Privacy Policy

1. Introduction and scope

This privacy policy (the “Policy”) explains how PartnerAZ Technologies Inc. (“PartnerAZ”, “we”, “us”), a British Columbia corporation, handles personal information. We operate a platform at app.partneraz.com (the “Platform”) on which municipalities and other public sector organizations (“Municipal Organizations”) discover technology offerings, research and assess technology vendors (“Vendors”) against criteria they set, and the two sides arrange meetings. Our website at www.partneraz.com is the “Site”. Use of the Platform is also governed by our terms of service (the “Terms”) and, for a Municipal Organization, by its Terms together with any signed agreement with us (the “Municipal Organization Agreement”).

“Personal information” means information about an identifiable individual. This Policy also covers business contact information.

We handle personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, the Personal Information Protection Acts of British Columbia and Alberta. The Platform is not offered to organizations or individuals in Quebec.

The Platform is for business users aged 18 and older and is not directed to children. If you believe someone under 18 has given us personal information, write to privacy@partneraz.com and we will delete it unless the law requires us to keep it.

2. Our role

For personal information PartnerAZ collects from its own users and Site visitors, PartnerAZ is the organization accountable for it.

For the records a Municipal Organization creates through its use of the Platform (“Municipal Organization records”, listed in section 3), PartnerAZ holds and processes those records as the Municipal Organization’s service provider, on its instructions, and the Municipal Organization remains accountable for them under the law that applies to it. PartnerAZ does not use Municipal Organization records for its own purposes except to operate and secure the Platform and as described in section 5. Where the Municipal Organization Agreement addresses the same subject as this Policy, it governs PartnerAZ’s handling of Municipal Organization records.

Vendor application content and published offerings (“Vendor content”) are Vendor-authored records that PartnerAZ holds so that Municipal Organizations can review them.

3. Information we collect

Account information: your name, work email, job title, onboarding answers, settings and team invitations, and your organization’s name, type, location, website and profile details, including a Vendor’s plan type.

Vendor content: a Vendor’s application answers and published offerings, such as descriptions, pricing, customer deployments and links to videos, review sites and social profiles, including the name and role of any customer who gives a testimonial.

Municipal Organization records: review decisions, scoring settings, department roles, viewing history, comments and notes, connection codes its users share with Vendors, and the messages sent with invitations and meeting requests.

Meeting scheduling data: proposed and confirmed times, availability offered, attendees, topic and the meeting link, and the Microsoft or Google calendar access you grant to create the meeting link; we do not read your calendar.

Sign-in and technical data: sign-in is managed by Auth0 by Okta in Canada through your Google or Microsoft account; we hold no passwords. We collect IP address, browser and device details, pages used, timestamps and error diagnostics for security, troubleshooting and aggregate statistics.

Site visitors: Apollo, Google Analytics and HubSpot (the “Site tools”) collect pages viewed, approximate location, device details and their own identifiers; contact and demo requests collect what you send, which HubSpot processes for us.

Forwarded emails: a Municipal Organization may forward an email from a vendor not yet on the Platform so that the vendor is invited to apply; we use the vendor’s name and email address only to send that invitation.

We do not ask for government identification numbers, payment details or health, biometric or genetic information; paid Vendors provide billing details in a signed agreement outside the Platform.

4. Consent

The user who creates an organization accepts the applicable Terms and this Policy, which we record, and invited users consent by using the Platform under them. Google or Microsoft account access is granted on that provider’s consent screen and analytics cookies in the Site’s banner. You may withdraw consent as described in section 9.

5. How we use personal information

To operate the Platform: accounts, routing applications to the Municipal Organizations and departments a Vendor selects, showing published offerings, scheduling meetings and sending service notices. To protect the Platform and enforce the Terms. To meet legal obligations. To understand how the Platform and the Site are used and to improve them.

To compute the match score, a weighted calculation of a Vendor’s answers against criteria the Municipal Organization sets and weights. The score is advisory; Municipal Organizations decide which Vendors to review or meet.

We do not use personal information to train artificial intelligence or machine learning models. We may improve how offerings are matched and ranked using aggregated or anonymized information.

To send promotional email and Platform announcements only where we have consent under Canada’s Anti-Spam Legislation, with a way to unsubscribe in every such message.

6. Retention

We keep personal information only as long as the purposes in this Policy require or the law demands.

Account information, Vendor content and scheduling data are deleted from active systems within 30 days of account closure and from backups within 90 days, except records we must keep for a legal, audit or dispute purpose, and except applications already submitted to a Municipal Organization, which stay with it for its own retention period. Municipal Organization records are kept as the Municipal Organization Agreement provides. Technical and log data is kept as long as needed for security, troubleshooting and audit. Forwarded emails are kept for 60 days, and the invited vendor’s address for no longer than 12 months. Paid Vendor agreements and invoices are kept for six years after the relevant taxation year, as required by law.

7. Sharing and third parties

We do not sell personal information.

Within the Platform. Vendor content is shown to the Municipal Organizations and departments the Vendor applied to, and published offerings to Municipal Organizations on the Platform. A Vendor sees a Municipal Organization’s name, its department names and the messages its users write, not users’ names or email addresses, except through a connection code a user chooses to share or a meeting a user hosts from their own calendar account.

Service providers. Platform hosting, email and sign-in are provided by Amazon Web Services and Auth0 by Okta, in Canada, under written data protection terms.

Location. Personal information you enter in the Platform, and email sent to our forwarding address, is stored and processed in Canada, including backups. The Site tools process your data in the United States, and a Vendor’s video plays from YouTube, Loom or Vidyard, under that service’s terms, only when you choose to play it. Amazon and Okta are headquartered in the United States, and the Site tools and video services operate there, so each may be required to disclose information to courts, law enforcement or national security authorities under United States law. We manage this through provider selection, written data protection terms and access controls, and remain accountable for personal information our providers handle on our behalf.

Legal demands. We disclose personal information where the law requires or permits it, including in response to a court order, warrant, production order or other lawful demand. Where the law permits and it is appropriate, we tell the Municipal Organization, or the individual where PartnerAZ is the accountable organization.

Business transactions. In a merger, acquisition, financing or sale of assets, personal information may be disclosed to the counterparty under confidentiality terms and transferred to a successor that takes on the commitments in this Policy.

8. Cookies

The Platform sets only the cookies it needs for sign-in, your preferences and error diagnostics; a video you choose to play may set its own. The Site tools’ cookies load only after you accept them in the cookie banner. Site analytics do not access Platform data. The Cookie Policy explains the cookies we use and how to manage them.

9. Your rights

Subject to the law, you may ask what personal information we hold about you, how it has been used and to whom it has been disclosed; ask us to correct it, and have your request noted if we disagree; withdraw consent, which may mean we can no longer provide a feature or the account; and ask us to delete your account information, subject to the exceptions in section 6.

You can update your name and title in Settings. To make a request, write to privacy@partneraz.com. We may ask for information needed to verify your identity. We respond within 30 days of a written request; if we need more time, we tell you in writing the new deadline, the reason and your right to complain. If we refuse all or part of a request, we say why and how to challenge it. Where your request concerns a Municipal Organization’s records, we refer it to that Municipal Organization.

Complaints. Raise a concern with our Privacy Officer (section 12) first. You may also complain to the Office of the Privacy Commissioner of Canada or, where British Columbia’s or Alberta’s Personal Information Protection Act applies to you, to that province’s Information and Privacy Commissioner. Complaints about a Municipal Organization’s records go to that Municipal Organization and its own regulator.

10. Security

We protect personal information with administrative, technical and physical safeguards suited to its sensitivity, including encryption in transit and at rest. No system is perfectly secure.

11. Breach notification

If it is reasonable to believe that a breach of security safeguards involving personal information under our control creates a real risk of significant harm to an individual, we report the breach to the Office of the Privacy Commissioner of Canada and to any provincial commissioner the law requires, and notify affected individuals as soon as feasible, unless the law prohibits it. Where the breach involves a Municipal Organization’s records, we notify that Municipal Organization as the law and the Municipal Organization Agreement require, so it can meet its own reporting duties. We keep a record of every such breach as the law requires.

12. Privacy Officer and contact

We have designated a Privacy Officer who is accountable for compliance with PIPEDA and applicable provincial privacy law, handles access requests and complaints, and whose name is given on request. Write to: Attention Privacy Officer, PartnerAZ Technologies Inc., 406-990 Broughton Street, Vancouver, BC V6G 2A5, or privacy@partneraz.com. Municipal Organizations may write to legal@partneraz.com for data location and privacy assessment requests.

13. Changes to this Policy

We may revise this Policy as the Platform or the law changes. Each version carries its effective date, and earlier versions are available on request. Non-material updates take effect when posted. For significant changes to how we collect, use or disclose personal information, we notify affected users and obtain any consent the law requires before the change takes effect.

14. Links

The Platform and Site link to sites we do not control, including Vendor websites and videos. This Policy does not cover them.