Privacy Policy

Last updated 2026-09-17. Sentrix Inc. is committed to protecting the privacy of visitors to sentrix.ca, of our customers and of the personal information processed through our platform. This policy explains what we collect, why, where it is processed and what your rights are.

1. Who we are

Sentrix Inc. (« Sentrix », « we », « us ») is a corporation incorporated under the laws of Canada. We operate a governance, risk and compliance (GRC) automation platform and offer compliance and security services.

For the purposes of applicable privacy legislation, including PIPEDA and Québec's Law 25, Sentrix acts as the data controller for personal information we collect about visitors to our website and users of our platform, and as a data processor for personal information our customers process through the platform.

2. Information we collect

On the website

Contact form. When you write to us through the form, we collect the fields you fill in: first and last name, work email, work phone, company, role, headcount, what you are looking for, and your message. The form is sent to our team by email through Resend, our transactional email provider, and you receive an acknowledgement from noreply@sentrix.ca. Before sending, Cloudflare Turnstile checks that the request does not come from a bot; this check sets no tracking cookie. The website keeps no copy of your submission: the email received by our team is the record.

Technical data. Our hosting provider, Vercel, processes standard web request data (IP address, browser type, requested pages, referring URL) to serve the site and protect it against abuse. Vercel Web Analytics, a cookieless and aggregated measurement of page views, may run on the production site.

Analytics, only with your consent. Google Analytics 4 is loaded only after you accept the analytics category in the consent modal. Before that, nothing from Google is loaded and no analytics cookie is set. Your choice is stored in a single cookie, sentrix_consent, for 365 days; no consent record is kept on our servers. See our Cookie Policy.

On the platform

Account and contact information. When your organization creates an account, we collect your name, work email address, company name and role.

Platform usage data. We collect information about how you use the Sentrix platform, including features accessed, evidence items reviewed, integrations connected and actions taken. This information is used to improve the platform and provide customer support.

Integration data. When you connect integrations, Sentrix collects compliance evidence from the connected systems using read-only API access. This evidence is stored on your behalf as part of the service.

Technical data. We collect standard log data, including IP addresses, browser type, operating system and referring URLs, for security monitoring and platform optimization.

3. How we use your information

We use personal information to: provide and improve the Sentrix platform; answer your requests; communicate with you about your account, product updates and support requests; conduct security monitoring and fraud prevention; comply with legal obligations; and, with your consent, send you marketing communications about products and resources we think you will find useful.

We do not sell personal information to third parties. We do not use customer compliance data for any purpose other than providing the service.

4. Where your information is processed

Customer compliance data processed through the platform is hosted in Canada. Website hosting, form email delivery and, with your consent, website analytics are provided by sub-processors that may process data outside Canada, as described below.

5. Sub-processors

We maintain data processing agreements with each sub-processor and require them to maintain appropriate security controls. Customers are notified at least 30 days before a new sub-processor is added to the platform.

The list of sub-processors used to operate the platform itself is provided to customers with their Data Processing Agreement and on request at privacy@sentrix.ca.

6. Your rights

Subject to applicable law, you have the right to: access the personal information we hold about you; correct inaccurate personal information; request deletion of your personal information; object to or restrict certain processing; and withdraw consent where processing is based on consent.

Québec residents have additional rights under Law 25, including the right to data portability and the right to be informed of any automated decision-making that significantly affects them.

To exercise your rights, contact us at privacy@sentrix.ca. We will respond within 30 days.

7. Retention

Contact form emails are retained as ordinary business correspondence for as long as needed to handle your request and our relationship with you. We retain account and contact information for the duration of your subscription plus 7 years, as required by Canadian tax law. Compliance evidence and platform data are retained for the period specified in your subscription agreement. You may request deletion of your account data at any time, subject to our legal retention obligations.

8. Visitors in the European Union, the EEA and the United Kingdom

If you are in the EU, the EEA or the UK, the GDPR and the UK GDPR apply to the personal information we process about you.

Legal bases. We process your information on the following bases: performance of a contract or steps at your request before entering one (platform accounts, answering your enquiries); our legitimate interests in operating, securing and improving the website and the platform; your consent for analytics cookies and marketing communications, which you can withdraw at any time; and compliance with legal obligations.

Your rights. In addition to the rights above, you have the right to data portability, the right to object to processing based on legitimate interests, and the right to lodge a complaint with the supervisory authority of your country of residence or of the place where you believe an infringement occurred.

International transfers. Sentrix is established in Canada, a country recognized by the European Commission and the United Kingdom as providing adequate protection for personal information handled by commercial organizations under PIPEDA. Where sub-processors process data in the United States, we rely on appropriate safeguards such as standard contractual clauses or a recognized certification framework.

9. California residents

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended, gives you the following rights: to know what personal information we collect, use and disclose; to request its deletion; to request its correction; to opt out of the sale or sharing of personal information; and not to be discriminated against for exercising these rights.

In the preceding twelve months we have collected the categories described in section 2: identifiers, professional information, and internet activity on our website. We do not sell personal information and we do not share it for cross-context behavioural advertising. To exercise your rights, or to have an authorized agent do so on your behalf, write to privacy@sentrix.ca; we will verify your request before acting on it.

10. Contact and Privacy Officer

Our Privacy Officer is William Georges Khouri. He can be reached at privacy@sentrix.ca or at our principal place of business. Individuals in Québec may also contact the Commission d'accès à l'information (CAI) with complaints about our handling of personal information.

Confidentiality incidents. In the event of a confidentiality incident involving personal information that presents a risk of serious injury, Sentrix will notify the Commission d'accès à l'information and the affected individuals with diligence, as required by Law 25 and PIPEDA. We maintain an incident register in accordance with our legal obligations.

11. Changes to this policy

We may update this policy from time to time. The date at the top of the page is the date of the last change. Material changes to how we use personal information will be announced on this page and, for platform customers, by email.