Personal Data Charter, Cookies and Trackers

1. Who we are

Global Data and BI Inc., operating as NoèmeX, is the legal entity that operates the Site and is responsible for the processing of personal information collected through it.

Registered address: 371 Front Street W, Unit D1, Toronto, ON, M5V 3R8.

Privacy contact: data-protection@noemex.com.

Under Quebec’s Act respecting the protection of personal information in the private sector (“Law 25”), the person in charge of the protection of personal information is designated by title, not by name. Absent a written delegation, this role is held by GDBI’s most senior officer. For GDPR purposes, GDBI acts as the data controller for personal data collected through this Site.

This Charter covers browsing noemex.com, submitting a contact, sales or partnership enquiry, requesting a gated resource, subscribing to or unsubscribing from follow-up email, and, at a summary level only, submitting a job application. Job applicants are covered in full detail by our separate Global Recruiting Privacy Policy.

It does not cover third-party websites We link to, Noème.ai products once a customer is using them in production, which are governed by their own terms and privacy documentation or offline interactions with GDBI not initiated through this Site.

2. Purpose of processing, legal basis and retention period

This table sets out the principal purposes for which We process personal data, the categories involved, the legal basis We rely on and the applicable retention approach.

Purpose	Categories of personal data	Legal basis	Retention period
Respond to a contact, sales or partnership enquiry and evaluate fit for Our services	Name, work email, phone, company and role information, message content and details you volunteer	Consent; contract or pre-contractual steps	As long as necessary to respond and follow up, subject to applicable rights and legal obligations
Deliver a gated resource you requested	Contact and professional information, plus a record of when the download link was used	Consent	As long as necessary for the purpose, subject to applicable rights and legal obligations
Verify your email address and process unsubscribe requests	Email address; verification and unsubscribe status and timestamps	Legal obligation (CASL); legitimate interests	As long as necessary for the purpose, subject to legal retention requirements
Evaluate a job application	Identity and contact details, work history, resume text and links you provide	Consent; contract or pre-contractual steps; legitimate interests	See the Global Recruiting Privacy Policy
Measure aggregate Site usage	Pages viewed, navigation patterns and general traffic data	Consent, given through the cookie banner	Until you withdraw consent; see section 7
Protect the Site against abuse	IP address, browser and device signals, submission patterns	Legitimate interests	A short, fixed window; not separately retained beyond that window

When you submit a contact, sales or partnership enquiry, We may derive a coarse privacy-region value from your submitted country and region. It is used only to determine which regional privacy rules apply to the record internally and is not used for marketing targeting.

3. Legal frameworks that apply to you

3.1 PIPEDA (Canada)

PIPEDA’s organizing principle is meaningful, purpose-limited consent. We collect, use and disclose personal information only for purposes a reasonable person would consider appropriate, identify those purposes at or before collection and obtain consent before using data for a new purpose except where law permits otherwise.

3.2 Quebec’s Law 25

Law 25 operates alongside PIPEDA’s consent framework for Quebec residents. It includes requirements concerning clear consent for sensitive information, privacy impact assessments for certain transfers outside Quebec, de-indexing and cessation-of-dissemination rights in specified circumstances and transparency concerning decisions based exclusively on automated processing.

GDBI does not use automated decision-making to make decisions about general website visitors or leads.

3.3 The GDPR

For visitors and leads in the EEA, UK or Switzerland, We may rely on consent, contract or pre-contractual steps, legitimate interests for anti-abuse/security processing and legal obligations where applicable.

4. Recipients of the data

We use a limited number of service-provider categories to operate the Site. They process personal data only for the purposes described in this Charter and under appropriate contractual or organizational controls.

Recipient category	What they do
Website hosting provider	Hosts, builds and serves pages and records standard server logs for security and reliability
Secure data storage system	Stores form submissions, including enquiries and job applications
Email delivery system	Sends verification, confirmation and follow-up email
Automated bot-detection service	Distinguishes human submissions from automated or bot traffic
Temporary rate-limiting system	Limits repeated form submissions to prevent abuse
Google Analytics through Google Tag Manager	Measures aggregate Site usage only where cookie consent has been given

We do not sell personal information, and We do not share it with advertisers, data brokers or parties for their own independent marketing purposes. Personal information may be disclosed where required by law.

If GDBI’s business is sold or restructured, personal information may transfer to the acquiring or restructured entity, subject to this Charter or a successor policy communicated to you.

The Site does not use advertising or behavioural-remarketing integrations, does not have a payment processor or user-account system and does not collect payment-card information.

5. Data transfers

Because service providers may operate internationally, personal data may be processed outside Canada and, depending on your location, outside Quebec, the EEA, the UK or Switzerland. Transfers are handled using safeguards required by applicable law, including privacy impact assessment obligations under Law 25 and appropriate contractual safeguards such as Standard Contractual Clauses where required under the GDPR.

6. Data security and confidentiality

We use technical and organizational measures appropriate to the sensitivity of the data described in this Charter, including anti-bot and rate-limiting controls, encrypted transport (HTTPS) and access controls limiting who can see submitted data. No transmission or storage method is completely secure, and absolute security cannot be guaranteed.

7. Cookies and trackers management

The Site may store a preferred-language value locally in your browser for job postings. That value is not transmitted to GDBI or a third party and can be cleared through your browser settings.

Non-essential cookies and trackers, such as analytics, are enabled only after consent through the cookie-preference interface. Strictly necessary technologies used to provide a feature you actively request do not require separate consent.

Category	Name	Purpose	Provider	Retention
Necessary	cf_clearance	Records that a bot-detection challenge has been passed	Cloudflare	30 minutes
Necessary	_cfuvid	Distinguishes visitors sharing the same IP address for bot-detection purposes	Cloudflare	Session
Analytics (consent required)	Google Analytics (_ga, _ga_*)	Measures aggregate Site usage and traffic sources; not used for advertising or remarketing	Google	As configured in Google Analytics

Analytics is off by default until consent is provided. Use the “Cookie preferences” control in the footer to review or change your choices at any time.

8. Your rights

Depending on applicable law, you may withdraw consent or unsubscribe, request access, request correction, request deletion subject to legal obligations, object to or restrict certain processing and exercise data-portability rights.

Quebec residents may also have rights concerning portability, automated-decision transparency and complaints to the Commission d’accès à l’information du Québec. EEA, UK and Swiss residents may have the GDPR right to lodge a complaint with their supervisory authority.

To exercise your rights, use the contact information in section 12. We may need to verify your identity before fulfilling a request.

9. Automated decision-making

We do not use automated processing to make decisions about general website visitors or leads that produce legal or similarly significant effects. Applicant processing is described separately in the Global Recruiting Privacy Policy.

10. Children’s privacy

The Site is directed at businesses and professionals, not children. We do not knowingly collect personal information from children. If you believe a child has provided personal information through the Site, contact us so it can be addressed.

11. Changes to this Charter

We may update this Charter when service providers, data flows, the Site or applicable law change. The revised Charter will be published with an updated date, and significant changes may receive additional notice.

12. Contact

For questions about this Charter or to exercise your rights, contact the privacy officer at data-protection@noemex.com or by mail at 371 Front Street W, Unit D1, Toronto, ON, M5V 3R8.