact us, request a demonstration, subscribe to communications, attend an event, or apply for a role with us.

1.2 Account information. When your organization subscribes to the Services, we collect the names, business contact details and role assignments of the individuals designated to administer or access the account, together with authentication records and audit logs of account activity.

1.3 Partner information. Where you are a contact at one of our channel partners, we collect your business contact details and records of our dealings with you.

1.4 Technical information. When you visit our websites or use the Services, we automatically collect IP address, browser type and version, device and operating system information, language preference, referring page, and the date, time and duration of your visit.

1.5 Cookies and similar technologies. We use cookies and similar technologies on our public website. See Section 5.

1.6 We do not knowingly collect personal information from children, and the Services are not directed to individuals under the age of majority.

2. WHY WE USE IT

2.1 We use personal information to: (a) respond to enquiries and provide information you request; (b) establish, administer and support customer and partner relationships; (c) provision, secure, monitor and support the Services, including authenticating users and investigating security incidents; (d) invoice and collect payment; (e) send service, security, billing and administrative communications; (f) send marketing communications where we are permitted to do so; (g) understand how our websites and Services are used, and improve them; (h) recruit and evaluate candidates; and (i) meet our legal, regulatory, audit and insurance obligations, and establish, exercise or defend legal claims.

2.2 We rely on consent where the law requires it, and otherwise on the necessity of the processing to provide services you or your organization have requested, to meet a legal obligation, or for our legitimate business interests where those interests are not overridden by your interests or rights.

2.3 We do not sell personal information, and we do not rent or trade it.

3. AGGREGATED AND DE-IDENTIFIED DATA

3.1 We produce aggregated, de-identified statistics and benchmarks from data across our customer base, and make these available to customers as a feature of the Services. Personal information does not leave a customer’s tenant and is not used to produce these insights. Contract, product, vendor and date information is stripped of anything identifying the customer organization or its affiliates before it is aggregated.

3.2 We do not publish or make available any aggregated insight derived from fewer than twenty (20) contributing customers, we do not attempt to re-identify aggregated data, and we do not permit any third party to do so.

3.3 A customer may withdraw its data from this process by giving us written notice under its Enterprise Subscription Terms.

4. WHO WE SHARE IT WITH

4.1 Service providers. We share personal information with providers who perform services on our behalf, including hosting, email delivery, analytics, customer support tooling, payment processing and professional advice. They are bound by contract to use it only to provide those services and to protect it appropriately.

4.2 Channel partners. Where you are a contact at an organization that purchased through one of our partners, we share account and support information with that partner as necessary to administer the relationship.

4.3 Legal and safety. We may disclose personal information where required by law or valid legal process, to protect our rights or property, or to address an emergency involving a risk to a person’s safety. Where we are permitted to do so, we will notify the affected organization of a request for its data.

4.4 Corporate transactions. If we are involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction, subject to the recipient continuing to protect it in a manner consistent with this policy.

5. COOKIES

5.1 Our public website uses cookies that are strictly necessary for the site to function, and analytics cookies that help us understand how the site is used. The Services themselves use only cookies necessary for authentication, session management and security.

5.2 You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of our website or the Services from working.

6. WHERE YOUR INFORMATION IS HELD

6.1 Customer data. Data recorded by customers in the Services is hosted in Canada on Amazon Web Services infrastructure, across multiple availability zones.

6.2 Network and domain services. We use Cloudflare for domain name services. Traffic to our public marketing website is routed through Cloudflare’s network, which includes points of presence outside Canada. Traffic to the RenewTrack application at app.renewtrack.com is not proxied through Cloudflare, and customer data does not pass through or reside on Cloudflare’s network.

6.3 Corporate systems. Some of the systems we use to run our own business — for example, email, customer relationship management and support tooling — are operated by providers that may store or access information outside Canada, including in the United States.

6.4 Where personal information is held or accessed outside Canada, it may be subject to the laws of that jurisdiction, including lawful access by courts, law enforcement and national security authorities. We use contractual and technical measures to require comparable protection wherever information is processed.

6.5 A current list of the providers we use to process personal information on behalf of customers is available on request to privacy@renewtrack.com.

7. HOW LONG WE KEEP IT

7.1 We keep personal information only as long as necessary for the purposes described in this policy, or as long as the law requires.

7.2 Marketing and prospect records are kept until you withdraw consent or ask us to delete them, and are reviewed periodically. Customer and partner account records are kept for the duration of the relationship and for a period afterwards to meet contractual, tax, audit and limitation-period requirements. Data held in a customer tenant is retained for as long as that customer chooses, and is deleted on that customer’s instruction or following termination in accordance with its Enterprise Subscription Terms. Copies in routine backups are deleted on our backup retention schedule.

8. HOW WE PROTECT IT

8.1 We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, role-based access controls, logging and monitoring, and access limited to personnel who need it.

8.2 No method of transmission or storage is completely secure. If we become aware of a security incident that creates a real risk of significant harm, we will notify affected individuals and the appropriate regulators as the law requires, and will notify our customers of incidents affecting their data without undue delay.

9. YOUR CHOICES AND RIGHTS

9.1 Subject to the exceptions the law allows, you may ask us to: (a) confirm whether we hold personal information about you and give you access to it; (b) correct information that is inaccurate or incomplete; (c) delete information we no longer need; and (d) tell you how we have used and disclosed it.

9.2 You may withdraw consent to our use of your personal information at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide certain services to you.

9.3 You may unsubscribe from marketing communications at any time using the link in any message or by contacting privacy@renewtrack.com. We will continue to send service, security and billing communications relating to an active account, as those are not marketing messages.

9.4 Residents of the United States. Where a United States state privacy law applies to your personal information, you may have rights to access, correct, delete or obtain a copy of that information, and to opt out of certain uses. We do not sell personal information or share it for cross-context behavioural advertising. Where we handle information on behalf of a customer, please direct your request to that customer; we will assist them in responding.

9.5 To exercise any of these rights, contact privacy@renewtrack.com. We may need to verify your identity before responding, and will respond within the time the applicable law requires.

10. ACCOUNTABILITY AND COMPLAINTS

10.1 We have designated a Privacy Officer who is accountable for our compliance with this policy and with applicable privacy legislation, including the Personal Information Protection and Electronic Documents Act. The Privacy Officer can be reached at privacy@renewtrack.com, or by mail at RenewTrack Solutions Inc., Attention: Privacy Officer, 901 King Street West, Suite 400, Toronto, Ontario M5V 3H5. The name of the individual currently holding this role is available on request.

10.2 If you are not satisfied with our response to a privacy concern, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, or the privacy regulator in your own jurisdiction.

11. CHANGES TO THIS POLICY

11.1 We may update this policy from time to time. The current version is always published at https://www.renewtrack.com/privacy, with the effective date shown at the top. Where a change materially affects how we handle personal information, we will provide notice before it takes effect.

Contact us at privacy@renewtrack.com, or RenewTrack Solutions Inc., 901 King Street West, Suite 400, Toronto, Ontario M5V 3H5.