Privacy Policy

01. Who we are

4UIT Inc. (“4UIT,” “we,” “us”) is an Ottawa managed IT, cybersecurity and website company, federally incorporated in Canada, with its registered office at 5-2000 Thurston Drive, Ottawa, ON K1G 4K7. This policy covers personal information we handle when you visit this site, call or text us, email us, answer one of our Facebook or Instagram lead forms, become a client, or otherwise deal with us.

Our Privacy Officer — the person accountable for how we handle personal information, which PIPEDA and Quebec’s Law 25 both require us to designate — is Amanjot Singh (Founder), reachable at hello@4uit.ca or 1-833-721-4848.

02. What we collect

Only what we need for the purposes in section 04. Most of it comes from you directly.

• Contact details — name, email, phone and mailing address, when you fill in a form, answer a lead form, call, text or email us, request a quote or sign a contract.
• Business details — organization name, your role, business address and, if you tell us, how many people work there.
• What you tell us — your message, your answers to a lead form, and anything you attach.
• Communication records — emails, support tickets, text messages, call logs, voicemails and the transcripts our phone system makes of them, and our notes.
• Service-delivery information — for managed clients: device inventory, network configuration, user accounts, system logs and security alerts, only as needed to deliver the service.
• Billing information — billing contact, invoicing address and payment history. If you pay by card, the card is handled by the payment provider; we never see or store full card numbers.

Collected automatically: our hosting provider’s server logs (IP address, browser, device, pages requested), which keep the site running and stop abuse, and the IP address of anyone who sends our contact form, which we log to block repeated automated submissions. Only with your consent: Google Analytics, Microsoft Clarity and Google Ads, described in section 04 and in the Cookie Policy.

When we work on your systems

Managing a client’s computers, email or network means we can come across personal information that belongs to the client, its staff or its own customers — patient files at a clinic, for example. We access it only as far as the work needs, follow the client’s instructions and our agreement, and use it for nothing else. The client remains responsible for that information under its own privacy obligations.

We may also receive information from referrals, public business directories or partners — only with a legitimate business purpose and where the source has appropriate consent.

03. Facebook and Instagram lead forms

Some of our ads on Facebook and Instagram open a short form inside the app (Meta calls these lead ads with instant forms). The form asks for your name, phone number, email address and organization name, plus a few questions about what you need. Meta can pre-fill some answers from your profile; you can edit them before you submit, and nothing reaches us until you do.

• What we do with your answers — contact you about the request you made, by phone, text or email, and work out whether and how we can help. Nothing else unless you agree to more.
• How they reach us — Meta passes your answers to us through its lead tools and API. We copy them into our own systems (section 06), where they are handled like any other enquiry.
• Meta’s part — the form runs on Meta’s platform, so Meta also receives your answers and uses them under its own Privacy Policy — for example, to pre-fill future forms. Meta stores lead data on its servers in several countries. We do not control what Meta does with it; Meta’s Privacy Policy and your Facebook and Instagram settings govern that.
• No selling, no passing on — we never sell lead-form answers or give them to anyone else for their own use.

Sending a lead form does not add you to a mailing list, unless you tick the optional box asking for tips. Our ads and forms are not aimed at minors, and our forms do not ask for sensitive information such as health details.

04. What we use it for

• Answering enquiries — replying to forms, lead forms, calls, texts and emails, and preparing quotes.
• Service delivery — the managed IT, security, cloud, web and repair work we contracted to do.
• Support and account management — tickets, troubleshooting, billing, contracts, quarterly reviews.
• Marketing, only with consent — occasional service updates and industry notes; withdraw any time.
• Site analytics, only with consent — understanding which pages get used and where people get stuck, so we can fix them.
• Measuring our ads, only with consent — learning which ads lead to enquiries, so we know which ones are worth paying for.
• Legal compliance — tax, regulatory and lawful-disclosure obligations.

How we contact you

If you send us a request — through this site, a Facebook or Instagram lead form, a call, a text or an email — we will contact you about it by phone, text or email, using the details you gave us. Under Canada’s Anti-Spam Legislation (CASL), your enquiry lets us send you related commercial emails and texts for six months. After that we send them only if you have agreed to receive them or you have become a client (CASL allows up to two years after your last purchase or the end of your contract). Every commercial email or text identifies us and gives you a way to unsubscribe, and we act on unsubscribe requests within 10 business days, as CASL requires. Ask us to stop calling or texting and we stop.

Analytics and advertising on this site

None of this runs until you choose it on our cookie banner, and if your browser sends a Global Privacy Control signal we treat it as a no.

• Analytics — Google Analytics and Microsoft Clarity record page views, clicks, scrolling and device type. Clarity also records replays of visits, with anything you type into a form field masked. Google says Google Analytics 4 does not log or store IP addresses. Microsoft also uses Clarity data under its own privacy statement.
• Marketing — Google Ads tags tell us which ads lead to enquiries. If you send our contact form, Google’s tag may send Google a scrambled (hashed) copy of the email address and phone number you entered, so Google can match the enquiry to an ad click; Google says it uses this data to provide its measurement services to us and does not share it with other advertisers. Third-party vendors, including Google, use cookies to show our ads on other sites based on your past visits to this one. You can opt out at Google’s Ads Settings or the Network Advertising Initiative opt-out page.

“Accept all” turns on both; “Customise” lets you pick. Change your mind through “Cookie settings” in the footer, or by clearing this site’s cookies and site data in your browser. Every cookie is listed in the Cookie Policy.

AI-assisted tools

Some of the tools we use have AI features, and we use AI assistants to help run the business — for example, to sort and title support tickets and to help draft replies. These tools process the personal information involved, such as a name, a phone number or a message, on servers outside Canada, typically in the United States. They never contact you on their own: a person at 4UIT reviews anything they draft before it is sent. We do not make decisions about you based solely on automated processing.

05. Who we share it with

We share personal information with the service providers in section 06, which help us run the business. Each works under written terms with us that require it to protect the information. Three of them also use part of the data for their own purposes, under their own privacy policies: Meta, for lead forms; and Google and Microsoft, for analytics and ads, only when you have consented.

Beyond that: business partners only with your explicit consent; disclosure where the law requires it (court orders, valid government requests, fraud or security investigations); and, in a merger or sale of the business, transfer under these same protections with notice to affected individuals first.

We do not sell, rent or trade personal information. Period.

06. Our providers, and where data is stored

Our website database is in Canada. Most of our other tools store data on servers in the United States, so your information is likely to be stored or processed in the United States, where courts, law enforcement and national security authorities can access it under US law. These are the providers that hold personal information for us:

Our accounting and payment tools also hold billing records. For more detail on any provider, email hello@4uit.ca with the subject “Provider list.”

07. Security, retention and breaches

We protect personal information with safeguards that match how sensitive it is: encrypted connections (HTTPS) to this site and to our business tools, security software on our work computers, access limited to the people at 4UIT who need it, and providers chosen in part for their security.

We keep personal information only as long as the purpose needs it or the law requires:

• Enquiries and lead-form answers that don’t lead to work — deleted within 24 months of our last contact with you.
• Client records — while you are a client, and afterwards only as long as we need them to answer questions or meet legal obligations. Invoices, contracts and other financial records: six years from the end of the tax year they relate to, as the Canada Revenue Agency requires.
• IP addresses logged by our contact form — deleted after 30 days.
• Clarity session replays — 30 days, set by Microsoft (Microsoft keeps a small sample, and any we mark as favourites, for up to nine months).
• Lead-form answers held by Meta — Meta lets us download them for 90 days after you submit, and keeps its own copy under its own policy.

When a period ends, we delete the information or make it anonymous. Copies in our providers’ backups expire on those providers’ own backup schedules.

If a breach of our security safeguards creates a real risk of significant harm (PIPEDA’s test), we report it to the Office of the Privacy Commissioner of Canada, notify affected people directly as soon as feasible, and notify any organization that can reduce the harm. We keep a record of every breach of security safeguards, including ones below that threshold, for at least two years, as PIPEDA’s breach regulations require. For Quebec residents, when an incident presents a risk of serious injury, our Privacy Officer promptly notifies the Commission d’accès à l’information and the people concerned, as Law 25 requires.

08. Your rights and choices

• Access a copy of what we hold about you, and correct anything inaccurate.
• Withdraw consent for marketing, analytics, ad measurement or any optional processing, at any time. We will tell you if withdrawing affects a service you have asked for.
• Delete your personal information, subject to legal retention obligations.
• Say no to marketing — unsubscribe from any email or text, ask us not to call, and switch off analytics and ads under “Cookie settings.”
• Data portability — information you gave us, in a structured, commonly used format.
• No automated decisions — we do not make decisions about you based solely on automated processing.

Email hello@4uit.ca with the subject “Privacy Request.” We reply within 30 days and may need to confirm your identity first. If you are not satisfied, tell our Privacy Officer first; you can also complain to the Office of the Privacy Commissioner of Canada, to the Information and Privacy Commissioner of Ontario about health information we handle for an Ontario health care provider, or, in Quebec, to the Commission d’accès à l’information du Québec.

09. Children

Our services are for organizations, not children. We do not knowingly collect information from anyone under 13, and our ads and lead forms are not aimed at minors. If we find we have collected a child’s information, we delete it; parents and guardians can contact us to have it removed.

10. Quebec residents — Law 25

Quebec residents have the rights in section 08. Under Law 25 you can also:

• be told when a decision about you is based exclusively on automated processing, and on what basis — we make no such decisions;
• receive the computerized information you gave us in a structured, commonly used technological format;
• know about any technology that can identify, locate or profile you, and how to turn it on — on this site, analytics and advertising tags stay off until you switch them on.

Your information may be communicated outside Québec, to the providers and countries listed in section 06. On request, we will also tell you what personal information we hold about you, who at 4UIT can access it and how long we keep it. Our person in charge of the protection of personal information is our Privacy Officer, Amanjot Singh (Founder), at hello@4uit.ca; we answer access and correction requests in writing within 30 days.

11. Changes and contact

We update this policy when our practices, providers or the law change, and move the “last updated” date at the top. When a change affects how we use information we already hold about you, we tell clients by email before it takes effect, and ask for consent where the law requires it.

What changed in October 2026: we now name our providers and where they store data, and corrected the earlier statement that data is kept mainly in Canada — most of our tools are hosted in the United States. We added Facebook and Instagram lead forms, how we contact people who send us a request, and our use of AI-assisted tools; described Microsoft Clarity and the Google Ads features that run only with your consent; and replaced general retention wording with set periods. This version replaces the one dated 2 May 2026.

4UIT Inc. — Privacy Officer · Amanjot Singh · 5-2000 Thurston Drive, Ottawa, ON K1G 4K7 (registered office) · hello@4uit.ca (subject “Privacy Request”) · 1-833-721-4848 · Mon–Fri 08:00–18:00 ET.