Privacy Policy

1. Who we are

Inacsys Inc. ("Inacsys," "we," "us," or "our") is an Ontario corporation with its registered office at 15 Wellesley St W Unit 201, Toronto, Ontario M4Y 0G7, Canada. This Privacy Policy applies to the Inacsys Circular Industry Cloud at inacsys.com and related subdomains (the "Platform"), a B2B technology platform that helps businesses discover, evaluate, communicate, and negotiate trades involving recyclable paper and plastic materials, including through the Kiwi AI matching co-pilot.

Depending on the processing activity and applicable law, Inacsys may act as a controller/business or as a processor/service provider on behalf of a Customer. Where required, Enterprise Customers may enter into a Data Processing Addendum ("DPA").

2. Information we collect

2.1 Account and business information. We may collect name, business email, phone number, job title, login credentials, company legal name, registration information, business address, tax/VAT/GST identifiers, licensing information, and business-verification documents.

2.2 Trading and Platform information. We may collect listings, material types and grades, quantities, specifications, prices, locations, photographs, documents, bids, offers, negotiations, messages, transaction-related records, buyer-risk information, and documents such as certificates, invoices, and specification sheets.

2.3 Kiwi and AI interaction information. We may collect prompts, matching queries, specifications supplied for matching, outputs, feedback, and technical information associated with use of Kiwi.

2.4 Technical information. We may collect IP address, browser/device information, logs, cookies, session information, security events, clickstream, feature usage, and similar telemetry.

2.5 Counterparty information. Where contact details are masked or matching requires information about another business or its representatives, we may process information necessary to operate the matching, messaging, verification, and anti-circumvention functions.

2.6 Payment information. We do not knowingly collect payment-card numbers or bank-account credentials directly. If a third-party payment provider is integrated, payment information will be handled under the provider's terms and applicable privacy notices.

3. How we use information

We use information as reasonably necessary to:

• create and administer accounts;
• verify businesses and authorized representatives;
• operate listings, matching, bidding, messaging, and Platform functions;
• provide Kiwi matching and decision-support;
• provide buyer-risk or counterparty indicators;
• detect fraud, abuse, sanctions concerns, and security threats;
• enforce the Terms of Use and prevent circumvention;
• communicate about accounts, transactions, security, support, and service changes;
• send marketing communications where legally permitted and, where required, with consent;
• comply with legal, tax, export/import, customs, environmental, regulatory, and law-enforcement obligations;
• maintain, secure, troubleshoot, and improve the Platform; and
• create aggregated or de-identified analytics, benchmarks, statistics, and product insights.

4. AI, matching and buyer-risk features

4.1 Decision Support. Kiwi and buyer-risk features are informational decision-support tools only. They do not constitute legal, financial, credit, regulatory, customs, environmental, investment, insurance, or professional advice.

4.2 Accuracy. AI-generated outputs and risk indicators may be inaccurate, incomplete, biased, outdated, unavailable, or unsuitable for a particular decision. Customers remain responsible for independent due diligence and decisions.

4.3 Model Improvement. Inacsys may use Customer Content as necessary to provide matching and other requested services. Inacsys may use aggregated, de-identified, and non-identifying information to develop, evaluate, secure, and improve Kiwi and the Platform. Inacsys will not use identifiable Customer Confidential Information or proprietary Customer Content to train a general-purpose model for unrelated third-party benefit unless expressly authorized or otherwise permitted under the applicable agreement.

4.4 Automated Decisions. Where applicable law provides rights relating to automated decision-making, profiling, or significant decisions, Inacsys will provide the rights and processes required by that law.

5. Legal bases

Where applicable law requires a legal basis, Inacsys may rely on:

• performance of a contract for core Platform services;
• legitimate interests for security, fraud prevention, service improvement, and business administration, balanced against applicable rights;
• consent for marketing, non-essential cookies, and other processing for which consent is legally required;
• legal obligations; and
• other lawful bases recognized by applicable law.

6. How we share information

We may share information:

• with other Platform users to operate listings, matching, negotiation, and messaging, subject to Platform controls;
• with service providers and subprocessors providing hosting, databases, email, analytics, AI infrastructure, security, customer support, and related services;
• with professional advisers, auditors, insurers, and service providers who have a legitimate need to receive it;
• with regulators, customs/export authorities, law enforcement, courts, or other authorities where required or reasonably necessary to comply with law or protect rights and safety;
• in connection with a merger, financing, reorganization, acquisition, bankruptcy, or sale of assets;
• where necessary to protect Inacsys, users, the Platform, or the public from fraud, security threats, unlawful activity, or material harm; and
• in aggregated or de-identified form for research, benchmarking, statistics, and product development.

We do not sell personal information for money. Where applicable law defines "sale," "sharing," targeted advertising, or similar concepts more broadly, we will comply with the requirements applicable to Inacsys.

7. Service providers and subprocessors

We use third-party providers to operate the Platform. Where applicable, providers processing personal information on our behalf will be subject to contractual confidentiality, security, and data-processing obligations appropriate to their role. Inacsys may maintain a current subprocessor list for Enterprise Customers and provide notice of material additions where required by the applicable DPA.

8. International data transfers

Inacsys and its service providers may process information in Canada, the United States, India, and other countries where our infrastructure or service providers operate.

Where applicable law restricts international transfers, Inacsys will use a legally recognized transfer mechanism or other safeguard, which may include contractual safeguards, standard contractual clauses, adequacy decisions, or another permitted mechanism. Where required, Inacsys will conduct appropriate transfer assessments and provide required supplementary measures.

9. Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy, including account administration, transaction records, security, legal compliance, tax/audit requirements, dispute resolution, fraud prevention, and enforcement of agreements.

Retention periods vary by data category. Transaction, tax, accounting, customs, export-control, and compliance records may be retained for periods required or reasonably appropriate under applicable law. We may retain information longer where necessary for a legal claim, investigation, audit, legal hold, security matter, or regulatory requirement.

10. Security

We maintain administrative, technical, and physical safeguards appropriate to the nature and sensitivity of information, which may include encryption in transit and at rest, access controls, authentication, logging, monitoring, backups, and contact-masking controls. No security measure can guarantee absolute security. We will respond to security incidents and provide notices where required by applicable law or an applicable DPA.

11. Privacy rights

11.1 Canada. Depending on the applicable law and jurisdiction, individuals may request access to and correction of personal information and may withdraw consent where processing is based on consent, subject to legal exceptions.

11.2 EU/EEA/UK/Switzerland. Where applicable, individuals may have rights to access, rectification, erasure, restriction, objection, portability, and rights relating to automated decision-making, together with the right to complain to a supervisory authority.

11.3 United States. Where applicable under state privacy law, individuals may have rights concerning access, correction, deletion, portability, opt-out of certain sales/sharing or targeted advertising, and appeal of certain decisions. Rights and thresholds vary by state and circumstance.

11.4 India. Where applicable under Indian privacy law, individuals may have rights and grievance mechanisms provided by applicable law, including rights concerning access, correction, erasure, consent withdrawal, and complaints.

11.5 China. Where applicable under PRC privacy law, individuals may have rights concerning access, correction, deletion, consent withdrawal, and other rights provided by applicable law. International transfers and other requirements will be addressed where applicable before processing at a scale or in circumstances requiring additional safeguards.

11.6 Brazil and Other Jurisdictions. Where applicable, individuals will receive the rights provided by local privacy law, including rights concerning access, correction, deletion, objection, portability, and complaints where applicable.

11.7 Requests. To exercise applicable rights, contact support@inacsys.com. We may need to verify identity and authority before responding. We will respond within the period required by applicable law. If we deny a request, we will explain the basis and any applicable appeal or complaint process.

12. Cookies and tracking

We may use cookies, JWT/session technologies, local storage, pixels, and similar technologies for:

• strictly necessary security, authentication, load balancing, and session functions;
• functional preferences;
• analytics and performance; and
• advertising or retargeting, if used.

Where consent is legally required, non-essential technologies will not be activated before the applicable consent is obtained. Where required, users may reject or change preferences through the applicable cookie controls. We honor legally recognized opt-out signals, including Global Privacy Control where required.

The separate Cookie Policy describes current categories, providers, purposes, and retention periods and is incorporated by reference.

13. Do Not Track / Global Privacy Control

We do not currently treat generic browser Do Not Track signals as a universal opt-out because no consistent standard applies. We honor Global Privacy Control and other legally recognized opt-out signals where required.

14. Children

The Platform is a B2B service and is not directed to children. Individuals under 18 or the applicable local age of majority must not use the Platform.

15. Breach response

Inacsys maintains procedures for identifying, containing, investigating, remediating, documenting, and responding to security incidents. Where required by applicable law or an applicable DPA, we will notify regulators, affected individuals, and/or Customers within the applicable legal or contractual timeframe.

16. Marketing communications

Where required, we obtain and document consent for commercial electronic messages and provide required identification and unsubscribe mechanisms. You may opt out of marketing communications at any time, without affecting transactional or security communications.

17. Data Processing Addendum

Where Inacsys processes personal information as a processor/service provider for a Customer, the parties may execute a DPA addressing processing instructions, security, confidentiality, subprocessors, international transfers, assistance with rights requests, breach response, audits, deletion/return, and other applicable requirements.

18. Your responsibilities for third-party data

If you upload or otherwise provide personal information about employees, representatives, suppliers, customers, counterparties, or other individuals, you are responsible for providing required notices and obtaining required permissions or lawful bases for that disclosure. You must not provide personal information that you are not authorized to provide.

19. Data ownership and Customer Content

Customer retains ownership of Customer Content. Inacsys owns its Platform, software, algorithms, Kiwi, models, technology, Platform Data, and Derived Data, subject to applicable rights in personal information. The Terms of Use govern the licence Customer grants to Inacsys for Customer Content.

20. Privacy Policy changes

We may update this Policy from time to time. Material changes will be communicated through the Platform or email with reasonable advance notice where required. The effective date will identify the current version.

21. Contact

Privacy inquiries:
Inacsys Inc.
15 Wellesley St W Unit 201
Toronto, Ontario M4Y 0G7 Canada
support@inacsys.com