Privacy policy

Who we are

XenoForm is the trade name of 2747636 Alberta Ltd., an Alberta corporation based in Edmonton, Alberta, Canada ("XenoForm", "we", "us"). We design, build and manage digital teams that take on routine work for businesses, through our XenoForm Scan, Forge, Orbit and Lab services.

We are responsible for the personal information we collect and hold. We follow Alberta's Personal Information Protection Act (PIPA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies, and Canada's Anti-Spam Legislation (CASL).

Our Privacy Officer is accountable for this policy and answers questions about it. You can reach the Privacy Officer at privacy@xenoform.ca.

What this policy covers

This policy covers personal information we collect through our website, our Digital Workforce Plan sessions, our emails and our everyday business with prospects, clients, suppliers and partners.

It does not cover information that a client's digital team handles for that client. That information belongs to the client, and we handle it as the client's service provider. See Information we handle for our clients.

What we collect

Information you give us

• Digital Workforce Plan requests: your name, work email, company, company size, industry and anything you choose to tell us about your staff's workload.
• Conversations: what you share by email, phone or video call, including notes we take during your session or a XenoForm Scan.
• Clients: contact and billing details for the people we work with, signed agreements, and the access details your digital team needs to connect to your tools. Card payments are handled by our payment processor; we do not store full card numbers.
• Email preferences: whether you have agreed to hear from us, and any request to stop.

Information collected when you visit

• Your IP address, browser and device type, the pages you view, the page that sent you to us, and the date and time of your visit. Our website host and the tools named under Cookies collect this for us.

Information from other sources

• Public business contact information: to introduce our services to businesses, we may collect a business's name, a person's name and job title, and their business email, phone number and address from public sources, such as company websites, business directories and professional profiles. We use it only to contact people about their work.
• Referrals: details a partner or client passes to us with your agreement.

Please do not send us health, financial or other sensitive information through our website forms. If a project needs it, we will agree a secure way to handle it with you first.

How we use it

We use personal information to:

• answer your questions, book your session and prepare your Digital Workforce Plan;
• propose, deliver, support and bill for our services;
• contact businesses about services that are relevant to their work;
• send newsletters and offers, but only with your consent (see Our emails);
• keep our website, systems and clients' digital teams secure, and fix problems;
• understand how our website is used so we can improve it; and
• meet our legal, tax and accounting obligations, and protect our legal rights.

We collect only what we need for these purposes. If we want to use your information for a new purpose, we will tell you and, where the law requires, ask for your consent first.

Consent

We collect, use and share personal information with your consent, or where the law allows or requires it without consent. Your consent may be express, such as ticking a box, or implied, such as giving us your email address so we can book your session.

You can withdraw your consent at any time, subject to legal or contract limits, by writing to privacy@xenoform.ca. We will tell you what withdrawing means. For example, we cannot run a client's digital team without the access it needs.

Our emails

We send commercial emails only when CASL allows it: when you have given us express consent, or when we have implied consent, for example because you asked us for a plan or a quote, you are a client, or you published your business email address and our message is relevant to your role.

Every email we send names 2747636 Alberta Ltd., operating as XenoForm, gives our mailing address and contact details, and includes a way to unsubscribe. We act on unsubscribe requests within 10 business days. We keep a record of the request so we do not contact you again by mistake.

Service emails, such as booking confirmations, invoices and messages about your account, are not marketing and continue while you are a client.

Cookies and similar tools

Cookies are small files a website stores in your browser. Our website uses them to:

• Make the site work: our website host (Wix.com) sets cookies needed for security, page loading and forms.
• Measure visits: our website host collects page views and similar statistics so we can see which pages help visitors.

Our pages load fonts from Google Fonts, which receives your IP address and browser details when a page loads.

We do not currently use advertising or cross-site tracking cookies. If that changes, we will update this policy first and ask for consent where the law requires.

You can block or delete cookies in your browser settings. The site will still work, though some features, such as forms, may not.

When we share information

We do not sell or rent personal information. We share it only:

• With service providers who help us run our business, such as website hosting, email delivery, form handling, customer records, scheduling, video calls, payments, accounting and cloud storage. They may use the information only to provide their service to us, and must protect it.
• With the tools your digital team connects to, when you are a client and ask us to connect them.
• With partners, only when you ask us to or agree to it, such as an introduction to another business.
• With professional advisers, such as our lawyers and accountants, who are bound by confidentiality.
• When the law requires or allows it, for example in response to a court order, or to protect someone's safety.
• In a business transaction, such as a sale or merger of all or part of our business. The other party must agree to protect the information as this policy describes.

Information we handle for our clients

When we build or run a digital team for a client, that team may handle personal information about the client's own customers, patients, tenants or staff. In that work:

• the client is the organization responsible for that information, and its own privacy policy applies;
• we use the information only to provide our services to that client, following our written agreement and the client's instructions;
• each digital team gets only the access its job needs, keeps a readable log of its actions, and can be switched off by the client at any time;
• we do not use one client's information for another client or for our own marketing; and
• when our work ends, we return or securely delete the information as our agreement says.

If your information is handled by one of our clients and you want to see, correct or delete it, please contact that business. We will help them respond.

Storage outside Canada

Some of our service providers, including our website host, store or process information outside Canada, mainly in the United States. While it is there, it is subject to the laws of that country, and authorities there may be able to access it.

We choose providers that protect information to a standard comparable to ours, and we bind them by contract to do so. To learn more about our policies and practices for service providers outside Canada, or to ask questions about how they collect, use, share or store personal information for us, write to our Privacy Officer at privacy@xenoform.ca.

How we protect it

We use physical, administrative and technical safeguards suited to how sensitive the information is. These include access limited to the people and digital teams that need it, multi-factor sign-in, encryption in transit, and regular review of who has access.

No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and report it to the Office of the Information and Privacy Commissioner of Alberta, and to the Office of the Privacy Commissioner of Canada where PIPEDA applies.

How long we keep it

• Plan requests and prospect records: up to two years after our last contact, unless you become a client or ask us to delete them sooner.
• Client records: for the length of our relationship, then as long as tax and corporate law require, generally six years after the end of the tax year they relate to.
• Unsubscribe requests: for as long as we send email, so we can honour them.
• Website statistics: as long as our website host keeps them, typically in summary form.

When we no longer need personal information, we securely delete it or make it anonymous. If information was used to make a decision about you, we keep it for at least one year so you can ask to see it.

Your rights

You can ask us to:

• tell you what personal information we hold about you, how we have used it and who we have shared it with;
• give you a copy of it;
• correct information that is wrong or incomplete; and
• stop sending you emails, or withdraw your consent.

Send your request in writing to privacy@xenoform.ca. We may ask you to confirm your identity. We will answer within 30 days, or tell you if we need more time and why, as the law allows. Requests are usually free; if a request would cost a lot to fulfil, we will give you an estimate first. If we cannot give you some information, for example because it includes someone else's personal information, we will explain why.

Children

Our website and services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal information from children.

Questions and complaints

Please contact our Privacy Officer first at privacy@xenoform.ca. We will look into every concern and tell you what we find.

If you are not satisfied with our answer, you can contact:

• the Office of the Information and Privacy Commissioner of Alberta; or
• the Office of the Privacy Commissioner of Canada.

Changes to this policy

We may update this policy as our services or the law change. We will post the new version here with a new "Last updated" date. If a change materially affects how we use information we already hold, we will tell clients and subscribers by email before it takes effect.

Contact us

Privacy Officer
2747636 Alberta Ltd., operating as XenoForm
Edmonton, Alberta, Canada
privacy@xenoform.ca