Privacy Policy

1. Introduction

Welcome to the Privacy Policy of AQS Avance Quality Solutions Inc, developed and operated by Apex Q. This document serves as a comprehensive explanation of how we collect, use, store, share, and protect information obtained from visitors to our website at https://www.apexq.buzz and from clients who engage our computer systems design and related IT services. By accessing our website, submitting any form, or using our services, you acknowledge that you have read, understood, and agreed to the practices described in this policy. We take your privacy seriously and have designed our data practices to align with the highest standards of transparency and accountability.

We are committed to protecting your privacy and handling your data with integrity at every stage of the information lifecycle. From the moment data enters our systems to the point of secure deletion, we apply rigorous controls and thoughtful governance to ensure your trust is well placed. This policy explains your rights and our obligations under applicable Canadian federal and provincial privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA), as well as relevant provincial statutes such as the Ontario Personal Health Information Protection Act where applicable. Our approach goes beyond mere legal compliance; we treat privacy as a foundational design principle embedded into every system, service, and process we build.

We encourage you to read this policy in its entirety. If after reading you have any questions or wish to exercise any of your rights, the contact details are provided in the final section. We update this policy periodically, and the last updated date at the top of this page indicates when the most recent revision took effect.

2. Information We Collect

We collect several categories of information, each serving distinct and legitimate purposes related to the delivery and improvement of our services. The collection is always conducted in a lawful and transparent manner, with your awareness and, where required, your explicit consent. The following describes in detail the types of personal and technical information we may gather.

Information you voluntarily provide to us forms the core of our client relationship data. When you fill out contact forms, request consultations, subscribe to communications, submit requests for proposals, or engage our professional services, you may share details such as your full name, job title, email address, telephone number, company name, industry sector, business address, project requirements, system specifications, technical documentation, architectural diagrams, and infrastructure inventories. Additionally, when you enter into a contractual relationship with us, we collect billing and payment information including invoicing details, purchase order references, and payment method records necessary to process transactions. We also maintain records of your communication preferences, correspondence history, meeting notes, and feedback provided through satisfaction surveys or support interactions.

Beyond the information you actively share, our systems automatically collect certain technical data when you visit our website. This includes your IP address, browser type and version, operating system, device type, screen resolution, referring URLs, page visit timestamps, session duration, clickstream data, and a general geographic location inferred from your IP address at the city or regional level. This information is collected via standard server logs and lightweight analytics tools. Importantly, none of this automatically collected data is used to identify you personally; it is always aggregated and analyzed to understand usage patterns and improve site performance.

We may also receive information about you from third-party sources where permitted by law. For example, if a colleague refers you to our services and provides your business contact details, or if we engage with publicly available business directories and professional networking platforms to identify potential partners. In all such cases, we take reasonable steps to verify that the information was lawfully obtained by the third party before incorporating it into our systems.

3. How We Use Your Information

The information we collect is used exclusively for purposes that are directly related to providing, maintaining, and improving our computer systems design and IT services. We do not engage in speculative data processing, and every use of your information is tied to a clearly defined business purpose that we believe is consistent with the expectations of a reasonable person. Our usage falls into several categories outlined below.

First, we use your information to respond to your inquiries and provide the services you have requested. This includes preparing tailored service proposals, conducting feasibility assessments for your infrastructure projects, delivering contracted services such as systems architecture design, infrastructure engineering, cloud integration, and managed operations, as well as providing ongoing technical support and account management. Each service engagement generates project-specific records that allow us to track milestones, allocate resources, and ensure deliverables meet our quality standards.

Second, we use your information for administrative and operational purposes. This encompasses processing payments and managing billing for professional engagements, communicating project updates and service announcements, sending administrative messages about changes to terms or policies, maintaining internal records and audit trails, and managing our client relationship database. We also use de-identified and aggregated data for business analytics, capacity planning, and service improvement initiatives that benefit all our clients.

Third, we use your information to comply with legal obligations, resolve disputes, and enforce our agreements. This includes responding to lawful requests from regulatory authorities, defending against legal claims, detecting and preventing fraudulent or unauthorized activity on our systems, and ensuring the security and integrity of our network infrastructure. In every instance, we carefully evaluate the necessity and proportionality of the data processing against the purpose served.

4. Legal Basis for Processing

We process personal information based on one or more of the following legal grounds, depending on the nature of the data, the context of collection, and the jurisdiction in which you reside. By clearly identifying the lawful basis for each processing activity, we ensure accountability and provide you with the transparency needed to understand how your rights are protected under the applicable legal framework.

Contractual necessity is the primary basis when processing is required to perform a contract with you or to take steps at your request prior to entering into a contract. For example, when you request a consultation, we need your contact details to schedule and deliver that service. When you sign a service agreement, we need your billing information to process invoices. Without this information, we would be unable to fulfill our contractual obligations, and the processing is therefore essential to the business relationship.

Legitimate interests serve as the legal basis for processing activities that are necessary for our business operations and are not overridden by your privacy rights. We conduct a legitimate interests assessment for each such activity, weighing our business need against the potential impact on your privacy. Examples include analyzing aggregated website analytics to improve user experience, maintaining the security of our network through monitoring and logging, and managing our client database for operational efficiency. You have the right to object to processing based on legitimate interests, and we provide a clear mechanism for doing so.

Consent is the basis when we collect or process personal information for purposes that go beyond contractual necessity or legitimate interests. Where required by law, we obtain your explicit consent before collecting sensitive information or using your data for purposes such as direct marketing communications. You may withdraw your consent at any time, and we make the withdrawal process as straightforward as the process for giving consent. Finally, legal obligation serves as the basis when processing is necessary to comply with applicable laws, regulations, court orders, or binding requests from government authorities with jurisdiction over our operations.

5. Data Storage and Retention

All personal information we collect is stored on secure servers located in Canada and the United States, within data centers that meet or exceed industry standards for physical security, environmental controls, and operational reliability. Our infrastructure partners are carefully vetted and contractually bound to maintain security measures that align with our own. Information at rest is protected by AES-256 encryption, and data in transit is secured using Transport Layer Security (TLS) protocols with forward secrecy enabled.

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Our retention schedules are documented, periodically reviewed, and enforced through automated data lifecycle management policies. The specific retention periods for each data category are as follows. Client project data and correspondence are retained for the duration of the engagement plus seven years after project completion to satisfy legal, tax, and audit requirements. Website analytics data, including server logs and aggregated usage statistics, are retained for a maximum of twenty-six months from the date of collection, after which they are automatically purged or irreversibly anonymized. Contact form submissions and general inquiry records that do not result in an ongoing relationship are retained for three years from the date of the last interaction, allowing us to reference past conversations if you reach out again. Billing and financial records are retained for seven years in accordance with Canadian tax law requirements under the Income Tax Act and the Excise Tax Act.

When the applicable retention period expires, we securely delete or irreversibly anonymize the data using methods that prevent reconstruction or unauthorized access. Secure deletion practices include cryptographic erasure where feasible, physical destruction of storage media that have reached end of life, and overwriting of logical storage volumes in accordance with NIST Special Publication 800-88 guidelines. Anonymized data, from which all personal identifiers have been removed and which cannot be re-identified using reasonably available means, may be retained indefinitely for analytical and research purposes.

6. Information Sharing and Disclosure

We do not sell, rent, trade, or otherwise monetize your personal information by providing it to third parties for their own marketing purposes. This principle is absolute and non-negotiable; your data is not a commodity in our business model. We earn our revenue through the quality of our professional services, not through the exploitation of client information. There are, however, limited circumstances in which we may share your information, each subject to strict conditions designed to preserve your privacy.

We engage trusted service providers and subcontractors who assist us in delivering our services, maintaining our systems, and operating our business. These may include cloud hosting providers, email delivery services, customer relationship management platforms, payment processors, and professional advisors such as legal counsel and auditors. Each service provider is carefully selected, contractually bound to maintain confidentiality, and restricted to using your information solely for the purpose of performing the specific tasks we have assigned to them. We conduct due diligence on all service providers and require that they implement security measures at least as protective as those we apply ourselves.

We may share information with payment processors and financial institutions solely for the purpose of processing authorized transactions. These entities operate under their own privacy policies and are subject to financial services regulations, including the Payment Card Industry Data Security Standard (PCI DSS). We do not store full payment card numbers on our own systems; instead, we rely on tokenization services provided by our payment partners to minimize our exposure to sensitive financial data.

If required by law, court order, subpoena, or binding governmental regulation, we may disclose information as necessary to comply with legal process. Before making any such disclosure, we evaluate the validity and scope of the request and, where permitted, notify you so that you have an opportunity to contest the disclosure. In connection with a merger, acquisition, reorganization, or sale of all or substantially all of our assets, your information may be transferred to the successor entity, provided that entity agrees to be bound by terms materially consistent with this policy. Finally, we may share information with your explicit consent or at your direction, for any purpose disclosed at the time of collection.

7. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, maintain session state, and collect analytical data about site usage. A cookie is a small text file placed on your device by your web browser at the request of our server. Cookies allow us to recognize your browser across visits, remember your preferences, and understand how you navigate through our pages. This section explains what types of cookies we deploy and how you can exercise control over them.

Essential cookies are required for the website to function properly and cannot be disabled through our systems. These cookies manage session state, maintain security tokens that protect against cross-site request forgery, and enable core navigation features. Without essential cookies, you would be unable to use basic functions such as navigating between pages or submitting forms. Because these cookies are strictly necessary for service delivery, they do not require your consent under most privacy regulations, though we disclose their use here as a matter of transparency.

Analytics cookies help us understand how visitors interact with our website by collecting aggregated, anonymized usage statistics. We use these cookies to measure page load times, track which pages are most frequently visited, identify navigation patterns, and detect technical errors that may degrade the user experience. The data collected is always aggregated and does not contain personally identifiable information. We use this insight to improve site performance, optimize content placement, and prioritize development efforts based on actual usage patterns rather than assumptions.

Functional cookies remember your preferences and choices to provide a more personalized experience. These may include your language preference, display settings, or previously viewed content. Functional cookies enhance usability but are not essential for core website operation. You can control cookie settings through your browser preferences at any time. Most modern browsers allow you to block all cookies, delete existing cookies, or configure site-specific exceptions. Please note that disabling certain categories of cookies, particularly essential and functional cookies, may affect the availability or performance of certain website features.

8. Data Security Measures

We implement and maintain a comprehensive framework of technical, administrative, and physical security measures designed to protect your personal information against unauthorized access, disclosure, alteration, and destruction. Security is not a one-time implementation but an ongoing commitment that requires continuous monitoring, regular assessment, and iterative improvement. Our security program is built on the principle of defense in depth, meaning that multiple overlapping layers of protection are deployed so that the failure of any single control does not compromise the overall security posture.

On the technical front, we employ Transport Layer Security (TLS) encryption with strong cipher suites for all data transmitted between your browser and our servers, ensuring that information in transit cannot be intercepted or tampered with by unauthorized parties. Data stored on our systems is protected with AES-256 encryption at rest, and encryption keys are managed through a dedicated key management service with strict access policies and automatic key rotation. Multi-factor authentication is mandatory for all administrative access to data systems, and role-based access controls ensure that personnel can only access the specific data and functions necessary for their role. We deploy continuous network monitoring and intrusion detection systems that analyze traffic patterns in real time and alert our security team to anomalous activity.

Our administrative controls include a documented information security policy that is reviewed and updated annually, mandatory security awareness training for all personnel upon hire and annually thereafter, background checks for employees and contractors who may access personal information, and a formal vendor risk management program that assesses the security posture of all third-party service providers. We conduct regular vulnerability assessments and commission independent penetration testing by qualified external security specialists at least twice per year. Findings from these assessments are tracked through a risk register and remediated according to severity-based timelines.

We maintain documented incident response procedures that define roles, communication protocols, containment strategies, and recovery steps. These procedures are tested through periodic tabletop exercises involving key stakeholders from legal, technical, and executive functions. In the unlikely event of a data breach involving personal information, we will notify affected individuals and relevant regulatory authorities in accordance with the timelines and requirements prescribed by applicable law, including the breach notification provisions under PIPEDA.

9. Your Rights and Choices

Subject to applicable law, you have a comprehensive set of rights regarding your personal information. These rights are designed to give you meaningful control over how your data is collected, used, and retained. We are committed to honoring these rights promptly and without unreasonable barriers. This section details each right and explains how you can exercise it.

The right of access allows you to request a copy of the personal information we hold about you. Upon receiving a verified request, we will provide you with a structured summary of the categories of data we hold, the purposes for which it is being processed, the categories of recipients with whom it has been shared, and the applicable retention period. The first copy is provided free of charge; we may charge a reasonable administrative fee for additional copies to cover our costs.

The right of correction enables you to request that we rectify inaccurate or incomplete personal information. We rely on the accuracy of the information you provide, and we encourage you to keep your details current. Upon receiving a correction request, we will update our records and, where appropriate, notify any third parties to whom the inaccurate information was disclosed within the preceding twelve months.

The right of deletion, also known as the right to erasure, allows you to request that we delete your personal information from our systems, subject to legal retention requirements that may obligate us to retain certain records. When deletion is not immediately possible due to technical constraints, we will restrict processing of the data pending completion of the deletion.

Additional rights include the right to restrict processing in certain circumstances, such as when you contest the accuracy of your data or object to its processing. The right of data portability entitles you to receive a structured, commonly used, and machine-readable copy of the data you have provided to us, enabling you to transfer it to another service provider if you choose. The right to object allows you to challenge processing based on legitimate interests, including processing for direct marketing purposes. Finally, where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. To exercise any of these rights, please contact us using the details provided in the Contact Information section. We will acknowledge your request within ten business days and provide a substantive response within thirty calendar days.

10. International Data Transfers

As a Canadian company serving clients across multiple jurisdictions, your personal information may be transferred to, stored in, or processed in countries outside your country of residence, including Canada and the United States. The data protection laws in these countries may differ from those in your jurisdiction and, in some cases, may offer a different level of protection. We take this responsibility seriously and implement robust safeguards to ensure that your information receives an equivalent level of protection regardless of where it is processed.

When we transfer personal information across international borders, we rely on recognized transfer mechanisms that provide appropriate safeguards. These mechanisms may include adequacy decisions issued by relevant regulatory authorities, which confirm that a destination country provides an adequate level of data protection. Where an adequacy decision is not in place, we use standard contractual clauses approved by data protection authorities, which impose binding obligations on both the data exporter and the data importer to protect the transferred information. We may also rely on binding corporate rules adopted by our service providers, certifications under approved frameworks, or derogations for specific situations where the transfer is necessary for the performance of a contract or the establishment of legal claims.

By using our website and services, you acknowledge and consent to the transfer of your information to countries outside your country of residence as described in this policy. If you have questions about the specific safeguards applied to a particular transfer, or if you wish to obtain a copy of the relevant contractual safeguards, please contact us using the details in the Contact Information section. We will respond to such requests within a reasonable timeframe.

11. Privacy for Children

Our website and services are designed for and directed to business professionals and organizations. They are not intended for, marketed to, or directed at individuals under the age of eighteen. We do not knowingly collect, use, solicit, or disclose personal information from children under this age threshold. Our services involve professional IT consulting, systems architecture, and enterprise infrastructure engineering, all of which are inherently business-to-business engagements that do not target minors in any capacity.

If we become aware that we have inadvertently collected personal information from a child under eighteen without verifiable parental consent, we will take prompt and decisive steps to delete that information from our systems, including from any backup archives where technically feasible. We will also take reasonable measures to prevent the recurrence of such collection by reviewing and, if necessary, strengthening our age verification and data intake procedures. We encourage parents and guardians to monitor their childrens online activities and to instruct them never to provide personal information through websites without permission.

If you are a parent or legal guardian and you believe that your child has provided us with personal information, please contact us immediately using the contact details provided in the Contact Information section of this policy. When you contact us, please provide sufficient information to allow us to identify and locate the relevant data, such as the name or username that may have been used, the approximate date of interaction, and any other details that would assist our investigation. We take reports of this nature seriously and will respond promptly to address your concerns.

12. Third-Party Links and Services

Our website may contain hyperlinks, embedded content, plugins, and references to third-party websites, platforms, and applications that are not owned, operated, or controlled by AQS Avance Quality Solutions Inc. These third-party destinations operate independently and have their own privacy policies, terms of use, and data collection practices over which we exercise no control and for which we assume no responsibility. Clicking on those links or interacting with embedded content may allow third parties to collect or share data about you, including through cookies, web beacons, or other tracking mechanisms.

We provide these links and references for your convenience and informational purposes only. Their inclusion does not constitute an endorsement, approval, or certification of the third party, its products, services, or privacy practices. Before providing any personal information to a third-party website or service, we strongly encourage you to review its privacy policy and terms of service carefully. Make an independent assessment of whether you trust that entity with your data and whether its data handling practices align with your expectations and comfort level.

This Privacy Policy applies exclusively to information collected by AQS Avance Quality Solutions Inc through our own website located at https://www.apexq.buzz and through our direct service engagements with clients. It does not apply to information collected by any third party, even if you access that third party through a link on our website. If you have concerns about how a third party handles your information, you should address those concerns directly to the third party. We are not in a position to mediate or resolve privacy disputes between you and an unaffiliated entity.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, technology infrastructure, legal and regulatory requirements, or operational needs. The landscape of privacy law and technology evolves continuously, and we are committed to keeping this policy current and accurate as those changes occur. When we make material changes to this policy, we will provide prominent notice on our website and, where we have your contact information on file, we will notify you directly by email at least thirty days before the changes take effect, giving you an opportunity to review the updated terms and make informed decisions about your continued use of our services.

Material changes are those that affect the types of information we collect, the purposes for which we use it, the categories of parties with whom we share it, or your rights regarding your data. Minor changes, such as updates to contact information, typographical corrections, or clarifications that do not alter the substantive meaning of the policy, may be made without advance notice, though we will always update the last updated date to reflect that a revision has occurred. The date displayed at the top of this page indicates when the policy was last revised in any respect.

We encourage you to review this policy periodically, especially before providing new personal information or entering into a new engagement with us. By continuing to use our website and services after any changes to this policy take effect, you acknowledge that you have read and accepted the updated terms. If you do not agree with the revised policy, you should discontinue use of our website and services and contact us to discuss the deletion of any personal information we may hold about you, subject to our legal retention obligations.

14. Data Breach Notification

We maintain robust procedures for detecting, containing, and responding to security incidents that may involve personal information. In the event of a data breach that poses a real risk of significant harm to affected individuals, we are committed to acting swiftly and transparently to address the situation. Our incident response plan defines clear escalation paths, communication protocols, and remediation steps that are activated as soon as a potential breach is identified.

Under Canadian privacy law, specifically the breach notification provisions of PIPEDA, we are required to report certain types of breaches to the Office of the Privacy Commissioner of Canada and to notify affected individuals when the breach creates a real risk of significant harm. We will comply fully with these obligations, providing detailed and timely notifications that describe the nature of the breach, the categories of information involved, the steps we have taken to contain and mitigate the impact, and the measures affected individuals can take to protect themselves. We will also provide our contact information so that affected individuals can reach us with questions or concerns.

Beyond the minimum legal requirements, we maintain internal procedures for conducting thorough post-incident reviews. These reviews examine the root causes of each incident, evaluate the effectiveness of our detection and response processes, and identify improvements to prevent recurrence. Lessons learned from each incident are incorporated into our security awareness training, technical controls, and incident response playbooks. We believe that a commitment to continuous improvement in breach preparedness is an essential component of responsible data stewardship.

15. Automated Decision-Making and Profiling

We wish to be transparent about the role that automated systems play in our data processing activities. As a professional services firm focused on human-driven consulting and systems engineering, we do not use automated decision-making systems that produce legal effects or similarly significant impacts concerning our clients. All substantive decisions regarding service delivery, project scoping, pricing, and client relationships are made by qualified human professionals exercising their judgment and expertise.

We may use limited automated processes for operational purposes that do not materially affect individuals. For example, our systems may automatically categorize incoming inquiries based on keywords to route them to the appropriate department, or generate aggregated trend reports from anonymized website analytics. These automated functions are tools that assist our personnel; they do not replace human oversight and do not result in decisions that have legal or contractual consequences for you.

We do not engage in profiling activities that involve the systematic analysis of personal information to evaluate, predict, or classify individuals based on their behavior, preferences, or characteristics. If this practice were to change in the future, we would first update this policy to disclose the nature and purpose of the profiling, explain the logic involved, and describe the significance and envisaged consequences. We would also provide a mechanism for you to opt out of such automated processing where the law permits.

16. Governing Law and Jurisdiction

This Privacy Policy and all matters relating to the collection, use, and protection of personal information by AQS Avance Quality Solutions Inc are governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein. This includes, but is not limited to, the Personal Information Protection and Electronic Documents Act (PIPEDA), which establishes the baseline privacy obligations for private-sector organizations operating in Canada, as well as any substantially similar provincial legislation that may apply in specific circumstances.

By using our website and services, you agree that any dispute, claim, or controversy arising out of or relating to this Privacy Policy or the handling of your personal information shall be subject to the exclusive jurisdiction of the courts of the Province of Ontario. This choice of law and forum does not limit any rights you may have under the mandatory data protection laws of your country of residence, to the extent those laws apply to our processing activities despite the governing law provision. We recognize that privacy is a fundamental right, and we will work cooperatively with data protection authorities in Canada and internationally to resolve any concerns in a fair and efficient manner.

17. Contact Information

If you have questions, concerns, requests, or feedback regarding this Privacy Policy or our data handling practices, we welcome you to reach out to us. We are committed to addressing privacy inquiries promptly, thoroughly, and respectfully. Our designated privacy contact serves as the primary point of contact for all data protection matters and is equipped to handle questions about your rights, complaints about our practices, or requests to exercise any of the rights described in this policy.

You can contact us through any of the following channels, and we will respond to your inquiry as quickly as possible. For requests involving the exercise of your data rights, please provide sufficient detail to allow us to verify your identity and locate the relevant information in our systems. You may reach us by email for the fastest response, by telephone during our regular business hours of Monday through Friday, nine in the morning to five in the evening Eastern Time, or by postal mail at our registered business address.

• Email: assist@apexq.buzz
• Phone: +1 948 224 3686
• Mail: AQS Avance Quality Solutions Inc, 7499 Middle Line, Charing Cross, ON N0P 1G0, Canada
• Website: https://www.apexq.buzz

If you are not satisfied with our response to your privacy concern, you have the right to lodge a complaint with a supervisory authority. For individuals in Canada, the primary authority is the Office of the Privacy Commissioner of Canada, which can be reached through its website or by mail. Residents of provinces with substantially similar privacy legislation, such as Ontario, may also have recourse to their provincial privacy commissioner. We encourage you to contact us first so that we have an opportunity to address your concern directly, but we respect your right to pursue external remedies at any time.

We also welcome suggestions for how we can improve our privacy practices. Privacy is an evolving discipline, and we value input from our clients, partners, and the broader community on how we can better protect the information entrusted to us. Your feedback helps us stay ahead of emerging expectations and maintain the trust that is essential to our business relationships.