This policy explains what we collect, why we use it and the choices available to you. It covers NLG’s own business activities; information we handle for a client is also governed by that engagement.
Who we are and what this covers
#North Lantern Group Inc. (NLG, we, us) is a Canadian technology and professional services company based in Ontario. We are responsible for the personal information we handle for our own business purposes. Our privacy lead can be reached at privacy@northlanterngroup.com or at the mailing address below.
This policy covers our public website, enquiries, assessments, consultation bookings, business communications, and our relationships with prospects, client contacts and business partners. Personal information means information about an identifiable individual.
Information in a client’s systems is different. When we handle that information on the client’s behalf, the client determines the permitted purposes and our engagement and data-processing terms govern our work. A person seeking access to that information should normally contact the client first; we assist as required. Neither those contracts nor this policy displace applicable privacy law.
A separate product, recruitment process or service may have its own notice. We provide additional information at collection where a new activity needs it; this policy is not permission for undisclosed future uses.
Information we collect
#- Enquiries and business correspondence. Your work email, company, service interest and message, plus the name, phone number, company size or other context you choose to provide. We also retain relevant correspondence, follow-up and consent records.
- Assessments and bookings. The answers and result you choose to send us, meeting details, time zone, company website, notes, and any colleague or guest details you supply.
- Business relationships. Contact and role details, instructions, proposals, contractual and billing correspondence needed to manage the relationship. The public website does not take payment-card details.
- Website and security information. IP address, browser and device information, timestamps, request details, spam-prevention signals and limited source-page context. Hosting and security providers also process technical information to deliver and protect the site.
- Optional analytics. If you allow analytics, Google Analytics processes cookie identifiers, page visits, device information, approximate location and selected interactions. These are used to understand website use, not to receive the contents of your forms.
Information usually comes directly from you or your device. A colleague, client or business partner may provide your business contact details or introduce you to us. We use that information for the relevant business conversation, not as automatic permission to add you to marketing.
Providing information is voluntary. Fields marked as required supply the minimum context for that form; without them we cannot process the submission. You can use email instead. Optional fields and marketing choices are not required to make an enquiry.
Please keep enquiries proportionate. Do not send passwords, access keys, payment-card details, government identifiers, health information or live client datasets through public forms. If a project needs sensitive information, agree the appropriate transfer method with us first. Provide another person’s information only where you are authorised to do so.
How and why we use it
#We use personal information to respond to requests, assess a possible engagement, arrange meetings, deliver requested information, administer business relationships, and keep appropriate records. We also use it to operate and secure the website, investigate misuse, resolve disputes and meet legal obligations.
With your separate choice, we use it to send marketing emails or measure website activity. We do not sell personal information or share it for cross-context behavioural advertising.
We seek consent where required and use information only for purposes that are appropriate to the circumstances. Choosing to contact us allows us to handle the request; it does not authorise unrelated marketing or model training.
Where European or UK data-protection law applies, the bases for these activities are consent for optional analytics and consent-based marketing; steps you request before a contract or performance of a contract with you; our legitimate interests in business correspondence, relationship administration and security, balanced against your rights; and compliance with legal obligations. You can object to processing based on legitimate interests.
Assessments and consultation bookings
#The Pipedrive assessment calculates its result in your browser using predefined rules. You can see the result without submitting a contact form. If you request an emailed copy, the answers, result and details included in that request are sent to NLG and our email provider. The copy is sent to you and any teammates you explicitly include.
Recipients can see the information and email addresses included in a shared result or invitation. Check the guest list and notes before proceeding. Optional analytics can record an assessment interaction and broad result category if you have allowed it; it does not receive your individual answers or contact details.
Our booking calendar is provided by Cal.com. We load it when you choose to open the calendar. At that point Cal.com receives the technical information needed to serve it and any details you choose to carry into the booking. Completing a booking shares the meeting information with NLG, the calendar service and invited participants. Cal.com’s privacy policy explains its own processing.
You can contact us by email instead of using an assessment, calendar or web form.
Communications and marketing
#We reply to enquiries and send requested results, meeting confirmations and relevant business correspondence. Those interactions do not automatically subscribe you to a marketing list.
Marketing consent is a separate, optional choice. Where we send commercial electronic messages, we rely on consent or another permission recognised by the applicable law, identify NLG and provide an unsubscribe method where required. You can also email privacy@northlanterngroup.com to stop marketing. We honour unsubscribe requests within the applicable deadline, including ten business days under Canada’s anti-spam law.
Unsubscribing from marketing does not stop a response you request or necessary communications about an existing engagement. We may retain a limited suppression record so that your choice continues to be respected.
AI, automation and human review
#We do not use client or prospect personal information to train general-purpose AI models. The website does not send contact-form content or assessment answers to a generative AI model. The assessment uses predefined scoring, not a generative AI service.
We do not put client information into general-purpose AI tools simply because it is available to us. Any use of client information in an AI system must have an agreed purpose, appropriate access and data-handling controls, and terms governing the provider’s use and retention of that information. Client-specific model development requires separate, express agreement.
Automated checks help detect spam, validate email addresses and limit abusive requests. They can reject a submission. If that happens, contact us by email for a human response. Our public assessment does not make decisions about employment, credit, eligibility or other matters with legal or similarly significant effects.
A future AI feature that changes how personal information is used needs its own assessment, disclosures and any required consent before it is introduced. This policy does not grant blanket permission for that change.
Service providers and other disclosures
#We use providers for hosting, security, communications, records, scheduling and optional analytics. They receive the information needed for their role. The website’s principal providers are:
- Vercel
- Website hosting and delivery; network, request and diagnostic information. Privacy notice.
- Workspace for business email and records, including lead records; reCAPTCHA for form protection; and Analytics when allowed. Privacy policy.
- Resend
- Delivery of enquiries and requested result emails, including the content and recipients of those messages. Privacy policy.
- ZeroBounce
- Validation of the email address submitted through a form. Privacy policy.
- Upstash
- Short-lived IP-based request counters used to limit abuse. Privacy policy (PDF).
- Cal.com
- Consultation scheduling and the booking information you choose to share. Privacy policy.
We remain responsible for information handled on our behalf and use contractual or other appropriate safeguards. A provider may also process information for its own lawful purposes under its notice. Following an external link, including a software-partner referral, takes you to a service with its own terms and practices.
We may disclose information to professional advisers, insurers or authorities where reasonably necessary and lawful—for example, to obtain advice, protect rights, investigate fraud or respond to a valid legal requirement. In a proposed or completed business transaction, such as a merger or sale, information may be shared only as permitted by law and subject to appropriate confidentiality, purpose and notification requirements. It is not an unrestricted asset for sale.
International processing
#NLG is based in Canada. Our providers may process information in Canada, the United States and other countries in which they or their subprocessors operate. The website does not offer a Canada-only data-residency commitment.
Information processed abroad may be subject to foreign laws and lawful access by courts or public authorities. We assess the purpose, sensitivity and safeguards for transfers. Where applicable law requires a particular transfer mechanism, that requirement must be met, such as an applicable adequacy decision or appropriate contractual safeguards. Contact our privacy lead for information about a particular transfer or the safeguards that apply.
Data-location requirements for client systems must be agreed for the engagement; they cannot be inferred from our Canadian incorporation or this website.
Retention and security
#We keep information for its stated purpose and for necessary legal, security and record-keeping reasons. Our retention standard for enquiries that do not become engagements is deletion or anonymisation within 12 months after the last substantive contact. An active enquiry, legal obligation or dispute can require a longer period; the retained information must remain relevant to that reason.
Client relationship, contract and financial records have separate retention requirements based on the engagement, applicable law and potential claims. Consent and suppression records are kept as needed to establish and respect communication choices. Short-lived security counters expire; security incidents and legal holds can require relevant evidence to be preserved.
Browser-cookie expiry does not delete historical analytics reports. We assess retained analytics against our ongoing measurement needs and the provider’s retention settings. Backup copies may remain until the applicable backup cycle ends; information retained only for recovery or a legal hold is not a reason to resume marketing.
We apply safeguards proportionate to the information and its risks. The website uses encrypted HTTPS connections, server-side form validation, spam checks and request limits. Our handling standard limits access to business records to people who need the information for their work. Public forms are not a secure file-transfer service and no system can guarantee absolute security.
If a privacy incident occurs, we assess it, take appropriate action and make notifications required by applicable law. A concern or suspected exposure can be reported to privacy@northlanterngroup.com.
Access, choices and complaints
#You can ask what personal information we hold about you, how it is used and disclosed, and request access or correction. You can withdraw consent and ask us to delete information that is no longer needed. Withdrawal does not undo lawful prior processing and may affect a service that needs the information.
Depending on the law that applies, additional rights may include objection, restriction, portability, an explanation of automated processing or an appeal of a request decision. Where European or UK law applies, these include the rights provided by the applicable GDPR. We assess requests under the relevant law and explain any lawful limits—for example, another person’s privacy, privilege or required record retention.
Send requests to privacy@northlanterngroup.com. We may ask for proportionate information to verify identity or authority; please do not send identity documents unless requested through an appropriate channel. We respond within the applicable statutory period. For access requests under PIPEDA, that is generally 30 days; a lawful extension requires notice and an explanation. We do not charge for ordinary requests, and any legally permitted fee would be explained in advance.
You may raise a concern directly with us or with the Office of the Privacy Commissioner of Canada, an applicable provincial regulator, or your local data-protection authority. You do not have to complain to us first. Exercising a privacy right does not waive another remedy.
Children and changes to this policy
#This is a business website, not a service directed to children. We do not knowingly seek personal information from children under 13. If you believe a child has provided information, contact us so we can assess and address it.
The effective date and version identify this notice. We update it when our practices or applicable requirements change and provide additional notice of material changes where appropriate or required. New purposes that require consent require a new choice; continuing to browse is not consent to an unrelated use of information already collected. You can ask for an earlier version.
Contact our privacy lead
#503–400 Slater Street, Ottawa, ON K1R 7S7, Canada
privacy@northlanterngroup.com
For general or contractual questions, email hello@northlanterngroup.com.