Privacy Policy

INTRODUCTION

Iterating Inc. is the owner of the domain names “epanetjs.com”, “masteringwater.com”, and “iterating.ca”, as well as the applications and associated educational content it makes available to its Users (hereinafter, the “Websites and Services”) for the purpose of offering its products, services, and educational content.

This Privacy Policy forms an integral part of the Terms and Conditions of use of our Websites and Services and will apply to the processing of personal data of the Users of our Websites and services, including both data provided directly by Users and data that may be collected automatically or provided by third parties during the provision of any service and/or in the development of a contractual relationship with us.

Your privacy matters to us, and we are committed to protecting your information in Canada, the European Union, and any other jurisdiction where we operate. Our Privacy Policy describes how Iterating Inc. collects such data, complying with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), as well as in compliance with any other applicable data protection regulations, ensuring a high standard of protection for all our users globally.

Access, use, and maintenance of our Websites and Services imply the processing of personal information of its Users in accordance with the purposes contained and duly informed in this policy. Browse or using our Websites, as well as their services and functionalities, implies full and unreserved acceptance by the User of the content of this Privacy Policy and the Terms and Conditions.

You should read our policy carefully to ensure you fully understand it. We recommend that you consult the Policy frequently for any updates or changes it may contain.

In case you have any questions, you can contact us directly at the postal address and email provided in the section “WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?”. If you do not agree with our policies, please leave our Websites and do not use our services.

WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?

Iterating Inc. (hereinafter, “Iterating”), with its registered office at 2967 Dundas St W #536, Toronto, Ontario, M6P 1Z2, Canada, is the Data Controller of your personal data, which will be processed in accordance with the parameters set forth in this policy.

All comments, queries, and requests regarding our use of your information should be addressed to the email address support@iterating.ca.

WHAT ARE THE DETAILS OF THE PROCESSING OF YOUR DATA?

We collect and process the information that the User provides us or to which we have access during navigation on our Websites and through the use of the services provided through them, under the terms established in this Privacy Policy.

Below, you will find more details about the processing of such data, classified by purpose:

Data linked to the user:

Providing access and user account management (Login/Registration):

• Data processed: email, first name, and last name.
• Method of obtaining: Directly from the user when they complete the registration form directly from our Platform or when they do so through our links, integrated with third-party services such as Google or Microsoft, or by an email to which we send a code to log in (Clerk).
• Legal bases: Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Retention periods: The time necessary to fulfill the purpose for which the data were collected (as long as the user maintains their account active and is a user of our services), and to comply with our legal obligations, unless the user revokes consent, requests erasure, restricts processing, portability, or objects to processing, except for those that need to be retained for a longer period as required by law.
• Data communication: We delegate the storage and handling of user data to Clerk.
• International transfers: The company is located in Canada, which is a country recognized by the EU as an adequate and safe country for protection. When using Clerk, data may be transferred to jurisdictions outside the EU. We ensure that adequate data transfer mechanisms (such as EU Standard Contractual Clauses) are in place with our providers, thus guaranteeing data protection regardless of their location.

Provision of contracted services (Payments and Subscriptions):

• Data processed: identifying data (first name and last name), contact data (email), payment data.
• Method of obtaining: Directly from the User.
• Legal bases: Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Retention period: The time necessary to fulfill the purpose for which the data were collected (as long as the user maintains their active subscription), and to comply with our legal obligations, unless the User revokes consent, requests erasure, restricts processing, portability, or objects to processing, except for those that need to be retained for a longer period as required by law.
• Data communication: We use Stripe for payments and subscriptions. The Stripe platform is an external payment platform. We do not manage or process credit card or bank account data, only those necessary to know if the user has paid the fee, which do not include the aforementioned data.

Sending commercial information and news (Newsletter):

• Data processed: users’ phone number, name, and email.
• Method of obtaining: Directly from the User when they provide their data through the forms enabled for subscription (KIT).
• Legal bases: Express consent of the data subject.
• Retention period: As long as the User is subscribed to this news service, unless they revoke their consent. After its termination, data will be kept for the legally foreseen periods.
• Data communication: We use KIT to send updates and notifications.
• International transfers: No data transfers to third countries are foreseen.

Communication with the user (Support and Contact):

• Data processed: identifying data (first name and last name), contact data (email and phone number) and any other information the User wishes to provide verbally or in writing, as there are free text boxes in the different spaces, establishing a communication channel through which the User can include any type of personal data they deem appropriate in their message.
• Method of obtaining: Directly from the User when they complete contact forms or contact via email or through our support channels.
• Legal bases: Performance of a contract to which the data subject is party or for the application of contractual measures at their request (to manage their request or query).
• Retention period: As long as necessary to process and respond to the query. After its completion, data will be kept for the legally foreseen periods to comply with legal obligations.
• Data communication: Data may be communicated to third-party support or communication service providers if necessary to manage the query.
• International transfers: No data transfers to third countries are foreseen.

Data not directly linked to the user:

Website/Application usage and functionality analysis (PostHog):

• Data processed: traffic and Browse data, user actions within the application.
• Method of obtaining: Through Browse and using the application.
• Legal bases: Legitimate interest (to improve the application and make better decisions about functionalities and improvements). If non-essential cookies are used, User consent will be required.
• Retention period: Defined according to PostHog configuration, no more than 18 months.
• Data communication: Data is processed by PostHog.
• International transfers: When using PostHog, data may be transferred to jurisdictions outside the EU. We ensure that adequate data transfer mechanisms (such as EU Standard Contractual Clauses) are in place with our providers. Options for cookieless tracking are explored to minimise privacy impact.

COMMUNICATIONS

Iterating Inc. may share information about platform activity, as well as about users who interact on it, always previously anonymised, so that it cannot reasonably be used to identify you. For example, we may share raw data or aggregated user statistics to describe our business to partners, the public, or for third-party collaborators of Iterating to analyse such anonymised and fully disassociated information to detect problems, trends, and help us improve our services.

HOW DO WE PROTECT YOUR DATA?

Iterating Inc. informs you that it has taken reasonable technical and organizational measures to prevent the loss, misuse, alteration, or unlawful disclosure of your data. Any third party, agent, or representative of Iterating Inc. who needs to access your information will also be required to implement reasonable technical and organizational measures for the protection of your information.

However, our Websites may contain links to third-party websites. If you choose to click on these third-party links, you will be redirected to the website of such third parties. Please note that these websites are governed by their own policies, so we recommend that you review their terms and conditions, privacy policy, and cookie policy before using such services. We cannot be held responsible for the use and access to such third-party websites or for the information or content made available by such third-party sites. The presence of third-party links on our website does not indicate that the company endorses or recommends such third parties. Access to or use of these sites is solely at the user’s own risk.

WHAT ARE YOUR RIGHTS REGARDING YOUR DATA?

As a data subject, the User has the right to exercise the following rights, which we guarantee to all our users, regardless of their geographical location:

• Access to your data.
• Rectification of your data, because we also want to ensure that your information is accurate and up to date.
• Restriction of the processing of data concerning you.
• Objection to the processing of your data, when the legal basis for processing is our legitimate interest.
• Withdrawal of your consent for data processing (when consent was the legal basis).
• Portability of your data, when the legal basis for data processing was your consent or the performance of a contract.
• Not to be subject to automated individual decision-making.

To exercise the aforementioned rights, data subjects must contact Iterating Inc. via the email address indicated at the beginning of this Policy (support@iterating.ca). For security reasons, we may additionally request a copy of an equivalent identification document for identity verification purposes, in accordance with the legally established minimum content.

We will process your request as soon as possible, always within the margins and deadlines stipulated by the GDPR and the applicable current legislation at the time of such request, guaranteeing a response to all our users under the highest privacy standards.

Furthermore, the User has the right to lodge a complaint with the competent data protection authority if they have doubts or are not satisfied with the exercise of their rights.