Privacy Policy

1. Introduction & Controller Identity

FLO Learning Canada provides practical education programs and learning resources for small business operations and entrepreneurship across Canada. This Privacy Policy applies to our website, pages, and forms that link to it.

Data Controller (responsible for the processing of personal information described in this Privacy Policy):

• Legal entity: FLO Learning Canada Inc.
• Registered address: 100 King Street West, Suite 5700, Toronto, ON M5X 1C7, Canada
• Contact email: [email protected]
• Telephone: +1 416 646 3228

If you have questions about privacy on this site or want to exercise your rights, contact us using the details above. We do not designate a Data Protection Officer because we do not conduct large-scale processing of special-category data.

Effective Date: March 14, 2026.

2. Personal Data We Collect

The information we collect depends on how you interact with the site. We collect the categories below to operate the site, respond to requests, and improve how our educational content is delivered.

• Identity and contact details: name, email address, phone number (if provided), and organization name (if included in your message).
• Form content: messages you submit, program interests you select, scheduling preferences, and any details you include about training scope (for example, cohort size, delivery format, or time zone).
• Technical data: IP address, browser type and version, device type, operating system, language settings, and approximate location derived from IP (city/province level).
• Usage data: pages viewed, time on page, referring pages, clicks and navigation paths, and error events (such as a failed form submission).
• Cookies and identifiers: first-party cookies we set to maintain session continuity and store cookie preferences, and third-party cookies used for analytics and marketing when you consent.
• Conversion events: when you submit a form, we may record that a conversion occurred (for example, “contact form submitted”) for measurement and quality improvement.

We do not intentionally collect special-category/sensitive personal information (such as health information, religious beliefs, political opinions, or biometric data) through our website forms. We also do not request government identification numbers or financial account information.

If you voluntarily include sensitive information in a message, we will handle it with care and use it only to respond to your request, unless we are required to retain it for legal reasons.

3. Why We Process Personal Data & Legal Basis

When applicable, we rely on recognized legal bases (commonly described in GDPR terminology) to explain why we process personal information. In Canada, our processing is also guided by applicable privacy laws and generally accepted principles of consent, purpose limitation, and safeguards.

• Responding to contact requests and coordinating program delivery: to answer inquiries, discuss program options, coordinate scheduling, and provide requested information. Legal basis: performance of a contract or steps prior to entering a contract; and/or consent when you choose to submit a form.
• Site security and fraud prevention: to protect our website from abuse, troubleshoot issues, and maintain reliability. Legal basis: legitimate interests.
• Analytics (with consent): to understand how the site is used so we can improve navigation, content clarity, and accessibility. Legal basis: consent.
• Marketing and advertising measurement (with consent): to measure ad performance, understand which pages lead to contact requests, and support relevant messaging to interested audiences. Legal basis: consent.
• Legal compliance: to comply with legal obligations, respond to lawful requests, and maintain records where required. Legal basis: legal obligation.

Automated decision-making: We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals.

4. Cookies & Tracking Technologies

Cookies are small text files stored on your device. We also use similar technologies such as pixel tags (small code snippets), local storage, and server logs. The categories below align with our Cookie Policy.

Essential (always active)

These are required for the site to function and for us to remember your cookie preferences. They do not require opt-in consent.

• _site_session: helps maintain session continuity and basic site functionality. Retention: session to 30 days (depending on configuration).
• cookie_consent: stores your cookie preference choices. Retention: 12 months.

Analytics (optional, consent-based)

If you consent to analytics cookies, we may use Google Analytics 4 (GA4) to understand site usage. We configure analytics to prioritize privacy and use the data to improve content structure, page readability, and navigation. Typical cookie examples include:

• _ga (2 years): GA4 user identifier.
• _ga_XXXXXXXXXX (2 years): GA4 session state (where “XXXXXXXXXX” is a GA4 property identifier).

Analytics retention is typically set to 14 months. Aggregated reporting may be kept longer because it no longer identifies individuals.

Marketing (optional, consent-based)

If you consent to marketing cookies, we may use cookies and pixels to measure advertising performance and support relevant messaging. Examples include:

• _gcl_au (90 days): Google Ads conversion linker.
• _fbp (90 days): Meta Pixel browser identifier.
• _fbc (90 days): Meta click identifier (set when a click ID is present).

Marketing technologies can involve pixel tags and may include server-side measurement configured by us or our partners. When used, such systems are intended for conversion attribution and audience measurement, not for collecting sensitive personal information.

5. Consent and Your Choices

When you visit our site, you can choose whether to allow non-essential cookies (analytics and marketing). Your preference is recorded in the cookie_consent cookie. You can change your choice at any time using the “Manage cookie preferences” link in the footer.

If you withdraw consent, we will stop using the relevant categories of cookies going forward. Withdrawal does not affect processing that occurred before you changed your settings.

6. Sharing With Service Providers and Advertising Partners

We share personal information only as needed to operate the site, deliver the services you request, and measure performance. We do not sell personal information.

Depending on your cookie choices and how the site is configured, the following categories of providers may receive information:

• Google LLC (Analytics and Ads measurement): usage data, cookie identifiers, and conversion events. Privacy information: https://policies.google.com/privacy
• Meta Platforms, Inc. (ads measurement and audiences): page views, cookie identifiers, and conversion events; in some setups, hashed identifiers may be used for matching (for example, hashed email) when you consent. Privacy information: https://www.facebook.com/privacy/policy
• Cloudflare, Inc. (security and performance): IP-based threat detection and delivery optimization. Privacy information: https://www.cloudflare.com/privacypolicy/

We require service providers to process information on our behalf and to implement appropriate safeguards. We do not permit them to use site data for their own independent commercial purposes.

7. International Transfers

FLO Learning Canada is based in Canada. Some service providers may process data in other countries, including the United States or other jurisdictions where they operate infrastructure. When personal information is transferred across borders, we use contractual and technical measures intended to protect it and to align with applicable requirements.

For transfers that may involve European data protection frameworks (for example, if visitors access the site from the EEA or the UK), transfers may rely on recognized mechanisms such as the EU-U.S. Data Privacy Framework where applicable, the UK Extension to the DPF, and/or Standard Contractual Clauses as a fallback.

8. Retention

We retain personal information only for as long as needed for the purposes described in this Privacy Policy, unless a longer retention period is required by law or necessary to establish, exercise, or defend legal claims.

• Contact form submissions: typically up to 2 years after the last interaction.
• Email correspondence: for the duration of the relationship plus up to 1 year, unless longer retention is required for recordkeeping.
• Server logs and security records: typically up to 90 days, unless needed for investigating abuse or incidents.
• Analytics retention: typically 14 months (for GA4 settings), with aggregated reports retained longer.
• Cookie consent record: up to 3 years for audit and accountability purposes.

9. Your Rights and How to Exercise Them

Depending on your location, you may have rights to access, correct, delete, or restrict the processing of your personal information, as well as the right to object to certain processing and to withdraw consent for optional cookies.

To submit a request, email [email protected] and include enough detail for us to identify your request. For security, we may need to verify your identity before completing certain requests.

• Access: request a copy of the personal information we hold about you.
• Correction: request correction of inaccurate or incomplete information.
• Deletion: request deletion where applicable (subject to legal and operational exceptions).
• Restriction or objection: in some cases, request that processing be limited or object to certain uses.
• Withdraw consent: change cookie settings using the footer “Manage cookie preferences” link.

We aim to respond within 30 days. If a request is complex, we may need additional time; if so, we will explain why.

10. Children

This website is not directed at individuals under 16. We do not knowingly collect personal information from minors. If you believe a minor has provided personal information through our site, contact us and we will take steps to delete it where appropriate.

11. Do Not Track Signals

Some browsers offer a “Do Not Track” (DNT) signal. There is no consistent industry standard for responding to DNT, and our website does not respond to DNT signals. You can still manage cookies through our preference tools and your browser settings.

12. Data Deletion Requests

To request deletion, email [email protected] with the subject line “Data Deletion Request”. We may ask for additional information to confirm the request relates to you. We will complete deletion within 30 days after verification, except where retention is required by law or necessary for legitimate business purposes (for example, security logs, dispute resolution, or compliance).

13. Business Transfers

If FLO Learning Canada Inc. is involved in a merger, acquisition, financing, restructuring, insolvency, or asset sale, personal information may be transferred to a successor entity as part of that transaction. If such a transfer materially changes how personal information is used, we will provide notice on the website.

14. California Privacy Notice (CCPA/CPRA)

This section is provided for visitors from California. In the past 12 months, we may have collected the following categories of personal information (depending on your interactions and cookie choices): identifiers (name, email, IP address, cookie IDs); internet or other electronic network activity (usage data); and inferences about interests based on browsing activity on this site.

We do not “sell” personal information as defined by the CCPA. We may “share” information for cross-context behavioral advertising when marketing cookies are enabled. California residents may opt out by rejecting marketing cookies in our cookie preferences panel (available via the footer).

• Rights: know, delete, correct, opt out of sale/sharing, and non-discrimination.
• How to submit: email [email protected] with subject “California Privacy Request”.
• Verification: we may request details to verify your identity and protect your information.
• Authorized agents: may submit requests with written permission and identity verification.

15. Virginia Privacy Notice (VCDPA)

This section is provided for visitors from Virginia. Depending on your interactions, we may process identifiers and internet activity data for analytics and advertising (only when consent is provided through cookie preferences). We do not sell personal data and we do not engage in profiling that produces legal or similarly significant effects.

• Rights: access, correct, delete, data portability, and opt out of targeted advertising.
• How to submit: email [email protected] with subject “Virginia Privacy Request”.
• Appeals: if we deny a request, you may appeal by emailing with subject “Appeal of Refusal — Privacy Request”. We will respond within 60 days.

16. Nevada Notice

Nevada residents may submit a verified opt-out request by emailing [email protected] with subject “Nevada Do Not Sell Request”. We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. If we make material changes, we will post an updated version and, when appropriate, provide a notice on the website at least 14 days before the change takes effect.

18. Contact

If you have questions, want to exercise a privacy right, or want more information about our cookie choices, contact:

• FLO Learning Canada Inc.
• 100 King Street West, Suite 5700, Toronto, ON M5X 1C7, Canada
• Email: [email protected]
• Phone: +1 416 646 3228