BLUEFLEX Privacy Policy
BlueFlex Logic IT ("BlueFlex," "we," "us") is a Canadian compliance consultancy. We advise organizations on how to handle personal information responsibly, so this policy is written the way we tell our clients to write theirs: in plain language, specific about what actually happens, and accountable to a named individual.
1. Who is accountable
Under the Personal Information Protection and Electronic Documents Act (PIPEDA), an organization must designate an individual accountable for its compliance. At BlueFlex, that individual is the Founder, Precious Eze, reachable at innovation@blueflexlogicit.com or +1 437 298 3909. Questions, access requests, corrections, and complaints under this policy all go there, and receive a response within 10 business days.
2. What we collect, and why
We collect only what the interaction requires:
- When you contact us or book a call: your name, email address, company, and whatever you choose to tell us about your situation. Used to respond to you and prepare for the conversation. Legal basis: your consent, given by reaching out.
- When you become a client: business contact details, engagement records, and the documents you share for the purposes of the engagement. Used solely to deliver the services in our agreement. Client materials are governed by the confidentiality terms of that agreement, which prevail over this policy where they are stricter.
- When you receive our emails: we send commercial electronic messages in compliance with Canada's Anti-Spam Legislation (CASL). Every message identifies us and includes a working unsubscribe, honoured within 10 business days. We record the consent basis for every address we contact.
- When you visit this website: we keep it simple. This site sets no cookies, runs no analytics, and uses no advertising trackers. Our hosting provider generates standard, short-lived server logs (such as IP address and pages requested) to operate and secure the service; we do not use these to identify visitors. If we ever add analytics, we will choose a privacy-respecting, cookieless service and update this policy first. We do not sell or rent personal information, to anyone, ever.
3. AI tools and your information
BlueFlex uses AI tools in its own operations under a written internal AI acceptable-use policy that classifies data by sensitivity and restricts which categories may be processed by which tools. Our current approved tool is Claude, by Anthropic, operated with data-sharing and training settings reviewed and configured before any client material is processed; client-confidential material is handled only in tools whose data-handling terms we have reviewed and approved, and the approved list is maintained in our internal AI register. We tell you this because we believe organizations using AI should say so, it is the standard we advise, so it is the standard we practice.
4. Where information lives, and who else touches it
We use a small number of service providers to operate: Google Workspace (email and documents); Netlify (website hosting); Cal.com (call booking). Each processes information only to provide its service to us, under its own contractual terms. Some providers store data outside Canada (typically in the United States); where they do, the information is subject to the laws of those jurisdictions. We select providers with appropriate security practices and contractual protections.
5. How long we keep it
- Inquiries that don't become engagements: deleted within 18 months.
- Client engagement records: retained 7 years from engagement end, consistent with Canada Revenue Agency requirements, then securely deleted.
- Client evidence files containing personal information: returned or deleted at engagement closeout per the engagement terms, with deletion logged.
- Email unsubscribes: suppression records kept indefinitely so we never contact you again by mistake.
6. Your rights
You may ask us: what personal information we hold about you, how it has been used, and to whom it has been disclosed; to correct it if it is inaccurate; and to withdraw consent to further contact at any time. Write to innovation@blueflexlogicit.com. We will respond within 30 days as PIPEDA requires. If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). Quebec residents may also contact the Commission d'accès à l'information du Québec.
7. Safeguards
We protect personal information with measures proportionate to its sensitivity, including multi-factor authentication on all business systems, access limited to those who need it (currently, the accountable individual named above), encryption in transit, and a documented incident response process. In the event of a breach creating a real risk of significant harm, we will notify affected individuals and the Privacy Commissioner as PIPEDA requires.
8. Changes to this policy
When this policy changes materially, we update the version number and dates above and note the change here. We do not retroactively change what we do with information already collected without seeking consent.