Privacy

Privacy Policy

This policy explains what we collect, why we collect it, and what you can ask us to do about it. It applies to gwizweb.com and to the client and tenant portals we host.

What we collect

• Details you give us. Name, email address, company, role and anything you write in a form when you request an audit, a scope consultation, or support.
• Account information. Email address, name and role for people signed in to a portal.
• Payment information. Handled by Stripe. We receive a confirmation and the plan purchased. We never see or store your full card number.
• Technical information. IP address, browser type and pages requested, kept in server logs for security and troubleshooting.

Why we use it

• To answer your enquiry and prepare a quote.
• To provide, host and support the services you buy.
• To take payment and meet accounting and tax obligations.
• To keep the service secure and investigate misuse.

Where the law requires a legal basis, we rely on performing our contract with you, our legitimate interest in running and securing the service, your consent for optional cookies, and compliance with legal obligations.

Who we share it with

We use a small number of processors, each handling only what their function requires:

• Google Cloud — hosting, storage and databases.
• Stripe — payment processing.
• SendGrid — sending notification and transactional email.

We do not sell or share your personal information for behavioural advertising.

Cookies

Essential cookies keep you signed in and protect checkout; these cannot be switched off. Analytics and marketing cookies are optional and off until you turn them on. If your browser sends a Do Not Track or Global Privacy Control signal, we treat that as declining the optional categories and record that decision.

Change your cookie settings

How long we keep it

• Enquiries and consultation requests: 24 months from last contact.
• Customer and billing records: 7 years, to meet tax and accounting rules.
• Server logs: 90 days.

Your rights

Depending on where you live, you may have the right to see the information we hold, correct it, delete it, take a copy elsewhere, object to certain uses, or withdraw consent. Residents of the EU and UK have these rights under the GDPR, residents of Canada under PIPEDA, and residents of California under the CCPA as amended by the CPRA, including the right not to be discriminated against for exercising them.

Use the request form below, or email info@gwizweb.com. We respond within 30 days.

Where your data is stored

Most of our infrastructure runs in Google Cloud's us-central1 region. The assessment and claim intake paths — the ones carrying claimant-identifying and clinical material, and the ones PIPEDA and SABS workflows touch — are stored in northamerica-northeast2 (Toronto). The platform as a whole is not Canadian-resident, and we do not claim it is: two of eleven stores are in Canada and the rest are in United States regions.

The store-by-store table, and what it would take to move a store to a Canadian region, are set out in Data residency & tenant isolation in our Governance & Architecture statement. That page is the authority on this and is re-checked against the live infrastructure rather than carried forward. Where a residency obligation applies to you, raise it before signing so it is scoped as part of the engagement.

If you are outside the region your data is stored in, it is transferred there and protected by the standard contractual clauses our providers operate under.

Data Subject Rights (DSAR)

You can ask for a copy of your information, ask us to correct or delete it, or opt out of sale and sharing. We verify who you are before acting, and we reply within 30 days. Requests go to info@gwizweb.com.