Privacy Policy

Who we are

KOSMOS Business Consulting Inc. (“KOSMOS”, “we”, “us”) is the execution partner for technology initiatives. We are based in Canada and work with organizations across Canada and the United States. We are responsible for the personal information described in this policy.

KOSMOS Business Consulting Inc. [MAILING ADDRESS] Email: [PRIVACY EMAIL] Phone: +1 514 577 2838

Person in charge of the protection of personal information: [PRIVACY OFFICER NAME], [TITLE]. You can reach this person at [PRIVACY EMAIL] for any question, request or complaint about privacy.

Scope of this policy

This policy explains how we handle personal information when you visit [DOMAIN], contact us through a form, email or phone, or send us a professional introduction.

It does not cover information we process on behalf of a client during an engagement. That information is governed by the agreement with that client and by the client’s own privacy practices. If you are an employee or contractor of one of our clients, please contact your organization first.

We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25). Where visitors from other jurisdictions have additional rights, we respect those rights as described in section 10.

Information we collect

Please do not send us sensitive information, such as health information, government identification numbers or financial account details, through the website. A portfolio should not include your date of birth, home address, photo or social insurance number.

Information collected automatically

• Server logs. Our hosting provider records technical data for every request: IP address, date and time, page requested, referring page, browser and device type. We use this for security and troubleshooting only.
• Spam protection. On the Contact page, Cloudflare Turnstile distinguishes human visitors from bots and blocks bot traffic. It processes client-side Signals: IP address, TLS fingerprint, User-Agent header, and the site key and associated origin. Cloudflare cannot directly identify you from these Signals, including your IP address. The Signals are strictly necessary for bot detection and blocking. See section 6.
• Cookies and similar technologies. Strictly necessary cookies remember your consent choices. Any other cookies are set only if you agree. See our Cookie Policy.

We do not collect information from data brokers. We may look at public professional sources, such as your LinkedIn profile or company website, to prepare for a conversation you have requested.

How we use your information

We do not use your information for purposes other than those above without asking you first, unless the law requires or permits it. We do not make decisions about you based solely on automated processing.

We may use business software that includes artificial intelligence features to help organize and summarize information. A person at KOSMOS always reviews and decides. We do not allow providers to use your personal information to train their models.

Cloudflare Turnstile uses the Signals in section 3 only to distinguish human visitors from bots and to block bot traffic. The purpose is not to identify, profile or target you. Cloudflare processes those Signals as our service provider, on our instructions, to protect this website. We are the controller for that processing. Cloudflare also processes the same Signals as a controller to improve Turnstile’s bot detection, as described in the Turnstile Privacy Addendum linked in section 6.

Consent and legal grounds

We rely on your consent when you submit a form, email us or call us. Your consent covers the purposes described in section 4. You can withdraw it at any time by contacting us, subject to legal or contractual limits. Withdrawing consent may mean we cannot respond to an inquiry or consider a professional submission.

For analytics and any other nonessential cookies, we ask for your express consent through the cookie banner. These technologies are off by default.

If you are located in the European Economic Area or the United Kingdom, our legal grounds are your consent, the steps needed before entering into a contract at your request, our legitimate interest in running and securing our business and compliance with legal obligations.

Where Turnstile Signals qualify as personal information and you are in the European Economic Area or the United Kingdom, we determine the lawful basis for the processing Cloudflare does on our behalf to protect this website. We rely on our legitimate interest in keeping the website secure. When Cloudflare processes the same Signals to improve Turnstile, Cloudflare is the controller and relies on its legitimate interest in improving bot detection, as set out in the Turnstile Privacy Addendum.

Who we share it with

We do not sell, rent or trade personal information. We do not share it for targeted advertising.

We share information only with service providers that help us run the website and our business, under contracts that require them to protect it and use it only on our instructions:

Cloudflare’s use of Turnstile data is governed by the Cloudflare Privacy Policy and the Turnstile Privacy Addendum (last updated June 18, 2025). The addendum supplements the Cloudflare Privacy Policy, including for Cloudflare’s Challenge Platform. Where the addendum is more specific, it applies instead. Questions about Cloudflare’s processing of Turnstile Signals to protect this website can be sent to us at [PRIVACY EMAIL]. Questions about the addendum, or about Cloudflare’s own processing, can be sent to Cloudflare’s Data Protection Officer at [email protected]. Google’s use of Maps data is governed by the Google Privacy Policy and Google Terms of Service.

We may also disclose information:

• to professional advisers such as lawyers and accountants, under a duty of confidentiality;
• if required by law, court order or a lawful request from a government authority;
• as part of a merger, acquisition or sale of all or part of our business, in which case the information remains protected by this policy.

Where your information is stored

We are based in Canada. Some of our service providers store or process information outside Canada and outside Quebec, mainly in the United States. Before sending personal information outside Quebec, we assess whether it will receive adequate protection, and we put written agreements in place. Information stored in another country may be accessible to that country’s courts and authorities under its laws.

How long we keep it

When information is no longer needed, we delete it or anonymize it so it can no longer identify you.

How we protect it

We use safeguards appropriate to the sensitivity of the information, including encrypted connections (HTTPS), access limited to people who need it, multifactor authentication on business accounts, regular software updates and secure handling of uploaded files.

No system is perfectly secure. If a confidentiality incident creates a risk of serious injury to you, we will notify you and the relevant privacy regulator, as required by law, and we keep a register of all such incidents.

Your rights and choices

You have the right to:

• Access the personal information we hold about you and learn how it has been used and shared.
• Correct information that is inaccurate, incomplete or out of date.
• Withdraw consent to a use of your information.
• Request deletion of your information, or ask us to stop disseminating it, where the law allows.
• Receive a copy of information you provided to us in a structured, commonly used technological format.
• Be informed if a decision about you is made solely by automated processing. We do not make such decisions.
• Change your cookie choices at any time using the Cookie settings button in the footer.

If you live in a US state with a consumer privacy law, you may have similar or additional rights, including the right to object to or restrict processing. We extend these rights to all visitors where we can. We honour Global Privacy Control signals as a request to opt out of nonessential cookies.

To make a request, email [PRIVACY EMAIL] or write to the address in section 1. We may ask you to confirm your identity. We respond within 30 days. Requests are free unless they are clearly excessive. If we cannot fulfil a request, we will explain why.

Cookies and similar technologies

We use a small number of cookies to make the website work and remember your choices. Analytics and other nonessential technologies run only with your consent. Our Cookie Policy lists each cookie, its purpose and how long it lasts.

Turnstile Signals are strictly necessary to detect and block bots so visitors can use this website securely. They are not optional analytics cookies. Cloudflare describes the cookies it uses in its Cookie Policy and in the Turnstile developer documentation.

Email and communications

We reply to messages you send us. We do not add you to marketing emails or newsletters without your express consent, as required by Canada’s Anti Spam Legislation (CASL). If we ever send you a commercial message, it will identify KOSMOS and include a simple way to unsubscribe.

Children

This website is intended for businesses and professionals. It is not directed at anyone under 18, and we do not knowingly collect personal information from minors. If you believe a minor has sent us information, contact us and we will delete it.

Links to other websites

Our website links to other sites, such as LinkedIn. Their privacy practices are their own. Please read their policies before sharing information with them.

Changes to this policy

We update this policy when our practices or the law change. The date at the top shows the latest version. If a change significantly affects how we use information you have already given us, we will tell you and ask for your consent where required.

Contact and complaints

If you have a question or concern, please contact [PRIVACY OFFICER NAME] at [PRIVACY EMAIL] first. We will work with you to resolve it.

If you are not satisfied with our response, you may contact:

• the Office of the Privacy Commissioner of Canada
• the Commission d’accès à l’information du Québec, if you are in Quebec
• the data protection authority where you live, if you are outside Canada