Privacy Policy
Data controller
The controller for all personal data collected through this website is Trivex Consulting, with its registered office in Vancouver. The controller decides why and how your data is processed, and is the first point of contact for any question, request, or complaint arising from this notice. You can reach the controller, and the person responsible for data protection matters, at info@trivexconsu.ca. Enquiries sent to that address are read only by staff who need them to answer, and are logged so that each request can be traced to a response. Where a request requires identification, only the minimum details needed to verify you are asked for.
Purpose of processing
Your data is used to answer the enquiry you sent, to prepare a proposal or continuation of work where you ask for one, and to keep an honest record of correspondence required for the responsible administration of the practice. If you become a client, the same record supports delivery, invoicing, and the closing handoff described elsewhere on this site. We do not use form data for newsletters, advertising, profiling, or automated decision-making of any kind. No enquiry is scored, ranked, or fed into a growth tool. When an exchange has clearly ended, the messages belonging to it are treated under the retention rules set out below rather than kept indefinitely.
Recipients and processors
Your data is not sold, rented, or disclosed to advertisers. It is shared only with parties that operate the infrastructure of this site: the hosting provider that stores the website and its database, and the email delivery service that carries messages between you and info@trivexconsu.ca. These providers act as processors under written agreements that bind them to the GDPR, limit their use of data to our instructions, and require appropriate security measures. Bank and tax authorities receive payment-related data only where a fee has been invoiced and the law requires disclosure. No processor is granted access beyond what its task needs, and each is reviewed at least once a year.
International transfers
This website and its mail infrastructure are operated from within the European Economic Area, and your enquiry data does not normally leave it. Where a processor maintains support or backup capacity outside the EEA, transfer takes place only under the safeguards required by Chapter V GDPR: an adequacy decision of the European Commission, or standard contractual clauses accompanied by a documented transfer impact assessment. The current list of processors, their locations, and the safeguard applied to each is available from info@trivexconsu.ca on request. If a future service change would move data outside the EEA without such safeguards, that change is not made; no transfer rests on your consent alone, and none is implied by using the form.
Retention periods
Enquiries that do not lead to an engagement are deleted twelve months after the last message, which is enough time to recognise a returning contact without building a permanent record. Correspondence connected to a delivered engagement is kept for six years after the closing handoff, aligned with ordinary contractual and accounting limitation periods. Consent records and analytics data, where analytics have been accepted, are kept for twelve months and then removed automatically. Data subject to a legal hold, an ongoing complaint, or a request you have made is not deleted on schedule; it is restricted to storage only until the matter closes, after which the normal periods resume and run their course.
Security measures
The site is served exclusively over HTTPS, and form submissions are encrypted in transit as well as at rest in the database. Access to enquiry data is limited by role to the small number of people who answer it, with individual accounts, strong authentication, and a logged trail of access. Backups are encrypted, kept in a separate location from the primary systems, and tested on a schedule. We apply security updates promptly, monitor the logs described above for anomalies, and keep a written procedure for the event of a breach, including assessment of risk and notification of the supervisory authority and of affected persons within seventy-two hours where required.
Your data subject rights
Under Articles 15 to 22 GDPR you have the right to access your data, to have inaccurate data rectified, and to have data erased when no legal basis remains. You may ask us to restrict processing while a dispute over accuracy is resolved, you may receive the data you gave us in a portable, machine-readable format, and you may object at any time to processing based on legitimate interest. To exercise any of these rights, write to info@trivexconsu.ca; no special form is required, and a plain request is enough. We answer within one month, extended by two further months for complex cases, and always tell you first if an extension is used. Where we cannot comply, you receive the reason.
Categories of personal data
We process only the data you enter into the contact form: your name, your email address, your phone number if you choose to give one, and the free-text message you write. Nothing else is collected through the form, and no fields are hidden or optional-but-harvested. Server logs kept for security purposes record technical details such as IP address, timestamp, and browser type, separated from form submissions. We do not buy contact lists, enrich your record from external sources, or infer additional characteristics such as interests or income. If you send documents by reply email, they are treated as part of your message and handled under the same rules.
Legal basis
Processing of enquiry data rests on two legal bases under the General Data Protection Regulation. Where you submit the form, processing is based on your consent within the meaning of Article 6(1)(a) GDPR: you gave the data voluntarily for the purpose of receiving an answer, and you may withdraw that consent at any time by writing to info@trivexconsu.ca. Where a message concerns an existing engagement or a request we must document, processing is based on our legitimate interest under Article 6(1)(f) GDPR in answering professional correspondence and keeping defensible records. On withdrawal we stop further processing; messages that must be retained for legal reasons are restricted rather than deleted.
Complaints
You have the right to lodge a complaint about how your data has been handled with a supervisory authority, in particular in the EU member state of your habitual residence or where the alleged infringement occurred. In these matters the competent authority for our practice is ICO, which operates an independent complaints procedure and does not charge a fee. Turning to the authority does not require you to contact us first, does not affect any other legal remedy, and does not put you at disadvantage in any ongoing exchange. We nevertheless ask you to write to info@trivexconsu.ca as well, because most concerns can be resolved directly and quickly once we know about them.