Privacy Policy

1. About This Privacy Policy

Thynk Innovation Ltd ("Thynk Innovation", "we", "our", "us") is an Ontario-based legal-technology company serving clients across Canada and the United States. We provide consulting services to law firms, the ThynkOps operations platform for law firms, the Thynk HR recruitment platform (in development), and Thynk Onboarding automation services. This policy explains how we collect, use, disclose, and protect personal information when you interact with thynkinnovation.com or our services. This policy is governed by Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Law 25 where applicable, applicable provincial privacy laws (Alberta PIPA, British Columbia PIPA), the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA) for California residents, and other applicable US state privacy laws.

2. Privacy Officer

The person responsible for the protection of personal information at Thynk Innovation is Mohamad D, Founder & Managing Director. You may contact the Privacy Officer at solutions@thynkinnovation.com to exercise any of the rights described in this policy or to ask questions about our privacy practices.

3. Personal Information We Collect

We collect personal information when you choose to provide it through specific interactions with our website and services:

• Contact form: full name, work email, firm or company name, message content
• Whitepaper download form: full name, work email, firm or company name, role
• Design partner waitlist (Thynk HR): full name, work email, company name, role, hiring volume estimate, current hiring pain point
• Discovery call booking: name, email, scheduled time (collected through Microsoft Bookings, a third-party service)
• Client engagements: information necessary to deliver our services, as defined in the applicable Master Services Agreement and Data Processing Agreement (may include client matter data, user account information, system credentials, and operational data)
• Automatic collection: we do not currently use analytics, advertising, or tracking technologies — if this changes, this policy will be updated and a consent mechanism will be implemented

4. How We Use Your Personal Information

We use personal information only for the purposes for which it was collected, including:

• Responding to inquiries and providing information about our services
• Scheduling and conducting discovery calls
• Sending you whitepapers, research, or other content you have requested
• Operating the ThynkOps, Thynk HR, and Thynk Onboarding platforms
• Delivering consulting services to active clients
• Communicating about updates to our services
• Complying with legal obligations
• Detecting, investigating, and preventing fraud or security incidents

5. We Do Not Sell Your Personal Information

Thynk Innovation does not sell personal information. We do not share personal information with third parties for their own independent marketing purposes.

6. Legal Basis for Processing

In Canada, we process personal information on the basis of:

• Your express or implied consent for marketing communications and content delivery
• Performance of a contract for client engagements
• Legitimate business purposes such as responding to inquiries
• Compliance with applicable laws

7. Service Providers and Subprocessors

We use the following third-party services to deliver our website and services. Each operates under a Data Processing Agreement requiring appropriate security measures and processing only as instructed:

• Vercel Inc. — website hosting and infrastructure (Canada / United States)
• Microsoft Bookings — discovery call scheduling (Microsoft cloud, Canada region)

8. International Data Transfers

Your personal information may be processed in or transferred to Canada or the United States, where our service providers operate. We require all providers to maintain protections substantively comparable to those required under Canadian law. For clients in jurisdictions with data localization requirements, we offer Canadian data residency on request.

9. Data Retention

We retain personal information only as long as necessary for the purposes for which it was collected, or as required by law:

• Contact form submissions: 24 months
• Whitepaper download leads: 24 months
• Design partner waitlist (Thynk HR): until the product launches, plus 12 months
• Discovery call records: duration of the evaluation period, plus 12 months
• Active client and matter data: contract term plus 7 years (legal industry standard for record retention)
• Marketing communication preferences: until you withdraw consent or are deleted from our records

10. Cookies and Tracking Technologies

We currently use only essential cookies required for basic website functionality (such as remembering your language preference). We do not currently use analytics, advertising, or tracking cookies. If we introduce analytics or tracking in the future, this policy will be updated and a consent mechanism will be implemented to allow you to control how your information is collected.

11. Automated Decision-Making

ThynkOps does not use AI or automated decision-making in client-matter handling. All operational decisions are rule-based, auditable, and explainable. The Thynk HR platform (currently in development) will use AI scoring to evaluate video interview responses. When Thynk HR launches, candidates will be informed before participating that AI is part of the evaluation, every shortlisted candidate will be reviewed by a human at the employing organization before any hiring decision, candidates will retain the right to request a human-only review, and bias audits will be conducted at least annually. A dedicated Responsible AI policy will be published when Thynk HR launches.

12. Your Privacy Rights

Subject to applicable law, you have the following rights:

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct inaccurate or incomplete information
• Deletion — request that we delete your personal information (subject to legal retention requirements)
• Restriction or objection — restrict or object to certain processing
• Withdraw consent — withdraw consent at any time where processing is based on consent
• Data portability — receive your personal information in a portable, machine-readable format
• Right to human review (Quebec Law 25) — request that a decision based exclusively on automated processing be reviewed by a person
• Right to non-discrimination — exercise these rights without any adverse effect on the quality of service you receive

13. California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know what personal information we collect, use, and disclose
• Right to delete personal information
• Right to correct inaccurate information
• Right to opt out of the sale or sharing of personal information (Thynk Innovation does not sell or share personal information)
• Right to limit the use of sensitive personal information
• Right to non-discrimination for exercising any of these rights

14. How to Exercise Your Rights

To exercise any of the rights described in this policy, contact our Privacy Officer at solutions@thynkinnovation.com. We will respond within 30 days (or longer if permitted by applicable law and we notify you of the extension). We may need to verify your identity before processing certain requests.

15. Security

We apply reasonable physical, administrative, and technical safeguards to protect personal information against unauthorized access, disclosure, loss, or alteration:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Role-based access controls
• Multi-factor authentication on internal systems
• Regular security reviews
• Vendor due diligence and Data Processing Agreements with all subprocessors

16. Breach Notification

In the event of a confirmed breach of security safeguards involving your personal information, where the breach creates a real risk of significant harm, we will notify you and the relevant regulatory authority in accordance with applicable law (within 72 hours of confirmation for PIPEDA-reportable breaches).

17. Children's Privacy

Our services are not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at solutions@thynkinnovation.com and we will promptly delete the information.

18. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated through a notice on our website or by email to active contacts where appropriate.

19. Contact and Complaints

For any privacy-related questions, requests, or concerns, contact Mohamad D, Privacy Officer, at solutions@thynkinnovation.com. If you believe your privacy rights have been violated, you may also contact:

• Office of the Privacy Commissioner of Canada — priv.gc.ca
• Commission d'accès à l'information du Québec (if you are a Quebec resident) — cai.gouv.qc.ca
• California Privacy Protection Agency (if you are a California resident) — cppa.ca.gov