// legal

Privacy Policy

Last updated: July 31, 2026

1. Who we are

TrazTech Inc. is a security and compliance firm incorporated in Ontario, Canada. We run the website at traztech.ca and traztech Workspace at traztech.ca/portal, and we deliver paid security and compliance services.

For personal information we decide the purposes of, TrazTech Inc. is the controller, or in Canadian terms the organisation accountable for it. Our privacy officer can be reached at:

Privacy Officer, TrazTech Inc.
145 1/2 Church Street, Unit 5, Office 876
Toronto, Ontario, M5B 1Y4
Canada
[email protected]

For personal information our customers put into their own workspace, they are the controller and we act on their instructions. Section 5 explains that split.

2. What we collect from marketing-site visitors

You can read traztech.ca without telling us who you are. If you interact with it, we collect what you give us.

Information you submit

• Contact and quote forms: your name, work email, company, phone number if you provide one, and whatever you write in the message. Submissions land in our internal CRM.
• Newsletter and tool sign-ups: your email address, and which tool or article you signed up from, so the follow-up emails are relevant instead of generic. Every one has an unsubscribe link.
• Booked calls: the details you enter when you book a readiness call, including the time you picked and anything you write in the booking notes.
• Free tools and calculators: the inputs you enter, so the tool can produce a result and so we can email it to you if you ask for that.

Information collected automatically

• Server logs: IP address, user agent, requested URL, referrer, timestamp, and response status. We use these for security, abuse prevention, and debugging.
• Google Analytics 4 (property G-58N80XGDN6), which tells us which pages get read and how people arrive. IP addresses are truncated by Google before storage.
• Microsoft Clarity (project xs6v2bnrp9), which records aggregate interaction and session-replay data so we can see where a page confuses people.

Analytics run on the marketing site only. The Workspace at /portal carries no analytics tags and is excluded from search indexing.

3. What we collect from platform users

When you create a workspace, this is what ends up in our database. It is worth reading properly, because a compliance workspace holds more about your organisation than a typical SaaS account does.

Account and organisation profile

• Your name, email address, and role in the workspace (owner, member, read-only auditor, or partner administrator).
• Your organisation's name, industry, size band and headcount, and head office country.

Onboarding answers

• Which frameworks you need, your primary framework, and your target timeline.
• What triggered the work, for example a customer requirement, a funding round, or a renewal, and any detail you add.
• Your current tooling and cloud providers, whether you have a security lead, and whether you have been through an audit before.
• Where you signed up from.

Compliance work product

• Self-assessment answers: a status per control (met, partially met, not met, not applicable, or unknown), your own notes on how the control is implemented, the owner you assign, and target dates.
• Readiness scores and snapshots, so you can see the trend over time.
• Evidence files you upload, along with their filenames, the controls they are mapped to, owners, collection dates, and review dates.
• Policy documents you draft or adopt from a template, including the body text, version, status, approver, and approval date.
• Risk register entries: title, description, category, likelihood, impact, treatment plan, owner, and dates.
• Vendor records: vendor name, website, category, your contact there and their email, criticality, what data you share with them, and whether a DPA is signed.
• Remediation items and calendar events, with owners and due dates.
• Quote requests, including the gap summary and framework list that generated them.

Technical and operational data

• Sign-in records. Sign-in is passwordless, so we store a hash of a short-lived one-time link rather than a password. We never hold a password for your workspace.
• Integration credentials for any system you connect, stored encrypted, plus a log of each sync run and its outcome.
• Audit and access records, including who was granted auditor access, by whom, and when it expires or was revoked.

How we use it

• To run the workspace: score assessments, map evidence to controls, generate gap lists, and send the notifications you have asked for.
• To send transactional email: sign-in links, invitations, reminders, and service notices. You cannot opt out of these while you have an account, because they are how the Service works.
• To keep the Service secure and to investigate abuse.
• To produce an indicative quote when you request one, and to follow up on that request.
• To understand which parts of the platform are used, in aggregate, so we can improve it.

We do not use the contents of your workspace to train machine learning models, and we do not sell or rent it. See the AI Policy.

4. Uploaded files

Evidence files and policy documents are stored outside the web root. They are never served as static files. Every download goes through an authenticated handler that checks your session and confirms the file belongs to your organisation before it releases a single byte.

Please upload only what a control genuinely needs. Redacted screenshots and extracts are usually enough, and are a better idea than uploading a production data export.

5. Vendor questionnaire respondents

6. Legal bases

Under Canadian law our basis is your consent, express or implied by the circumstances, together with the exceptions PIPEDA allows for business contact information and for information needed to perform a transaction you asked for.

Where the GDPR or UK GDPR applies, we rely on:

• Contract: running your workspace, sending transactional email, and delivering paid services.
• Legitimate interests: keeping the Service secure, preventing abuse, understanding aggregate usage, and contacting a business about a service they asked about. We balance those against your interests, and you can object.
• Consent: the newsletter, marketing email, and analytics and session replay where consent is required. You can withdraw it at any time.
• Legal obligation: tax, accounting, and records we are required to keep.

Where we process a customer's workspace data on their instructions, the legal basis for that processing is theirs to establish.

7. How long we keep it

• Workspace data: for as long as the workspace is active. If you ask us to delete it, we remove it from production within 30 days and from backups as those backups age out.
• Inactive workspaces: we may email you before deleting a workspace that has had no sign-in for 24 months, and give you a chance to keep it or export it.
• Marketing and CRM records: up to 24 months after the last interaction, then deleted or anonymised.
• Newsletter subscriptions: until you unsubscribe. We keep a suppression record of the unsubscribed address so we do not email you again by mistake.
• Server and security logs: generally under 12 months, longer only where an incident is being investigated.
• Invoices and contracts: seven years, to meet Canadian tax and corporate record-keeping requirements.
• Vendor questionnaire responses: for as long as the customer who collected them keeps them, subject to the expiry they set.

8. Who we share it with

We do not sell personal information and we do not share it for anyone else's advertising. We use a small set of service providers, and each of them only gets what they need:

• Akamai Connected Cloud (Linode) hosts our servers, in Toronto, Canada.
• Cloudflare sits in front of the site as CDN and edge security, and sees request metadata in transit.
• Google provides Google Workspace, which is how our email and internal documents work, Gmail SMTP for outbound transactional and newsletter mail, and Google Analytics 4 on the marketing site.
• Microsoft provides Clarity, the analytics and session-replay tool on the marketing site.
• Stripe processes payments for paid engagements. Card details go directly to Stripe. We never receive or store a full card number.

Within your workspace, data is shared with the people you invite, at the role you gave them. Read-only auditors can see your assessments, evidence, policies, risks, and vendor records but cannot change anything. Where your workspace was created under a white-label partner, that partner's administrators can access it, because that is the relationship you have with them.

We will also disclose information where the law requires it, in response to a valid legal demand, or to protect our rights, our users, or the public from serious harm. If we are ever bought or merged, personal information transfers with the business and you will be told before it is used for a materially different purpose.

9. International transfers

Our servers are in Canada. Some of our processors are American companies and may process data in the United States or elsewhere. That means foreign courts and law enforcement may in some cases be able to compel access to it under the law of that country.

Where personal information leaves the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, the UK Addendum, and the adequacy decision Canada holds for commercial organisations under PIPEDA. Under PIPEDA and Quebec's Law 25, we remain accountable for personal information we transfer to a service provider, and we use contractual protections to keep it at a comparable level of protection.

10. How we protect it

• Encryption in transit with TLS across the site and the platform.
• Passwordless authentication with short-lived, single-use sign-in links, so there is no password to be reused or leaked.
• Uploaded files stored outside the web root, released only by an authenticated handler that checks organisation ownership on every request.
• Integration credentials stored encrypted at rest.
• Role-based access inside the Workspace, with read-only auditor and member roles genuinely restricted rather than hidden in the interface.
• Internal access limited to staff who need it, on managed devices, with multi-factor authentication.
• Network access to the origin server restricted at the firewall.
• Logging and monitoring of access, with review of anomalies.

No system is perfectly secure, and we will not claim otherwise. If a breach creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as PIPEDA requires, and meet the equivalent obligations under Quebec's Law 25 and the GDPR where they apply. To report a vulnerability, email [email protected].

11. Your rights

Whoever you are and wherever you live, you can email [email protected] and ask what we hold about you, ask for a copy, ask us to fix it, or ask us to delete it. We answer within 30 days. We will ask you to verify your identity first, and we do not charge for a reasonable request.

Canada, under PIPEDA

• Access the personal information we hold about you and be told how it has been used and who it has been disclosed to.
• Challenge its accuracy and have it corrected.
• Withdraw consent, subject to legal and contractual limits. Withdrawing consent to processing that is necessary for the Service means we can no longer provide it.
• Challenge our compliance with these principles by contacting our privacy officer.

Quebec, under Law 25

• All of the above, plus data portability: you can ask for the computerised personal information you gave us in a structured, commonly used technical format, and ask us to send it to another organisation.
• Ask us to stop disseminating personal information, or to de-index a link, where the dissemination breaches the law or a court order, or causes serious injury to your reputation or privacy.
• Be told, and be able to object, if a decision about you is based exclusively on automated processing. We do not make decisions about individuals by exclusively automated means today. Readiness scores are calculated automatically, but they describe an organisation's answers, not an individual, and they are not used to make a decision about a person.
• Complain to the Commission d'acces a l'information du Quebec if you are not satisfied with our response. Details are at cai.gouv.qc.ca.

European Union and United Kingdom, under the GDPR

• Access, rectification, erasure, restriction of processing, and data portability.
• Object to processing based on legitimate interests, and object to direct marketing at any time with no reason needed.
• Withdraw consent at any time, without affecting processing that already happened.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not carry out that kind of processing.
• Lodge a complaint with your national supervisory authority, or with the UK Information Commissioner's Office.

If your request relates to data held inside a customer's workspace, including vendor questionnaire answers, we will forward it to that customer and support them in responding, because it is their record and their decision.

12. Cookies and similar technologies

What we set, what third parties set, and how to turn it off is all on the Cookie Policy page. We keep it there rather than repeating it here, so there is one version to maintain and one version to be accurate.

13. Marketing email

We send marketing email only to people who asked for it or who contacted us about our services, which is what Canada's anti-spam legislation requires. Every marketing message carries an unsubscribe link and our mailing address, and unsubscribing takes effect immediately. Transactional email, such as sign-in links and service notices, is separate and continues while you have an account.

14. Children

The Service is for businesses. It is not directed at children and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, email [email protected] and we will delete it.

15. Changes to this policy

We update this policy when what we do changes. The date at the top is always the current version. For a material change, we will notify account holders by email or by a notice in the platform before it takes effect. Please re-read it occasionally.

16. How to complain

Start with us, at [email protected]. We would rather fix a problem than argue about it.

If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec, K1A 1H3, at priv.gc.ca or 1-800-282-1376. Quebec residents can complain to the Commission d'acces a l'information du Quebec. Residents of the EEA or the UK can complain to their national supervisory authority or to the Information Commissioner's Office.

17. Contact

Privacy requests and questions: [email protected].
Security reports: [email protected].
Everything else: [email protected] or the form at traztech.ca/contact.

Related reading: the Terms of Service, the Cookie Policy, the AI Policy, and what the traztech Workspace stores.