1. Introduction

This Privacy Policy explains how Strat2gy Inc., trading as Strat2gyAI (“Strat2gyAI”, “we”, “us” or “our”) collects, uses, discloses and protects personal information in connection with our websites, the Strat2gyAI platform and applications (the “Platform”), and our related business activities.

Strat2gyAI is operated by:

Strat2gy Inc.
First Canadian Place
Suite 5600
100 King Street West
Toronto, Ontario M5X 1C9
Canada

This Privacy Policy applies to:

• visitors to our websites;
• customers and prospective customers;
• business contacts;
• authorized users of the Platform;
• individuals who contact us for support or other enquiries; and
• personal information we process in connection with our business.

Please read this Privacy Policy together with our Terms of Use and, where applicable, the agreement between Strat2gyAI and the organization through which you access the Platform.

2. Our Roles

We handle personal information in two primary capacities.

As a service provider or processor

When an organization subscribes to Strat2gyAI (the “Customer”), its authorized users may upload strategic plans, initiatives, performance information, documents and other information and content (“Customer Data”).

The Customer determines:

• what Customer Data is provided to the Platform;
• the purposes for which it is processed;
• who is authorized to access it; and
• how it is used within the Customer’s workspace.

For Customer Data, the Customer generally acts as the controller, business or organization responsible for the information, and Strat2gyAI acts as its processor or service provider in accordance with the Customer Agreement and applicable data processing terms.

If personal information about you appears within a Customer’s Strat2gyAI workspace and you wish to exercise rights relating to that information, you should normally contact that Customer.

As an organization in our own right

We also process personal information for our own legitimate business purposes, including:

• operating our websites;
• creating and managing user accounts;
• authenticating authorized users;
• securing the Platform;
• maintaining access and audit records;
• providing customer support;
• responding to enquiries;
• communicating with customers, users and prospects;
• administering our commercial relationships; and
• complying with legal and regulatory obligations.

For these activities, Strat2gyAI acts as the controller or business responsible for the personal information.

3. Personal Information We Collect

The information we collect depends on how you interact with Strat2gyAI.

Website visitors

When you visit our websites, we may collect:

• IP address;
• browser and device information;
• operating system;
• pages viewed;
• referring pages or websites;
• approximate location derived from IP address;
• cookie and similar technology information; and
• other technical information about use of our websites.

If you contact us through a form, by email, by telephone or through another communication channel, we may also collect the information you choose to provide.

Account and identity information

For Platform users, we may collect:

• name;
• business email address;
• job title and organization;
• user role and permissions;
• authentication and sign-in information;
• multi-factor authentication settings;
• identifiers received from authorized third-party identity providers; and
• preferences and settings associated with your account.

Most account information is provided either by you or by your organization’s administrator.

Usage, device, security and log information

We may collect:

• sign-in and sign-out events;
• timestamps;
• successful and unsuccessful authentication attempts;
• IP address;
• approximate location derived from IP address;
• device, browser and operating system information;
• pages and features accessed;
• actions taken within the Platform;
• administrative actions;
• diagnostic and error information; and
• security and audit events.

Support and communications

We may collect:

• support requests;
• email correspondence and other communications;
• feedback;
• survey responses; and
• information provided during demonstrations, training or support interactions.

Where a call or meeting is recorded, we will provide appropriate notice.

Commercial and business information

For customers, prospective customers and other business contacts, we may collect:

• name and business contact details;
• organization and role;
• records of meetings, demonstrations and commercial discussions;
• subscription and account administration information;
• billing contact information; and
• other information relevant to a business relationship.

We may also collect business information from publicly available sources or legitimate business information providers.

Customer Data

Customer Data may include strategic plans, initiatives, financial or operational information, organizational information, documents and other content supplied by a Customer or its authorized users.

Customer Data is processed as described in Sections 5 and 10 of this Privacy Policy.

Sensitive information

We do not intentionally collect sensitive categories of personal information for our own purposes unless reasonably necessary and permitted by applicable law.

Customers should not upload sensitive personal information to the Platform unless they are authorized to do so and the Customer Agreement permits it.

4. How and Why We Use Personal Information

We use personal information where reasonably necessary to:

• operate and maintain our websites;
• respond to website enquiries;
• provide information about our products and services;
• create, authenticate and manage user accounts;
• ensure that only authorized users access the Platform;
• provide and operate the Platform;
• secure our systems and prevent fraud, misuse and unauthorized access;
• maintain security, access and audit records;
• provide customer support;
• diagnose technical issues;
• maintain and improve the operation, reliability and usability of our websites and Platform;
• administer customer relationships and subscriptions;
• provide service, security and administrative communications;
• communicate with prospective customers and business contacts;
• manage billing and account administration;
• comply with legal and regulatory requirements; and
• establish, exercise or defend legal rights.

Where consent is required by applicable law, we will obtain consent before processing personal information.

Where Canadian privacy law applies, we process personal information in accordance with applicable consent requirements and statutory exceptions.

Where European or UK data protection law applies, our legal basis may include performance of a contract, compliance with legal obligations, legitimate interests, or consent where required.

Where U.S. state privacy laws apply, we process personal information in accordance with applicable requirements concerning permitted purposes, data minimization, security, sensitive information and consumer rights.

5. Artificial Intelligence and External Services

The Platform uses artificial intelligence and other analytical technologies to generate summaries, analyses, recommendations and other decision-support information.

Use of Customer Data

Customer Data is logically segregated by Customer and is accessed and processed only within the scope of that Customer’s authorized use of the Platform.

Strat2gyAI’s artificial intelligence functionality operates within that authorized Customer context.

Customer Data from one Customer is not used to provide responses, analyses or recommendations to another Customer.

Strat2gyAI does not use Customer Data to train general-purpose artificial intelligence models.

Customer Data is processed only as necessary to provide, operate, secure and support the Platform in accordance with the Customer Agreement and applicable data processing terms.

External searches and data sources

Certain Platform features may use third-party services to retrieve external information, obtain external data or perform searches requested through the Platform.

When these services are used, Strat2gyAI may transmit limited information reasonably necessary to perform the requested function. This may include:

• search terms;
• company names;
• company or market identifiers;
• user-generated search queries; or
• limited contextual information necessary to return relevant results.

These services are not provided with general or unrestricted access to a Customer’s Strat2gyAI workspace or Customer Data.

We seek to limit information transmitted to third-party services to what is reasonably necessary to perform the requested function.

Where personal information is transmitted to a service provider, it is handled in accordance with applicable privacy law, our contractual arrangements with the provider and, where applicable, the Customer Agreement and applicable data processing terms.

AI-generated output and human judgment

Artificial intelligence systems may generate information that is inaccurate, incomplete, outdated or misleading.

AI-generated output is intended to support rather than replace human judgment.

The Platform is not designed to make decisions producing legal or similarly significant effects on individuals without appropriate human involvement.

Customers and users are responsible for reviewing Platform output and determining how it is used in their decision-making processes.

6. How We Disclose Information

We do not sell personal information.

We do not use or share personal information for cross-context behavioral advertising or targeted advertising.

We disclose information only where reasonably necessary to operate our websites and Platform, provide requested functionality, support our customers, protect our systems, conduct legitimate business activities or comply with applicable law.

Service providers and sub-processors

We use third-party service providers to support our business and the operation of Strat2gyAI. These may include providers of:

• cloud infrastructure and hosting;
• authentication and identity services;
• communications;
• security and monitoring;
• technical support;
• analytics;
• artificial intelligence services;
• search services; and
• external business, financial or market data.

Where these providers process personal information on our behalf, we require appropriate contractual, privacy and security protections based on the nature of the information and services provided.

External search and data services

Certain Platform features may transmit limited search terms, company identifiers or contextual information to third-party services where necessary to perform a search, retrieve external information or provide requested functionality.

These services are not provided with general or unrestricted access to a Customer’s workspace.

Your organization

If you access Strat2gyAI through an organization’s subscription, authorized administrators of that organization may have access to information concerning:

• your account;
• access permissions;
• content you create or access within the Customer’s workspace;
• activity records; and
• relevant access and audit logs.

Professional advisers

We may disclose information to lawyers, accountants, auditors, insurers and other professional advisers where reasonably necessary and subject to confidentiality obligations.

Business transactions

Information may be disclosed in connection with a proposed or completed merger, acquisition, investment, financing, reorganization, restructuring or sale of all or part of our business or assets, subject to appropriate protections.

Legal and security requirements

We may disclose information where:

• required by applicable law;
• required by a valid court order or governmental request;
• reasonably necessary to enforce our agreements;
• necessary to investigate suspected unlawful activity or misuse;
• necessary to protect the security or integrity of our websites or Platform; or
• reasonably necessary to protect the rights or safety of Strat2gyAI, our customers, users or others.

Where permitted and appropriate, we will notify the affected Customer before disclosing Customer Data in response to a governmental or legal demand.

7. International Processing and Data Transfers

Strat2gyAI uses cloud infrastructure and service providers that operate in multiple jurisdictions.

Personal information and Customer Data may be processed, stored or backed up in Canada, the United States, or other jurisdictions in which Strat2gyAI or its authorized service providers operate.

As a result, information may be subject to the laws of the jurisdiction in which it is processed or stored and may be accessible to courts, law enforcement or governmental authorities where required by applicable law.

We maintain appropriate contractual, organizational and technical safeguards designed to protect personal information and Customer Data when it is processed across jurisdictions.

Where applicable law requires additional safeguards for international transfers, we implement appropriate transfer mechanisms and protections.

Customers with specific contractual data-residency requirements should refer to their Customer Agreement or contact Strat2gyAI.

8. Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

Website and enquiry information

Information provided through website forms, enquiries and business communications may be retained for as long as reasonably necessary to respond, maintain appropriate business records and manage our relationship with you.

Account information

Account information is generally retained while an account remains active and for an appropriate period following account closure where necessary for security, audit, contractual or legal purposes.

Security and audit information

Access, security, system and audit records are retained in accordance with our information-security and records-management requirements.

Support and communications

Support correspondence and related communications may be retained for as long as reasonably necessary to provide support, maintain business records and resolve disputes.

Financial records

Billing, accounting and financial records are retained as required by applicable tax, accounting and corporate law.

Customer Data

Customer Data is retained and deleted in accordance with the Customer Agreement, applicable data processing terms and the Customer’s instructions.

Information may be retained longer where reasonably necessary to comply with law, preserve evidence, resolve disputes or enforce agreements.

Backup copies may remain for a limited period as part of routine backup and disaster-recovery processes before being overwritten or securely deleted.

9. Cookies and Similar Technologies

We may use cookies and similar technologies on our websites and within the Platform.

Strictly necessary technologies

Certain technologies are required to:

• authenticate users;
• maintain sessions;
• protect our websites and Platform;
• prevent fraud and unauthorized access;
• balance system loads; and
• provide essential functionality.

Analytics

We may use analytics technologies to understand how our websites and Platform are used, diagnose technical problems and improve usability and performance.

Where applicable law requires consent for non-essential analytics technologies, we will obtain consent before using them.

Marketing and advertising technologies

We do not use personal information for cross-context behavioral advertising or targeted advertising.

If our practices change, we will update this Privacy Policy and provide any notice, consent or opt-out mechanisms required by applicable law.

You may also be able to manage cookies through your browser or through cookie preference tools that we make available.

Blocking strictly necessary cookies may prevent some features, including authentication, from functioning correctly.

10. Customer Data — Our Role as Processor or Service Provider

When a Customer subscribes to Strat2gyAI, we process Customer Data on that Customer’s behalf.

For Customer Data:

• the Customer determines what information is provided to the Platform;
• the Customer determines the purposes for which it is processed;
• the Customer determines which individuals are authorized to access its workspace;
• Customer Data is logically segregated from the data of other Customers;
• we process Customer Data in accordance with the Customer Agreement, applicable data processing terms and the Customer’s instructions;
• Customer Data from one Customer is not used to provide responses, analyses or recommendations to another Customer;
• we do not use Customer Data to train general-purpose artificial intelligence models;
• we do not sell Customer Data;
• we do not use or disclose Customer Data for third-party advertising;
• we do not retain, use or disclose Customer Data outside the purposes permitted by our agreements with the Customer except where required by law; and
• we assist Customers with applicable data protection obligations as provided in our contractual agreements.

Providing the Platform may involve approved service providers or external data, search or technology services.

Where information is transmitted to such providers, we seek to limit the information disclosed to what is reasonably necessary to perform the requested function.

On termination of the Customer relationship, Customer Data is returned or deleted in accordance with the Customer Agreement and applicable data processing terms.

If you are an individual whose personal information appears within a Customer’s Strat2gyAI workspace and wish to exercise rights over that information, you should normally contact the Customer directly.

Where appropriate, we will assist the Customer in responding to the request.

11. Security

We maintain technical and organizational safeguards designed to protect personal information and Customer Data against unauthorized access, use, alteration, disclosure, destruction or loss.

Our safeguards may include:

• encryption in transit and at rest;
• logical segregation of Customer environments and data;
• role-based access controls;
• least-privilege access principles;
• multi-factor authentication;
• authentication and account security controls;
• security logging and monitoring;
• vulnerability and dependency management;
• secure software-development practices;
• review of third-party service providers;
• incident-response procedures;
• backup and disaster-recovery procedures; and
• employee and contractor confidentiality and security obligations.

We continually review and develop our information-security program as our Platform and business evolve.

No information system can be guaranteed to be completely secure.

If we become aware of a security incident involving personal information, we will investigate and provide notifications where required by applicable law or our contractual obligations.

12. Your Privacy Rights

Your privacy rights depend on where you live and the applicable law.

For personal information that Strat2gyAI controls directly, you may have rights to:

• request access to personal information;
• request correction;
• request deletion;
• obtain information about how your personal information is processed;
• obtain a copy of certain personal information;
• withdraw consent where processing is based on consent;
• object to or restrict certain processing;
• opt out of certain sales, sharing, targeted advertising or profiling where applicable; and
• lodge a complaint with an applicable privacy authority.

Customer-controlled information

If your request relates to personal information contained within a Customer’s workspace, the Customer is generally responsible for responding.

We may refer your request to the relevant Customer and assist that Customer where appropriate.

13. Canada

Individuals in Canada may have rights to access personal information and request correction, together with additional rights under applicable federal or provincial privacy legislation.

You may also have the right to complain to the Office of the Privacy Commissioner of Canada or an applicable provincial privacy authority.

14. United States Privacy Rights

Residents of certain U.S. states may have additional rights under applicable state privacy laws.

Depending on your state and whether the applicable law applies to Strat2gyAI, these rights may include the right to:

• know or confirm whether we process your personal information;
• access personal information we hold about you;
• obtain information about the categories and purposes of processing;
• correct inaccurate personal information;
• delete certain personal information;
• obtain a portable copy of certain personal information;
• opt out of the sale of personal information;
• opt out of sharing for cross-context behavioral advertising or targeted advertising;
• opt out of certain profiling involving significant decisions;
• limit certain uses of sensitive personal information; and
• appeal a decision we make concerning a privacy request where applicable.

We will not discriminate against you for exercising applicable privacy rights.

California residents

If the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), applies to Strat2gyAI’s processing of your personal information, you may have rights to:

• know the categories and specific pieces of personal information we collect;
• know the purposes for which personal information is used;
• know the categories of sources from which personal information is collected;
• know the categories of third parties to whom personal information is disclosed;
• request correction;
• request deletion;
• opt out of the sale or sharing of personal information;
• limit certain uses or disclosures of sensitive personal information where applicable; and
• receive equal service and treatment when exercising your privacy rights.

Strat2gyAI does not sell personal information or share personal information for cross-context behavioral advertising.

If our practices change in the future, we will update this Privacy Policy and provide any mechanisms required by applicable California law.

Other U.S. states

Residents of other U.S. states with comprehensive privacy legislation may have similar rights relating to access, correction, deletion, portability, targeted advertising, sale of personal information and certain forms of profiling.

We will honor applicable rights as required by the laws that apply to us.

15. European Economic Area and United Kingdom

Where European or UK data protection law applies, you may have rights including:

• access;
• rectification;
• erasure;
• restriction;
• portability;
• objection to certain processing; and
• withdrawal of consent.

You may exercise these rights by contacting privacy@strat2gy.com.

You may also lodge a complaint with your applicable supervisory authority.

16. Exercising Your Rights

To make a privacy request, contact:

privacy@strat2gy.com

Please describe the nature of your request and the jurisdiction in which you reside.

We may need to verify your identity before responding.

We may request additional information where reasonably necessary to verify your identity, understand your request or determine the information to which the request relates.

We will not require you to create a new account solely to submit a privacy request.

We will respond within the timeframe required by applicable law.

Where applicable law provides an appeal right and we decline your request, you may ask us to review that decision by responding to our decision or contacting privacy@strat2gy.com.

Authorized agents may submit requests where permitted by applicable law, subject to appropriate verification of their authority.

Where permitted by law, we may decline or charge a reasonable fee for requests that are manifestly unfounded, excessive, repetitive or otherwise subject to an applicable exception.

17. Children

Our websites and the Strat2gyAI Platform are intended for business and organizational use and are not directed toward children.

We do not knowingly permit individuals below the applicable age of majority to establish independent Platform accounts.

If you believe a child has improperly provided personal information to Strat2gyAI, contact:

privacy@strat2gy.com

18. Communications and Marketing

Where permitted by applicable law, we may use business contact information to communicate with you about:

• our products and services;
• demonstrations and events;
• product updates; and
• other information that may be relevant to your business relationship with Strat2gyAI.

You may opt out of marketing communications at any time by using the unsubscribe mechanism included in the communication or by contacting us.

Opting out of marketing communications does not prevent us from sending service, security, account or other non-promotional communications where appropriate.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to:

• our websites;
• the Platform;
• our business;
• our privacy and security practices;
• applicable law; or
• the services we use to operate Strat2gyAI.

When we update this Privacy Policy, we will update the “Last updated” date at the beginning of the document.

Where changes are material, we may provide additional notice through our websites, the Platform, by email or through the relevant Customer.

20. Contact Us

Privacy enquiries and rights requests

privacy@strat2gy.com

Privacy Officer

Privacy Officer
Strat2gy Inc.
First Canadian Place
Suite 5600
100 King Street West
Toronto, Ontario M5X 1C9
Canada

privacy@strat2gy.com

General and security enquiries

support@strat2gy.com

Questions concerning your authorization, permissions or access to a Customer’s Strat2gyAI workspace should normally be directed to your organization’s Strat2gyAI administrator.

You may also have the right to complain to the privacy or data protection authority responsible for your jurisdiction.