Privacy Policy

Last Updated: February 12, 2026

1. Introduction & Controller Identity

This Privacy Policy explains how IT Education Canada Ltd. ("we", "us", or "our") collects, uses, stores, and protects your personal data when you visit iteducationcanada.ca (the "Site"). IT Education Canada Ltd. is the data controller responsible for processing your personal information.

Data Controller: IT Education Canada Ltd.
Registered Address: 100 King Street West, Suite 5600, Toronto, ON M5X 1C9, Canada
Contact Email: [email protected]
Effective Date: February 12, 2026

If you have questions or concerns about how your data is handled, contact us at the email address above. We aim to respond to all privacy-related inquiries within 30 calendar days.

2. Personal Data We Collect

We collect the following categories of personal data, depending on how you interact with the Site:

• Identity and contact data: Full name, email address, and phone number when you voluntarily submit them through our consultation forms or newsletter sign-up.
• Form content: Messages, project descriptions, areas of interest, and any additional details you provide in free-text form fields.
• Technical data: IP address, browser type and version, device type, operating system, preferred language, and screen resolution.
• Usage data: Pages visited, time spent on each page, referral source, click paths, and scroll depth.
• Cookies and identifiers: Cookie IDs, session tokens, and advertising identifiers as described in Section 4 below.
• Conversion events: Form submissions, button clicks, and page-view events sent to analytics and advertising platforms when you have consented.

We do not collect special-category data (such as health information, religious beliefs, political opinions, sexual orientation, or biometric data), financial account details, or government-issued identification numbers through this Site.

3. Why We Process & Legal Basis

Under GDPR Article 6, we process your data on the following legal bases:

• Contact and consultation forms: Performance of a contract or pre-contractual steps at your request (Art. 6(1)(b)) and your consent (Art. 6(1)(a)).
• Analytics: Your consent (Art. 6(1)(a)), obtained through the cookie consent mechanism before any analytics cookies are set.
• Marketing, remarketing, and lookalike audiences: Your consent (Art. 6(1)(a)), obtained before marketing cookies are activated.
• Security and fraud prevention: Our legitimate interest in maintaining a secure website and protecting against malicious activity (Art. 6(1)(f)).
• Legal and tax obligations: Compliance with applicable law (Art. 6(1)(c)).

Under Canadian law, we rely on the principles set out in the Personal Information Protection and Electronic Documents Act (PIPEDA), including meaningful consent, limited collection, and purpose limitation.

Automated Decision-Making (Art. 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on you.

4. Cookies & Tracking

We use three categories of cookies and tracking technologies. Full details, including cookie names and retention periods, are available in our Cookie Policy.

Essential Cookies (no consent required, always active):

• _site_session — Maintains session continuity. First-party. Session duration.
• cookie_consent — Stores your cookie preference choices. First-party. 12 months.

Analytics Cookies (consent required):

• Google Analytics 4 (GA4) with IP anonymisation enabled. Data retention set to 14 months.
• _ga — GA4 user identifier. Third-party. 2 years.
• _ga_XXXXXXXXXX — GA4 session state (10-character GA4 measurement ID). Third-party. 2 years.

Marketing Cookies (consent required):

• _gcl_au — Google Ads conversion linker. Third-party. 90 days.
• _fbp — Meta Pixel browser identifier. Third-party. 90 days.
• _fbc — Meta Pixel click identifier. Third-party. 90 days.
• Used for remarketing, conversion attribution, custom audiences, and lookalike audience building.

Beyond cookies, we may use pixel tags (gtag.js, Meta Pixel), server-side event tracking via Meta Conversion API or Google Server-Side GTM (transmitting hashed identifiers), and device identifiers derived from IP address and User-Agent combinations.

5. Consent (EEA/UK)

Users in the European Economic Area and the United Kingdom receive a consent notice under GDPR and UK GDPR respectively. Marketing and analytics cookies activate only after explicit, informed, freely given consent (Art. 6(1)(a)). Your consent choice is recorded in the cookie_consent browser cookie, which is retained for 12 months.

You may withdraw consent at any time by clicking "Manage Cookie Preferences" in the website footer or by clearing your browser cookies. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

6. Sharing With Advertising & Service Partners

We share data with the following categories of service providers, solely for the purposes described:

• Google LLC (Google Analytics 4, Google Ads, Google Tag Manager, Remarketing): Cookie IDs, usage data, conversion events, and remarketing list membership. Google's privacy policy: policies.google.com/privacy
• Meta Platforms, Inc. (Meta Pixel, Custom Audiences, Lookalike Audiences, Conversion API): Page-view events, conversion data, audience membership, and hashed identifiers. Meta's privacy policy: facebook.com/privacy/policy
• Cloudflare, Inc. (CDN and security): IP-based threat detection and DDoS mitigation. Cloudflare's privacy policy: cloudflare.com/privacypolicy

We do not sell personal data. These providers are contractually prohibited from using Site data for their own independent commercial purposes beyond delivering the services described.

7. International Transfers

Some of our service providers (notably Google and Meta) process data in the United States. For transfers outside the EEA/UK, we rely on the following safeguards:

• EU-US Data Privacy Framework (primary mechanism, effective since July 2023)
• UK Extension to the EU-US Data Privacy Framework
• Swiss-US Data Privacy Framework
• Standard Contractual Clauses (EU Commission Decision 2021/914) as a fallback mechanism
• UK International Data Transfer Agreement (IDTA) as a fallback for UK-originating transfers

For transfers from Canada, we comply with PIPEDA's requirements for accountability and adequate protection when data crosses borders.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected:

• Contact form submissions: 2 years from the date of your last interaction with us.
• Analytics data: 14 months (GA4 data retention setting).
• Marketing cookies: Per individual cookie lifetime (see Section 4), maximum 2 years.
• Email correspondence: Duration of the consulting relationship plus 1 year.
• Server logs: 90 days.
• Cookie consent records: 3 years (for audit and compliance documentation).
• Legal and tax records: As required by applicable law, typically 6 to 10 years for invoices and financial records.

After the applicable retention period, data is securely deleted or irreversibly anonymised.

9. Your Rights (GDPR & UK GDPR)

If you are located in the EEA or the UK, you have the following rights under data protection law:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to Erasure (Art. 17): Request deletion of your data, subject to legal retention requirements.
• Right to Restriction (Art. 18): Request that we limit processing while a dispute is resolved.
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interest, including direct marketing.
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint (Art. 77): File a complaint with your local supervisory authority.

To exercise any of these rights, email us at [email protected] with the subject line "Privacy Rights Request". We will respond within 30 calendar days. This period may be extended by up to 60 additional days for complex or numerous requests, in which case we will notify you of the extension and the reasons for it.

Relevant Supervisory Authorities:

• Canada: Office of the Privacy Commissioner of Canada — priv.gc.ca
• EU (general): European Data Protection Board — edpb.europa.eu
• UK: Information Commissioner's Office — ico.org.uk
• Germany: Federal Commissioner for Data Protection — bfdi.bund.de
• France: Commission Nationale de l'Informatique et des Libertés — cnil.fr

10. Children

This Site is not directed at individuals under the age of 16. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a child under 16 without verifiable parental consent, we will delete that data promptly. If you believe a minor has provided personal data through our Site, please contact us immediately at [email protected].

11. Do Not Track

This website does not respond to "Do Not Track" (DNT) browser signals. There is currently no universally accepted standard for how DNT signals should be interpreted by websites. Third-party providers integrated into this Site (such as Google and Meta) may have their own DNT handling policies, which are governed by their respective privacy policies linked in Section 6.

12. Account & Data Deletion

To request deletion of all personal data we hold about you, send an email to [email protected] with the subject line "Data Deletion Request". We will complete the deletion within 30 calendar days of verifying your identity. Limited retention beyond this period occurs only where required by law (for example, tax records that must be kept for the statutory retention period under Canadian or provincial law).

13. Business Transfers

In the event of a merger, acquisition, asset sale, financing arrangement, or insolvency proceeding involving IT Education Canada Ltd., personal data may be transferred to a successor entity as part of the transaction. We will notify users via a prominent notice on the Site if such a transfer materially changes how your data is used. The successor entity will be bound by the commitments in this Privacy Policy until it publishes a revised policy with at least 14 days advance notice.

14. California (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) grants you specific rights regarding your personal information.

Categories of personal information disclosed in the past 12 months:

• Identifiers (name, email, IP address, device IDs) — disclosed to service providers and advertising partners.
• Internet or other electronic network activity (browsing history, interactions with the Site) — disclosed to analytics and advertising providers.
• Inferences (interests, preferences derived from usage data) — disclosed to advertising partners for audience building.

We do not sell personal information as defined by the CCPA. We do share personal information for cross-context behavioural advertising. California residents may opt out of this sharing via the cookie preferences panel accessible from the "Manage Cookie Preferences" link in the website footer.

Your California rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information collected.
• Right to Delete: Request deletion of personal information we have collected.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: Opt out of the sharing of personal information for cross-context behavioural advertising.
• Right to Non-Discrimination: Exercise your rights without receiving discriminatory treatment.

To submit a request, email [email protected] with the subject line "California Privacy Request". We will verify your identity before processing the request. Authorised agents may submit requests on your behalf with written proof of authorisation.

15. Virginia (VCDPA)

Virginia residents have the following rights under the Virginia Consumer Data Protection Act:

• Right to Access: Confirm whether we are processing your personal data and obtain a copy.
• Right to Correct: Request correction of inaccuracies.
• Right to Delete: Request deletion of personal data.
• Right to Data Portability: Obtain your data in a portable, readily usable format.
• Right to Opt-Out of Targeted Advertising: Opt out via our cookie preferences panel.

To submit a request, email [email protected] with the subject line "Virginia Privacy Request". We do not sell personal data or engage in profiling that produces legal or similarly significant effects.

Appeals: If we refuse a request, you may appeal by emailing us with the subject line "Appeal of Refusal — Privacy Request". We will respond to appeals within 60 days. If the appeal is denied and you remain unsatisfied, you may contact the Virginia Attorney General.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject line "Nevada Do Not Sell Request". We do not currently sell personal information as defined under Nevada Revised Statutes Chapter 603A.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. Material changes will be announced via a banner on the homepage at least 14 days before taking effect. The "Last Updated" date at the top of this page will be revised with every new version. We encourage you to review this page periodically.

18. Contact

If you have any questions about this Privacy Policy or how we handle your personal data, you can reach us at:

IT Education Canada Ltd.
100 King Street West, Suite 5600
Toronto, ON M5X 1C9, Canada
Email: [email protected]
Phone: +1 (416) 907-4823