How We Handle Your Data

Data Gold Inc. ("Data Gold", "we", "us") is responsible for the personal information we collect. Our designated Privacy Officer handles all privacy-related inquiries and complaints:

We are responsible for personal information in our custody, including information shared with third-party processors on our behalf.

We collect personal information only for the following purposes, identified before or at the time of collection:

• Data Gold Score assessments — to calculate your score, generate your personalized report, and follow up with insights relevant to your business.
• Contact form submissions — to respond to your inquiry and, if you agree, to follow up with relevant services.
• Analytics — to understand how businesses in different industries and sizes are using our tools (aggregated and anonymized).

We will tell you the specific purpose before we collect any information that falls outside these categories.

By submitting the Data Gold Score assessment or the contact form, you consent to the collection, use, and storage of your information for the purposes stated in Section 2. You may withdraw consent at any time by emailing info@datagold.ca — we will stop using your data and delete it within 30 days.

We rely on implied consent for low-sensitivity business contact information (name, company, work email) as permitted under PIPEDA Schedule 1, Clause 4.3.

We collect only what is necessary:

We do not collect: government ID, financial account details, health information, or Social Insurance Numbers.

Your information is used only for the purposes in Section 2. We do not sell, rent, or trade your personal information. We do not share it with third parties except:

• Supabase (database infrastructure) — hosted in AWS ca-central-1 (Canada). Data never leaves Canada.
• Google AI (Gemini) — assessment answers are sent to Google's API to generate your Full Assay Report. Google's data processing terms apply. Answers are not used to train Google's models under our enterprise agreement.
• Legal requirement — if required by Canadian law or court order.

Retention schedule: Assessment records and associated personal information are retained for 24 months from the date of submission, then permanently deleted. Contact form inquiries are retained for 12 months, then deleted. You may request earlier deletion at any time (see Section 9).

We keep personal information as accurate as reasonably necessary for its purpose. If your name, company, or email changes, you can request a correction by emailing info@datagold.ca with the subject line "Data Correction Request". We will update or delete the record within 30 days and confirm in writing.

• Encryption in transit: All data is transmitted over TLS 1.2+.
• Encryption at rest: Data is stored in Supabase (PostgreSQL) with AES-256 encryption at rest.
• Access control: Row-Level Security (RLS) is enabled on all tables. API keys are server-only and never exposed to the browser.
• Signed download URLs: Report download links are cryptographically signed and valid only for the session in which they were generated.
• Rate limiting: All data submission endpoints are rate-limited by IP address.
• Canadian data residency: All personal information is stored and processed within Canada (AWS ca-central-1, Montreal).

This policy is publicly available at datagold.ca/privacy. We will update it whenever our practices change and will note the effective date at the top. If we make a material change, we will notify users who have provided an email address.

Questions about our privacy practices can be directed to info@datagold.ca.

Under PIPEDA, you have the right to:

• Know whether we hold personal information about you
• Access that information and receive a copy
• Challenge its accuracy and request corrections or deletion

To exercise any of these rights, email info@datagold.ca with the subject line "Data Access Request" or "Data Deletion Request". Include your full name and the email address you used when submitting the assessment. We will respond within 30 days and fulfill the request at no charge.

Alternatively, use our Data Request Form and we will contact you within 30 days.

If you believe we have not complied with PIPEDA or this policy, contact our Privacy Officer first:

We will investigate and respond in writing within 30 days. If you are not satisfied with our response, you may escalate to the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca or 1-800-282-1376.