Canada Privacy Notice (PIPEDA, Quebec Law 25, CASL)

Organization: InfiniNova Limited (星天域有限公司), trading as VeyJet Privacy Officer: Wayne W. Zhou, Director of Security · legal-privacy-ofac@infini-nova.com · +1-502-536-9198

Supplements the Privacy Policy (Privacy Policy) for individuals in Canada.

1. The ten PIPEDA principles, as we apply them

1. Accountability. We remain accountable for personal information transferred to a third party for processing, including our mentors and our storage and email providers. We use contract to secure a comparable level of protection (the “Data Processing Addendum”).

2. Identifying purposes. We identify purposes at or before collection: to respond to your enquiry, to deliver the services you engage us for, to take payment, and to keep records the law requires. The enquiry form states its purpose at the point of collection.

3. Consent. Your submission of an enquiry is implied consent to be contacted about it. Engaging us is express consent to the processing needed to deliver the service. Marketing, sensitive information and any transfer beyond the list in Privacy Policy §5 require separate express opt-in, which you may withdraw at any time on reasonable notice. We will explain the consequence of withdrawal — usually that we can no longer deliver part of the service — and we will not treat withdrawal as a breach.

4. Limiting collection. We collect only what the service requires. We decline ID documents, financial account numbers and health records (Privacy Policy §3.1).

5. Limiting use, disclosure and retention. Used only for the identified purposes; disclosed only per Privacy Policy §5; retained per Privacy Policy §8, then destroyed or anonymised.

6. Accuracy. We keep information accurate and current as needed for its purpose. Tell us when a student's circumstances change — it directly affects the advice.

7. Safeguards. Security measures proportionate to sensitivity: access control, least privilege, TLS, restricted storage, contractual obligations on every recipient (Privacy Policy §10). We describe only controls we actually operate.

8. Openness. This notice and Privacy Policy are published and free to read, with a named contact.

9. Individual access. On written request we tell you whether we hold information about you, what it is used for, and to whom it has been disclosed, and we give you access — within 30 days, at minimal or no cost. Where we must refuse (it would reveal another individual's information, is subject to solicitor-client privilege, or falls within another PIPEDA exception) we say so, give the reason and the provision, and tell you how to complain.

10. Challenging compliance. Address a challenge to the Privacy Officer above. We investigate every complaint, respond in writing, and correct our practices where a complaint is justified. You may then complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376).

2. 🔴 Where your data is — say plainly

Your personal information is held and processed in Hong Kong (Alibaba Cloud OSS). We do not sell or exchange it, and we do not disclose it to any third party for that party's own purposes (the “No Data Exchange Commitment, and Where Your Data Lives” §1). Mentors in the US and Canada work from a de-identified brief by default. Enquiry notification email transits a relay in the United States. The full picture is at the “No Data Exchange Commitment, and Where Your Data Lives” §4.

While your information is outside Canada it is subject to the law of that jurisdiction and may be accessible to courts and government authorities there, including by lawful order, and PIPEDA's protections do not follow it. We use contract, access control and data minimisation to maintain a comparable level of protection, but we do not represent that Hong Kong or US law is equivalent to Canadian law.

This disclosure is made so that your consent to engage us is informed. If you are not comfortable with it, tell us before you engage us — we would rather lose the engagement than take your data on a consent you did not really give.

3. Quebec (Law 25 / Act respecting the protection of personal information in the private sector)

4. Alberta, British Columbia, Quebec PIPA — private sector

Where provincial legislation is declared substantially similar to PIPEDA, that provincial law applies to our activities in that province. The rights and procedures above are provided on the same terms, and provincial commissioners may be approached directly.

5. CASL — commercial electronic messages

We send a commercial electronic message to a Canadian address only with express consent obtained separately (not pre-checked, not bundled with engaging us), or within a narrow implied-consent window arising from an existing business relationship.

Every message identifies us, gives our postal address and a working unsubscribe mechanism that functions for at least 60 days and is actioned within 10 business days. We keep the consent record — when, how and what you were told — for as long as we may need to prove it. Detail: Communications and Marketing Consent Policy.

We do not install any program on your device, so CASL's software-installation consent rules do not arise.

6. Minors in Canada

Consent for a minor is given by a parent or legal guardian. In Quebec, a minor aged 14 or over may in some circumstances consent personally; we nonetheless require guardian involvement for engagement and payment, because the contract and the fee are the guardian's. See Minors, Guardian Consent and Student Records Policy.

7. Contact

Privacy Officer: Wayne W. Zhou, Director of Security · legal-privacy-ofac@infini-nova.com · +1-502-536-9198 Mailbox 108, 13030 Eastgate Park Way, Louisville, KY 40223, USA Office of the Privacy Commissioner of Canada: priv.gc.ca · 1-800-282-1376 Commission d'accès à l'information du Québec: cai.gouv.qc.ca