Privacy Policy

1. Introduction

NorthBridge Academy Inc. (“NorthBridge Academy,” “we,” “us,” or “our”) is the data controller responsible for the personal information collected through our website and related services. Our registered office is located at 250 University Avenue, Suite 1200, Toronto, ON M5H 3E5, Canada. Our Business Number is 712845309 RC0001.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have regarding your information. By using our website or submitting information to us, you acknowledge that you have read and understood this policy. If you do not agree with any part of this policy, please do not use our website or provide us with your personal information.

We are committed to handling your personal information with care and in accordance with applicable Canadian federal and provincial privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA).

2. What Data We Collect

We collect the following categories of personal information:

2.1 Information You Provide Directly

When you fill out our demo booking form or contact us by email, we may collect:

• Full name
• Company or organization name
• Email address
• Phone number (when provided voluntarily)
• Team size
• Preferred demo date
• Free-text messages or questions you include in the form

2.2 Information Collected Automatically

When you visit our website, certain technical information is gathered automatically through cookies and similar tracking technologies:

• IP address (anonymized where applicable)
• Browser type and version
• Operating system
• Referring URL and pages visited
• Date, time, and duration of your visit
• Device type (desktop, tablet, or mobile)
• Screen resolution and language preference

3. Legal Basis for Collection

We collect and process your personal information based on the following legal grounds:

• Consent: When you submit a demo booking form or sign up for communications, you give us explicit consent to process your data for the stated purposes. You may withdraw consent at any time by contacting us.
• Legitimate Interest: We process certain data (such as analytics and website usage patterns) based on our legitimate interest in understanding how visitors use our site, improving site performance, and ensuring the security of our services. These interests do not override your fundamental rights and freedoms.
• Contractual Necessity: When you enroll in a training program, we process your information as necessary to fulfill our contractual obligations to you, including scheduling, invoicing, and providing access to lab environments.

4. How We Use Your Data

The personal information we collect is used for the following purposes:

• Demo Booking: To process and confirm your demo request, schedule a time with an instructor, and follow up with relevant information about our training programs.
• Service Provision: To deliver the training services you have enrolled in, manage your account, grant access to lab environments, and provide mentoring and support.
• Communication: To respond to your inquiries, send booking confirmations, and provide service-related updates. We will not send unsolicited marketing emails unless you have given explicit consent to receive them.
• Analytics: To analyze aggregate website usage data so we can understand traffic patterns, identify technical issues, and improve the user experience on our site.
• Billing and Administration: To generate invoices, process payments in Canadian dollars, and maintain accurate financial records as required by law.

5. Third-Party Services

We use a limited number of third-party services to operate our website and understand visitor behaviour. These services may collect and process data on our behalf:

• Google Analytics: We use Google Analytics to collect anonymized data about website traffic and user interactions. IP anonymization is enabled, meaning your full IP address is never stored by Google Analytics. Data is processed in accordance with Google’s privacy practices.
• Google Ads: If you arrive at our website through a Google Ads campaign, certain conversion tracking data may be collected to measure the performance of our advertising. This data is aggregated and does not identify you personally.
• Google Tag Manager (GTM): We use GTM to manage tracking scripts on our website. GTM itself does not collect personal data, but it facilitates the deployment of tags that may do so (such as Google Analytics and Google Ads tags).

We do not sell, rent, or trade your personal information to any third party. Third-party service providers who process data on our behalf are contractually bound to use the data only for the purposes we specify and in accordance with applicable privacy laws.

6. Cookies

Our website uses cookies — small text files placed on your device — to provide functionality and gather usage information. Below is a list of the cookies we use:

You can control cookie preferences through the consent banner displayed on your first visit. Necessary cookies cannot be disabled because they are required for core site functionality. You may also manage cookies through your browser settings at any time. Disabling analytics or marketing cookies will not affect your ability to use the website.

7. Data Retention

We retain personal information only for as long as it is necessary to fulfill the purposes for which it was collected, or as required by law. Our specific retention periods are:

• Form submissions (demo booking requests, contact inquiries): retained for 24 months from the date of submission, after which they are permanently deleted from our systems.
• Analytics data (Google Analytics): retained for 14 months. After this period, user-level and event-level data is automatically deleted by Google Analytics.
• Billing and invoicing records: retained for the period required by applicable Canadian tax legislation (typically 6 years from the end of the relevant tax year).
• Cookie data: retained according to the durations specified in the cookie table above.

When data is no longer needed, we delete it securely or anonymize it so that it can no longer be linked to you.

8. Your Rights

You have the following rights with respect to your personal information:

• Right of Access: You may request a copy of the personal data we hold about you. We will respond within 30 days of receiving your request.
• Right to Rectification: If any of the information we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it.
• Right to Erasure: You may request that we delete your personal data, provided there is no legal obligation requiring us to retain it. We will process deletion requests within 30 days.
• Right to Data Portability: Where technically feasible, you may request that we provide your personal data in a structured, commonly used, and machine-readable format so you can transfer it to another service.
• Right to Object: You have the right to object to the processing of your personal data for purposes based on our legitimate interests. Upon receiving your objection, we will cease processing unless we can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

9. For Canadian Residents

NorthBridge Academy Inc. is a Canadian corporation and is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activities.

Under PIPEDA, we adhere to the following ten fair information principles:

• Accountability for the personal information under our control
• Identifying the purposes for which personal information is collected
• Obtaining meaningful consent for the collection, use, and disclosure of personal information
• Limiting collection to information that is necessary for the stated purposes
• Limiting use, disclosure, and retention to the stated purposes
• Ensuring personal information is accurate, complete, and up to date
• Protecting personal information with appropriate security safeguards
• Being transparent about our policies and practices
• Providing individuals with access to their personal information upon request
• Providing a mechanism for individuals to challenge our compliance

If you reside in a province with its own privacy legislation — such as the Personal Information Protection Act (PIPA) in Alberta or British Columbia, or the Act Respecting the Protection of Personal Information in the Private Sector in Quebec — those provincial laws may apply in place of or in addition to PIPEDA. We comply with all applicable provincial privacy statutes.

If you believe that we have not handled your personal information in accordance with PIPEDA or applicable provincial legislation, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada or the relevant provincial privacy commissioner.

10. How to Exercise Your Rights

To exercise any of the rights described above, or to ask a question about this Privacy Policy, please contact us by email at:

info@northbridgeacademy.ca

When submitting a request, please include your full name and the email address you used when interacting with our services so that we can locate your records. We may ask you to verify your identity before processing certain requests in order to protect your personal information from unauthorized access.

We will acknowledge receipt of your request within 5 business days and provide a substantive response within 30 calendar days. If we require additional time due to the complexity of the request, we will inform you of the extension and the reasons for it.

11. Data Security

We take the security of your personal information seriously and have implemented appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction. These measures include:

• TLS Encryption: All data transmitted between your browser and our website is encrypted using Transport Layer Security (TLS). This ensures that information you submit through our forms cannot be intercepted in transit.
• Access Controls: Access to personal data within our organization is restricted to staff members who require it to perform their duties. All staff with access to personal data are bound by confidentiality obligations.
• Regular Review: We periodically review our security practices and update them as necessary to address new threats and maintain the integrity of your data.
• Incident Response: In the event of a data breach that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by the breach notification provisions of PIPEDA.

While we take all reasonable precautions, no method of data transmission or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to protecting your information to the best of our ability.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make changes, we will update the “Last updated” date at the top of this page.

If we make material changes that significantly affect how we handle your personal information, we will make reasonable efforts to notify you — for example, by posting a prominent notice on our website or sending an email to the address you provided.

We encourage you to review this page periodically to stay informed about our privacy practices. Continued use of our website after the posting of changes constitutes your acceptance of those changes.

This policy was last updated on September 1, 2026.

13. Contact Information

If you have any questions, concerns, or requests related to this Privacy Policy or our handling of your personal data, please contact us: