Privacy Policy

1. Who we are

Sentrix Inc. (“Sentrix”, “we”, “us”) is a corporation incorporated under the laws of Canada, with its principal place of business at 1000 rue Saint-Antoine Ouest, Montréal QC H3C 3R7, Canada. We operate a governance, risk, and compliance (GRC) automation platform.

For the purposes of applicable privacy legislation including PIPEDA and Law 25, Sentrix acts as the data controller for personal information we collect about visitors to our website and users of our platform, and as a data processor for personal information our customers process through the platform.

2. Information we collect

Account and contact information

When you create an account or book a demo, we collect your name, work email address, company name, and role. When you contact us, we collect any information you choose to provide.

Platform usage data

We collect information about how you use the Sentrix platform, including features accessed, evidence items reviewed, integrations connected, and actions taken. This information is used to improve the platform and provide customer support.

Integration data: When you connect integrations, Sentrix collects compliance evidence from the connected systems using read-only API access. This evidence is stored on your behalf as part of the service.

Technical data: We collect standard web log data including IP addresses, browser type, operating system, and referring URLs for security monitoring and platform optimization purposes.

Cookie consent records: When you make a cookie consent choice on our website, we record an anonymous session identifier, the categories accepted or declined, the policy version in effect, your language preference, and the page URL. This record is stored in our consent audit log to demonstrate compliance with our obligations under PIPEDA and Law 25. No name, email address, or IP address is stored in the consent log. See our Cookie Policy for details.

3. How we use your information

We use personal information to: provide and improve the Sentrix platform; communicate with you about your account, product updates, and support requests; conduct security monitoring and fraud prevention; comply with legal obligations; and, with your consent, send you marketing communications about products and resources we think you will find useful.

We do not sell personal information to third parties. We do not use customer compliance data for any purpose other than providing the service.

4. Data residency and transfers

All customer data is stored in Canadian data centres (AWS ca-central-1) by default. We do not transfer customer compliance data outside of Canada. Technical and operational data (such as transactional email and website analytics) may be processed by sub-processors outside of Canada, as described in our sub-processor list below. Website cookie usage is further described in our Cookie Policy.

5. Sub-processors

We use the following sub-processors to provide the Sentrix service. We maintain data processing agreements with each sub-processor and require them to maintain appropriate security controls.

6. Your rights

Subject to applicable law, you have the right to: access the personal information we hold about you; correct inaccurate personal information; request deletion of your personal information; object to or restrict certain processing; and withdraw consent where processing is based on consent.

Québec residents have additional rights under Law 25, including the right to data portability and the right to be informed of any automated decision-making that significantly affects you.

To exercise your rights, contact us at [email protected]. We will respond within 30 days.

7. Retention

We retain account and contact information for the duration of your subscription plus 7 years as required by Canadian tax law. Compliance evidence and platform data is retained for the period specified in your subscription agreement. You may request deletion of your account data at any time subject to our legal retention obligations.

8. Contact

Our Privacy Officer is William Georges Khouri. He can be reached at [email protected] or at our principal place of business. Customers in Québec may also contact the Commission d’accès à l’information (CAI) with complaints about our handling of personal information.

Breach notification: In the event of a confidentiality incident involving personal information that presents a risk of serious injury, Sentrix will notify the Commission d’accès à l’information (CAI) and affected individuals as required by Law 25 and PIPEDA. Notification to the CAI will be made within 72 hours of determining that a serious risk exists. We maintain an incident register in accordance with our legal obligations.