Applicable law and legal basis

This Cookies Policy is issued in accordance with the following privacy and electronic-marketing laws:

• Canada – Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, including the Office of the Privacy Commissioner of Canada's guidelines on online consent.
• Quebec – An Act respecting the protection of personal information in the private sector, CQLR c. P-39.1 (“Law 25” / formerly Bill 64), including the cross-border transfer assessment requirement undersection 17.
• Canada – An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities (Canada's Anti-Spam Legislation, “CASL”).
• United States – California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA / CPRA), and other state privacy laws as applicable.

Where consent is required for non-essential cookies, we rely on the visitor's express, informed consent obtained through the cookie consent banner. Strictly necessary cookies are loaded on the legal basis of legitimate interest in operating and securing the Website, where consent is not legally required.

What are cookies and similar technologies?

Cookies are small text files that a website places on your device (computer, tablet, or phone) when you visit it. They are widely used to make websites work, work more efficiently, and provide information to website operators. In this Policy, we use the term “cookies” to refer collectively to:

• Cookies (first-party cookies, set by our domain; and third-party cookies, set by other domains).
• Pixels and tags (also known as web beacons or tracking pixels), which are small pieces of code embedded in pages and used by analytics and advertising tools.
• Local storage and similar browser-based storage technologies.
• Software development kits and server-side measurement tools that perform similar functions.

Categories of cookies we use

We classify the cookies and similar technologies on the Website into the following categories:

Strictly necessary cookies

These cookies are essential for the Website to function and cannot be switched off. They are usually set in response to actions you take, such as setting your privacy preferences, filling in a form, or navigating the Website. You can configure your browser to block these cookies, but parts of the Website will not work as a result.

Strictly necessary cookies do not require consent under applicable law and are loaded by default.

Analytics cookies

These cookies help us understand how visitors interact with the Website by collecting information such as the number of visitors, the pages visited, traffic sources, and how visitors navigate around the Website. The information is used in aggregated form to improve the Website.

Marketing and advertising cookies

These cookies are set by us or by our advertising partners to measure the performance of our advertising campaigns, to enable conversion tracking, and to support audience-based advertising on third-party platforms. They may be used to build a profile of your interests and to show you relevant advertising on other sites.

Tag-management infrastructure

Google Tag Manager (GTM) is a tag-management infrastructure tool that loads and manages the analytics and marketing tags listed above. We classify GTM as non-essential, even though the GTM container itself does not set tracking cookies. Non-essential tags fired by GTM are gated behind your consent through Google Consent Mode v2 and the Flowappz consent banner. Until consent is granted, those tags either do not fire or operate in cookieless / consent-aware mode in line with Google's documented behaviour.

Your consent and how to manage cookies

When you first visit the Website, our cookie consent banner (provided by FlowAppz – see Section 8) gives you the option to accept all cookies, reject non-essential cookies, or set granular preferences by category.

Analytics, marketing, and advertising cookies are not loaded until you provide consent through the banner. Strictly necessary cookies are loaded by default, as they are required for the Website to function.

You can change or withdraw your consent at any time by:

• Re-opening the cookie preferences panel using the link or button provided through the Flowappz banner.
• Adjusting your browser settings to block or delete cookies. Each browser provides controls in its settings menu; refer to your browser's help documentation for instructions.
• Using opt-out tools provided directly by some service providers (for example, the Google Analytics Opt-out Browser Add-on, or ad-preference settings on Google, Meta, and LinkedIn).

Withdrawing consent will not affect the lawfulness of any processing carried out before you withdrew consent. Some features of the Website may not function correctly if you reject certain cookies.

Global Privacy Control (GPC) and similar opt-out signals

We honour Global Privacy Control (GPC) signals on a best-efforts basis for all visitors who send them, regardless of jurisdiction. Where required by applicable law (including U.S. state privacy laws such as the CCPA / CPRA), we treat a recognized GPC signal as abinding opt-out of cookies categorised as “sale” or “sharing”, and as an opt-out of targeted advertising.

For visitors in Canada, including residents of Quebec, we treat GPC as an indication that you do not wish to consent to non-essential cookies, and we will not load analytics or marketing cookies until you affirmatively grant consent through the Flowappz banner.

Consent logging and audit trail

To demonstrate that valid consent was obtained, in accordance with the accountability principle under PIPEDA and Quebec Law 25, our consent management platform records each consent event. Record stypically include:

• A timestamp of when consent was given, refused, or modified.
• The version of this Cookies Policy in force at the time.
• The categories of cookies accepted or rejected.
• A pseudonymous identifier sufficient to associate the record with the browser/device, without identifying you.

We retain consent records for a minimum of three (3) years from the date of the consent event, after which they are deleted or anonymized. We will produce these records on request from a competent privacy regulator or in response to a verifiable request from the visitor concerned.

Cookies and similar technologies we use

The table below lists the cookies and similar technologies currently used on the Website. Specific cookie names, providers, and durations may change as service providers update their products. We will keep this list reasonably current.

Some cookies are listed as “first-party” because they are set under the business-analysis.ca domain, even though the data they generate is shared with the third-party provider listed.

Cross-border transfers and Privacy Impact Assessment

Most of the providers listed in Section 4 are located in the United States. When you accept analytics or marketing cookies, the information collected through those cookies may be transferred to and processed in the United States and other jurisdictions outside Canada.

Privacy Impact Assessment (Quebec Law 25, section 17)

Before initiating cross-border transfers of personal information, we conduct a Privacy Impact Assessment (PIA) as required under section 17 of Quebec Law 25. The PIA evaluates, for each receiving jurisdiction:

• The sensitivity of the personal information being transferred (in our case, primarily pseudonymous identifiers, IP addresses, and behavioural Website data – not directly identifying or sensitive information).
• The purposes of the transfer and the volume of data involved.
• The protections, including contractual safeguards, that apply to the personal information.
• The legal regime applicable in the destination jurisdiction (in particular the United States), and any potential government access.

PIA conclusion: Based on the assessment we have performed, the personal information transferred through the cookies described in this Policy receives a level of protection adequate for the purposes for which it is used, taking into account the safeguards listed below. The PIA is reviewed at least annually and whenever a new cross-border transfer is introduced. A summary of the assessment is available to regulators on request.

Contractual safeguards

We rely on the following safeguards to protect personal information transferred outside Canada:

• Data Processing Addenda (DPAs) executed with each processor that handles personal information on our behalf, including (where applicable) the Google Ads Data Processing Terms, the Google Analytics Data Processing Terms, the Meta Business Tools Terms and Data Processing Terms, the LinkedIn Marketing Solutions Data Processing Agreement, the Microsoft Online Services Data Protection Addendum, the Webflow Data Processing Addendum, and a DPA with FlowAppz (see Section 8 – status of confirmation).
• Standard contractual clauses or equivalent transfer mechanisms incorporated into those addenda where the processor offers them.
• Vendor due diligence on each processor's security and privacy practices before it is engaged, and periodic re-assessment thereafter.
• Configuration measures within the relevant tools (for example, IP-anonymization features in Google Analytics where available, and consent-gated tag firing through Google Consent Mode v2).

Data Processing Agreements with cookie-related processors

We confirm that, before activating each non-essential cookie or tag described in Section 4, the following contractual instruments have been executed (or, where the processor's terms are auto-incorporated, are in force) between Senior Maple Marketing Ltd. and the relevant processor:

• Webflow, Inc. – Data Processing Addendum incorporated into the Webflow Customer Terms of Service.
• Google LLC – Google Analytics Data Processing Terms, Google Ads Data Processing Terms, and Google Tag Manager terms (which incorporate the relevant data processing terms).
• Microsoft Corporation – Microsoft Online Services Data Protection Addendum applicable to Bing Webmaster Tools.
• Meta Platforms, Inc. – Meta Business Tools Terms and the European/Global Data Processing Terms (as applicable to advertisers using Meta Pixel).
• LinkedIn Corporation – LinkedIn Marketing Solutions Data Processing Agreement applicable to advertisers using the LinkedIn Insight Tag.
• FlowAppz – a written data processing agreement (status: see Section 8).

Each DPA obliges the processor to process personal information only on documented instructions from us, to maintain confidentiality and security, to assist with data-subject requests and breach notifications, and to delete or return personal information at the end of the engagement.

How long cookies remain on your device

Cookies fall into two broad categories based on how long they remain on your device:

• Consent records are retained as described in Section 3.2.
• Persistent cookies remain on your device for a fixed period, or until you delete them manually. Indicative durations are listed in the table in Section 4.

Consent records are retained as described in Section 3.2.

About FlowAppz (cookie consent provider)

Our cookie consent banner is operated using the “Cookie Consent” application provided by FlowAppz, a Webflow Marketplace app vendor.

Brand / vendor name: FlowAppz (flowappz.com)

Privacy Policy: https://flowappz.com/privacy-policy

Terms & Conditions: https://flowappz.com/terms-and-conditions

Vendor contact: via flowappz.com/contact

Registered legal entity / jurisdiction: Under confirmation with the vendor. This Cookies Policy will be updated to reflect the final position.

Data Processing Agreement status: Under confirmation with the vendor. Pending finalisation of the DPA, processing through the consent tool is limited to what is strictly necessary to record cookie consent (timestamp, categories selected, and a pseudonymous identifier), consistent with PIPEDA, Quebec Law 25, and U.S. stateprivacy laws. This Cookies Policy will be updated when the DPA is inplace.

Third-party privacy and cookie policies

Where third-party cookies are loaded on the Website, those cookies are subject to the privacy and cookie practices of the relevant providers, in addition to ours. You can find more information at:

• Google (Analytics, Tag Manager, Search Console, Ads): policies.google.com/privacy
• Microsoft (Bing Webmaster Tools): privacy.microsoft.com
• Meta (Facebook Pixel): facebook.com/privacy/policy
• LinkedIn (Insight Tag): linkedin.com/legal/privacy-policy
• Webflow: webflow.com/legal/privacy
• Webflow: webflow.com/legal/privacy

Changes to this Cookies Policy

We may update this Cookies Policy from time to time to reflect changes to the technologies we use, our service providers, or applicable law. The “Last updated” date and version number at the top of this Policy indicate when it was most recently revised.

If we make material changes that affect categories of cookies or new providers, we will request fresh consent through the cookie banner where required by applicable law, and we will retain a record of each consent version as described in Section 3.2.

How to contact us

If you have questions about our use of cookies, please contact our Privacy Officer:

Privacy Officer

Business Analysis Canada (Senior Maple Marketing Ltd.)

133 Prince William Street, Suite 801

Saint John, NB E2L 2B5, Canada

Email: office@business-analysis.ca