Privacy Policy

Knect ("Knect", "we", "us") provides dynamic QR codes, digital business cards, wallet passes and scan analytics at https://link.cpxs.ca. We act as the organization responsible for personal information under PIPEDA. For personal information that our customers publish on their own business cards, the customer is the responsible organization and Knect processes that information on their behalf.

• Account information: name, email address, password credentials, workspace and organization details.
• Business card content: the contact details you choose to publish, such as name, job title, company, phone numbers, email addresses, website, social profiles, photos and logos.
• Scan and usage analytics: the QR code or card scanned, timestamp, coarse device type, operating system family and browser family. We do not store GPS location and we do not retain raw IP addresses for analytics purposes.
• Contact exchange submissions: details a visitor voluntarily submits to share their own contact information back with a cardholder.
• Technical and security logs: limited request logs used to secure the service, detect abuse and diagnose errors.

We identify the purposes for collection at or before the time of collection, as required by PIPEDA Principle 2. We use personal information to:

• create and administer your account and workspace;
• publish and serve your digital business card and permanent QR resolver links;
• generate vCards and Apple/Google Wallet passes at your request;
• produce aggregate engagement analytics for the cardholder;
• provide customer support and send service-related notices;
• protect the service against fraud, abuse and security incidents; and
• meet legal, regulatory and accounting obligations.

We do not sell personal information, and we do not use your card content for advertising or for training third-party AI models.

We rely on your consent to collect, use and disclose personal information, except where collection, use or disclosure without consent is permitted or required by law. Express consent is obtained for sensitive information and for commercial electronic messages under Canada's Anti-Spam Legislation (CASL). Implied consent may apply to information that is obviously necessary to deliver a service you requested. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice — see our Consent page.

Personal information published on a business card is, by design, publicly accessible to anyone with the card link or QR code. Beyond that, we disclose personal information only to service providers who process it on our behalf under contract (cloud hosting and database, authentication, email delivery, wallet pass issuance), or where disclosure is required by Canadian law, a court order or lawful authority.

Our infrastructure providers may store or process data in Canada, the United States or other jurisdictions. Where information is processed outside Canada it may be accessible to foreign courts, law enforcement and national security authorities under the laws of that jurisdiction. We use contractual and technical safeguards to provide a comparable level of protection.

We protect personal information with security appropriate to its sensitivity: encryption in transit, row-level access controls that isolate each customer's workspace at the database layer, role-based administrative access, and least-privilege credentials for server functions. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

We keep personal information only as long as necessary to fulfill the purposes above or to meet legal requirements, after which it is deleted or de-identified. Analytics events are retained in aggregate form. You can correct or update your card content at any time in your workspace, and you may ask us to correct inaccurate account information.

• access the personal information we hold about you and be told how it has been used and to whom it has been disclosed;
• request correction of inaccurate or incomplete information;
• withdraw consent or request deletion of your account and card content;
• request portability of information you provided, where applicable; and
• complain to a supervisory authority.

We respond to access requests within 30 days as required by PIPEDA. Quebec residents also have rights of de-indexing and to be informed about automated decision-making under Law 25; Knect does not make automated decisions producing legal effects about individuals.

If a breach of security safeguards creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada, notify affected individuals as soon as feasible, and maintain records of breaches as required by PIPEDA.

Knect is a business tool intended for individuals 16 years of age or older. We do not knowingly collect personal information from children.

To exercise your rights or raise a privacy concern, contact our Privacy Officer at privacy@cpxs.ca. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca, or your provincial privacy regulator.