Privacy Policy

INNOVASIUM INC.

Version 2026-2.0 · Effective: January 1, 2026 · innovasium.com/privacy-policy

This Privacy Policy describes how Innovasium Inc.( “Innovasium”, “we”, “us”) collects, uses, and discloses personal information when you visit innovasium.com or interact with us as a prospective or current client ( “you”, “your”). It does not govern personal information processed by Innovasium on behalf of clients in the course of delivering client services — that processing is governed by the Innovasium Data Processing Addendum at innovasium.com/dpa and the applicable client agreement.

Summary. We collect limited personal information — primarily what you give us through our contact form, demo booking, and email correspondence, plus standard website analytics. We do not sell personal information. We use a small set of service providers to operate this website and our business. Our infrastructure is primarily in the United States. You have rights of access, correction, and deletion under Canadian privacy law.

A.  Information We Collect

A.1  Information You Provide Directly. When you contact us, request a demo, submit a support inquiry, or otherwise communicate with us, you may provide your name, email address, telephone number, organization name, role, and any information you choose to include in your message. We collect what you choose to share.

A.2  Information Collected Automatically. When you visit innovasium.com , our website hosting platform and analytics service automatically collect technical information including your IP address, browser type, device type, referring page, pages viewed, time spent on pages, and similar usage data. Cookies and similar technologies are used to support website functionality and analytics.

A.3  Information from Third Parties. We may receive limited information from third parties where you have authorized them to share it with us (e.g., if you contact us via LinkedIn or are introduced to us by a mutual contact). We do not purchase personal information from data brokers.

B.  How We Use Information

We use personal information to:

  • respond to your inquiries, schedule meetings, and provide information about our services;
  • provide proposals, estimates, and project updates to current and prospective clients;
  • operate and improve innovasium.com , including understanding how visitors use the site;
  • maintain business records, comply with our legal and professional obligations, and detect or prevent fraud or misuse;
  • communicate occasional updates about our work, with your consent where required by law.

We do not use personal information collected through innovasium.com to make automated decisions that have a significant effect on you, and we do not engage in advertising-based profiling.

C.  Legal Basis for Processing

We process personal information on the legal bases recognized under the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and applicable Canadian provincial privacy legislation:

  • Consent — when you submit information through our contact form, book a demo, or subscribe to communications, you provide implied or express consent for the use described above;
  • Legitimate business interests — operating our website, responding to inquiries, and maintaining records of our business relationships;
  • Legal obligations — complying with applicable laws, including tax, anti-spam (CASL), and accessibility legislation.

D.  Service Providers

We use a small number of third-party service providers to operate innovasium.com and our business. These providers process personal information on our behalf and are bound by contractual obligations to protect that information.

The categories and primary providers as of the effective date of this Policy are:

  • Website hosting and content management: Duda Inc. (United States), which hosts innovasium.com.
  • Content delivery and security: Cloudflare, Inc. (United States), which provides content delivery and security services for innovasium.com.
  • Website analytics: Google LLC (United States), which provides Google Analytics 4. Analytics data is configured to use IP anonymization where supported.
  • Email and productivity: We use standard business email and productivity tools to communicate with you and store our correspondence. Communications you send to privacy@innovasium.com or other Innovasium email addresses are stored in our business email system.
  • Cloud infrastructure: Amazon Web Services, Inc. (AWS), which provides cloud infrastructure used to host client engagements (governed by the DPA where applicable) and supporting business systems.

This list reflects our material providers but is not necessarily exhaustive. We may engage additional providers from time to time and will update this Policy accordingly.

E.  International Data Transfer

Innovasium is based in Ontario, Canada. Most of our service providers are located in the United States, which means that personal information you provide may be stored, processed, and accessed in the United States. Personal information stored or processed in the United States is subject to the laws of that jurisdiction, including possible access by U.S. governmental authorities under applicable U.S. law (including the CLOUD Act), notwithstanding any conflict with Canadian law.

We use contractual and technical measures to provide a comparable level of protection wherever personal information is processed. By using innovasium.com or communicating with us, you acknowledge this cross-border transfer.

F.  Cookies and Similar Technologies

Cookies are small files stored on your device when you visit a website. We and our service providers use cookies for the following purposes:

  • Strictly necessary cookies: support core website functionality (e.g., page navigation, security). These cannot be turned off.
  • Analytics cookies: set by Google Analytics 4 to help us understand how visitors use innovasium.com. These collect aggregated and pseudonymized usage information.

You can configure your browser to refuse cookies or to alert you when cookies are being set. Disabling cookies may affect website functionality. Where required by applicable law (including Quebec’s Law 25 for Quebec residents), we will obtain your consent before setting non-essential cookies.

G.  When We Share Information

We do not sell personal information. We share personal information only as described below:

  • With service providers(Section D) as necessary to operate our website and business.
  • With professional advisors(accountants, lawyers) bound by professional confidentiality obligations.
  • As required by law(court order, subpoena, regulatory request) or to protect the rights, property, or safety of Innovasium, our clients, or others.
  • In connection with a business transaction(merger, acquisition, sale of assets), in which case the receiving party will be bound by terms substantially similar to this Policy.

H.  How Long We Keep Information

We retain personal information for as long as needed for the purposes described in this Policy, then delete or de-identify it. Specifically:

  • Inquiry and prospect communications: retained for up to three (3) years from last contact, then deleted unless you have become a client or asked us to stay in touch.
  • Client business records: retained for the duration of the engagement plus seven (7) years thereafter for tax, accounting, and professional record-keeping purposes (or longer where required by law).
  • Website analytics data: retained according to default Google Analytics 4 retention settings, currently 14 months for user-level and event-level data.
  • Email correspondence: retained per our internal email retention policy, generally seven (7) years.

I.  Your Rights

Under Canadian privacy law you have the right to:

  • access the personal information we hold about you;
  • request correction of inaccurate or incomplete information;
  • withdraw consent for processing where processing is based on consent (this may affect our ability to provide services to you);
  • request deletion of personal information, subject to our legal and business retention obligations;
  • file a complaint with the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.

To exercise these rights, contact us at the address in Section L. We will respond within thirty (30) days, or sooner where required by law, and will inform you in advance of any cost for fulfilling a request (most requests are fulfilled at no cost).

J.  Quebec Residents

If you are a Quebec resident, you have additional rights under Quebec’s Act respecting the protection of personal information in the private sector (“Law 25”), including the right to data portability (to receive your personal information in a structured, commonly used technological format), the right to deindexation of online information about you in certain circumstances, and the right to be informed before personal information about you is used in an automated decision.

K.  Children

innovasium.com is a business-to-business website and is not directed to children. We do not knowingly collect personal information from children under the age of majority. If you believe a child has provided personal information to us, please contact us and we will delete the information.

L.  Contact, Complaints, and Updates

L.1  Privacy Officer. Inquiries, requests to exercise your rights, and complaints under this Policy may be directed to:

Daniel Hageman, P.Eng. · Privacy Officer · CEO, Innovasium Inc.

privacy@innovasium.com

Innovasium Inc., Toronto, Ontario, Canada

L.2  External Complaints. If you are not satisfied with our response to a privacy concern, you may also contact:

Office of the Privacy Commissioner of Canada ( priv.gc.ca , 1-800-282-1376 )

Commission d’accès à l’information du Québec ( cai.gouv.qc.ca ) — for Quebec residents

Information and Privacy Commissioner of Ontario ( ipc.on.ca ) — for Ontario-specific matters

L.3  Updates. We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The current version is available at innovasium.com/privacy-policy and shows the effective date. Material changes will be noted on the page; where required by law, we will obtain your consent for material changes before they apply to your personal information.