Privacy Policy

Consultations NovaWave Inc. ("NovaWave," "we," "us," or "our") provides governance, risk, compliance, cybersecurity, and AI advisory services to organizations in Canada, the United States, the European Union, and other jurisdictions. This Privacy Policy explains what information we collect through cnovawave.com (the "Site"), how we use it, and the choices and rights available to you.

This policy covers the Site only. If you engage NovaWave for professional services, the handling of information related to that engagement is governed by our signed services agreement with you, not this policy.

Because NovaWave is based in Québec, this policy is written to comply with Québec's Act respecting the protection of personal information in the private sector ("Law 25"), Canada's federal Personal Information Protection and Electronic Documents Act ("PIPEDA"), and, for visitors located there, the EU General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act ("CCPA/CPRA"). Where these laws differ, we apply whichever gives you the stronger protection.

1. Information We Collect

We collect information in the following ways:

• Information you submit directly. When you use the contact form on the Site, we collect your name, work email address, company name, the service area you selected, and the message you provide.
• Information collected automatically. Our hosting provider (Netlify) logs standard technical data for every request, such as IP address, browser type, referring page, and timestamp, for security and reliability purposes.
• Information from third-party links. The Site links to Calendly (for scheduling) and LinkedIn. If you use those services, their own privacy policies govern the information you provide there, not this one.

We do not use cookies, advertising pixels, or behavioral tracking scripts on the Site, and we do not currently run analytics software on the Site. The Site does store one small piece of information in your browser's local storage (not a cookie) — your selected display language (English, French, Spanish, or Portuguese) — purely so the Site remembers your preference on your next visit. This never leaves your browser and is never sent to us.

2. How We Use Your Information — and Your Consent

We only collect and use personal information for purposes you would reasonably expect, and only with your consent, given by submitting the contact form. We use it to:

• Respond to inquiries submitted through the contact form.
• Evaluate whether NovaWave's services are a fit for your organization.
• Maintain an internal record of prospective client communications.
• Comply with legal obligations and protect against fraud, abuse, or security incidents.

We do not sell your information, we do not use it for advertising or marketing to third parties, and we do not use it to make any automated decision that produces legal or similarly significant effects about you. If we ever wanted to use your information for a materially different purpose, we would ask for your consent again first. You may withdraw your consent at any time, subject to legal or contractual restrictions, by contacting us using the details in Section 10 — we will then delete or anonymize your information unless we are required or permitted by law to keep it.

3. Who We Share It With

We use the following service providers to operate the Site and process inquiries. Each processes information only as necessary to provide their service to us:

We do not share your information with any other third party except where required by law, to enforce our agreements, or to protect the rights, safety, or property of NovaWave or others.

4. International Data Transfers

NovaWave is based in Gatineau, Québec, Canada. Information you submit may be processed or stored in Canada, the United States, or the European Union by the service providers listed above. Where required, we rely on those providers' own safeguards (such as standard contractual clauses) for cross-border transfers.

5. Data Retention

We retain contact form submissions and related correspondence for as long as reasonably necessary to evaluate and follow up on the inquiry, and thereafter as needed for our business records, unless you ask us to delete it sooner and we have no legal obligation to retain it.

6. Your Rights

Depending on where you are located, you may have rights under applicable law, including:

• Québec (Law 25): the right to access and receive a copy of personal information we hold about you, to request correction of inaccurate or incomplete information, to withdraw your consent, to request that we cease disseminating your information or de-index a link to it in certain circumstances (the right to de-referencing), and to request that we provide, in a structured and commonly used technology format, personal information you provided us so you can transfer it elsewhere (data portability).
• Canada (PIPEDA): the right to access personal information we hold about you and to request correction.
• European Union / EEA (GDPR): the right to access, correct, delete, restrict, or object to processing of your personal data, and the right to data portability.
• California (CCPA/CPRA): the right to know what personal information is collected, to request deletion, and to non-discrimination for exercising these rights. NovaWave does not sell personal information.

To exercise any of these rights, contact us using the details in Section 11. We will respond within the timeframe required by applicable law (generally within 30 days under Law 25). If we cannot fulfill a request, we will explain why. If you are not satisfied with our response, Québec residents may contact the Commission d'accès à l'information du Québec (CAI); residents elsewhere in Canada may contact the Office of the Privacy Commissioner of Canada.

7. Security and Confidentiality Incidents

We rely on reputable third-party providers (Netlify, Slack, Google) that maintain their own security programs, and we limit access to submitted information to personnel who need it to respond to inquiries. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

In the event of a confidentiality incident (a breach involving personal information) that presents a risk of serious injury, we will notify the Commission d'accès à l'information du Québec and any affected individuals, and take reasonable steps to reduce the risk of harm, as required by Law 25. We also maintain a confidentiality incident register as required by law.

8. Person Responsible for the Protection of Personal Information

As required by Law 25, NovaWave has designated a person responsible for the protection of personal information. By default, that role belongs to the person with the highest authority at NovaWave:

Direct any question, concern, or request regarding this policy or your personal information to this contact.

9. Children's Privacy

The Site is intended for business use and is not directed at children. We do not knowingly collect personal information from anyone under 16.

10. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be reflected here.

11. Contact Us