Privacy Policy

Altergy Network Solutions Corp. ("Altergy," "we," "us," or "our") is committed to protecting the privacy and personal information of our customers, website visitors, and platform users. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices and rights you have regarding your information.

This Privacy Policy applies to the altergy.ca website, the Altergy customer and staff platform, and all services provided by Altergy (collectively, the "Services"). It does not apply to third-party websites or services that we link to or integrate with.

Altergy is a business-to-business service provider. We collect personal information primarily in the context of providing professional services to our business customers. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), the Canada Anti-Spam Legislation (CASL), and applicable provincial privacy laws including Quebec's Law 25.

2.1 Information You Provide Directly

• Contact information: Name, email address, phone number, business name, and job title when you submit a service request, register for an account, or contact us.
• Project information: Business details, website URLs, branding assets, content, and other materials you provide for the purpose of delivering Services.
• Billing information: Invoice details, payment references, and transaction metadata. We do not store full credit card numbers or banking credentials on our systems.
• Communication content: Messages, support tickets, and notes you submit through the platform or via email.

2.2 Information Collected Automatically

• Technical data: IP address, browser type, device information, and operating system when you visit our website or use the platform.
• Usage data: Pages visited, features used, time spent, and click patterns within the platform.
• Cookies and similar technologies: See our Cookie Policy for details.

2.3 Information Collected Through Campaign Services

• Lead data: When performing lead generation or appointment setting on behalf of a Customer, we process contact information of the Customer's prospects, including names, business emails, phone numbers, and company details. This information is processed on behalf of and under the instructions of the Customer, who is the business owner of that data.
• Call recordings: Telephone calls made through our telephony platform may be recorded for quality assurance, training, and compliance purposes. Participants are notified when recording is active.

We use personal information for the following purposes:

• Service delivery: To provide, operate, and maintain the Services you have requested, including website development, software development, lead generation, and appointment setting.
• Communication: To respond to your inquiries, send service-related notifications (such as invoice availability and project updates), and provide customer support.
• Billing and account management: To process payments, issue invoices, manage accounts, and maintain financial records.
• Improvement: To analyze usage patterns, measure feature adoption, and improve the quality and performance of our Services.
• Security: To monitor for fraud, unauthorized access, security incidents, and other threats to the integrity of the platform.
• Compliance: To comply with legal obligations, respond to lawful requests from authorities, and maintain records as required by applicable law.
• Marketing: To send you information about our Services that may be of interest, where you have provided consent or where permitted under CASL. You may unsubscribe at any time.

Under PIPEDA and similar privacy legislation, we rely on the following grounds for processing personal information:

• Consent: You have consented to the collection, use, or disclosure of your personal information for the identified purposes.
• Performance of a contract: Processing is necessary to deliver the Services under a service agreement with you.
• Legal obligation: Processing is required to comply with a legal obligation, such as tax record retention.
• Legitimate business interest: Processing is reasonably expected in the context of a business-to-business relationship and is not out of proportion to the sensitivity of the information.

For residents of Quebec, the legal basis requirements under Law 25 are satisfied through these grounds, and we obtain express consent where required for sensitive information or secondary purposes.

Altergy does not sell personal information to third parties. We share personal information only in the following circumstances:

• Service providers: We use third-party service providers to host infrastructure, deliver email, provide analytics, and process payments. These providers have access to personal information only as necessary to perform their functions and are contractually bound to protect it.
• Customer's own data: Lead generation and appointment setting data we process on behalf of a Customer is shared with that Customer as the owner of the data. We do not share one Customer's lead data with other Customers.
• Legal compliance: We may disclose personal information in response to a lawful request from a court, government agency, or law enforcement authority, or when we believe disclosure is necessary to protect our rights, safety, or property.
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of the transaction. We will notify affected users before such a transfer where required by law.

We engage the following categories of sub-processors to help deliver the Services:

• Cloud hosting and database: Supabase (PostgreSQL hosting, authentication, file storage).
• Email delivery: Resend for transactional email delivery.
• Telephony: Twilio for voice calls, call routing, and call recording.
• Analytics: Internal analytics tools for platform performance measurement.

Each sub-processor is governed by a data processing agreement that requires them to protect personal information in accordance with applicable privacy laws and to use it only for the purpose of providing their service to Altergy.

We maintain a current list of sub-processors and will notify affected Customers of any new sub-processor before it begins processing personal information, giving the Customer an opportunity to object.

We retain personal information only as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations. Specific retention periods:

• Account and project data: Retained for the duration of the service relationship and for seven (7) years thereafter for record-keeping and dispute resolution purposes.
• Billing and financial records: Retained for seven (7) years as required by Canadian tax law.
• Communication records: Messages, support tickets, and call recordings retained for up to three (3) years unless legal hold is in effect.
• Lead generation data: Retained for the duration of the campaign plus two (2) years, unless the Customer requests earlier deletion.
• Marketing data: Retained until you unsubscribe or for two (2) years of inactivity, whichever comes first.

When personal information is no longer needed, we securely delete or anonymize it so that it can no longer be associated with an identifiable individual.

Altergy implements industry-standard technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit using TLS 1.2+ and encryption of data at rest in the database and file storage.
• Row-level security policies enforced at the database level to ensure users can only access data they are authorized to see.
• Role-based access control for all platform features, with principle of least privilege applied to staff accounts.
• Regular security reviews and prompt remediation of identified vulnerabilities.
• Secure, time-limited signed URLs for file access rather than publicly accessible storage.
• Audit logging of administrative actions within the platform.

No system is perfectly secure. If a data breach occurs that poses a real risk of significant harm to affected individuals, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required by PIPEDA, and we will take reasonable steps to mitigate the harm.

Subject to applicable law, you have the following rights regarding your personal information:

• Access: You may request a copy of the personal information we hold about you.
• Correction: You may request that we correct inaccurate or incomplete personal information.
• Deletion: You may request that we delete your personal information, subject to legal retention obligations and the need to retain records for legitimate business purposes.
• Withdrawal of consent: You may withdraw your consent to processing that was based on consent. Withdrawal does not affect processing that was already completed.
• Objection: You may object to processing based on legitimate interests or for direct marketing.
• Portability: You may request that we provide your personal information in a structured, machine-readable format.

To exercise any of these rights, contact us at info@altergy.ca. We will respond to your request within thirty (30) days. We may verify your identity before processing your request.

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

The Services are intended for business use and are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected personal information from a child, please contact us and we will promptly delete it.

Altergy is based in Toronto, Ontario, Canada. Our primary cloud infrastructure is hosted in Canada. However, some sub-processors may process data in the United States or other jurisdictions. When personal information is transferred outside Canada, we ensure that the transfer is protected by appropriate safeguards, including standard contractual clauses or comparable protections, and that the receiving party is bound by obligations consistent with PIPEDA.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make material changes, we will notify you by email or through the platform and will update the "Last updated" date at the top of this document.

We encourage you to review this Privacy Policy periodically. Your continued use of the Services after changes take effect constitutes acceptance of the updated policy.