1 Who we are
KANAZ is the brand used by KANAZ SOLUTIONS CORP., an Ontario corporation governed by the Business Corporations Act, with Ontario Corporation Number 1001772473 and its registered office at 155 East Beaver Creek Road, Suite 24-147, Richmond Hill, Ontario, L4B 2N1, Canada. In this Policy, “KANAZ”, “we”, “us” and “our” refer to that company.
We are responsible for the personal information we process for our own website, enquiries, client relationships and business administration. Where data protection law uses the term, we act as the controller for these activities. Contact the person responsible for privacy through our contact form.
This Policy explains how we handle personal information through kanaz.org and related communications and service arrangements. Our primary services are management and strategy consulting, supported by technology, software, cloud and data services, advertising and brand communications, and corporate assistance. Personal concierge and membership services are arranged separately.
2 Information you provide
Enquiries. When you use an enabled enquiry form or contact us, we collect your enquiry type, name, email address, country and message. Depending on your enquiry, we also request your company name and service of interest. You may provide your company website, telephone number, location where support is needed and preferred timing. Fields marked as required are needed to process the relevant enquiry.
Client and supplier relationships. If discussions lead to an engagement, we may collect business contact details, role and authority information, contractual and billing details, relevant project records and communications, and information needed to verify a counterparty where proportionate and lawful. We request identity documents only when necessary, through an appropriate channel and with additional information about their use.
Personal concierge and membership. For an agreed request, we may need preferences, reservation or itinerary details, service locations, household arrangements and relevant information about people for whom assistance is requested. We collect only what is needed for the approved service. A general enquiry does not authorize us to obtain all information about your family or household.
3 Information from your visit and other sources
Our website infrastructure and security providers may process IP addresses, request times, pages requested, browser and device information, referring pages, error records and security signals. Cookies and similar technologies are explained in our Cookie Policy. Optional tracking, if enabled, is subject to the choices and disclosures provided for that tool.
We may receive relevant information from an authorized representative, an organization you work for, a provider involved in an approved request, or publicly available business sources. When legally required, we provide notice about indirectly obtained information within the applicable period, including its source and purpose.
4 How we use information
We use personal information to assess and respond to enquiries; discuss and agree a scope; deliver or coordinate approved services; administer memberships; communicate with clients and suppliers; issue invoices and maintain records; safeguard our systems; prevent abuse and fraud; comply with applicable obligations; and establish, exercise or defend legal claims. We do not use information for unrelated purposes without the notice and permission required by law.
Where EU or UK data protection law applies, we use the following legal bases. They do not replace any consent requirements applicable under Canadian privacy law or rules governing electronic marketing and device storage.
| Purpose | Legal basis where applicable |
|---|---|
| Personal enquiry and agreed services | Steps requested before entering a contract with you, and performance of that contract. |
| Company and supplier contacts | Legitimate interests in responding to business enquiries and administering business relationships; contract only where the individual is a party. |
| Security and service administration | Legitimate interests in protecting the website, preventing abuse and maintaining reliable communications, subject to your rights. |
| Required records and disclosures | Compliance with a legal obligation that applies to the processing; otherwise an appropriate basis, such as legitimate interests in maintaining defensible records. |
| Optional tracking and consent based marketing | Consent, which you may withdraw. Any permitted alternative basis for a particular communication must comply with applicable marketing rules. |
We assess legitimate interests against the effects on individuals. Where meaningful consent is required, we explain the information involved, its purposes, relevant disclosures and material consequences. Merely reading this Policy or browsing the website is not consent to optional tracking or marketing.
5 Sensitive information and information about others
Do not submit passport copies, payment credentials, medical records or other sensitive information through the general enquiry form. If a concierge request genuinely requires sensitive information, we explain the specific need, recipients and secure channel before collecting it. Where special category data rules apply, we also require a valid condition for that processing, such as explicit consent where appropriate, in addition to a general legal basis.
When providing information about another person, ensure that you are authorized to do so and that they receive the relevant privacy information. We may need their direct permission. Services are directed to adults. Any necessary information about children for an adult’s approved family request is handled with appropriate authority and safeguards; we do not knowingly seek children’s direct enquiries or market to them.
6 Who receives personal information
Authorized team members and contractors may access information needed for their responsibilities. We use providers supporting website infrastructure and security, business email and communications, document storage and business administration. They receive information appropriate to their role, with contractual and other safeguards where required.
For an approved service request, we may share necessary details with relevant specialists, technical providers, advertising service providers, accommodation or transport providers, event organizers, household service providers or other suppliers involved in that request. We do not send a complete client file to every supplier. Where a supplier independently determines how it processes information, its own privacy notice also applies.
Professional advisers, banks or payment providers may receive relevant details for advice, billing or an authorized payment. Authorities or other parties may receive information where disclosure is legally required or permitted and proportionate. In a genuine business restructuring, relevant information may be disclosed under safeguards and applicable legal requirements.
We do not sell personal information or disclose it to third parties for their own unrelated direct marketing. Any optional advertising technology would be separately disclosed, assessed and subject to the required choices before activation.
7 Cloudflare security services
Our website uses Cloudflare infrastructure and the contact page includes Cloudflare Turnstile to help detect automated abuse. Turnstile processes technical signals such as IP address, browser user agent and connection characteristics. Cloudflare processes signals on our behalf to protect the site and also processes signals for its own improvement of bot detection, as explained in its notices.
Cloudflare also supports network error reporting to help diagnose connection failures. In supported browsers, our response headers direct error reports to Cloudflare’s reporting endpoint. This is operational diagnostics rather than advertising tracking. For details, see Cloudflare’s Privacy Policy at https://www.cloudflare.com/privacypolicy/ and its Turnstile Privacy Addendum at https://www.cloudflare.com/turnstile-privacy-policy/. Security processing is distinct from optional visitor analytics or advertising. Our Cookie Policy explains device storage and related controls.
8 Processing outside your country
KANAZ operates internationally. Your information may be accessed or processed in Canada, Hungary and the country where the approved service is performed, as well as in countries where our infrastructure and other service providers operate. Our identified website delivery and security provider is Cloudflare, Inc., a United States company operating an international network. Cloudflare’s services may involve processing in the United States and other countries covered by its network and service arrangements. Its privacy notices explain that processing. Providers used for communications, administration or a particular engagement may also process information outside your country; contact our contact form for information relevant to your request. Different countries may have different privacy protections, and local authorities may have lawful access to information.
Where applicable law restricts an international transfer, we use an available lawful mechanism and any necessary supplementary safeguards. These may include an applicable adequacy decision or approved contractual clauses. Canada’s EU adequacy recognition is limited to its specified scope; it is not an assurance covering every recipient or onward transfer. Contact us to request information about the safeguards applicable to your information and a copy where available, subject to lawful redactions.
9 How long we keep information
We retain personal information only for as long as reasonably necessary for its purpose and applicable obligations. For enquiries that do not lead to an engagement, we consider the status of the enquiry, relevant follow up and whether you have asked us to close it. For clients and suppliers, we consider the duration of the relationship, ongoing service needs, accounting requirements and applicable limitation periods. Operational details for a completed concierge request are not kept merely because general accounting records must be retained.
Security logs are kept for the period reasonably needed to detect, investigate and resolve incidents. We retain consent records and a limited suppression record as necessary to respect your choices and demonstrate compliance. Records may be retained longer where required by law or a genuine dispute. We delete or anonymize information when retention is no longer justified, including through applicable backup expiry procedures.
10 Safeguards and automated decisions
We use safeguards appropriate to the information and risks, including access restrictions and appropriate protection of storage and communications. No internet service is completely secure. Please use the secure channel we identify for sensitive material. If an incident triggers notification duties, we notify the relevant individuals and authorities as required by law.
We do not make decisions producing legal or similarly significant effects on you solely through automated processing. Security tools may automatically identify or block suspected abusive traffic. If you believe a legitimate enquiry has been blocked, contact us through the published contact details.
11 Your rights and communication preferences
Subject to applicable law and permitted exceptions, you may request access to your personal information and information about its use and disclosure, request correction, withdraw consent and challenge our handling of it. Where applicable, you may also request erasure, restriction or portability, and object to processing based on legitimate interests. You may object to direct marketing at any time. Rights are subject to their legal conditions; withdrawal does not affect lawful processing before withdrawal.
We may request proportionate information to verify your identity and authority. We respond within the applicable legal period, ordinarily within 30 days for a PIPEDA access request or one month for a GDPR rights request, with any permitted extension explained. Where a lawful exception applies, we explain the decision and available complaint route.
A service enquiry does not subscribe you to marketing. Where we send promotional messages, we comply with applicable consent requirements, identify the sender and provide a working unsubscribe option. You may also use our contact form. Essential service communications may continue where necessary for an active engagement.
12 Complaints changes and contact
Contact our privacy lead through our contact form or write to 155 East Beaver Creek Road, Suite 24-147, Richmond Hill, Ontario, L4B 2N1, Canada. You may complain to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, an applicable provincial regulator, or, where EU or UK law applies, your competent supervisory authority. You do not need to contact us first to exercise a statutory complaint right.
We update this Policy when necessary and display the effective date. Material changes will be communicated appropriately; new consent will be sought where required. If we process client controlled data as a processor under a technology or other service agreement, that processing is also governed by the applicable agreement and data processing terms. Requests concerning such data should normally be directed to the client controller.