Skip to main content

Privacy Policy

Last Updated: March 12, 2026

1. Introduction & Controller Identity

This Privacy Policy explains how NorthMap Learning (“we”, “us”, or “our”) collects, uses, and protects personal data when you visit our website and when you contact us about online courses, live webinars, masterclasses, intensives, or educational programs. It also describes the choices you have about your information, including cookie preferences.

Data Controller: NorthMap Learning Inc.
Registered Address: 100 Queen St W, Suite 4000, Toronto, ON M5H 2N2, Canada
Contact Email: [email protected]
Phone: +1 416 697 2849

This policy applies to data we collect through our website, our contact/registration inquiry forms, and related communications (for example, email exchanges about schedules, pricing in Canadian dollars (CAD), cohort availability, and webinar logistics).

Effective Date: March 12, 2026.

2. Personal Data We Collect

We collect personal data in a limited, practical way that supports delivering educational programs and responding to requests. The exact data depends on how you interact with the site and what you submit.

  • Identity and contact information: name, email address, and (if you provide it) phone number.
  • Form content: the program you select, your message, and any details you provide about goals, scheduling constraints, or your starting level.
  • Technical data: IP address, browser type and version, device identifiers, operating system, and language settings.
  • Usage data: pages you view, time spent on pages, referrer information, and interaction events (for example, clicks that indicate interest in courses vs. webinars).
  • Cookies and identifiers: cookie identifiers and consent state as described in Section 4.
  • Conversion events: events that indicate you submitted a form or reached a confirmation page after submission.

We do not intentionally collect special-category data (such as health information, religious beliefs, political opinions), government identification numbers, or financial account details through our website forms. Please do not include sensitive personal data in free-text message fields.

3. Why We Process Personal Data & Legal Basis

When laws like the GDPR or UK GDPR apply (for example, if you are located in the EEA or the UK), we rely on the legal bases below. Where Canadian privacy laws apply, we process personal information with appropriate consent and for reasonable purposes related to delivering and improving our educational services.

  • Contact and registration inquiries: to respond to your request, confirm schedules, and provide registration and purchase steps. Legal basis: GDPR Art. 6(1)(b) (steps prior to entering a contract) and Art. 6(1)(a) (consent), depending on the context.
  • Analytics (optional): to understand how the site is used and improve content and navigation. Legal basis: GDPR Art. 6(1)(a) (consent) where required.
  • Marketing and remarketing (optional): to measure advertising performance and show relevant messages. Legal basis: GDPR Art. 6(1)(a) (consent) where required.
  • Security and fraud prevention: to protect the site, prevent spam, and detect abusive traffic. Legal basis: GDPR Art. 6(1)(f) (legitimate interests).
  • Legal obligations: to comply with applicable law, respond to lawful requests, or maintain records where required. Legal basis: GDPR Art. 6(1)(c).

Automated Decision-Making (GDPR Art. 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Any decisions about program fit, scheduling, or eligibility are made by people based on the information you provide.

4. Cookies & Tracking

Cookies are small text files stored on your device. We also use similar technologies such as pixel tags and (where configured) server-side event forwarding. We group cookies and related tracking into the categories below. These categories match our Cookie Policy at /cookie-policy/.

Essential

Essential cookies are required for the site to function. They support core features such as session continuity and saving your cookie preferences. Essential cookies are always active because the site cannot operate reliably without them.

  • _site_session (first-party): supports session continuity. Retention: session to 12 months depending on implementation.
  • cookie_consent (first-party): stores your cookie preferences. Retention: 12 months.

Analytics (Consent)

Analytics cookies help us understand how visitors navigate the site and which pages are useful. If enabled, we use Google Analytics 4 (GA4) with IP anonymization where applicable. Retention for analytics data is set to 14 months.

  • _ga (third-party): GA4 user identifier. Retention: 2 years.
  • _ga_XXXXXXXXXX (third-party): GA4 session state. Retention: 2 years.

Marketing (Consent)

Marketing cookies are used for advertising measurement, remarketing, and conversion attribution. If enabled, they may allow advertising platforms to recognize your browser and infer interest based on page views and conversion events.

  • _gcl_au (third-party): Google Ads conversion linker. Retention: 90 days.
  • _fbp (third-party): Meta Pixel browser identifier. Retention: 90 days.
  • _fbc (third-party): Meta Pixel click identifier (created when click ID is present). Retention: 90 days.

Beyond cookies, we may use pixel tags (for example, Google tags or Meta Pixel) and may later configure server-side processing (for example, via a tag manager or conversion API). Where consent is required, these technologies are activated only after you opt in to the relevant category.

5. Consent (EEA/UK)

Users located in the EEA and the UK receive a consent notice under GDPR/UK GDPR. Analytics and marketing cookies activate only after explicit, informed, freely given consent (GDPR Art. 6(1)(a)). Your consent choice is recorded in the cookie_consent browser cookie for 12 months.

You can withdraw or change consent at any time by using “Manage cookie preferences” in the site footer or by clearing cookies in your browser. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

6. Sharing With Advertising & Service Partners

We share limited data with service providers that help operate the website and (if enabled through consent) measure advertising performance. We do not sell personal data.

We do not permit these providers to use site data for their own independent commercial purposes. They process data as service providers and may only use it to deliver services to us, subject to their contracts and policies.

7. International Transfers

Our organization is based in Canada. Some of our service providers and advertising partners may process data in other countries, including the United States. Where GDPR/UK GDPR applies, transfers may rely on the EU–U.S. Data Privacy Framework (DPF) (and the UK Extension or Swiss–U.S. DPF where applicable). Where needed, we also use Standard Contractual Clauses (EU 2021/914) as a fallback mechanism and the UK International Data Transfer Agreement (IDTA) as a fallback for UK transfers.

Transfer safeguards vary by provider and the product configuration used. If you want more detail about the safeguards relevant to your specific situation, contact us at [email protected].

8. Data Retention

We keep personal data only as long as needed for the purpose it was collected, then delete or anonymize it unless a longer retention period is required by law or justified for legitimate purposes like security.

  • Contact submissions: up to 2 years from the last interaction.
  • Analytics data: 14 months (where enabled through consent).
  • Marketing cookies: per cookie lifetime (for example, 90 days for typical marketing cookies), where enabled through consent.
  • Email correspondence: for the duration of the relationship, plus up to 1 year for context and continuity.
  • Server and security logs: typically up to 90 days unless needed longer for incident investigation.
  • Cookie consent record: up to 3 years for audit purposes where needed.
  • Legal and tax records: retained as required by applicable law (often 6–10 years for invoices and related records).

9. Your Rights (GDPR & UK GDPR)

If GDPR or UK GDPR applies to you, you may have rights including:

  • Right of access (Art. 15)
  • Right to rectification (Art. 16)
  • Right to erasure (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object (Art. 21)
  • Right to withdraw consent at any time (Art. 7(3))
  • Right to lodge a complaint with a supervisory authority (Art. 77)

To exercise rights, email [email protected]. We aim to respond within 30 days. For complex requests, we may extend by up to 60 additional days and will explain the reason.

Supervisory authority references: https://edpb.europa.eu (EEA) and https://ico.org.uk (UK).

10. Children

This site is not directed at individuals under 16. We do not knowingly collect personal data from minors. If you believe a child under 16 has provided personal data to us without verifiable parental consent, contact us and we will delete the information promptly.

11. Do Not Track

This website does not respond to Do Not Track (DNT) browser signals. Third-party providers may have their own approaches to DNT signals and similar controls.

12. Data Deletion Requests

You can request deletion of personal data by emailing [email protected] with the subject line “Data Deletion Request”. We may need to verify your identity before completing the request. We aim to complete verified deletion requests within 30 days, unless we must retain certain information to comply with legal obligations or to establish, exercise, or defend legal claims.

13. Business Transfers

If NorthMap Learning Inc. is involved in a merger, acquisition, asset sale, financing, reorganization, insolvency, or receivership, personal data may be transferred as part of that transaction. If the transfer results in a material change to how personal data is used, we will provide notice on the website.

14. California (CCPA / CPRA)

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Over the past 12 months, we may have disclosed the following categories of personal information for business purposes:

  • Identifiers: name, email address, IP address, cookie identifiers. Shared with service providers and (where enabled by consent) advertising partners.
  • Internet or network activity: browsing and interaction data used for analytics and advertising measurement where enabled.
  • Inferences: interests or preferences inferred from site interactions, used for ad measurement or audience grouping where enabled.

We do not sell personal information as defined by CCPA. We may share personal information for cross-context behavioral advertising when marketing cookies are enabled. California residents may opt out of sharing for cross-context behavioral advertising through our cookie preferences panel.

To submit a request, email [email protected] with the subject “California Privacy Request”. We will verify your identity before processing. Authorized agents may submit requests with proof of authorization.

15. Virginia (VCDPA)

If you are a Virginia resident, you may have rights under the Virginia Consumer Data Protection Act (VCDPA), including the right to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising. We do not sell personal data or engage in profiling that produces legal or similarly significant effects.

To submit a request, email [email protected] with the subject “Virginia Privacy Request”. If we decline a request, you can appeal by emailing with the subject “Appeal of Refusal — Privacy Request”. We respond to appeals within 60 days. If your appeal is denied, you may contact the Virginia Attorney General.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject “Nevada Do Not Sell Request”. We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice on the website at least 14 days before the updated policy takes effect. The “Last Updated” date at the top of this page reflects the most recent version.

18. Contact

If you have questions about privacy, data retention, or cookie preferences, contact:

NorthMap Learning Inc.
100 Queen St W, Suite 4000, Toronto, ON M5H 2N2, Canada
Email: [email protected]
Phone: +1 416 697 2849