Privacy Notice

Last updated: October 4, 2026

This Privacy Notice explains how the Trinytics platform (the "Platform") handles personal information. In this Notice:

"Provider", "we", or "us" means Trinity Consulting & Analytics Inc. and its subsidiaries (which is Trinytics Technologies Inc.), which operates the Platform;
"Client" or "you" means the organization accessing the Platform;
"Authorized Users" means the individuals the Client authorizes to use the Platform.

This Notice describes our privacy practices in plain terms. It complements our Terms of Service, which set out the operative, contractual processing obligations; where a practice is governed by a specific section of the Terms, this Notice points to it rather than restating it.

1. Two categories of information

This Notice distinguishes two categories, because different rules apply to each:

Client Data — data you provide to the Platform, which may include personal information about your patrons. We process it only on your instructions, as a service provider (processor) under applicable privacy law, as set out in Sections 3.1 to 3.7 of the Terms of Service. You remain the organization accountable for it.
Platform Usage Data — the record of how your Authorized Users interact with the software, which we collect on our own behalf, as set out in Section 3.8 of the Terms of Service.

2. Who we are, and our Privacy Officer

The Platform is operated by Trinity Consulting & Analytics Inc. and maintained by its wholly-owned subsidiary Trinytics Technologies Inc. Our Privacy Officer is Jenny Yang ([email protected]), who is accountable for how we collect, use, and protect personal information.

We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, including Alberta's Personal Information Protection Act (PIPA) and British Columbia's Personal Information Protection Act.

3. Personal information we handle

Account information — the name, email address, organization, and role of each Authorized User. Authentication is handled by federated identity providers (Microsoft Entra ID, Google) or email magic-link sign-in; we receive basic profile information, not your provider credentials.
Platform Usage Data — as described in Section 3.8 of the Terms: the Authorized User taking an action, the action taken, pages viewed expressed as route patterns (not the specific records viewed), sign-in and sign-out events, and technical context (session and device identifiers, a one-way cryptographic hash of the network address rather than the address itself, browser and device family, and the software version). Our systems are designed to exclude patron personal information from Platform Usage Data (Section 3.8.2).
Audit Record — as described in Section 3.9 of the Terms: the record of each action an Authorized User takes within the Client's organization and of each Client Data record they access, create, change, export or delete, with the time, the outcome and the same technical context. Unlike Platform Usage Data, the Audit Record is Client Data: we keep it for the Client, the Client's owners can review it within the Platform, and each entry is retained for seven (7) years. The Client is responsible for telling its Authorized Users that their actions are recorded.
Client Data — may contain personal information about your patrons. We handle it only as your processor, on your instructions (Sections 3.1 to 3.7 of the Terms).

4. How we use personal information

Account information — to provide and secure access, authenticate Authorized Users, deliver support, and administer billing.
Platform Usage Data — only for the purposes listed in Section 3.8.3 of the Terms (operating, securing, troubleshooting, and improving the Platform; support; security and audit records; seat and licence verification for billing; and aggregated statistics in which no individual is identifiable). The restrictions in Section 3.8.4 apply — in particular, we do not disclose an individual's Platform Usage Data to the Client for evaluating or managing that person's job performance.
Client Data — only to provide the Services on your instructions (Section 3.3 of the Terms).

5. Disclosure and sub-processors

We do not sell personal information. We share it only with the sub-processors listed in Section 3.4 of the Terms of Service — Digital Ocean (application and database hosting; Toronto, Canada), Amazon Web Services SES (outbound email for the campaign module; Canada Central), Trinytics Technologies Inc. (development, maintenance, and support access), and Functional Software, Inc. / Sentry (application error and performance diagnostics; United States). Each is bound by confidentiality and privacy-compliant terms no less protective than our own. We may also disclose personal information where required by law.

Development, maintenance, and support of the Platform are carried out by our own personnel and by the developers and contractors we engage for that purpose. They may access personal information only as needed to build, maintain, and support the Platform, are bound by confidentiality obligations (Section 3.5 of the Terms), and may not use it for any other purpose. We remain accountable for personal information processed on our behalf.

6. Where information is stored

Client Data and Platform Usage Data are stored and processed in Canada. Fault diagnostics sent to the Sentry sub-processor may be processed in the United States. These are limited to the technical stack trace of a software error and the name of the function that raised it; Sentry is not sent Client Data, patron records, account identifiers, network addresses, session cookies, or application logs. Where an error needs to be traced to the Authorized User who encountered it, that association is held in our Canadian systems and linked to the Sentry record by an opaque reference (Section 3.4). Where you require that no data leave Canada, we will disable that sub-processor on written request, with a corresponding reduction in our diagnostic capability (Section 3.4).

7. How long we keep it

Platform Usage Data at the level of individual actions is retained for thirteen (13) months and then deleted (Section 3.8.5).
Security and audit records are retained for seven (7) years, consistent with our regulatory record-keeping obligations.
Aggregated statistics in which no individual is identifiable may be retained indefinitely.
Client Data — on termination you have thirty (30) days to export it (the "Export Period"), during which you may also ask us in writing to return it, which we do within thirty (30) days of the request. We securely delete it after the Export Period ends, and in any event within thirty (30) days of that date. Where you ask us to delete Client Data other than on termination, we do so within thirty (30) days of the request. This is subject to legal retention obligations and to backup copies persisting in disaster-recovery systems for up to one (1) year (Section 3.6).

8. Your rights

Subject to legal limits, you may request access to, or correction of, the personal information we hold about you. An Authorized User may request access to or correction of their own Platform Usage Data by contacting us (Section 3.8.6). Rights in respect of patron personal information within Client Data are exercised through the Client as the accountable organization; we will assist the Client as its processor. We respond within the period required by applicable privacy law. We may decline a deletion request in respect of security and audit records where retention is required for our own legal or regulatory purposes.

9. How we protect information

We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the information, as described in Section 3.5 of the Terms — including encryption in transit and, where supported, at rest; role-based access controls scoped to each organization; ongoing monitoring of software dependencies; and documented incident-response practices. In the event of a privacy breach posing a real risk of significant harm, we notify the affected parties and the applicable privacy regulator as required by law (Section 3.5).

10. Changes to this Notice

We may update this Notice from time to time. The "last updated" date above reflects the current version, and material changes are published as a new version.

11. Contact us

For any privacy question or request, contact our Privacy Officer:

Jenny Yang, Privacy Officer — [email protected]

Trinity Consulting & Analytics Inc. and its subsidiaries (which is Trinytics Technologies Inc.), 255 W 1st Street, North Vancouver, BC.