Privacy policy

Gpenda Technologies Inc. (Gpenda Technologies) is an IT and cybersecurity company based in Toronto, Ontario, Canada. We are the organisation responsible for the personal information described on this page.

• Address: 561 Sherbourne Street, Toronto, ON M4X 0A1, Canada
• Phone: +1 437-320-4284
• Privacy contact: privacy@gpendatechnologies.ca

We only collect information you choose to give us through a form or an account, plus a small amount of technical context that arrives with those submissions. We do not buy personal information about website visitors, and we do not sell yours.

We handle personal information in line with the principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). In practice that means:

• We identify the purpose before or at the time we collect information — the purposes listed above are the only ones we use it for.
• We rely on your consent. Submitting a form or creating an account is your consent for the purpose described on that form, and you can withdraw it at any time.
• We limit collection to what is needed for that purpose.
• We do not use your information for an unrelated new purpose without asking you first.

Essential cookies and browser storage keep you signed in, protect the site, and remember your cookie choices. Analytics and marketing categories are optional and stay switched off unless you opt in through the cookie banner. Full detail, and the controls to change your mind, are on our cookie policy page.

We share personal information only with the providers that run parts of our service, and only so far as they need it to do that job. They are not permitted to use it for their own purposes.

• Cloud hosting, database, storage and authentication — runs this website, stores form submissions, files and accounts.
• Email delivery — sends transactional and reply emails from our own domain and records bounces and unsubscribes.
• Stripe — processes card payments and holds the card data we never receive.
• Social publishing tools — schedule and publish our own marketing posts. No visitor or customer data is sent to them.
• AI content generation — used to draft our own marketing material. We do not feed your enquiries, resumes or customer records into it, and it is not used to make decisions about you.

We may also disclose information where we are legally required to, or to protect our rights or the safety of others.

We keep personal information only as long as it is needed for the purpose it was collected for — for example, to run an active conversation, complete an engagement, assess an application, or meet our accounting and legal obligations — and then delete it. We do not keep records indefinitely "just in case". If you ask us to delete your information sooner, we will do so unless we are legally required to retain it.

These are the concrete measures in place, not aspirations:

• All traffic to and from this website is encrypted in transit (HTTPS).
• Uploaded files — contact attachments and resumes — go into private storage buckets that are not publicly readable.
• Database access is governed by row-level access rules, so accounts can only reach their own records.
• Administrative areas require sign-in and an explicit admin role; roles are stored server-side and cannot be granted from the browser.
• Payment card data is handled entirely by our payment processor.

Our privacy practices follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Payments are processed by Stripe, a PCI DSS Level 1 certified payment provider — card details are entered on Stripe's systems and never reach our servers or database, so cardholder data stays within Stripe's PCI-compliant environment.

You can ask us at any time to:

• Tell you what personal information we hold about you and how it has been used.
• Correct information that is wrong or out of date.
• Delete your information, or close your account.
• Withdraw consent for a purpose you previously agreed to.
• Stop marketing email — every marketing email includes an unsubscribe link, and one click is enough.

Email privacy@gpendatechnologies.ca and we will respond within a reasonable time, normally within 30 days. We may need to confirm your identity before acting on a request. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

Our services are intended for businesses and the adults who run them. We do not knowingly collect personal information from children under 13. If you believe a child has sent us information, email us and we will delete it.

We are based in Canada, but some of the providers listed above operate infrastructure in other countries, including the United States. Where that happens, your information may be stored or processed outside Canada and can be subject to the laws of those countries. We use established providers with contractual protections in place.

If we change how we handle personal information, we will update this page and change the "last updated" date at the top. Material changes will be reflected here before they take effect.

Privacy questions, requests or complaints: privacy@gpendatechnologies.ca, or call +1 437-320-4284. By post: Gpenda Technologies Inc., 561 Sherbourne Street, Toronto, ON M4X 0A1, Canada.