Privacy Policy

MALTO Group Inc. ("MALTO Group," "we," "us") respects the privacy of every visitor to maltogroup.com (the "Site"). This Privacy Policy explains what personal information we collect through the Site, why we collect it, how we handle it, and the rights you have over it. We are an Ontario-incorporated company based in Toronto, Canada.

1. Person responsible for personal information

In accordance with Quebec's Act respecting the protection of personal information in the private sector (Law 25) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA), MALTO Group has designated a person responsible for the protection of personal information:

Marcus Tommy, Co-Founder & Privacy Officer
Email: accounts@maltogroup.com

You can contact our Privacy Officer for any question about this policy, to exercise your rights, or to file a complaint.

2. Information we collect

We only collect personal information when you choose to provide it. Specifically:

• Contact form submissions. When you fill in our contact form, we collect the name, email, phone number, company, industry, service of interest, and message text you provide.
• Email correspondence. Any information you include when you email us directly.
• Technical logs. Our hosting provider (Vercel) automatically logs standard server data — IP address, browser type, referring URL, request paths, timestamps — for security, abuse prevention, and operational diagnostics. These logs are short-lived.

We do not use third-party analytics, advertising trackers, or marketing cookies on the Site. We do not sell personal information.

3. How and why we use your information

We use the information you provide to:

• Respond to your enquiry and discuss potential engagements;
• Send follow-up correspondence at your request;
• Maintain a record of business communications;
• Operate, secure, and improve the Site.

We rely on your consent (PIPEDA / Law 25) and, for visitors from the European Economic Area, on our legitimate interest in responding to business enquiries (GDPR Art. 6(1)(f)).

4. Service providers and data processors

We share personal information only with service providers that help us operate the Site, each under a written agreement that limits use of your data to providing services to us:

• Vercel Inc. — Site hosting and server logs. Vercel may process data in the United States and other jurisdictions.
• Resend (Resend.com Inc.) — Outbound email delivery for contact form submissions. Resend processes data in the United States.
• Microsoft Corporation — Our email mailbox (Microsoft 365) where contact form messages are received. Data may be processed in Canada, the United States, and other jurisdictions.

We do not share personal information with any other third party except where required by law.

5. Cross-border transfers (Quebec Law 25 disclosure)

Some of our service providers process or store data outside Quebec and outside Canada — primarily in the United States. Before relying on any such provider, we assess whether the destination jurisdiction offers personal information protection equivalent to what applies in Quebec, and we put in place contractual safeguards. By submitting personal information through the Site, you acknowledge that your data may be transferred outside Quebec and outside Canada as described above.

6. Retention

We retain contact form submissions and related correspondence for as long as needed to respond to your enquiry and maintain a reasonable record of the discussion, typically up to 24 months from your last contact with us, unless a longer period is required for legal or contractual reasons. Server logs are retained for a much shorter period (typically 30 days) under our hosting provider's defaults.

7. Your rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you;
• Rectify inaccurate or incomplete information;
• Withdraw consent and request that we delete your information, subject to legal retention requirements;
• Data portability — receive a copy of your information in a structured, commonly used format (Law 25, GDPR);
• Deindexation — request that links to information about you be ceased or deindexed in qualifying cases (Law 25);
• Object to processing or restrict it in certain cases (GDPR).

We do not use automated decision-making that produces legal or similarly significant effects. To exercise any of these rights, contact our Privacy Officer at the address above. We will respond within 30 days.

8. Cookies

The Site uses only strictly necessary cookies required to deliver pages and (if applicable) protect against abuse. We do not set advertising, analytics, or social-media cookies. Your browser settings let you block or delete cookies at any time; doing so will not meaningfully affect your use of the Site.

9. Security

We apply reasonable administrative, technical, and physical safeguards to protect personal information against loss, theft, and unauthorized access. The Site is served over HTTPS with HTTP Strict Transport Security enforced. In the event of a confidentiality incident posing a risk of serious injury, we will notify affected individuals and the Commission d'accès à l'information du Québec as required by Law 25, and other regulators where applicable.

10. Children

The Site is intended for business audiences and is not directed at children. We do not knowingly collect personal information from children under 16.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be highlighted on this page; continued use of the Site after such changes indicates your acceptance of the revised policy.

12. Complaints

If you have a concern about how we handle your personal information, please first contact our Privacy Officer. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Commission d'accès à l'information du Québec (cai.gouv.qc.ca), or — for EEA residents — your local data protection authority.

Contact: accounts@maltogroup.com