Privacy Policy

1. Introduction & Controller Identity

Canadian Professional Academy is an online professional education provider serving learners across Canada. The website and related educational support processes are operated by Pigije Holding B.V. This Privacy Policy explains what personal data we collect, why we collect it, how long we keep it, and what rights you have under applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (GDPR).

Data Controller (GDPR terminology) for the processing described in this policy is:

• Legal entity: Pigije Holding B.V.
• Registered address: Ridderhof 9, 4461 TZ Goes, Netherlands
• Contact email: [email protected]
• Telephone: +31 113 227 941

We do not currently appoint a Data Protection Officer (DPO) because we do not conduct large-scale processing of special-category personal data. If this changes, we will update this policy.

2. Personal Data We Collect

The personal data we collect depends on how you interact with the website. We collect information you provide directly and information generated automatically by your browser or device when you access the site.

2.1 Data you provide

• Identity and contact details: name, email address, phone number.
• Program selection details: selected program, preferred workshop topic (if provided).
• Message content: any comments or context you submit in a form (for example, learning goals, timeline, or questions).

2.2 Data collected automatically

• Technical identifiers: IP address, browser type, device type, operating system, language settings.
• Usage information: pages visited, time spent, navigation paths, referring page, and interactions with content.
• Cookies and similar identifiers: including essential cookies for site functionality and consent management, and (only if you consent) analytics and marketing identifiers.
• Conversion events: basic events such as form submissions and landing page views, when measurement is enabled based on your consent.

2.3 Data we do not intentionally collect

We do not ask for or intentionally collect special-category personal data (such as health data, biometric data, political opinions, or religious beliefs), financial account information, or government-issued identification numbers. Please do not submit such information through our forms.

3. Why We Process Your Data & Legal Bases (GDPR Article 6)

We process personal data only when we have a lawful basis. The lawful basis depends on the purpose of the processing:

Automated decision-making

We do not engage in automated decision-making or profiling that produces legal effects or similarly significant effects (GDPR Article 22).

4. Cookies & Tracking

We use cookies and similar technologies to run the site, remember your preferences, and (only with consent) to measure and improve marketing and analytics. Cookies are small text files stored in your browser. Some cookies are first-party (set by us) and some are third-party (set by providers such as Google or Meta when enabled).

4.1 Cookie categories

• Essential cookies (always active): required for site functionality and consent storage. Examples include _site_session and cookie_consent. Retention: session to 12 months depending on the cookie.
• Analytics cookies (consent required): used to understand website usage. When enabled, we may use Google Analytics 4 with IP anonymization. Examples: _ga (2 years) and _ga_XXXXXXXXXX (2 years). Data retention setting: 14 months.
• Marketing cookies (consent required): used for advertising measurement, remarketing, and audience building. Examples include _gcl_au (Google Ads, 90 days), _fbp (Meta, 90 days), and _fbc (Meta, 90 days when click ID is present).

4.2 Beyond cookies

When enabled by consent, measurement may also involve pixel tags and similar scripts (for example, Google tags and Meta Pixel). In some configurations, conversion data may also be transmitted server-side (for example, through Meta Conversion API or server-side tag management). Where used, identifiers may include cookie values, IP address, and user-agent information. If server-side integrations include hashing, identifiers are typically transformed before transmission.

For details about cookies, please also read our Cookie Policy.

5. Consent (EEA/UK)

Users in the European Economic Area and the United Kingdom receive a consent notice under GDPR/UK GDPR. Analytics and marketing cookies activate only after explicit, informed, freely given consent (GDPR Article 6(1)(a)). Your choice is recorded in the cookie_consent cookie (typically 12 months).

You may withdraw consent at any time by using the “Manage cookie preferences” link in the footer or by clearing cookies in your browser. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

6. Sharing With Advertising & Service Partners

We use service providers to operate and secure the website, and (only with consent) to measure analytics and marketing performance. We do not sell personal data. Depending on your cookie preferences and interactions, we may share limited data with the following categories of partners:

• Google LLC (Google Analytics 4, Google Ads measurement/remarketing, tag management): cookie identifiers, usage data, conversions, and remarketing list membership. Privacy information: https://policies.google.com/privacy
• Meta Platforms (Pixel, Custom/Lookalike Audiences, Conversion API when enabled): page views, conversions, audience membership, and identifiers (including hashed identifiers where configured). Privacy information: https://www.facebook.com/privacy/policy
• Cloudflare (content delivery network and security controls): IP-based threat detection and traffic protection. Privacy information: https://www.cloudflare.com/privacypolicy/

We do not permit these providers to use site data for their own independent commercial purposes beyond providing services to us, subject to their applicable terms and configurations.

7. International Transfers

Pigije Holding B.V. is based in the Netherlands. Some of our service providers may process data outside the European Economic Area, including in the United States (for example, Google and Meta). Where international transfers occur, we rely on appropriate safeguards such as:

• EU-US Data Privacy Framework (where applicable) and related extensions.
• Standard Contractual Clauses (EU 2021/914) as a fallback safeguard.
• Additional technical and organizational measures where needed.

8. Data Retention

We keep personal data only as long as necessary for the purposes described in this policy:

• Contact and registration submissions: up to 2 years from the last meaningful interaction, unless a longer period is required to handle disputes or legal obligations.
• Analytics data: typically 14 months (when enabled by consent), subject to the provider configuration.
• Marketing cookies: per cookie lifetime (for example, 90 days) when enabled by consent.
• Email correspondence: relationship duration plus 1 year, unless we must retain it longer for legal reasons.
• Server and security logs: typically 90 days, unless extended for incident investigation.
• Cookie consent record: up to 3 years for audit purposes.
• Legal and tax obligations: as required under applicable law (often 6–10 years for certain records).

9. Your Rights (GDPR & UK GDPR)

If you are in the EU/EEA or the UK, you have the following rights, subject to conditions and exceptions in applicable law:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Right to withdraw consent at any time (Article 7(3))
• Right to lodge a complaint with a supervisory authority (Article 77)

To exercise your rights, email us at [email protected]. We typically respond within 30 days. For complex requests, this period may be extended by up to 60 additional days.

If you would like to contact a supervisory authority, you can start with the European Data Protection Board directory: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

10. Children

This website is not directed at individuals under 16. We do not knowingly collect personal data from minors. If we learn that we have collected personal data from a child under 16 without verifiable parental consent, we will delete it promptly.

11. Do Not Track

This website does not respond to “Do Not Track” (DNT) browser signals. Some third-party providers may have their own handling of DNT or similar mechanisms.

12. Data Deletion Requests

You may request deletion of your personal data by emailing [email protected] with the subject line “Data Deletion Request”. We may ask for reasonable information to verify your identity before completing the request. Where we must keep certain records to comply with legal obligations, we will restrict processing and retain only what is necessary.

13. Business Transfers

If Pigije Holding B.V. is involved in a merger, acquisition, asset sale, financing, insolvency, or similar transaction, personal data may be transferred to a successor entity as part of that transaction. If such a transfer materially changes how personal data is used, we will provide notice on the website.

14. California (CCPA / CPRA)

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). For the last 12 months, the categories of personal information that may be collected or disclosed include:

• Identifiers: name, email, IP address, cookie IDs (shared with service providers and, with consent, advertising partners).
• Internet or network activity: page views and interactions (used for analytics and advertising measurement when enabled).
• Inferences: preferences or interests derived from browsing activity (used by advertising partners when marketing cookies are enabled).

We do not sell personal information as defined by the CCPA. We may share data for cross-context behavioral advertising when marketing cookies are enabled; California residents may opt out through our cookie preferences panel.

You may submit a request to know, delete, or correct by emailing [email protected] with the subject “California Privacy Request”. We may need to verify your identity. Authorized agents may submit requests with written proof of authorization.

15. Virginia (VCDPA)

If you are a Virginia resident, you may have rights under the Virginia Consumer Data Protection Act (VCDPA), including access, correction, deletion, portability, and the right to opt out of targeted advertising. Submit requests by emailing [email protected] with the subject “Virginia Privacy Request”.

We do not sell personal data or engage in profiling that produces legal or similarly significant effects. If we decline a request, you may appeal by emailing with the subject “Appeal of Refusal — Privacy Request”. We will respond within 60 days.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject “Nevada Do Not Sell Request”. We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice on the homepage at least 14 days before the change takes effect. The “Last Updated” date at the top of this page reflects the most recent version.

18. Contact

For privacy questions or requests, contact:

• Pigije Holding B.V.
• Ridderhof 9, 4461 TZ Goes, Netherlands
• Email: [email protected]
• Phone: +31 113 227 941