Skip to main content

Privacy Policy

Last Updated: March 18, 2026

1. Introduction and controller identity

This Privacy Policy explains how Gapa Holding Canada Inc. (operating as “Gapa Holding”, “we”, “us”) collects, uses, shares, and protects personal information when you visit our website, request information, or communicate with us about our business education and professional development programs across Canada.

For the purposes of Canadian privacy laws (including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws), Gapa Holding Canada Inc. is the organization responsible for your personal information (often described as the “data controller” in GDPR terminology).

Controller and contact details:

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), we also describe GDPR/UK GDPR concepts (such as legal bases and cookie consent) because our site may be accessed internationally. We do not appoint a Data Protection Officer (DPO) because our activities do not involve large-scale processing of special category data.

2. Personal data we collect

We collect personal information in a few practical ways: when you provide it directly, when you communicate with us, and when your device automatically provides technical data when visiting the website.

  • Identity and contact information: name, email address, phone number, and organization name (if provided).
  • Form content and inquiry details: the program you select, your message, scheduling preferences, and any context you choose to share about learning goals or organizational needs.
  • Technical information: IP address, browser type, device type, operating system, language preferences, approximate location derived from IP, and timestamps.
  • Usage information: pages visited, time spent on pages, referral source, and click paths (where analytics cookies are enabled by consent).
  • Cookies and identifiers: cookie identifiers and consent signals (see Section 4 and our Cookie Policy).
  • Conversion events: events such as form submissions or engagement signals (when analytics or marketing cookies are enabled by consent).

We do not intentionally request or collect special category data (such as health information, religious beliefs, political opinions), financial account details, or government-issued identification numbers through our standard website forms. Please do not submit sensitive information in a free-text message.

3. Why we process personal data and legal bases

We process personal information for clear, education-focused operational reasons: responding to requests, delivering program information, maintaining site security, and (where consented) measuring and improving marketing and website performance.

Where GDPR/UK GDPR applies, our legal bases include:

  • Contact and consultation requests: performing steps at your request before entering into a service arrangement (GDPR Art. 6(1)(b)) and, where required, your consent (Art. 6(1)(a)).
  • Analytics: consent (Art. 6(1)(a)).
  • Marketing and remarketing: consent (Art. 6(1)(a)).
  • Security and fraud prevention: legitimate interests in protecting the website and preventing abuse (Art. 6(1)(f)).
  • Legal compliance: compliance with legal obligations (Art. 6(1)(c)).

Automated decision-making: we do not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals (GDPR Art. 22).

Under Canadian privacy principles, we limit collection to what a reasonable person would consider appropriate in the circumstances, we use information for identified purposes, and we retain it only as long as needed for those purposes.

4. Cookies and tracking technologies

Cookies are small text files stored on your device. We also use similar technologies (for example, pixel tags and server-side events) that help measure website usage and advertising performance. Your choices are controlled through our cookie banner and preferences panel.

Our categories are:

Essential cookies (always active)

These are required for the website to function. They include a basic session cookie and your cookie consent record. Essential cookies do not require consent in most jurisdictions because they are necessary for delivering a service you request (a functioning website).

  • _site_session (session): supports site continuity and basic security.
  • cookie_consent (12 months): stores your preferences for analytics and marketing cookies.

Analytics cookies (consent required)

Analytics cookies help us understand which pages are useful, how visitors navigate, and where the site can be improved. We use Google Analytics 4 (GA4) with IP anonymization where supported. Analytics data is retained for 14 months in our GA4 settings.

  • _ga (2 years): GA4 user identifier.
  • _ga_XXXXXXXXXX (2 years): GA4 session state.

Marketing cookies (consent required)

Marketing cookies are used to measure ad campaigns, attribute conversions, and enable remarketing audiences. These cookies may be set by providers such as Google and Meta when enabled.

  • _gcl_au (90 days): Google Ads conversion linker.
  • _fbp (90 days): Meta Pixel browser identifier.
  • _fbc (90 days): Meta click identifier when a click ID is present.

Beyond cookies, advertising and analytics measurement can also rely on pixel tags and server-side events. When configured, these may use IP address and user-agent information, and may include hashed identifiers where applicable. We use these tools to measure performance and improve relevance, not to sell personal information.

For more detail and cookie management options, see our Cookie Policy.

5. Consent and cookie preference management

When you first visit the site, you can accept all cookies, reject non-essential cookies, or manage preferences by category. Your choices are stored in the cookie_consent cookie for up to 12 months.

Users in the EEA and UK receive a consent notice under GDPR/UK GDPR. Analytics and marketing cookies are activated only after explicit consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time by using “Manage cookie preferences” in the footer or by clearing cookies in your browser. Withdrawal does not affect the lawfulness of processing carried out before you withdrew your consent.

In Canada, consent can be express or implied depending on context and sensitivity. For analytics and marketing cookies, we treat your choice as express consent when you opt in, and we offer clear opt-out controls through the banner and preferences panel.

6. Sharing with advertising and service partners

We use a small set of service providers to operate the website and, if you consent, to measure and improve marketing. These providers process data on our instructions, subject to contractual and technical safeguards.

  • Google LLC (Google Analytics 4, Google Ads, Tag Manager, remarketing): may receive cookie identifiers, usage data, and conversion events when enabled. Privacy policy: https://policies.google.com/privacy
  • Meta Platforms, Inc. (Meta Pixel, Custom/Lookalike Audiences, Conversion API where configured): may receive page views, conversion events, and audience membership signals when enabled. Privacy policy: https://www.facebook.com/privacy/policy
  • Cloudflare, Inc. (content delivery network and security): may process IP-based signals for threat detection and performance. Privacy policy: https://www.cloudflare.com/privacypolicy/

We do not sell personal information. We also do not permit our providers to use site data for their own independent commercial purposes beyond providing services to us, subject to their contractual commitments and platform terms.

7. International transfers

Our organization operates in Canada, but some of our service providers (such as Google and Meta) may process data in other countries, including the United States. As a result, personal information may be subject to the laws of those jurisdictions and may be accessible to law enforcement or national security authorities according to those laws.

For EEA/UK users, transfers to the United States may rely on the EU–US Data Privacy Framework (and the UK Extension where applicable) when providers are certified, with Standard Contractual Clauses (EU 2021/914) and UK IDTA approaches used as fallback safeguards.

We take reasonable steps to ensure that service providers maintain appropriate protections, and we limit shared data to what is needed for the intended purpose.

8. Retention

We keep personal information only as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Our typical retention periods are:

  • Contact submissions and inquiry records: up to 2 years from the last interaction.
  • Email correspondence: for the duration of the relationship and up to 1 additional year for operational continuity.
  • Analytics data: 14 months (GA4 setting) when analytics cookies are enabled.
  • Server security logs: typically up to 90 days, unless needed to investigate abuse or incidents.
  • Cookie consent record: up to 3 years for compliance audit purposes, where applicable.
  • Legal and regulatory records: as required under Canadian law (for example, where invoices or contractual records must be retained).

Where deletion is requested, we may retain limited information where necessary to comply with legal obligations, resolve disputes, or enforce agreements.

9. Your rights and choices

Canada: you can request access to the personal information we hold about you and ask us to correct inaccuracies. You may also withdraw consent for certain uses (for example, marketing cookies) subject to legal or contractual restrictions and reasonable notice. We will respond within a reasonable time and may need to verify your identity.

GDPR/UK GDPR (where applicable): you may have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), and to withdraw consent (Art. 7(3)). To exercise these rights, email us at [email protected]. We aim to respond within 30 days; this may be extended for complex requests.

If you are located in the EEA, you can lodge a complaint with a supervisory authority. A starting point for EU authorities is the European Data Protection Board: https://edpb.europa.eu. UK residents can contact the Information Commissioner’s Office: https://ico.org.uk.

In Canada, privacy complaints may be made to the Office of the Privacy Commissioner of Canada (OPC): https://www.priv.gc.ca.

10. Children

This website is not directed to individuals under 16. We do not knowingly collect personal information from minors. If we learn that we have collected personal information from a child under 16 without appropriate consent, we will delete it promptly.

11. Do Not Track

Some browsers offer a “Do Not Track” (DNT) signal. Our website does not respond to DNT signals in a uniform way, because there is no consistent industry standard. Third-party providers may have their own approaches to DNT.

12. Data deletion requests

You can request deletion of personal information by emailing [email protected] with the subject line “Data Deletion Request”. We may ask for information to verify your identity and locate records. Where deletion is feasible and lawful, we typically complete deletion within 30 days.

In some cases, we may need to retain limited information to meet legal obligations or for legitimate business purposes such as dispute resolution, security incident investigation, or record-keeping requirements.

13. Business transfers

If Gapa Holding Canada Inc. is involved in a merger, acquisition, reorganization, financing, sale of assets, or insolvency event, personal information may be transferred as part of that transaction. If a transfer materially changes how personal information is used, we will provide notice on the website.

14. California privacy notice (CCPA/CPRA)

This section is included because the website may be accessed from the United States. It describes disclosures for California residents under the California Consumer Privacy Act (CCPA) as amended by the CPRA.

Categories of personal information disclosed in the past 12 months may include: identifiers (name, email, IP address, cookie IDs), internet or other electronic network activity (pages visited and interactions), and inferences about interests (derived from on-site behavior when marketing cookies are enabled).

We do not “sell” personal information as defined by CCPA. We may “share” information for cross-context behavioral advertising when marketing cookies are enabled. You can opt out by rejecting marketing cookies or updating preferences in the cookie panel.

California rights may include the right to know, delete, correct, and opt out of sale/sharing, as well as the right to non-discrimination. Requests can be submitted by emailing [email protected] with the subject line “California Privacy Request”. We will verify identity before responding. Authorized agents must provide written proof of authorization.

15. Virginia privacy notice (VCDPA)

Virginia residents may have rights to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising. Requests can be submitted by emailing [email protected] with the subject line “Virginia Privacy Request”.

We do not sell personal data and do not engage in profiling that produces legal or similarly significant effects. If we decline a request, you may appeal by emailing with the subject line “Appeal of Refusal — Privacy Request”. We respond to appeals within 60 days.

16. Nevada privacy notice

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject line “Nevada Do Not Sell Request”. We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will provide a clear notice on the website at least 14 days before the updated policy takes effect. The “Last Updated” date at the top of the page will reflect the most recent revision.

18. Contact

Questions, requests, or concerns about privacy can be sent to: