Privacy policy

1. Who this policy covers

UnifyX ("UnifyX", "we", "us", "our") is a consulting firm based in Ottawa, Ontario, Canada.

This policy applies to www.unifyx.ca and to the personal information we handle when you browse the site, contact us, book a discovery call, or engage us for consulting services.

It does not cover third-party websites we link to, or the systems we configure for our clients once those clients operate them themselves. See section 6 for how we handle information that belongs to our clients.

2. What we collect

Information you give us

Contact and booking forms. Your name, email address, company name and phone number (optional); if you choose to provide them, how you heard about us, the topics you want to discuss, your current tools, your team size and anything you write in the message field; the time slot you select; and the date and time you gave your consent. When you book, the form also sends the first page you visited on our site and the website or campaign link that brought you here, so we know how you found us; this information stays in your browser tab until you submit the form. Name, email, company name and consent are required to book a discovery call; without them we can’t hold the appointment.

Correspondence. Emails, call notes, and documents you send us before or during an engagement.

Business information. Details about your operations, systems, and processes that you share with us so we can scope, price, or deliver work.

Information collected automatically

Server and security logs. Your IP address, browser type, the pages requested, and timestamps, recorded by our hosting infrastructure to keep the site running and secure.

Essential cookies. Session cookies the website needs to keep forms and the booking flow working from one page to the next. See section 5.

Audience measurement, with your consent. If you accept analytics cookies, Google Analytics records how the site is used: pages viewed, time spent, approximate location (city or region), device and browser type, and the page or campaign that brought you here. See section 5.

Where your visit came from. If you reach the site by clicking one of our Google ads, the address carries a click identifier (gclid) and campaign parameters (utm_*). When you book a call, we keep them with your request so we know which ad led to the conversation and can measure how our campaigns perform. These parameters tell us nothing about you beyond the ad you clicked.

We do not collect payment card details through this website, and we do not knowingly collect sensitive personal information about site visitors, such as health, biometric, or government identification data.

3. Why we use it

We use the information above to:

• respond to your enquiry, and schedule and hold a discovery call;
• prepare proposals, contracts, and invoices;
• deliver, support, and improve our consulting and Odoo implementation services;
• keep the business records we are required to keep for tax, accounting, and legal purposes;
• protect the site and our systems against fraud, abuse, and security incidents;
• with your consent, send occasional emails about our services. Every such email includes an unsubscribe link.

We do not sell your personal information, and we do not share it with third parties for advertising, profiling, or automated decision-making.

4. Consent and legal grounds

In Canada, we rely on your consent under the Personal Information Protection and Electronic Documents Act (PIPEDA): express consent when you submit a form or book a call, and implied consent where it is reasonable, such as replying to an email you sent us.

Where the EU or UK General Data Protection Regulation applies, our legal bases are: your consent; taking steps at your request before entering into a contract, and performing that contract; our legitimate interests in operating and securing our business; and compliance with legal obligations.

You can withdraw your consent at any time (see section 11). Withdrawing it may limit our ability to respond to you or continue an engagement, and it does not undo processing already carried out or affect records we are legally required to keep.

5. Cookies and similar technologies

This website uses strictly necessary cookies, which are always active. They hold your session identifier, a security token that protects forms against cross-site request forgery, your language preference, and the state of a booking you have started but not yet confirmed.

Analytics cookies, only with your consent. We use Google Analytics, a service of Google LLC, to understand how visitors use the site and to improve it. On your first visit, a banner asks for your choice: Google Analytics sets its cookies (named _ga and _ga_…, kept for up to 2 years) only if you select “I agree”. If you select “Essential only”, no analytics cookie is set. We look at this information in aggregate; we do not use it to identify you.

Advertising measurement cookies, only with your consent. We advertise on Google Ads. If you select “I agree”, Google Ads may set a cookie (named _gcl_au, kept for up to 90 days) that ties a booked call back to the ad you clicked. It is used to measure how our ads perform. If you select “Essential only”, no advertising cookie is set. We do not run retargeting and we do not sell any data.

Protection against robots. Our contact and booking forms are protected by Google reCAPTCHA v3 (Google LLC), which analyses how the page is used to tell a person from an automated script. It only loads when you fill in a form, and it may read technical information from your browser and place a cookie of its own. We use it to keep the forms and our calendar usable, and we cannot switch it off without exposing them to abuse; Google’s privacy policy and terms apply to that service.

We do not use advertising cookies or cross-site tracking. To change your choice, delete this site’s cookies and site data in your browser: the banner will appear again on your next visit.

You can block or delete cookies in your browser settings. Blocking essential cookies will break the contact and booking forms.

6. Client data during an engagement

When we implement, migrate, integrate, or support an ERP system, we may access personal information that belongs to our client: employee records, customer contacts, supplier details, transaction history, and similar data.

In that situation our client remains responsible for that information and we act on their documented instructions as a service provider (a "processor" under the GDPR). Specifically, we:

• use the data only to deliver the services agreed in writing;
• limit access to the team members who need it for the work;
• work with anonymized, masked, or sample data in test environments wherever it is practical;
• return or delete the data at the end of the engagement, in line with the engagement agreement;
• keep it confidential, both during and after the engagement.

If you are an employee, customer, or supplier of one of our clients and want to exercise your privacy rights, please contact that organization directly. We will assist them in responding.

7. Who we share information with

We share personal information only where it is necessary, and only with:

• Service providers acting on our behalf, bound by confidentiality obligations: website and database hosting, email and calendar services, video conferencing for discovery calls, website audience measurement (Google Analytics, only with your consent), advertising performance measurement (Google Ads, only with your consent), form protection against robots (Google reCAPTCHA), accounting and invoicing, and electronic signature where used.
• Professional advisors, such as lawyers and accountants, where necessary for legal or financial matters.
• Authorities, where we are required to do so by law, or where it is necessary to establish, exercise, or defend legal claims, or to protect someone's safety.
• A successor organization, if UnifyX is involved in a merger, acquisition, or sale of assets. Your information would remain subject to this policy.

8. Where your information is stored

Our website and its database are operated by a third-party hosting provider on servers that may be located outside Canada, including in the European Union. Some of the email, calendar, conferencing, audience measurement and form protection services we use, including Google Analytics, Google Ads and Google reCAPTCHA, are operated by providers based in the United States.

When personal information is stored or processed outside Canada, it may be accessible to the courts, law enforcement, and national security authorities of that jurisdiction under their laws. We choose providers that offer appropriate contractual and technical safeguards, and we keep the amount of personal information held on the website itself to a minimum.

9. How long we keep it

• Enquiries and bookings that do not lead to an engagement: up to 24 months from our last contact, then deleted or anonymized.
• Client records, contracts, and correspondence: for the duration of the engagement and 7 years afterwards, to meet Canadian tax, accounting, and limitation-period requirements.
• Client system data we access during a project: as set out in the engagement agreement, and returned or deleted when the work is complete.
• Server and security logs: a short rolling period, typically a few weeks to a few months, for troubleshooting and security.

When a retention period ends, we delete the information or anonymize it so it can no longer be linked to you.

10. How we protect it

We apply safeguards proportionate to the sensitivity of the information: encrypted connections (HTTPS/TLS) across the site, multi-factor authentication on administrative accounts, access granted on a least-privilege basis, systems and dependencies kept up to date, and regular backups.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach of security safeguards creates a real risk of significant harm, we will notify the affected individuals and the Office of the Privacy Commissioner of Canada as required by law, and we will inform any client whose data is involved without undue delay.

11. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you, and know how it has been used and disclosed;
• Correct information that is inaccurate or incomplete;
• Withdraw your consent, or unsubscribe from our emails, at any time;
• Request deletion of information we no longer need to keep;
• Receive a portable copy of the information you provided, in a structured, commonly used format;
• Object to or restrict certain processing, where the GDPR applies;
• Complain to a privacy regulator.

To exercise any of these rights, email privacy@unifyx.ca. We respond within 30 days, as PIPEDA requires. We may need to verify your identity before acting on a request. There is no charge, unless a request is manifestly unfounded or excessive, in which case we will tell you the cost before proceeding.

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376). Residents of Quebec may also contact the Commission d'accès à l'information du Québec. Individuals in the EU or the UK may contact their local supervisory authority.

12. Links to other sites

Our website links to third-party sites and platforms, including our social media profiles and documentation published by Odoo S.A. Those organizations have their own privacy practices, and we are not responsible for them. We encourage you to read their policies before sharing information with them.

13. Children

Our services are directed at businesses and business professionals. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

14. Changes to this policy

We may update this policy as our services, tools, or legal obligations change. The revised version is posted on this page with a new "last updated" date. If a change materially affects how we handle your personal information, we will give notice on our website and, where appropriate, by email to active clients.

15. Contact us

Questions about this policy, or about how we handle your personal information? Our Privacy Officer is responsible for compliance and will answer you directly.

UnifyX — Privacy Officer
privacy@unifyx.ca