Privacy Policy

Formaxis Inc. ("Formaxis", "we", "us", or "our") respects your privacy and is committed to protecting the personal information you provide to us.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you visit our website, contact us, submit an inquiry, apply for an offer, or use our services.

1. Who We Are

Formaxis Inc. provides website, digital setup, and related business support services for small businesses.

We have designated a Privacy Officer who is accountable for our compliance with applicable privacy laws, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). If you have questions about this Privacy Policy or about how your personal information is handled, you may contact our Privacy Officer at:

• Privacy Officer: Kevin Kwan, privacy@formaxis.ca
• Business Email: info@formaxis.ca

2. What Personal Information We Collect

Depending on how you interact with us, we may collect information such as:

• name
• business name
• email address
• phone number
• website or social media page
• business type or industry
• domain-related information
• project details, business needs, timeline, and notes you provide
• invite code or campaign-related information
• communications you send to us through forms, email, or messaging platforms
• technical information such as IP address, browser type, device information, referral source, and basic website usage data

We only collect personal information that is reasonably necessary for our business purposes and the services or information you request from us.

3. How We Collect Information

We may collect personal information:

• directly from you when you fill out a form, submit an application, request information, or contact us
• when you communicate with us by email, website form, or social media / messaging platforms
• automatically through standard website technologies such as server logs, cookies, or analytics tools, if enabled on our website
• from service-related onboarding materials or documents you voluntarily provide

4. Why We Collect and Use Personal Information

We may collect, use, and process personal information for purposes such as:

• responding to inquiries and messages
• reviewing applications for invitation-only or limited offers
• issuing and validating invite codes or private access
• assessing project fit, readiness, and service requirements
• contacting you about your inquiry, application, or requested services
• onboarding approved clients
• delivering website, setup, hosting, email, domain, and related services
• maintaining internal records, project history, and service communications
• improving our website, services, and business operations
• protecting our business against fraud, abuse, unauthorized access, or misuse
• complying with legal, regulatory, tax, accounting, or contractual requirements

We will not use your personal information for purposes unrelated to those described here unless required or permitted by law, or unless we obtain appropriate consent.

5. Consent

By providing your personal information to us, submitting a form, communicating with us, or applying for an offer, you consent to our collection, use, and disclosure of your personal information for the purposes described in this Privacy Policy and any collection notice presented at the point of submission.

Where required, we may request additional or express consent for specific activities.

You may withdraw your consent to certain uses of your information, subject to legal, contractual, or operational limitations. Withdrawing consent may affect our ability to review your application or provide services.

6. Sharing of Personal Information

We do not sell your personal information.

We may share personal information only where reasonably necessary, including with:

• website hosting providers
• domain registrars and DNS-related providers
• email and communications providers
• payment processors
• cloud storage or software tools used to operate our business
• contractors or service providers assisting with service delivery, administration, or technical support
• legal, accounting, or regulatory advisors where necessary
• government authorities or other parties where required by law or lawful process

We require service providers handling personal information on our behalf to enter into written agreements obligating them to protect personal information in a manner consistent with this Privacy Policy and applicable laws, and to use it solely for authorized purposes.

7. Information We Process on Behalf of Clients

When we provide hosting, maintenance, development, or related services to our business clients, we may process personal information that those clients collect from their own customers, patients, members, or end users ("Client Data").

For Client Data, Formaxis acts as a service provider/processor. We process Client Data solely under instructions from the relevant business client and in accordance with our service agreement with that client. We do not use Client Data for our own purposes.

For business clients in regulated professions — including legal, accounting, healthcare, insurance, and financial services — we offer additional contractual safeguards, including on-premises server deployment options, HTTPS encryption for web traffic, and confidentiality undertakings appropriate to applicable professional rules and regulations (such as the Law Society of Ontario's Rules of Professional Conduct, PHIPA for healthcare, or CPA Ontario standards for accounting).

If you are an end user of one of our business clients (for example, a patient, customer, or member of a Formaxis client), your personal information is governed by that client's privacy policy, not this one. Please contact our client directly for access, correction, or deletion requests, or contact us at privacy@formaxis.ca for routing.

8. Cookies and Website Analytics

Our website uses essential cookies for site functionality and, only with your consent, Google Tag Manager + Google Analytics 4 for traffic analysis. These tools may collect technical or usage information such as browser type, pages visited, referral source, approximate location, and session behavior.

We provide a granular cookie consent banner that lets you accept or reject analytics tracking. You can change your preferences at any time via the "Cookie preferences" link in our website footer. The cookies we use are:

• access_token — JWT authentication token (Essential, HttpOnly, Secure, SameSite=Lax, 15 minutes)
• refresh_token — JWT refresh token (Essential, HttpOnly, Secure, SameSite=Lax, 7 days)
• app-locale — language preference (Essential, SameSite=Strict, session)
• invite_code — invite code verification (Essential, SameSite=Strict, 7 days)
• formaxis-consent-v1 — your cookie consent choice, stored in localStorage (Essential)
• _ga, _ga_* — Google Analytics tracking (Analytics, only set if you grant consent)

Essential cookies cannot be disabled because the site requires them to function (e.g., login state, language preference). Analytics cookies are off by default and only loaded if you grant consent via the banner.

9. Third-Party Services and Platforms

Our website or workflows may rely on third-party tools or platforms, including hosting, forms, analytics, domain services, payment services, and communication tools.

If you interact with us through third-party platforms such as Facebook, Instagram, WhatsApp, or email providers, your information may also be subject to those platforms' own privacy practices and terms. For sensitive matters (such as legal advice, health information, or financial details), we do not recommend transmitting confidential information through these channels — please use email at privacy@formaxis.ca or our secure web forms instead.

We are not responsible for the independent privacy practices of third-party websites, services, or platforms that we do not control.

10. Retention

We retain personal information only as long as reasonably necessary for the purposes for which it was collected, including to:

• respond to inquiries
• review applications
• provide services
• maintain project and business records
• meet legal, tax, accounting, or dispute-resolution obligations

Specific retention periods we apply:

• Inquiry forms with no client engagement: up to 12 months
• Active client records: duration of contract plus 7 years (Canada Revenue Agency tax record requirement)
• Marketing email subscribers: until unsubscribe plus 30 days
• Audit logs (authentication and administrative actions): 5 years
• Backup snapshots: 90 days, rolling

These periods may be extended as required for legal, regulatory, tax, accounting, or dispute-resolution obligations.

When personal information is no longer required, we will delete, anonymize, or securely dispose of it as appropriate.

11. Safeguards

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, modification, or destruction.

However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

12. Access and Correction

You may request access to the personal information we hold about you, and you may request correction of inaccurate or incomplete information, subject to applicable legal exceptions.

To make a request, please contact us using the contact details listed above.

13. How to Make a Complaint

If you believe we have not complied with this Privacy Policy or your privacy rights under applicable law, please contact our Privacy Officer at privacy@formaxis.ca first. We will investigate and respond.

If you are not satisfied with our response, you may file a complaint with:

• The Office of the Privacy Commissioner of Canada (priv.gc.ca)
• The Information and Privacy Commissioner of Ontario (ipc.on.ca), if applicable
• The Commission d'accès à l'information du Québec (cai.gouv.qc.ca), for Quebec residents

14. Cross-Border Storage or Processing

Some of our service providers may store or process personal information outside your province or outside Canada, including in the United States. This may include cloud storage providers, analytics services (e.g., Google Analytics), payment processors (e.g., Stripe), and communication tools.

When personal information is processed outside Canada, it may be subject to the laws of the jurisdiction in which it is processed, including potential lawful access by foreign government authorities.

We require service providers handling personal information on our behalf to enter into written agreements that obligate them to protect personal information consistent with this Privacy Policy and applicable Canadian privacy laws.

For business clients with specific deployment or jurisdiction requirements (such as legal or healthcare clients), we offer on-premises deployment options that allow your data to remain within infrastructure you control — please contact us to discuss specific requirements.

15. Children's Privacy

Our services are intended for businesses and adults aged 18 or older acting on behalf of businesses. We do not knowingly collect personal information from individuals under the age of 18.

If we become aware that we have collected such information without verified parental consent, we will delete it promptly. If you believe we have collected information from a minor, please contact privacy@formaxis.ca.

16. Electronic Communications (CASL)

Where you provide your business email address through our website or in the course of inquiring about our services, you provide implied consent under Canada's Anti-Spam Legislation (CASL) to receive related business communications, including responses to your inquiry, project updates, and information about our services.

You may withdraw your consent and unsubscribe at any time by clicking the unsubscribe link in any commercial email we send, or by emailing privacy@formaxis.ca with the subject line "Unsubscribe". We will process unsubscribe requests within 10 business days as required by CASL.

Each commercial electronic message we send will clearly identify Formaxis Inc. as the sender, provide our valid contact information, and include a functioning unsubscribe mechanism.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, practices, technologies, or legal requirements.

The updated version will be posted on this page with a revised effective or last updated date.

For material changes (such as new categories of data collection, new sharing of personal information, or significant changes to your rights), we will provide reasonable advance notice and, where required, seek your renewed consent. For non-material changes (such as clarifications or updated contact details), continued use may indicate acceptance.

Previous versions of this policy are retained for reference and are available upon request — contact privacy@formaxis.ca with the effective date or last-updated date you would like to review.

We monitor proposed Canadian privacy legislation, including the Consumer Privacy Protection Act (CPPA) under Bill C-27, and will update this policy as required to align with future legislation.

18. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or your personal information, please contact: