Zenith AutoSolution (“Zenith”, “we”) operates as a private-sector organization subject to Alberta PIPA. For EU/UK users we act as a GDPR controller for our website and demo intake. For enterprise deployments we can act as a processor under a DPA with your institution.

We collect only what is necessary to provide the demo or contracted services (purpose specification). Lawful bases: Contract (service delivery), Consent (demo email, optional marketing), and Legitimate Interests (basic product analytics with opt-out). No sale of personal information.

• Consent: Express or implied as appropriate; we identify purposes at or before collection and provide contact details for questions or withdrawal.
• Access & Correction: Individuals may request access to their personal information and corrections for accuracy/completeness.
• Safeguards: Reasonable administrative, technical, and physical safeguards proportional to sensitivity.
• Breach Reporting: We assess reasonable risk of significant harm (RROSH). When RROSH exists, Zenith will notify the Alberta Office of the Information and Privacy Commissioner (OIPC) and affected individuals as required, without unreasonable delay.

TLS 1.2+ in transit; AES-256 at rest; RBAC with least-privilege; MFA for administrative access; audit logs for admin actions; periodic access reviews; secure software development practices and vendor due diligence.

Primary data residency: REPLACE_ME (e.g., Alberta/Canada, US, EU). We can support regional hosting for enterprise tiers. Cross-border transfers rely on appropriate safeguards (e.g., Standard Contractual Clauses) and contractual protections in the DPA.

Demo inputs auto-expire after 30 days. Production default is 365 days (configurable per contract). Post-contract deletion occurs within 30 days unless retention is legally required. Deletion includes backups per reasonable operational cycles.

Marketing emails require express consent (opt-in) with clear identification and a one-click unsubscribe. Service/transactional emails are limited to fulfillment or service notices. Preferences can be changed at any time.

Contact [email protected] to exercise: access, correction, portability (where applicable), objection/opt-out, restriction, and deletion/erasure. We verify identity and respond within 30 days (or notify if an extension is needed).

We engage vetted subprocessors bound by confidentiality and data protection terms. See /legal/subprocessors for the current list and change notifications. Data is processed only on documented instructions under our DPA.

We use strictly necessary cookies for security and session continuity. Optional analytics are consent-based and can be disabled. No behavioral advertising cookies are used in the demo flow.

Our services are intended for adults and institutional use. We do not knowingly collect personal information from children under the age applicable in the user’s jurisdiction.

We maintain an incident response plan, conduct harm/risk assessments, notify customers and (where applicable) the Alberta OIPC and other regulators as required by law, and document remediation.

Privacy (link), Terms (link), DPA (link), Data Protection Policy (link), Subprocessors (link). Privacy inquiries: [email protected]. Alberta OIPC information is publicly available for complaint submission if concerns are unresolved.