Privacy Policy

Personal Information You Provide

When you contact us through our website, we collect:

• Name and contact information (email address)
• Company name and professional details
• Information about services you're interested in
• Details about your current technology environment
• Any additional information you choose to provide in your message

Automatically Collected Information

When you visit our website, we may automatically collect:

• IP address and browser type
• Device information and operating system
• Pages visited and time spent on pages
• Referring website addresses
• General location information (city/region level)

Who is responsible

Valment Partners Inc., 3426 Liptay Ave, Oakville, Ontario L6M 0M8, Canada, is the controller of the personal data described in this policy. Questions about it, and any request to exercise the rights set out below, can be sent to privacy@valment.com. We answer within one month.

What we process, and on what basis

When you use the contact form we process the name, email address, company and message you provide, together with the technical data your browser sends with the request. The legal bases are:

• **Article 6(1)(b)**: taking steps at your request before entering into a contract, where your message is an enquiry about our services.
• **Article 6(1)(f)**: our legitimate interest in responding to enquiries, keeping the site secure, and retaining a record of business correspondence. You can object to processing on this basis at any time.
• **No special categories.** We do not ask for, and have no use for, data revealing health, biometrics, political opinions, or the other categories listed in Article 9.
• **No automated decision-making.** Nothing you send is subject to automated decision-making or profiling within the meaning of Article 22.

How long we keep it

Enquiry data is kept for twelve months and then deleted. Where an enquiry becomes an engagement, the records that belong to that engagement are kept for as long as the contract and applicable tax and professional obligations require, and no longer.

Where your data actually goes

Three legs, and it is worth being precise about each. First, we are established in Canada, so the controller sits outside the EEA: the European Commission has recognised Canada as providing an adequate level of protection for personal data transferred to recipients subject to PIPEDA (Commission Decision 2002/2/EC), and we work to PIPEDA as stated above. Second, the server that receives the contact form is a virtual private server located in the United States, and that transfer is made under the European Commission’s standard contractual clauses incorporated in our agreement with the hosting provider. Third, the enquiry is delivered to a mailbox on Google Workspace, so Google processes it as well; that transfer rests on Google’s data processing terms, which incorporate the standard contractual clauses, and on Google’s certification under the EU-U.S. Data Privacy Framework. The United States has no general adequacy decision, which is why safeguards rather than adequacy carry the second and third legs.

Who else touches it

Two providers, and no more than two. Hostinger hosts the virtual private server that runs the contact endpoint and receives submissions. Google, through Google Workspace, hosts the mailbox the enquiry is delivered to and the correspondence that follows. Both act as processors, both are bound by data processing agreements, and both handle personal data only on our instructions. Nobody else receives enquiry data: we do not sell, rent or share it, we run no analytics, and we do not use it for advertising.

No analytics, no tracking

We run no analytics on this site. There is no Google Analytics, no advertising pixel, no session recording, and no cross-site tracking. Web fonts are served from our own domain rather than a third party, so loading a page on this site does not disclose your IP address to anyone else.

Your rights

Under the GDPR you have the right to:

• **Access** (Art. 15): obtain confirmation of whether we process your data, and a copy of it.
• **Rectification** (Art. 16): have inaccurate or incomplete data corrected.
• **Erasure** (Art. 17): have your data deleted where the conditions are met.
• **Restriction** (Art. 18): have processing limited in the circumstances the article defines.
• **Portability** (Art. 20): receive the data you provided in a structured, commonly used, machine-readable format.
• **Object** (Art. 21): object to processing that rests on legitimate interests.
• **Withdraw consent** at any time where processing rests on consent, without affecting the lawfulness of processing carried out before you withdrew it.

Complaints

You can lodge a complaint with a supervisory authority in the member state of your residence, your place of work, or the place of the alleged infringement. In Germany the competent authority depends on your Land, and the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit publishes the list. In Austria it is the Datenschutzbehörde. In Switzerland it is the Eidgenössische Datenschutz- und Öffentlichkeitsbeauftragte. We would rather you raised it with us first, but the right is yours either way and using it does not require going through us.

Representative in the Union

We have not designated a representative in the Union under Article 27 GDPR, and Article 27(2)(a) is the reason. That exemption applies where processing is occasional, does not include large-scale processing of the special categories of data in Article 9 or data relating to criminal convictions, and is unlikely to result in a risk to the rights and freedoms of individuals. Our processing of EEA personal data consists of occasional business enquiry correspondence: a name, an email address, a company, and whatever you choose to write. It meets all three conditions. The same reasoning applies to the equivalent requirement under the UK GDPR. If the nature or the scale of what we process changes, this position changes with it, and this policy will say so.

Switzerland

The Swiss Federal Act on Data Protection gives you comparable rights, and requests under it reach us the same way. Article 14 requires a controller abroad to designate a representative in Switzerland only where the processing is connected to offering goods or services or to monitoring behaviour in Switzerland, and is extensive, and is regular, and poses a high risk to the data subject. Occasional enquiry correspondence does not meet that test, so no Swiss representative has been designated.