Website Privacy Policy

BriteBase ("BriteBase," "we," "us," or "our") respects your privacy. This Website Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit gobritebase.com (the "Website"), contact us, or schedule a meeting with us through the Website.

This policy applies to the public Website and related business communications. It does not govern personal information processed through the BriteBase screening platform, application programming interfaces, case-management tools, or watchlist-data services on behalf of customers. Those activities are governed by the applicable customer agreement, data-processing terms, and any product-specific privacy notice.

1. Personal information we collect

We collect personal information in three ways: when you provide it to us, automatically when you use the Website, and through service providers used on the Website.

Information you provide

The Website does not currently use a BriteBase-hosted contact form. You may provide information to us when you:

• email or call us;
• schedule a demo or meeting through Calendly;
• reply to a message from us; or
• otherwise communicate with us about our business or services.

Depending on how you contact us, this information may include your name, business email address, telephone number, company, job title or role, time zone, meeting availability, the subject and content of your communications, information about your organization's screening or compliance needs, and any other information you choose to provide.

Please do not send sensitive personal information, customer screening records, identification documents, payment data, or other regulated data through the public Website, ordinary email, or Calendly unless we have agreed on an appropriate secure method.

Information collected automatically

When you visit the Website, BriteBase and the providers described below may receive technical and usage information such as:

• Internet Protocol address and approximate location derived from it;
• date and time of access;
• pages and links viewed, page location, referring page or source, and campaign parameters;
• browser type, device type, operating system, language, screen or device characteristics, and user-agent information;
• website interactions and events, such as page views, engagement, and demo-related conversion events;
• cookie, browser, advertising, or similar identifiers; and
• network, security, routing, error, and performance information.

The exact information collected depends on the page you visit, the choices you make in the Website's consent banner, your browser settings, and whether you interact with the Calendly scheduler.

Consent preference stored in your browser

When you use the Website's cookie consent banner, the Website stores a record called bb_cookie_consent_v1 in your browser's local storage. It contains your analytics and marketing choices, a necessary-storage indicator, and the time the choice was saved. This record is used to remember your preferences. It remains in your browser until you clear the Website's stored data or BriteBase replaces the consent record with a new version.

2. Website technologies and service providers

The Website uses the following technologies. Some providers may act as service providers to BriteBase, while others may process information for their own purposes under their privacy notices.

Cloudflare

Cloudflare provides website delivery, network security, traffic management, and website performance analytics. Cloudflare may process Internet Protocol addresses, traffic-routing data, system-configuration information, request data, security signals, and browser performance information when you access the Website. Cloudflare's browser analytics beacon loads on the Website regardless of your analytics or marketing selection.

Cloudflare states that its Web Analytics service does not use cookies or local storage to collect usage metrics and does not fingerprint individuals for analytics. Cloudflare may still process network and request information as part of delivering and protecting the Website. For details, see Cloudflare's Privacy Policy and Cloudflare Web Analytics.

Google Tag Manager and Google Analytics 4

If you consent to Analytics in the Website's consent banner, the Website loads Google Tag Manager container GTM-MMHT4RG5 and Google Analytics 4 measurement ID G-Q200G808SQ.

Google Analytics 4 may collect page URLs, page titles, referrers, campaign information, Internet Protocol address, approximate location, browser and device information, language, engagement data, events, and cookie or device identifiers. BriteBase uses this information to understand Website traffic, measure how visitors use the Website, diagnose performance issues, and improve Website content and navigation.

Google may set analytics cookies, including _ga and a property-specific _ga_... cookie, subject to your browser and consent settings. Google Tag Manager is used to deploy and manage tags; the tags loaded through it determine what information is collected. For more information, see How Google uses information from sites or apps that use its services and the Google Privacy Policy.

LinkedIn Insight Tag

If you consent to Marketing in the Website's consent banner, the Website loads the LinkedIn Insight Tag associated with partner ID 9283506.

The LinkedIn Insight Tag allows LinkedIn to receive information about visits to the Website, including the page URL, referring URL, Internet Protocol address, device and browser characteristics, timestamp, and LinkedIn cookie or advertising identifiers. BriteBase uses the tag to measure advertising and website conversions, create or measure retargeting audiences, and receive aggregated reports about Website audiences and campaign performance.

BriteBase does not intentionally send names, email addresses, booking-form entries, or customer screening data to LinkedIn through the base Insight Tag. LinkedIn states that it removes members' direct identifiers within seven days to pseudonymize Insight Tag data and deletes the remaining pseudonymized data within 180 days. LinkedIn does not provide BriteBase with information that directly identifies individual LinkedIn members through its audience reports. For more information and advertising controls, see the LinkedIn Insight Tag FAQs, LinkedIn Privacy Policy, and LinkedIn Cookie Policy.

Calendly

The contact page includes a Calendly scheduling widget. The Website is currently configured to load the Calendly widget when the scheduling section approaches the visible part of the page. This loading is not controlled by the Website's Analytics or Marketing consent choices. As a result, Calendly may receive technical information when you visit and scroll through the contact page even if you do not book a meeting.

Calendly may collect Internet Protocol address, referring and destination pages, device model, operating system, browser type, device identifiers, time zone or approximate location, cookies, local-storage data, and information about how the scheduling service is used. If you schedule a meeting, Calendly will also process the information requested in the booking form, which may include your name, email address, telephone number, company, role, meeting time, and information you enter about the purpose of the meeting. BriteBase receives the booking information needed to arrange and conduct the meeting.

If you prefer not to use Calendly, you may contact BriteBase directly at hello@gobritebase.com. Calendly processes information under its Privacy Notice.

3. How we use personal information

BriteBase uses personal information to:

• operate, deliver, secure, maintain, and troubleshoot the Website;
• remember and apply your consent choices;
• respond to questions, demo requests, and other communications;
• arrange, conduct, and follow up on meetings;
• understand a prospective customer's business needs and evaluate a potential business relationship;
• analyze Website use and improve its content, structure, accessibility, and performance, where you have consented to analytics;
• measure marketing campaigns, attribute conversions, and conduct retargeting, where you have consented to marketing technologies;
• prevent misuse, fraud, security incidents, and other unlawful activity;
• establish, exercise, or defend legal rights; and
• comply with legal, regulatory, accounting, and reporting obligations.

Where consent is required, BriteBase relies on the consent you provide through the Website or through your direct interaction with us. Where permitted by law, we may also process information when it is necessary to respond to your request, take steps toward a business relationship, operate and secure the Website, comply with law, or pursue a legitimate business purpose that does not override your rights.

BriteBase does not use information collected through the public Website to make solely automated decisions that produce legal or similarly significant effects about Website visitors.

4. When we disclose personal information

BriteBase may disclose personal information to:

• Cloudflare, Google, LinkedIn, and Calendly for the purposes described above;
• hosting, information-technology, security, communications, and professional-service providers that support the Website and our business communications;
• legal, accounting, insurance, and other professional advisers where reasonably necessary;
• law-enforcement agencies, courts, regulators, government authorities, or other parties when disclosure is required or permitted by law, or is reasonably necessary to protect rights, safety, and security; and
• a buyer, investor, lender, adviser, or successor in connection with an actual or proposed financing, merger, acquisition, reorganization, or sale of all or part of our business, subject to appropriate confidentiality and legal safeguards.

We do not sell personal information for money. Our use of the LinkedIn Insight Tag for retargeting or advertising measurement may be considered a "sale," "sharing," or targeted advertising under the laws of some jurisdictions even though BriteBase does not receive money in exchange for the information. You can prevent the Website from loading the LinkedIn Insight Tag by rejecting Marketing technologies in the consent banner.

5. Cookies and your choices

When no preference has previously been saved, the Website does not load Google Tag Manager, Google Analytics 4, or the LinkedIn Insight Tag until you make a choice in the consent banner.

The banner provides the following choices:

• Strictly necessary: always active. This includes the local-storage record used to remember your consent choice and technologies required to deliver, protect, and operate the Website.
• Analytics: controls Google Tag Manager and Google Analytics 4 for Website measurement and improvement.
• Marketing: controls the LinkedIn Insight Tag for advertising measurement, audience reporting, and retargeting.

You may accept all optional technologies, reject all optional technologies, or use Preferences to select Analytics and Marketing separately.

The Website does not currently provide a persistent Cookie Settings link after a preference has been saved. To reset your choice, delete the cookies and local-storage data for gobritebase.com in your browser and reload the Website. You may also block or delete cookies through your browser settings. Blocking some technologies may affect how the Website or third-party scheduling features work.

Rejecting the Website's optional Analytics and Marketing technologies does not prevent Cloudflare from processing information required to deliver, secure, and measure the performance of the Website. It also does not prevent Calendly from loading when the scheduling section of the contact page approaches the viewport. Calendly provides its own privacy and cookie controls.

You may also use the Google Analytics Opt-out Browser Add-on and adjust advertising preferences through your LinkedIn account settings.

6. Retention

BriteBase retains personal information only for as long as reasonably necessary for the purposes described in this policy, including responding to inquiries, managing meetings and prospective business relationships, maintaining appropriate business records, securing the Website, resolving disputes, enforcing agreements, and meeting legal obligations. Retention periods vary according to the type of information, its sensitivity, the purpose for which it was collected, and applicable legal requirements.

The Website consent preference remains in your browser until you clear the Website's stored data or BriteBase changes the consent-storage version. Google Analytics, Calendly, Cloudflare, and LinkedIn retain information according to their applicable settings, contracts, and privacy notices. As noted above, LinkedIn states that it removes direct identifiers from Insight Tag data within seven days and deletes the remaining pseudonymized data within 180 days.

When personal information is no longer required, BriteBase will delete it, anonymize it, or securely dispose of it, subject to legal and technical limitations.

7. Processing outside Canada

BriteBase is based in Ontario, Canada. Our service providers may process or store personal information in Canada, the United States, and other countries. Information processed outside your province or country may be subject to the laws of the place where it is processed and may be accessible to courts, law-enforcement agencies, or national-security authorities in that jurisdiction.

Where BriteBase uses a provider to process personal information on its behalf, we use contractual or other measures appropriate to the nature of the information and the service. Third-party providers that determine their own purposes for processing also govern that processing under their privacy notices.

8. Security

BriteBase uses administrative, technical, and organizational safeguards appropriate to the sensitivity of the personal information under our control. These measures are intended to reduce the risk of loss, theft, unauthorized access, disclosure, copying, use, or modification. No website, transmission, or storage system can be guaranteed to be completely secure.

9. Your privacy rights

Subject to applicable law, you may ask BriteBase to:

• confirm whether we hold personal information about you;
• provide access to personal information we hold about you and explain how it has been used or disclosed;
• correct information that is inaccurate or incomplete;
• withdraw consent to future collection, use, or disclosure, subject to legal or contractual restrictions and reasonable notice;
• delete information that we are not required to retain; or
• address a concern or complaint about our privacy practices.

Depending on where you live, you may have additional rights, including rights to object to or restrict processing, receive a portable copy of information, or opt out of targeted advertising or certain disclosures.

To make a request, contact the Privacy Officer using the details below. We may need enough information to verify your identity and locate the relevant records. We will use information provided for verification only for that purpose and to document our response. We will respond within the period required by applicable law.

You may also complain to the Office of the Privacy Commissioner of Canada or another privacy or data-protection authority that has jurisdiction over your concern.

10. Third-party links and social media

The Website contains links to third-party websites and social-media services. If you follow a link or interact with a third-party service, that provider may collect information under its own privacy terms. BriteBase does not control the privacy practices of third-party websites or services.

11. Children

The Website is intended for business and professional audiences and is not directed to children. BriteBase does not knowingly collect personal information from children through the Website. If you believe a child has provided personal information to us, contact the Privacy Officer so we can review and, where appropriate, delete it.

12. Changes to this policy

BriteBase may update this policy to reflect changes to the Website, our service providers, our practices, or applicable law. We will post the revised policy on the Website and change the "Last updated" date. If a change materially affects how we use personal information already collected, we will provide any additional notice or obtain any consent required by law.

13. Contact the Privacy Officer

Questions, access requests, withdrawal requests, and privacy complaints may be directed to:

Privacy Officer
BriteBase
Toronto, Ontario, Canada
Email: hello@gobritebase.com
Telephone: +1 905-218-7088