Privacy Policy

Effective Date: November 3 2025 Last Updated: April 1 2026

1. Introduction

Output (“Output,” “we,” “us,” or “our”) operates the website located at output.systems (the “Website”) and provides business consulting and intelligent systems development services (the “Services”). Output is operated by 14305124 Canada Inc, a corporation organized under the laws of Canada with its principal place of business in Toronto, Ontario, Canada.

This Privacy Policy describes how Output collects, uses, discloses, retains, and protects personal information when you visit the Website, communicate with us, or engage our Services. It also describes your rights with respect to your personal information and how to exercise those rights.

This Privacy Policy is intended to comply with:

The Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”);
Applicable provincial privacy legislation in Canada, including Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (Law 25);
The General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) and the United Kingdom General Data Protection Regulation (“UK GDPR”);
The California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”); and
Other applicable data protection and privacy laws.

By accessing the Website or engaging our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Policy, you must not use the Website or our Services.

2. Data Controller and Contact Information

For the purposes of GDPR and UK GDPR, Output is the data controller of personal information collected through the Website and Services.

For all privacy-related inquiries, requests, or complaints, please contact:

Privacy Officer: Curtis Grier-Coward
Email: curtis@output.systems
Mailing Address:
375 University ave Suite 3267
Toronto Ontario Canada
M5G2J5

We will respond to all inquiries within thirty (30) days, or such shorter period as required by applicable law.

3. Information We Collect

We collect personal information through the following means:

3.1 Information You Provide Directly

When you contact us, request a free assessment, subscribe to communications, complete forms on the Website, or engage our Services, we may collect:

Full name;
Email address;
Telephone number;
Business name and role;
Industry and business size;
Information about your business operations relevant to the Services requested;
Communication preferences;
Any other information you voluntarily provide.

3.2 Information Collected Automatically

When you visit the Website, we may automatically collect:

IP address;
Browser type and version;
Operating system;
Device identifiers;
Pages visited and time spent on each page;
Referring URL;
Date and time of access;
Geolocation data (general, derived from IP address);
Cookies, pixel tags, web beacons, and similar tracking technologies (see Section 7).

3.3 Information from Third Parties

We may receive personal information from third-party sources, including:

Analytics providers (e.g., Google Analytics);
Marketing platforms;
Customer relationship management systems;
Publicly available business directories;
Social media platforms when you engage with our content.

3.4 Sensitive Personal Information

We do not knowingly collect sensitive personal information (such as government identification numbers, financial account credentials, health information, biometric data, racial or ethnic origin, religious beliefs, or sexual orientation). If sensitive personal information is provided to us inadvertently, we will take reasonable steps to delete it.

3.5 Image Uploads

If you upload images or other media to the Website (for example, in connection with engagement materials or assessment forms), please be aware that images may contain embedded location data (EXIF GPS) or other metadata. We recommend removing such metadata before upload if you wish to keep that information private. We do not extract or process embedded metadata from uploaded images for any purpose other than displaying or processing the image as required to deliver the Services.

4. Legal Bases for Processing (GDPR / UK GDPR)

For individuals located in the European Economic Area, the United Kingdom, or Switzerland, we process personal information on the following legal bases:

Consent: Where you have given clear, informed, and revocable consent to specific processing activities.
Contract: Where processing is necessary to perform a contract with you or to take steps at your request prior to entering into a contract.
Legitimate Interests: Where processing is necessary for our legitimate business interests (such as improving our Services, marketing, fraud prevention, and network security), provided those interests are not overridden by your fundamental rights and freedoms.
Legal Obligation: Where processing is necessary to comply with a legal obligation under Canadian, EU, UK, or other applicable law.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

5. How We Use Personal Information

We use personal information for the following purposes:

To respond to your inquiries and provide requested information;
To deliver, manage, and improve our Services;
To process transactions and manage client engagements;
To send communications relating to the Services, including assessments, proposals, and follow-ups;
To send marketing communications, where you have consented or where permitted by law;
To analyze Website usage, performance, and user behaviour;
To prevent fraud, secure our systems, and ensure the integrity of the Website and Services;
To comply with legal and regulatory obligations;
To enforce our terms of service and protect our legal rights;
For any other purpose disclosed at the time of collection or with your consent.

We do not use personal information for automated decision-making or profiling that produces legal effects or similarly significant effects on individuals without explicit consent.

6. Disclosure of Personal Information

We do not sell personal information. We may disclose personal information only in the following circumstances:

6.1 Service Providers

We may share personal information with third-party service providers who perform services on our behalf, including:

Cloud hosting and infrastructure providers;
Email and communication platforms;
Customer relationship management providers;
Analytics providers;
Payment processors;
Spam detection and security services;
Professional advisors (legal, accounting, insurance);
Marketing and advertising platforms.

All service providers are bound by contractual obligations to protect personal information and use it only for the purposes for which it was disclosed.

6.2 Legal Requirements

We may disclose personal information when required by law, regulation, legal process, or governmental request, or where we believe in good faith that disclosure is necessary to:

Comply with a legal obligation;
Protect and defend our rights or property;
Prevent or investigate possible wrongdoing in connection with the Services;
Protect the personal safety of users or the public;
Protect against legal liability.

6.3 Business Transfers

If Output is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, personal information may be transferred as part of that transaction, subject to standard confidentiality protections.

6.4 With Your Consent

We may disclose personal information for any other purpose with your explicit consent.

7. Cookies and Tracking Technologies

The Website uses cookies and similar tracking technologies to enhance functionality, analyze usage, and deliver relevant content.

Types of cookies used:

Strictly necessary cookies: Required for the Website to function. Cannot be disabled.
Analytics cookies: Used to understand Website usage. Subject to your consent.
Marketing cookies: Used to deliver relevant advertising. Subject to your consent.

You may manage cookie preferences through the Website’s cookie consent tool or your browser settings. Disabling cookies may impair Website functionality.

For users in jurisdictions requiring prior consent (including the EU, UK, and similar regions), non-essential cookies are not deployed until consent is given.

If a future version of the Website includes user accounts, comment functionality, or login features, additional cookies may be set in connection with those features. Any such cookies will be disclosed in an updated version of this Policy and will be subject to the same consent requirements.

8. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements.

Specific retention periods:

Inquiry data (no engagement): Up to 24 months.
Active client data: For the duration of the engagement plus 7 years (Canadian record-keeping requirements).
Marketing communications data: Until you unsubscribe or withdraw consent.
Website analytics data: Up to 26 months.
Legal records: As required by applicable law.

When personal information is no longer required, it will be securely deleted or anonymized.

9. International Data Transfers

Output is based in Canada. Personal information collected from individuals located outside Canada (including the EU, UK, and United States) may be transferred to, stored in, and processed in Canada and other jurisdictions where our service providers operate.

For transfers from the EU, UK, or Switzerland:

Canada has been recognized by the European Commission as providing an adequate level of data protection for commercial organizations subject to PIPEDA, pursuant to the Adequacy Decision of December 20, 2001.
For transfers to other jurisdictions, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission or equivalent mechanisms.

By using the Website or Services, you consent to the transfer of your personal information to Canada and other jurisdictions as described.

10. Data Security

We implement appropriate technical, administrative, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

Encryption of data in transit (TLS/SSL) and at rest where applicable;
Access controls and authentication;
Regular security assessments;
Staff confidentiality obligations;
Vendor due diligence and contractual safeguards;
Incident response procedures.

No method of transmission over the Internet or electronic storage is completely secure. While we strive to protect personal information, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify you and applicable regulatory authorities as required by law.

11. Your Rights

Subject to applicable law, you have the following rights with respect to your personal information:

11.1 Rights Available to All Users

Access: Request a copy of personal information we hold about you.
Correction: Request correction of inaccurate or incomplete personal information.
Deletion: Request deletion of personal information, subject to legal exceptions.
Withdrawal of consent: Withdraw consent to processing at any time, where processing is based on consent.
Complaint: File a complaint with a privacy regulator.

11.2 Additional Rights Under GDPR / UK GDPR

If you are located in the EU, UK, or Switzerland, you also have the right to:

Restriction of processing: Request that we limit processing in certain circumstances.
Data portability: Receive personal information in a structured, machine-readable format and transmit it to another controller.
Object to processing: Object to processing based on legitimate interests or for direct marketing.
Not be subject to automated decision-making: Including profiling that produces legal or similarly significant effects.
Lodge a complaint: With your local data protection authority.

11.3 Additional Rights Under CCPA / CPRA (California Residents)

If you are a California resident, you have the right to:

Know what personal information is collected, used, shared, or sold;
Request deletion of personal information;
Correct inaccurate personal information;
Opt out of the sale or sharing of personal information (Output does not sell personal information);
Limit the use of sensitive personal information;
Non-discrimination for exercising your rights.

You may designate an authorized agent to make requests on your behalf.

11.4 How to Exercise Your Rights

To exercise any of these rights, contact us at the email address listed in Section 2. We will verify your identity before responding to substantive requests. We will respond within the timeframes required by applicable law (generally 30 days under PIPEDA and GDPR; 45 days under CCPA, extendable by 45 additional days where reasonably necessary).

There is no charge for most requests. We may charge a reasonable fee for manifestly unfounded, repetitive, or excessive requests.

12. Children’s Privacy

The Website and Services are not directed to children under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child without verified parental consent, we will delete it promptly. Parents or guardians who believe their child has provided personal information to us should contact us immediately.

13. Third-Party Links and Embedded Content

The Website may contain links to third-party websites, applications, and services. We are not responsible for the privacy practices or content of those third parties.

The Website may also include embedded content from external platforms (such as videos, social media posts, calendars, maps, scheduling widgets, or other interactive elements). Embedded content behaves as if you had visited the third-party website directly. These third parties may:

Collect data about you;
Set their own cookies;
Embed additional third-party tracking technologies;
Monitor your interaction with the embedded content, including (where applicable) if you are logged into an account on that third-party platform.

We encourage you to review the privacy policies of any third-party websites or platforms whose content appears on the Website.

14. Marketing Communications

We may send marketing communications where permitted by law and where required, with your consent. You may opt out at any time by:

Clicking the “unsubscribe” link in any marketing email;
Contacting us at the email address in Section 2;
Adjusting your communication preferences.

Opt-out applies to marketing communications only. We may continue to send transactional or service-related communications necessary to deliver the Services.

15. Do Not Track Signals

Some browsers transmit “Do Not Track” signals. Because no consistent industry standard for responding to Do Not Track signals has been established, the Website does not currently respond to such signals. We treat all users in accordance with this Privacy Policy and applicable consent mechanisms.

16. Automated Decision-Making

We do not engage in automated decision-making that produces legal or similarly significant effects on individuals without human oversight. If this changes, we will update this Privacy Policy and obtain consent where required.

17. Spam Detection and Form Security

To protect the Website and prevent abuse, forms and submissions on the Website may be checked through automated spam detection and security services. These services may process limited information, such as IP address, browser data, and submission contents, solely to identify and prevent spam, fraudulent submissions, and malicious activity. Information processed by these services is used only for security purposes and is not used for marketing or analytics.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The updated version will be posted on the Website with a revised “Last Updated” date. Material changes will be communicated through additional means, such as email notice or a prominent notice on the Website, where practicable.

Your continued use of the Website or Services after the effective date of any update constitutes acceptance of the revised Privacy Policy.

19. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict of laws principles. Any disputes arising from this Privacy Policy will be subject to the exclusive jurisdiction of the courts of the Province of Ontario, except where prohibited by applicable law in your jurisdiction.

For users in the EU, UK, or California, nothing in this Privacy Policy limits your right to bring a complaint or claim under the applicable mandatory provisions of your local data protection laws.

20. Regulatory Authorities

You have the right to lodge a complaint with the relevant supervisory authority:

Canada: Office of the Privacy Commissioner of Canada (priv.gc.ca)
Quebec: Commission d’accès à l’information du Québec (cai.gouv.qc.ca)
EU: Your local Data Protection Authority (list available at edpb.europa.eu)
UK: Information Commissioner’s Office (ico.org.uk)
California: California Privacy Protection Agency (cppa.ca.gov) and California Attorney General (oag.ca.gov/privacy)

21. Definitions

Sensitive personal information: Has the meaning given in applicable law.

Personal information: Any information about an identified or identifiable individual.

Processing: Any operation performed on personal information, including collection, use, disclosure, retention, and disposal.

Data controller / data processor: Have the meanings given in GDPR.