Introduction
Kasvu Digital Inc. ("Kasvu", "we", "our") is an agency specializing in artificial intelligence and performance marketing for professional service firms. We understand the importance of privacy and compliance, particularly in the context of professional services where data protection is paramount.
This policy explains how we collect, use, and protect your personal information in compliance with:
- Quebec's Bill 25 (modernization of the Act respecting the protection of personal information in the private sector)
- The General Data Protection Regulation (GDPR) for European residents
- Applicable Canadian data protection laws
1. Information We Collect
1.1 Information You Provide Directly
When you use our website, request a consultation, or use our services, we collect:
Contact information:
- First and last name
- Professional email address
- Professional phone number
- Position and role within your organization
Organizational information:
- Name of practice/firm/company
- Industry sector (legal, accounting, financial, etc.)
- Professional website
- Organization size
Information related to your needs:
- Growth objectives
- Current marketing or automation challenges
- Approximate budget (if voluntarily provided)
- Any information shared during consultations or exchanges
1.2 Automatically Collected Information
When you visit our website, we automatically collect:
- IP address
- Browser type and version
- Operating system
- Pages visited and visit duration
- Referral source (how you arrived at our site)
- Browsing behavior (clicks, scrolling)
2. How We Use Your Information
Your personal information is used exclusively for:
Services and communications:
- Respond to your information or consultation requests
- Schedule and manage appointments (Blueprint IA, audits, consultations)
- Manage our contractual relationships and service delivery
- Send you tailored business proposals
Service improvement:
- Analyze website usage to improve user experience
- Understand the needs of our target clientele (professional firms)
- Develop relevant educational content (articles, case studies)
Marketing and communications:
- Send you our monthly newsletter (with explicit consent)
- Share relevant content on AI and marketing for professional services
- Inform you of our new services or events
Legal obligations:
- Comply with our accounting and tax obligations
- Respond to requests from legal authorities, if required
Important: We never sell, trade, or rent your personal information to third parties.
3. Tracking Technologies and Cookies
3.1 Cookies and Tracking Pixels
Our website uses cookies and tracking technologies to analyze traffic and optimize our advertising campaigns. We use:
Google Tag Manager to manage all our tracking tags, including:
- Google Analytics 4 (GA4): Traffic analysis, visitor behavior, page performance
- Meta Pixel (Facebook/Instagram): Advertising conversion tracking, remarketing
- LinkedIn Insight Tag: LinkedIn conversion tracking, professional audiences
3.2 Managing Your Preferences
You can control cookies through:
- Your browser settings (complete or selective deactivation)
- Our cookie consent banner (when present)
- Google, Meta, and LinkedIn privacy settings
Note: Disabling certain cookies may affect your experience on our site.
4. Third-Party Tools and Data Sharing
To provide our services effectively, we use trusted third-party vendors who may access your data as part of their function:
4.1 Customer Relationship Management
- Copper CRM: Contact storage and management, opportunity tracking
- Calendly: Appointment and consultation scheduling
- Google Workspace: Email communications, shared documents, video conferencing
4.2 Payment Processing
- Stripe: Secure credit card payment processing
Your payment information is encrypted and processed directly by Stripe. Kasvu never stores your complete credit card numbers.
4.3 Automation and AI Tools
- n8n (hosted on Canadian servers): Internal workflow automations
- OpenAI API / Anthropic Claude API: Artificial intelligence services for content analysis and generation
- Supabase (Canadian servers): Database for certain client projects
4.4 Advertising Platforms
- Google Ads: Advertising campaign management for our clients
- Meta Ads Manager: Facebook/Instagram campaign management for our clients
- LinkedIn Campaign Manager: LinkedIn campaign management for our clients
4.5 Hosting and Infrastructure
- Web hosting: Servers located in Canada
- Cloudflare: DDoS protection and website performance
All these vendors are contractually bound to protect your information in accordance with their own privacy policies and applicable laws.
5. Information Sharing
We do not sell, trade, or rent your personal information.
We may share your information only in the following cases:
With your explicit consent:
- Client testimonials or case studies (anonymized or with your written permission)
Essential service providers:
- The third-party tools mentioned in Section 4, strictly for the provision of our services
Legal obligations:
- If required by law, court, or government authority
- To protect our legal rights, safety, or that of third parties
Business transfers:
- In the event of a merger, acquisition, or sale of Kasvu Digital Inc. assets
6. Data Location and Transfer
6.1 Data Storage
We prioritize Canadian servers for storing your data whenever possible:
- Copper CRM: Servers in the United States (SOC 2 certified)
- Google Workspace: Possibility of Canadian storage
- n8n and Supabase: Canadian servers
- Stripe: Encrypted data, secure servers
6.2 International Transfers
Some of our vendors (Google, Meta, LinkedIn, Stripe) may transfer data to the United States or other jurisdictions. These transfers are made in accordance with appropriate legal mechanisms (standard contractual clauses, Privacy Shield successors).
7. Data Retention
We retain your personal information:
Prospects and contacts:
- Active period: As long as you show interest in our services
- After inactivity: 3 years without interaction, then deletion (except legal obligation)
Current and past clients:
- Contract duration + 7 years to comply with our accounting and tax obligations
- Project documents may be retained longer if you request
Marketing data:
- You can unsubscribe from our newsletter at any time
- Deletion within 30 days of your unsubscribe request
8. Your Rights (Bill 25 and GDPR)
In accordance with Bill 25 and the GDPR, you have the following rights:
Right of Access
Obtain a copy of your personal information we hold
Right to Rectification
Correct inaccurate or incomplete information
Right to Erasure ("right to be forgotten")
Request deletion of your data (subject to our legal obligations)
Right to Restriction of Processing
Restrict the use of your data in certain circumstances
Right to Data Portability
Receive your data in a structured, machine-readable format
Right to Object
Object to the processing of your data for direct marketing purposes
Right to Withdraw Consent
Withdraw your consent at any time (without affecting the lawfulness of prior processing)
Right to Lodge a Complaint
Lodge a complaint with the Commission d'accès à l'information du Québec (CAI):
- Website: www.cai.gouv.qc.ca
- Phone: 1-888-528-7741
9. How to Exercise Your Rights
To exercise any of your rights, contact us by:
- Email: legal@kasvu.ca (subject: "Privacy Request")
- Phone: (514) 700-6464
- Postal Mail:
Kasvu Digital Inc.
Attention: Privacy Officer
1395 Fleury Est #102.2
Montreal, QC Canada H2C 1R7
Response Time: We commit to responding to your request within 30 days.
10. Data Security
We take the security of your information very seriously and implement appropriate technical and organizational measures:
Technical measures:
- SSL/TLS encryption for all data transmissions
- Multi-factor authentication (MFA) for access to internal systems
- Regular encrypted backups
- Firewall and anti-malware protection
- Restricted data access following the principle of least privilege
Organizational measures:
- Regular team training on data protection
- Strict internal access management policies
- Confidentiality agreements with all employees and subcontractors
- Periodic security audits
In case of data breach: In accordance with Bill 25, we will inform you within 72 hours if a security breach presents a risk to your rights and freedoms.
11. Children's Privacy
Our services are intended for professionals and businesses. We do not knowingly collect personal information from individuals under 18 years of age. If we learn that a minor has provided us with data, we will delete it immediately.
12. Services for Professional Practices
Special note for our professional sector clients:
When Kasvu provides automation, CRM, or AI services to your practice (legal, accounting, financial, etc.), we act as a data processor of your client data. In this context:
- You remain the data controller of your client data
- Kasvu processes data only according to your instructions
- We implement security measures compliant with professional standards (professional secrecy, ethical obligations)
- Specific Data Processing Agreements (DPA) are signed for these mandates
For more details on our security practices for client projects, contact us at legal@kasvu.ca.
13. Changes to This Policy
We reserve the right to modify this privacy policy at any time to reflect:
- Changes in our business practices
- Technological developments
- Changes to applicable laws
In case of substantial modification:
- We will update the "Last updated" date at the top of this page
- We will inform you by email if you are an active client
- Changes take effect immediately upon publication
We encourage you to regularly consult this page.
14. Questions and Contact
For any questions regarding this privacy policy or our data protection practices, contact us:
Kasvu Digital Inc.
Privacy Officer
Address:
1395 Fleury Est #102.2
Montreal, QC Canada H2C 1R7
Phone: (514) 700-6464
Email: legal@kasvu.ca
Website: www.kasvu.ca
15. Consent
By using our website or services, you acknowledge that you have read, understood, and accepted this privacy policy.
If you do not consent to this policy, please do not use our website or services.
