Personal Data Charter, Cookies and Trackers
Last updated August 12, 2026.
Welcome to globaldataandbi.com (the “Site”). Global Data and BI Inc. (“GDBI,” “We,” “Us,” or “Our”) is committed to protecting the personal data of everyone who visits the Site, and this Charter explains what We collect, why, who We share it with, and the rights you have over it. By browsing the Site or submitting any form on it, you acknowledge that you have read and understood this Charter.
1. Who we are
The Site is operated by Global Data and BI Inc., through which We market Our data engineering, business intelligence, and AI/ML consulting services and the Noème.AI product suite.
Registered address: 371 Front Street W, Unit D1, Toronto, ON, M5V 3R8.
Privacy contact: data-protection@globaldataandbi.com.
Under Quebec’s Act respecting the protection of personal information in the private sector (“Law 25”), the person in charge of the protection of personal information is designated by title, not by name, as the statute requires. Absent a written delegation, this role is held by GDBI’s most senior officer. You can reach the person in charge of the protection of personal information at the contact above. For GDPR purposes, GDBI acts as the data controller for personal data collected through this Site.
This Charter covers your use of globaldataandbi.com: browsing the Site, submitting a contact, sales, or partnership enquiry, requesting a gated resource, subscribing to or unsubscribing from follow-up email, and, at a summary level only, submitting a job application (job applicants are covered in full detail by Our separate Global Recruiting Privacy Policy). It does not cover websites We link to, which We do not control, the Noème.AI product suite once a customer is using it in production, which is governed by that product’s own terms and privacy documentation, or any offline interactions with GDBI not initiated through this Site.
2. Purpose of processing, legal basis, and retention period
This table sets out, for each purpose We process personal data for, the categories of data involved, the legal basis We rely on, and how long We keep it. Where the legal basis is consent, that consent is given through the checkbox on the relevant form; you may withdraw it at any time (section 8).
| Purpose | Categories of personal data | Legal basis | Retention period |
|---|---|---|---|
| Respond to a contact, sales, or partnership enquiry, and evaluate fit for Our services | Name, work email, phone, company and role information, message content, and any details you volunteer in the form you use | Consent; contract or pre-contractual steps | As long as necessary to respond and follow up, subject to your right to withdraw consent or request deletion |
| Deliver a gated resource you requested (for example, a case studies summary) | Same as above, plus a record of when your download link was used | Consent | Same as above |
| Verify your email address and process unsubscribe requests | Email address; verification and unsubscribe status and timestamps | Legal obligation (CASL); legitimate interests | As long as necessary for the purpose, subject to legal retention requirements |
| Evaluate a job application (summary only, see the Global Recruiting Privacy Policy for full detail) | Identity and contact details, work history, resume text, and links you provide | Consent; contract or pre-contractual steps; legitimate interests | See the Global Recruiting Privacy Policy |
| Measure aggregate Site usage (analytics) | Pages viewed, navigation patterns, and general traffic data; see section 7 | Consent, given through the cookie banner | Until you withdraw consent; see section 7 |
| Protect the Site against abuse (bot detection, rate-limiting) | IP address, browser and device signals, submission patterns | Legitimate interests | A short, fixed window; not separately retained beyond that window |
When you submit a contact, sales, or partnership enquiry, We also derive a coarse privacy-region value from your submitted country and region, used only to route which regional privacy rules apply to your record internally, and not used for marketing targeting.
3. Legal frameworks that apply to you
Depending on where you are located, one or more of the following frameworks governs how We process your personal information, in addition to the purposes and legal bases set out above.
3.1 PIPEDA (Canada)
PIPEDA’s organizing principle is meaningful, purpose-limited consent, not a menu of alternative legal bases. We collect, use, and disclose your personal information only for purposes a reasonable person would consider appropriate in the circumstances, We identify those purposes at or before collection, and We obtain your consent, express, via the consent checkbox on Our forms, or in narrower cases implied by the context of an existing relationship, before using your data for a new purpose.
3.2 Quebec’s Law 25
Law 25 operates on top of PIPEDA’s consent framework for Quebec residents. It additionally requires clear, specific, and separately identifiable consent for sensitive information; a documented privacy impact assessment before transferring personal information outside Quebec where the transfer could not adequately protect it; the ability to request that GDBI cease disseminating certain information about you or de-index it in specified circumstances; and, where automated decision-making is used to render a decision based exclusively on automated processing, a right to be informed of that fact and, on request, of the personal information used and the reasons and main factors behind the decision. GDBI does not use automated decision-making to make decisions about general website visitors or leads.
3.3 The GDPR
For visitors and leads in the EEA, UK, or Switzerland, and in connection with Noème.AI’s deployment in France, We rely on the following Article 6 grounds:
- Consent, for submitting a contact or partnership form and for receiving follow-up marketing email, both of which require the consent checkbox described in section 2, and which you may withdraw at any time (section 8).
- Contract or pre-contractual steps, where you contact us to evaluate or negotiate Our consulting services, processing your enquiry is necessary to take steps you requested before any contract is signed.
- Legitimate interests, for the anti-abuse, bot-detection, rate-limiting, and server-log processing described above, where Our interest in keeping the Site’s forms and email delivery functioning for everyone is not overridden by your rights.
- Legal obligation, where We must retain or disclose data to comply with Canadian or EU law (for example, tax, anti-spam, or law-enforcement requirements).
4. Recipients of the data
We use a small number of trusted service providers to run this Site, each of whom processes your data solely on Our instructions and only for the purposes described in this Charter. This table is updated whenever the categories in use change.
| Recipient category | What they do |
|---|---|
| Website hosting provider | Hosts the Site and builds and serves all pages, and records standard server logs, including your IP address, for security and reliability |
| Secure data storage system | Stores form submissions, including general enquiries, partnership and contact-sales details, and job applications |
| Email delivery system | Operated on infrastructure We control; sends verification, confirmation, and follow-up email |
| Automated bot-detection service | Distinguishes human submissions from automated or bot traffic on Our public forms |
| Temporary rate-limiting system | Limits how often the same visitor can submit certain forms, to prevent abuse |
| Google Analytics, delivered through Google Tag Manager | Measures aggregate Site usage; runs only where you have given cookie consent, see section 7 |
We do not sell personal information, and We do not share it with advertisers, data brokers, or any party for their own independent marketing purposes. We may disclose personal information where required by law, for example, in response to a valid court order, government request, or legal process, without further consent, and only to the extent that disclosure is legally required. If GDBI’s business is sold or restructured, personal information may transfer to the acquiring or restructured entity, which would be bound by this Charter, or a successor policy you are notified of, for the information it receives.
Beyond the categories listed above, We do not use, and this Site does not integrate with, any advertising or behavioural-remarketing third party. There is no payment processor and no user-account system on this Site, and We do not collect payment or credit or debit card information anywhere on it.
5. Data transfers
Because Our service providers operate internationally, your data may be processed outside of Canada, and outside of Quebec, the EEA, the UK, or Switzerland if you are located there. For transfers out of Quebec, Law 25 requires a privacy impact assessment confirming the destination offers adequate protection, taking into account contractual safeguards, before the transfer occurs. For transfers out of the EEA, UK, or Switzerland under the GDPR, We rely on appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission and data processing agreements with each service provider.
6. Data security and confidentiality
We use technical and organizational measures appropriate to the sensitivity of the data described in this Charter, including the anti-bot and rate-limiting controls described above, encrypted transport (HTTPS) for the Site and its forms, and access controls limiting who at GDBI and Our service providers can see submitted data. No method of transmission or storage is completely secure, and We cannot guarantee absolute security.
7. Cookies and trackers management
The Site stores exactly one item locally in your browser without asking for consent (not a cookie): your preferred language for job postings. That value is never transmitted to GDBI or to any third party, and you can clear it at any time through your browser’s settings.
We only enable non-essential cookies and trackers, such as analytics, once you have given your consent through the banner shown on your first visit. Cookies that are strictly necessary to provide a feature you have actively requested, such as submitting a form, do not require separate consent.
| Category | Name | Purpose | Provider | Retention |
|---|---|---|---|---|
| Necessary | cf_clearance | Proof that the Site’s bot-detection challenge has been passed, so you are not re-challenged; required to submit a form | Cloudflare | 30 minutes |
| Necessary | _cfuvid | Distinguishes visitors sharing the same IP address, for the same bot-detection purpose | Cloudflare | Session |
| Analytics (requires your consent) | Google Analytics (_ga, _ga_*) | Measures aggregate Site usage: pages viewed, navigation patterns, and traffic sources. Not used for advertising or remarketing | As configured in Google Analytics |
How to manage your consent. Analytics is off by default for every visitor. Click the “Cookies” tab in the corner of any page to open Our preference center, where you can review each category, including which cookies it actually sets, and turn Analytics on or off. You can change your choice at any time, using the same tab or the “Cookie preferences” link in the Site’s footer.
8. Your rights
You may:
- Withdraw consent or unsubscribe from email at any time, using the link in any email We send you, via the unsubscribe page on the Site, or by contacting us using the details in section 12. Unsubscribe requests are processed promptly and are not gated behind a bot check.
- Request access to the personal information We hold about you.
- Request correction of inaccurate or incomplete information.
- Request deletion of your information, subject to Our legal retention obligations.
- Object to, or request restriction of, processing based on legitimate interests.
Additional rights apply depending on where you are:
- Quebec residents additionally have the right to data portability and the automated-decision-making disclosure right described in section 3.2, and may complain to the Commission d’accès à l’information du Québec (CAI) if dissatisfied with Our response.
- EEA, UK, or Swiss residents additionally have the GDPR rights of data portability and the right to lodge a complaint with their local supervisory authority (for example, in France, the CNIL) in addition to or instead of contacting us directly.
To exercise any of these rights, contact us using the details in section 12. We will respond within the time limits required by the applicable law, generally 30 days under Law 25 and PIPEDA, one month, extendable, under the GDPR, and may need to verify your identity first.
9. Automated decision-making
We do not use automated processing to make decisions about general website visitors or leads that would produce legal or similarly significant effects. If this changes, We will update this section, and, for applicants, the Global Recruiting Privacy Policy, before it takes effect.
10. Children’s privacy
This Site is directed at businesses and professionals, not children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us using the details below and We will delete it.
11. Changes to this Charter
We may update this Charter from time to time, including when Our service providers, data flows, or applicable law change. We will post the revised Charter on this page with an updated “Last updated” date, and where a change is significant We will provide more prominent notice, such as a banner on the Site.
12. Contact
For any question about this Charter or to exercise your rights, contact Our privacy officer at data-protection@globaldataandbi.com or by mail at 371 Front Street W, Unit D1, Toronto, ON, M5V 3R8.