Privacy Notice

1. Introduction

‍Trace Consulting Group Ltd. (“TCG”, "we", "us", "our") respects your privacy and is committed to protecting your personal information. We are dedicated to safeguarding your personal information and ensuring transparency about how we collect, use, share and protect it. This Privacy Notice outlines how we handle personal data across various interactions-with clients, suppliers, partners, service providers, employees, applicants, website visitors and others. It also outlines your rights regarding your personal data and how you can exercise them.

TCG may collect personal information solely for the purpose of conducting and delivering our engineering and consulting services, managing professional relationships. We do not sell your personal data to any third party for marketing or any other commercial purposes. Whether you engaged with us through our services, website, or events, we take every reasonable step to ensure that your personal data is used and protected appropriately.

2. Who we are and our responsibilities with regards to your personal data

TCG is a Canadian based professional services firm specializing in engineering consulting company headquartered in Toronto, Ontario, Canada.

The entity within TCG and its subsidiaries that collect and process your personal data will generally be the one with which you have a relationship or from which you receive services.

In certain situations, Trace Consulting Group may process personal data on behalf of its clients in accordance with their instructions and relevant data protection legislation, including Personal Information Protection and Electronic Documents Act (PIPEDA) and any relevant provincial privacy legislation. In these cases, our clients generally serve as the data controllers—deciding the purpose and method of processing—while TCG acts as the data processor, carrying out those instructions in line with contractual obligations and regulatory requirements.

3. What personal data we collect and why

Depending on the nature of your interaction with us, we may collect different types of personal data to fulfill our business activities, legal obligations, and provide you with our services. This may include:

• Identification information: Such as your name, job title, company, contact information (email, phone, postal address).
• Correspondence records: Including emails, phone logs, and other communications exchanged us.
• Verification information: Including official identification documents, especially when accessing TCG offices. We may also gather data from external sources such as tax authorities, authorized screening providers, or public records platforms to meet due diligence and compliance requirements.
• Visitor and security data: CCTV footage, visitor logs, and vehicle registration details when you visit our offices or sites.
• Event and meeting participation data: Such as registration information, contact details, photographs or videos and specific requirements (e.g., dietary or accessibility related) for events or meetings organized by TCG – whether internal or client-facing.
• Website usage information: Information collected automatically via cookies and similar technologies when you visit our website to improve your user experience.
• Recruitment data: If you apply for a job or consultancy position with us, we collect information such as CVs, references, background check results, and eligibility to work documentation.
• Marketing and communications: This includes your communication preferences and responses related to our blogs, webinars, newsletters, surveys, event invitations, and other updates we share. You have the right to opt out of receiving marketing communications from us at any time by clicking the unsubscribe link in any of our emails or by contacting us directly at info@traceconsultinggroup.com.

4. Legal basis for processing your personal data

We process your personal data only when there is a valid legal basis to do so, which includes:

• Consent: When you have explicitly or implicitly agreed to the use of your personal data – such as for receiving marketing communications or for processing sensitive information. You may withdraw your consent at any time; however, doing so may impact our ability to deliver certain services or accommodate specific requests.
• Contractual necessity: Processing necessary to perform a contract with you or your organization, such as delivering consulting services, managing your visit to our premises, or administering employment applications.
• Legitimate interests: Where processing is necessary for our legitimate business interests or those of a third party, provided that your rights and freedoms are not overridden. Examples include website management, fraud prevention, security monitoring, and direct marketing.
• Compliance with legal obligations: When we are required to process data to comply with laws, such as maintaining accurate business records, performing due diligence checks, or assisting with investigations.

5. Sharing your personal data

We may disclose your personal data within the TCG network and to third parties who support our business operations, including but not limited to:

• IT and cloud service providers
• Legal, tax and financial advisors
• Insurers and background screening agencies
• Marketing support vendors and office facility managers

These third parties are contractually required to protect your data appropriately.

In certain circumstances, we may share personal data during business transitions such as mergers, acquisitions, sales, or restructurings.

We may also disclose your data if required by law, court order, or regulatory authority, or to protect the safety, rights, or property of TCG, our employees, clients, or others.

6. How we protect your personal data

We implement a combination of organizational, technical, and physical safeguards to protect your personal data against unauthorized access, loss, misuse, or alteration. These include:

• Role-based access controls to restrict data access
• Encryption, firewalls, secure authentication systems
• On-site physical security protocols
• Staff training on privacy and cybersecurity
• Confidentiality and security clauses in supplier contracts
• Incident response procedures to investigate and mitigate breaches

7. Data retention

We retain personal data only as long as necessary to fulfill the purposes for which it was collected, including for the duration of project delivery and to satisfy any contractual or operational obligations.

For most client-related matters, personal data is retained while TCG is actively delivering services and, in line with industry standards, for a period of 5-7 years following the completion of the project. This retention period allows for reference, warranty, regulatory, and audit purposes.

Retention periods may vary depending on:

• The nature and duration of our engagement.
• Legal or regulatory obligations that require specific retention timelines.
• The type and sensitivity of the data.
• Internal operational needs or contractual agreements.

When data is no longer needed, we securely delete it or anonymize it.

8. Your rights regarding your personal data

In accordance with the laws of Ontario, Canada, you have certain rights over your personal data, which may include:

• The right to access and receive a copy of your personal data we hold.
• The right to correct or update inaccurate data.
• The right to withdraw consent where processing is based on your consent.
• The right to request deletion of your data where no legal basis exists to retain it.
• The right to restrict or object to certain types of processing, including direct marketing or profiling.
• The right to data portability, allowing you to receive your data in a structured, machine-readable format.

To exercise any of these rights or to make enquiries, please contact us at info@traceconsultinggroup.com.

9. Contacting Us

If you have any questions, concerns, or requests regarding your personal data or this Privacy Notice, please contact our us at info@traceconsultinggroup.com.

We strive to respond to all privacy-related inquiries promptly and will acknowledge receipt within 5 business days. We aim to provide a full response or resolution within 30 calendar days, depending on the nature and complexity of the request. If additional time is required, we will keep you informed accordingly.

TCG is incorporated and operates under the laws of the Province of Ontario, Canada. Any legal disputes related to your personal data or this Privacy Notice will be subject exclusively to the courts in Ontario.

‍