Privacy Policy

Your privacy matters

This Privacy Policy explains how Rehosys collects, uses, retains and protects personal information when you visit our website or contact us.

Rehosys is a Canadian consulting firm providing ISO consulting and audit support to organizations in Canada, the United States and through select international engagements.

This policy applies to information collected through the Rehosys website, its online inquiry form and email communications initiated from the website.

1. Information we collect

Information you provide through the inquiry form or by email

Rehosys operates an online inquiry form but does not currently operate a user account system or customer portal.

We collect personal information when you voluntarily submit the inquiry form or contact us by email. Depending on how you contact us and what you include, this information may include:

• Your name
• Your work email address
• Your company or organization
• Your country or region
• The ISO standard and type of support that interest you
• Your preferred method of response
• The contents of your enquiry
• Your job title or telephone number if you voluntarily provide it by email
• Documents or attachments you voluntarily provide by email
• Any other information included in your email signature or correspondence

Please avoid submitting or emailing sensitive, confidential or security-critical information during an initial enquiry unless it is necessary and an appropriate method of transmission has been agreed upon.

Form security information

The inquiry form uses Cloudflare Turnstile to distinguish legitimate submissions from automated abuse. Cloudflare may process technical information such as your IP address, browser or device characteristics, and interaction data to perform this security check. Rehosys receives the verification result but does not use Turnstile for advertising.

Website analytics

Rehosys intends to use Plausible Analytics to understand how visitors use the website.

Plausible Analytics is designed to provide aggregate website statistics without using cookies, persistent identifiers, cross-site tracking or individual visitor profiles. Plausible states that its standard service does not collect or store personal information that can identify individual visitors.

The aggregate information available to Rehosys may include:

• Pages viewed
• Approximate visitor counts
• Referring websites
• General geographic information, such as country or region
• Browser type
• Device type
• Operating system
• Aggregate website events, such as selected links

Rehosys will not use Plausible Analytics to collect names, email addresses, message contents or other information entered by visitors.

2. How we use personal information

Information submitted through the inquiry form or by email may be used to:

• Respond to your enquiry
• Understand your organization’s needs
• Arrange an introductory conversation
• Determine whether Rehosys is an appropriate service provider
• Prepare a proposal, quotation or potential engagement
• Communicate with you about requested services
• Maintain business and correspondence records
• Protect the security and integrity of our systems
• Meet legal, regulatory, accounting or contractual obligations
• Establish, exercise or defend legal rights

Rehosys limits its collection, use and retention of personal information to purposes that are reasonably necessary and appropriate. Canadian privacy principles require organizations to identify their purposes, limit collection, protect information appropriately and retain it only as long as necessary.

3. Marketing communications

Rehosys does not automatically add people who make enquiries to a newsletter or marketing mailing list.

We will only send marketing communications where you have separately consented or where otherwise permitted by applicable law.

You may withdraw your consent to marketing communications at any time.

4. Cookies and similar technologies

The Rehosys website does not currently intend to use advertising cookies, behavioural tracking cookies or social-media tracking pixels.

The standard Plausible Analytics implementation is designed to operate without cookies or persistent identifiers.

If Rehosys later introduces technologies that use non-essential cookies, profiling, advertising or identifiable visitor tracking, this Privacy Policy will be updated and any legally required consent mechanism will be implemented.

5. Service providers

Rehosys uses third-party service providers to operate its website and business communications.

These providers may include:

• GoDaddy, for domain registration and DNS services
• OpenAI Sites and Cloudflare, for website hosting and delivery infrastructure
• Proton Mail, for business email
• Resend, for secure delivery of inquiry-form submissions to Rehosys
• Cloudflare Turnstile, for spam and automated-abuse protection
• Plausible Analytics, for aggregate website analytics
• Other professional, technology, security or administrative providers reasonably required to operate the business

These providers may process information only to the extent necessary to provide their services or as required by law.

Information may be processed or stored outside your province, state or country, including in Canada, the United States or Europe. When information is handled in another jurisdiction, it may be subject to the laws of that jurisdiction.

6. When information may be shared

Rehosys does not sell personal information.

Personal information may be shared only when reasonably necessary:

• With service providers supporting website hosting, email, security or business operations
• With professional advisers such as lawyers, accountants or insurers
• To comply with a legal obligation, court order or lawful government request
• To investigate fraud, misuse, security incidents or unlawful activity
• To protect the rights, property or safety of Rehosys or others
• As part of a business reorganization, merger, acquisition or transfer, subject to appropriate safeguards
• With your consent or at your direction

Quebec guidance expects privacy policies to explain which third parties may receive or access personal information and the circumstances in which that may occur.

7. Retention

General enquiries that do not result in an engagement may be retained for up to twelve months after the last communication, unless a longer period is reasonably required for legal, security or business-record purposes.

Where an enquiry results in a client engagement, information may be retained for longer in accordance with:

• The applicable Statement of Work
• Consulting or audit agreements
• Non-disclosure agreements
• Professional and contractual obligations
• Tax, accounting and insurance requirements
• Applicable limitation periods
• Legal or regulatory requirements

When personal information is no longer required, Rehosys will take reasonable steps to securely delete, destroy or anonymize it.

8. Security safeguards

Rehosys uses reasonable administrative, technical and organizational safeguards appropriate to the sensitivity of the information.

These safeguards may include:

• Access controls
• Password protection
• Multi-factor authentication
• Secure email and hosting services
• Device and account security
• Limited access on a need-to-know basis
• Secure retention and deletion practices
• Monitoring and response measures for suspected security incidents

No method of electronic transmission or storage can be guaranteed to be completely secure. For this reason, visitors should avoid submitting highly sensitive information through the inquiry form or ordinary email unless appropriate safeguards have been agreed upon.

9. Your privacy rights

Subject to applicable law, you may request:

• Confirmation of whether Rehosys holds personal information about you
• Access to personal information held about you
• Correction of inaccurate or incomplete information
• Withdrawal of consent, where processing depends on consent
• Deletion of information where it is no longer required or where applicable law permits
• Information about how your personal information has been used or disclosed
• A copy of eligible computerized personal information in a structured and commonly used format, where applicable

You may also raise a concern or complaint about Rehosys’s handling of personal information.

Canadian privacy principles recognize rights of access and correction and require organizations to make their privacy practices publicly available.

10. Privacy Officer

Questions, requests or complaints concerning privacy may be directed to:

The Privacy Officer is responsible for receiving and responding to privacy enquiries, access requests, correction requests and complaints.

Quebec requires businesses to publish the title and contact details of the person responsible for protecting personal information.

11. Children’s privacy

The Rehosys website and services are intended for organizations and business professionals.

Rehosys does not knowingly collect personal information from children through the website. Anyone who believes a child has submitted personal information may contact the Privacy Officer.

12. External links

The website may contain links to external services, including LinkedIn.

Rehosys is not responsible for the privacy practices, security or content of third-party websites. Visitors should review the privacy policies of those services before providing personal information.

13. Changes to this policy

Rehosys may update this Privacy Policy as its website, services, technologies or legal obligations change.

The updated version will be published on the website with a revised “Last updated” date. Where required by law, additional notice or consent will be provided.

14. Contact

For general business enquiries:

hello@rehosys.com

For privacy enquiries:

privacy@rehosys.com