Privacy Policy

1. Accountability

A&G is responsible for personal information under its control. A designated privacy contact oversees compliance with this policy and with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Privacy enquiries can be directed to the contact listed in section 11.

2. Information we collect

From website visitors: name, firm name, email address and any information you volunteer when booking a call or registering for a webinar; plus standard technical data such as IP address, browser type and pages viewed.

From client firms during an engagement: business contact details, descriptions of workflows and systems, and configuration data required to build and operate automations. Where an automation touches your clients' records, we may process that information as a service provider on your instructions only.

3. Purposes and consent

We collect personal information to respond to enquiries, deliver booked calls and webinars, perform assessment and implementation work, operate and support automations, and meet legal or professional obligations. We obtain consent at the point of collection and you may withdraw consent at any time, subject to legal and contractual restrictions.

4. Third-party processors

We use third-party service providers to operate our business, which may include scheduling, email, cloud hosting, analytics, document storage and workflow automation platforms. Each engagement is supported by a written list of the specific subprocessors used for that client, provided before any system is connected. [TO COMPLETE: published subprocessor list and links to their privacy terms.]

Client information is not used to train third-party AI models. Where a service offers training on submitted data, that setting is disabled or the service is not used.

5. Data residency

[TO COMPLETE: identify the countries in which personal information is stored and processed for each category of data, and note that information stored outside Canada may be accessible to foreign courts and law enforcement.]

6. Safeguards

We apply administrative, technical and physical safeguards appropriate to the sensitivity of the information: least-privilege access, multi-factor authentication on administrative accounts, encryption in transit, encryption at rest with our hosting providers, and documented access reviews.

7. Breach notification

If we become aware of a breach of security safeguards involving personal information under our control that creates a real risk of significant harm, we will notify affected client firms within 72 hours of confirming the breach, report to the Office of the Privacy Commissioner of Canada as required, and maintain a record of the incident.

8. Retention and disposal

Personal information is retained only as long as necessary for the purposes it was collected or as required by law, then securely destroyed or anonymized. [TO COMPLETE: specific retention periods by data category — enquiry records, webinar registrations, engagement working papers, automation logs, and backup expiry.]

9. Access and correction

You may request access to the personal information we hold about you, ask that it be corrected, or request its deletion where we are not required to retain it. We respond to written requests within 30 days and will explain any refusal and the grounds for it.

10. Cookies and analytics

Our website may use cookies and analytics to understand aggregate usage. [TO COMPLETE: name the analytics tool in use, its cookie lifetimes, and the consent mechanism, including Quebec-specific consent requirements.]

11. Contact and complaints

Privacy questions and complaints can be sent to our privacy contact. [TO COMPLETE: privacy officer name, email address and mailing address.] If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec where applicable.