Privacy Policy

1. Who we are

Entity: Purpose Forward Technical Solutions Inc. (PF TECH)
Privacy Officer: Greg Zatulovsky, CEO (CPA, CMA)
Contact: privacy@purposeforwardtech.com

2. Where your data lives

Form submissions and mailing-list records are held in Canada, under PIPEDA. Some things necessarily travel outside it: email we send you, any call you book, the delivery of this site, and analytics — and analytics only if you consent. Section 3.1 lists the services we rely on and what each one receives.

PF TECH products carry their own terms and privacy statements — TERN's data handling, including residency options for client organisations, is covered by TERN's own privacy statement, not this policy.

3. What we collect, and why

We collect what you give us through the forms on this site — contact, program applications, friction-point submissions, newsletter sign-up, and data-erasure requests. That's what we use it for: to respond to you, assess fit, and act on your requests.

Each submission also records your IP address, browser, the page you submitted from, and any campaign (UTM) parameters. These support abuse prevention, rate limiting, and knowing which channel brought you to us.

What we never do: your submissions are not used to train AI models, ours or anyone else's, and we do not sell your data.

The Pathfinder is a partial exception worth naming: your answers live in your own browser unless you act on them. Book a call and they travel to Cal.com as booking notes; grant analytics consent and each choice is also counted as an analytics event. Do neither and they never leave your browser — we store no Pathfinder record of our own.

3.1 Services we rely on

• Cal.com (United States): booking. Receives your name, email, and meeting details — plus your Pathfinder summary if you came through it. Runs in their iframe, under their privacy policy.
• Supabase (AWS Canada East, ca-central-1): our database.
• n8n (self-hosted, Azure Canada Central): workflow automation, on PF TECH-controlled infrastructure.
• SMTP2GO (processed outside Canada): our transactional email. Receives your email address, your first name, and the one-time links in confirmation and unsubscribe messages.
• Cloudflare / Vercel (processed outside Canada): site delivery and security. Receive your IP address and request details as you browse; delivery networks are global by design and cannot be pinned to a single country.
• Google Analytics 4 / Tag Manager (United States): anonymised usage analytics, loaded only after you consent via the cookie banner.
• Helcim: payment processing, not yet active on this site. This policy will be updated before it launches; no card data will ever be stored on PF TECH servers.

4. Your rights under PIPEDA

As a Canadian organisation subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), we uphold your rights to:

• Access the personal information we hold about you, with an explanation of how it has been used.
• Correct anything inaccurate or incomplete.
• Withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.
• Erase your data through the self-serve data-erasure page (verified by email, and the link is valid for 72 hours), or by writing to our Privacy Officer. This empties your form submissions and your mailing-list record. One thing is kept: your email address, flagged as permanently unsubscribed, so we can honour the request and never contact you again.
• Complain — first to our Privacy Officer, and if unresolved, to the Office of the Privacy Commissioner of Canada.

To exercise any of these, write to privacy@purposeforwardtech.com.

5. How long we keep it

• Form submissions: while we have an active relationship or open enquiry with you, reviewed at least annually. You can request earlier erasure at any time.
• Mailing-list records: while you are subscribed. After that, only the suppression record described in Section 4.
• Consent records: for the life of your subscription, as proof of consent. Your cookie choice lives in your own browser for up to 12 months, then we ask again.
• Rate-limiting logs: deleted automatically after 30 days.
• Analytics cookies: up to 2 years (see the Cookie Policy).

6. Visitors in the EEA and UK

Some of our programs are open worldwide. If you are in the European Economic Area or the United Kingdom, the GDPR (or UK GDPR) applies, supplementing the rights above.

• Legal bases: consent (cookies, email subscriptions — withdrawable anytime), legitimate interests (abuse prevention, security logging), and steps prior to a contract (program enquiries and applications).
• Additional rights: data portability, restriction of processing, and objection to processing based on legitimate interests — exercised via the data-erasure page or our Privacy Officer.
• Transfers: our database and workflow automation are held in Canada, which holds a European Commission adequacy decision. The services in Section 3.1 marked as processed outside Canada rely on their own EU-approved safeguards, and personal information handled there may be subject to the laws of the country it is processed in.
• Complaints: you may also contact the supervisory authority in your country of residence.