1. Who We Are
Progentic Inc. ("Progentic", "we", "us" or "our") is an Ontario corporation that provides procurement consulting services and ProcureSense, an AI-powered spend analytics platform. Our office is located at 2 Bloor Street East, Suite 700, Toronto, Ontario, Canada.
We are committed to protecting personal information and handling it in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws.
2. Scope of This Policy
This policy explains how we collect, use, disclose and protect personal information when you:
- visit our website at pro-gentic.com;
- contact us, request a demonstration or subscribe to our communications;
- do business with us as a client, prospective client, supplier or partner; or
- use the ProcureSense platform.
Client data in ProcureSense. When our clients upload data to ProcureSense (such as spend, invoice or supplier data), we process that data on our client's behalf and according to their instructions and our agreement with them. Our client remains responsible for that data. If your information was provided to us by one of our clients, please contact that organization with privacy questions.
3. Information We Collect
Information you provide to us
- Contact details, such as your name, job title, company, email address and phone number.
- Information you include in enquiries, proposals, meetings or correspondence with us.
- Account information for ProcureSense users, such as name, business email and user role.
Information collected automatically
- Technical information such as IP address, browser type, device information and pages visited on our website.
- Platform usage and security logs for ProcureSense, used to operate, secure and improve the service.
- Cookies and similar technologies, described in Section 8.
Information from other sources
- Business contact information that is publicly available, or provided to us by referrals and professional networks.
We do not knowingly collect sensitive personal information through our website, and we ask that you do not send it to us.
4. How We Use Personal Information
We use personal information to:
- respond to enquiries and provide demonstrations, proposals and quotes;
- deliver our consulting services and the ProcureSense platform;
- manage client accounts, contracts, billing and support;
- secure our systems, prevent fraud and investigate security incidents;
- improve our website, services and platform;
- send business communications you have agreed to receive; and
- comply with legal, regulatory and contractual obligations.
We do not sell personal information. We do not use client data uploaded to ProcureSense to train AI models for the benefit of other clients.
5. Lawful Basis, Choice and Consent
Lawful basis. We rely on the following grounds to collect and process personal information:
- Consent – when you submit a form, subscribe to communications or otherwise agree to our collection and use of your information.
- Contract – where processing is needed to provide services under an agreement with you or your organization, or to take steps before entering into one.
- Legitimate business interests – such as securing our systems, improving our services and managing business relationships, where these interests are not overridden by your privacy rights.
- Legal obligation – where we must process information to comply with applicable laws.
Where a law (such as the EU or UK GDPR) requires a specific lawful basis, we rely on the bases above as applicable.
We collect, use and disclose personal information with your consent, except where otherwise permitted or required by law. Consent may be express (for example, when you submit a form) or implied (for example, when you provide your business card or contact us about our services).
You may withdraw your consent at any time, subject to legal or contractual restrictions, by contacting us using the details in Section 14. Withdrawing consent may affect our ability to provide certain services to you.
Electronic marketing. We send commercial electronic messages only in accordance with Canada's Anti-Spam Legislation (CASL). Every marketing email includes an unsubscribe link.
6. How We Share Personal Information and Use of Subprocessors
We share personal information only as needed with:
- Service providers that help us operate our business and platform, including cloud hosting, database, email, communications and security monitoring providers (for example Microsoft, Supabase, Vercel and Resend). These providers are bound by contractual obligations to protect personal information and use it only to provide services to us.
- AI service providers used to power specific ProcureSense features, subject to contractual and technical safeguards appropriate to the data involved.
- Professional advisors such as lawyers, accountants and auditors.
- Authorities, where required by law or legal process.
- A successor organization, in connection with a merger, acquisition or sale of our business, subject to appropriate confidentiality protections.
7. Where Information Is Stored
Some of our service providers store or process information outside Canada, including in the United States. When information is stored outside Canada, it may be subject to the laws of that jurisdiction, including lawful access by courts, law enforcement and national security authorities. We use contractual and other measures to protect information transferred to service providers.
8. Cookies and Analytics
Our website uses cookies and similar technologies to operate the site, remember preferences and understand how visitors use it. We use Vercel Web Analytics to collect aggregated website usage information. You can control or delete cookies through your browser settings; disabling some cookies may affect how the website works.
9. Technical and Organizational Measures
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:
- encryption of data in transit and at rest;
- multi-factor authentication and role-based, least-privilege access;
- continuous security monitoring and logging;
- regular backups and tested disaster recovery procedures; and
- confidentiality obligations for our personnel and service providers.
No method of transmission or storage is completely secure. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law.
10. Use, Retention and Disposal
We keep personal information only as long as needed for the purposes described in this policy, or as required by law or our agreements with clients. When it is no longer needed, we securely delete or anonymize it. Client data in ProcureSense is retained and deleted in accordance with the applicable client agreement.
11. Your Rights
Subject to applicable law, you may:
- request access to the personal information we hold about you;
- ask us to correct inaccurate or incomplete information;
- withdraw your consent to certain uses; and
- ask questions or make a complaint about how we handle your information.
We will respond to requests within 30 days, or as otherwise required by law. We may need to verify your identity before responding.
12. Data Quality
We take reasonable steps to keep personal information accurate, complete and up to date for the purposes for which it is used. This includes collecting information directly from individuals or their organizations where possible, and correcting information promptly when we learn it is inaccurate.
Your responsibilities. You are responsible for giving us accurate and complete information and for letting us know when it changes. ProcureSense users can update their account details in the platform, or by contacting us. Clients are responsible for the accuracy of the data they upload to ProcureSense.
13. Monitoring and Enforcement
Our Privacy Officer is accountable for compliance with this policy. To monitor and enforce it, we:
- review this policy and our privacy practices at least annually;
- require our personnel to complete privacy and security training and to follow our privacy and confidentiality obligations;
- monitor our systems and service providers for compliance with our privacy and security requirements;
- investigate privacy complaints and incidents and take corrective action where needed; and
- take disciplinary action, up to and including termination, for violations of this policy by our personnel.
If you have a concern or complaint, please contact our Privacy Officer using the details in Section 14. We will investigate and respond promptly.
14. Contact Us
Our Privacy Officer is responsible for our compliance with this policy:
Privacy Officer
Progentic Inc.
2 Bloor Street East, Suite 700
Toronto, Ontario, Canada
Email: william.kwok@pro-gentic.com
Privacy requests and privacy incidents
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.
15. Children
Our website and services are intended for businesses and are not directed to individuals under 18. We do not knowingly collect personal information from children.
16. Changes to This Policy
We may update this policy from time to time. The updated version will be posted on this page with a new "Last updated" date. Where changes are significant, we will take reasonable steps to notify affected individuals.