Privacy Policy

This policy covers only the marketing website at getinreach.ca. It does not cover the InReach procurement platform, which is available at app.getinreach.ca. The platform has its own privacy policy which addresses supplier certifications, procurement records, and other data processed by the InReach application.

What personal information do we process? Contact form submissions (name, email, company, phone, message) and, with your consent, aggregated analytics data via Google Analytics 4.

Do we process sensitive personal information? No. We do not process sensitive personal information.

Do we collect information from third parties? No. We do not collect any information from third parties.

With whom do we share personal information? We use Microsoft Azure (Canada Central region) for hosting and Google Analytics 4 for analytics (when you consent). We do not sell your personal information.

Where is data stored? Contact form data and website infrastructure are in Microsoft Azure's Canada Central region. Analytics data, if you consent, is processed by Google.

Cookies? We use a first-party cookie to remember your consent choices. Google Analytics 4 sets its own cookies only after you opt in.

We collect personal information that you voluntarily provide when you contact us through the website.

• Contact form submissions — name, email address, company name, phone number, and the message you write. Submitted when you fill in the contact form at getinreach.ca/contact.

Automatically collected data (analytics, with your consent). If you opt in to analytics cookies, Google Analytics 4 collects aggregated, anonymised data about how visitors use the website — pages viewed, session duration, general geography, and device type. IP addresses are anonymised before storage. We cannot identify you individually from this data.

Sensitive Information. We do not process sensitive personal information such as racial or ethnic origins, sexual orientation, or religious beliefs.

All personal information you provide must be true, complete, and accurate.

We process your personal information only for the following purposes:

• Responding to enquiries. When you submit the contact form, we use your details to reply to your question or request.
• Website improvement (analytics, with consent). Aggregated analytics data helps us understand which content is useful so we can improve the website.
• Security and fraud prevention. Server-side logs and monitoring to keep the website safe.
• Legal compliance. To comply with PIPEDA, Quebec's Loi 25, and any other applicable Canadian law.

We do not sell your personal information. We share it only in the following circumstances:

• Microsoft Azure — cloud infrastructure sub-processor. The website is hosted on Microsoft Azure (Canada Central region). Azure processes data on our behalf as a data processor. Specifically:
  • Azure App Service — hosts the website application servers. Contact form submissions pass through this service.
  • Azure Application Insights — collects server-side performance telemetry and error logs. This runs server-side only — no Application Insights SDK is loaded in your browser.
  Azure is certified under ISO 27001 and SOC 2 and meets Canadian data residency standards. See the Microsoft Trust Center.
• Google (analytics, with your consent only). If you consent to analytics cookies, Google Analytics 4 receives aggregated, anonymised usage data. Google acts as a data processor under its data processing terms. IP anonymisation is enabled. GA4 cookies are only set after you opt in — we do not use GA4 Consent Mode (which would send data to Google before your decision).
• Business transfers. We may share or transfer your information in connection with any merger, sale of company assets, or acquisition of all or a portion of our business.
• Legal and regulatory obligations. We may disclose your information where required by law or in response to a valid legal process from a Canadian government authority or court.

Website infrastructure and any contact form submissions you send us are stored and processed in Microsoft Azure's Canada Central region (Toronto, Ontario). We do not transfer this data outside Canada.

If you consent to analytics, Google Analytics 4 data is processed by Google on its own infrastructure, which may be located outside Canada. Google's data processing terms and Standard Contractual Clauses govern this transfer. IP anonymisation is enabled before any data reaches Google's servers.

We have implemented appropriate technical and organisational security measures, including:

• TLS encryption for all data in transit
• Azure-managed encryption at rest
• Server-side monitoring via Azure Application Insights — no browser-side tracking SDK is loaded on your device
• Role-based access controls on all internal systems

Despite our safeguards, no electronic transmission over the Internet can be guaranteed 100% secure. Transmission of personal information to and from our website is at your own risk.

We retain your personal information only as long as necessary for the purposes described above, or as required by law.

• Contact form submissions — retained for as long as needed to handle your enquiry. TODO: confirm specific retention period with the operations team.
• Analytics data (Google Analytics 4, with consent)— Google retains event data for 14 months by default. You can adjust this in your Google Account's Data & Privacy settings.
• Consent record (inreach_consent cookie) — stored client-side for up to 12 months. After 12 months we will ask you to confirm your choices again.

We follow Quebec's Loi 25 as our compliance floor, which means we apply the same standard to every visitor regardless of province or country.

• Strictly necessary — inreach_consent (first-party). Records your cookie choices. Stored client-side for 12 months. No personal data sent to any server.
• Analytics — Google Analytics 4 (opt-in only). Sets two cookies: _ga (2 years) and _ga_[ID] (2 years). These cookies are only created after you accept analytics. They do not load by default. IP anonymisation is enabled.

You can review our full cookie list, change your choices, or withdraw consent at any time using the button below. Withdrawing consent prevents analytics scripts from loading on future page loads.

We do not knowingly collect, solicit data from, or market to children under 18 years of age. By using the website, you represent that you are at least 18 years of age. If we learn that personal information from a user under 18 has been collected, we will take reasonable measures to promptly delete it from our records.

Under PIPEDA and Quebec's Loi 25, you have the following rights:

• Request access to the personal information we hold about you
• Receive a clear account of how your information has been used and disclosed
• Correct inaccuracies in your personal information
• Request deletion of your personal information (subject to legal retention obligations)
• Withdraw your consent to non-essential data processing at any time (via the Cookies button above)
• Request a portable copy of the personal information you have provided to us (right to data portability under Loi 25)

To exercise any of these rights, contact us at hello@adaptabilitycanada.com. We will respond within 30 days.

Filing a complaint. If you believe we have not handled your personal information appropriately, you may file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) under PIPEDA, or — if you are a Quebec resident — with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) under Loi 25. We will cooperate fully with either authority.

If you have questions or concerns about this Privacy Policy or how we handle your personal information, please contact us:

• Email: hello@adaptabilitycanada.com
• Phone: (647) 631-2070
• Post: Adaptability Canada Corporation, 2-520 Coronation Drive, Toronto, ON M1E 5C7, Canada

For our broader data handling commitments when you use the InReach platform (not just this marketing website), see the platform privacy policy at app.getinreach.ca/privacy.

Policy version. Version 2 — April 28, 2026. Previous version: March 18, 2025. Material changes in this version: added scope clarification, GA4 analytics disclosure, Microsoft Azure sub-processor disclosure, data residency section (Azure Canada Central), data retention section, cookies section, and updated privacy rights to reflect Loi 25 data portability right and CAI complaint path.