Privacy policy.

1. Who we are

Droz Technologies Inc. ("Droz," "we," "us") is a corporation incorporated in Ontario, Canada, headquartered at 4145 North Service Road, Burlington, Ontario, Canada. For privacy matters, we are the data controller for the personal information collected through droz.tech and its locale mirrors (/fr/ and /es/).

Contact: privacy@droz.tech (or contact@droz.tech if the dedicated privacy alias is not yet provisioned). Postal: 4145 North Service Road, Burlington, Ontario, Canada.

2. What we collect

We collect only the information you provide through the forms on this site. We do not use behavioural tracking, third-party advertising cookies, or first-party analytics. The form provider (see Section 4) sets a session cookie only during the moments of submission.

Per form, the fields we collect are:

• contact-general (Contact form, /en/contact/): name, email, company / organization, role (optional), topic, message, consent.
• engagement-request (inline on practice / service / pillar / industry / product pages): name, email, company / organization, role (optional), message, consent. The originating page URL is also recorded as page_source.
• procurement-rfp (/en/contact/#procurement-form): name, email, organization, position / title, solicitation / RFP number (optional), response due date (optional), scope summary, attachment (optional PDF / SOW / NDA, ≤10 MB), consent.
• press-inquiry (/en/press/): name, email, publication, deadline (optional), topic / angle, message, consent.
• capabilities-statement (/en/capabilities-statement/): name, email, organization, procurement intent, consent.
• career-application (/en/careers/{role}/): name, email, phone, role slug (hidden), LinkedIn URL (optional), cover letter (optional), résumé file (PDF / DOCX, ≤10 MB), consent. Career applications fall under additional Ontario / Canadian labor-law protections.
• insights-subscribe (/en/insights/): email, name (optional), topics of interest (optional).

Each form also records the page URL of submission (page_source) and the active locale (locale). No IP-derived geolocation, no device fingerprinting, no browser-history tracking.

3. Why we collect it

We collect this information to (a) respond to your inquiry, (b) deliver the document you requested (capabilities statement, media kit), (c) progress an active procurement or recruitment process, and (d) meet legal and contractual obligations.

Legal basis under GDPR (where applicable): legitimate interest (Art. 6(1)(f) — responding to inquiries you initiated), consent (Art. 6(1)(a) — the consent checkbox on each form), and contractual necessity (Art. 6(1)(b) — when a procurement engagement is contemplated).

Legal basis under PIPEDA (Canada): your express consent via the form's consent checkbox.

4. Who processes the data

Submissions are transmitted via TLS to Web3Forms (Web3Forms, the form-handling service operated by Surjith S. M., HKR Tech Park, Vempayam, Trivandrum, India), which forwards the message to the routed Droz inbox and stores a record for approximately 30 days before automatic deletion per Web3Forms TOS.

Spam protection is handled by Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend Street, San Francisco, California, USA). Turnstile is privacy-respecting and processes a transient browser challenge token; it does not store personal data persistently.

Backup form processor (drop-in equivalent if Web3Forms misbehaves): FormSubmit (Bridgewater Software, India). Activation of FormSubmit will be disclosed here within 30 days of the switch.

Email delivery: each form is routed to one of contact@droz.tech, procurement@droz.tech, press@droz.tech, careers@droz.tech, or insights@droz.tech. Mail is hosted on Droz infrastructure and the corresponding mail provider. Submissions are exported from Web3Forms into Droz-internal archives within the 30-day window so the data has a stable, auditable home outside the processor.

5. How long we keep it

Form-by-form retention windows:

• Engagement / Contact submissions — 24 months after last contact, then deleted on a rolling basis.
• Procurement / RFP submissions — retained for the duration of the solicitation plus 7 years for tax / audit / contract retention.
• Press inquiries — 24 months after last contact.
• Capabilities-statement requests — 24 months after request; the auto-reply email is logged for 24 months.
• Career applications — 12 months after the closing of the role for which the candidate applied, unless the candidate consents to longer retention.
• Insights subscription — retained until the subscriber unsubscribes (one-click unsubscribe link in every issue).

Processor side: Web3Forms retains the submission record for ~30 days (their TOS). The authoritative copy lives in the Droz-internal archive, not on the processor.

6. Who we share it with

We do not sell, rent, or trade personal information. We share form submissions only with: (a) the sub-processors named in Section 4, (b) Droz personnel and senior partners with a legitimate operational need to read the submission, (c) law enforcement or a regulator when legally compelled.

Submissions are not transferred to advertising networks, data brokers, or AI training datasets.

7. Your rights

Across PIPEDA and GDPR you have the following rights:

• Right to access — request a copy of the personal data we hold on you.
• Right to rectification — correct inaccurate data.
• Right to erasure / deletion ("right to be forgotten" under GDPR; equivalent under PIPEDA on request).
• Right to restrict processing.
• Right to object — including objection to processing based on legitimate interest.
• Right to data portability — receive your data in a machine-readable format.
• Right to withdraw consent at any time (does not affect processing that already happened on the basis of consent).
• Right to lodge a complaint — with the Office of the Privacy Commissioner of Canada (OPC, www.priv.gc.ca) or your local EU supervisory authority.

To exercise any right, email privacy@droz.tech with the request and identifying information sufficient for us to locate your submission. We respond within 30 days (PIPEDA / GDPR-aligned).

8. International transfers

Droz Technologies is based in Canada. Submission data is processed by Web3Forms (India) and Cloudflare (USA) as named in Section 4. Cross-border transfers from Canada and the EU are protected by (a) Cloudflare's certified data-protection program, (b) Web3Forms' standard contractual terms, and (c) the consent provided through the form's consent checkbox.

EU and UK residents may request additional safeguards (e.g., Standard Contractual Clauses) before submitting via the form by contacting privacy@droz.tech.

9. Cookies and analytics

We do not run third-party analytics or advertising on droz.tech at the time of writing. We do not set first-party tracking cookies.

Cloudflare Turnstile may set a transient cookie scoped to the form submission moment; it does not persist behavioural data.

If Droz introduces analytics in the future, this policy will be updated and the change announced via the version history in the article meta ("Last updated" line).

10. Children

droz.tech is a business-to-business site. We do not knowingly collect personal information from anyone under 16. If you believe a minor has submitted a form, contact privacy@droz.tech and we will delete the record.

11. Changes to this policy

Material changes to this policy are announced at the top of the article (the "Last updated" meta) and a version-history table appended below. Non-material wording changes (typo fixes, link updates) do not bump the version.