Privacy Policy

Who we are, and what this policy covers

Quwa Smart Services Inc. ("Quwa", "we", "us") is an engineering firm registered in Ontario, Canada, with offices at 100 King Street West, Suite 5700, Toronto, Ontario M5X 1C7. We are the organization accountable for the personal information described here.

This policy applies to the public websites we operate:

• www.quwaservices.com and quwaservices.com, our company website
• The Q-Peak marketing pages at quwaservices.com/qpeak/

Together we call these "the Sites". By using the Sites you accept the practices described here. If you do not agree with them, please do not use the Sites.

This policy does not cover our client platforms. The Q-Peak Operator Dashboard and our project management dashboard are password-protected applications used by clients under a signed agreement. They hold operational and account data of a different kind, and they are governed by that agreement and by their own privacy notice rather than by this page. Nothing here reduces any commitment we have made to a client in a contract.

What the Sites collect on their own

Very little, and we would rather say so plainly than pad this section.

The Sites are static pages. There is no application server, no database and no user account behind them. They are files served from Amazon Web Services storage in Canada through a content delivery network. Loading a page does not create a record about you on our systems, and access logging on our content delivery network is currently switched off.

Like any website, the Sites cannot be delivered to you without your device's IP address and browser user agent being visible in transit to the infrastructure that serves the page. That is a property of how the internet works rather than a collection we perform, and we do not retain or analyse it.

The forms do not submit anywhere

This surprises people, so it is worth being explicit. The forms on our Contact and No-cost assessment pages are not connected to a server. When you press the button, a small script running in your own browser assembles what you typed into a plain text message and opens it in your email program, addressed to info@quwaservices.com.

Nothing is transmitted to us at that moment. You see the draft, you can change it, and you can close it without sending. We receive your information only if you press send in your own email program, at which point it reaches us as an ordinary email.

What you send us, when you choose to

When you contact us by email, by telephone, through the forms described above, or by meeting us at an event, we receive whatever you decide to give us. In practice that is usually:

• your name
• your organization
• an email address or telephone number to reach you on
• the building or portfolio you are asking about, its type and approximate size
• the services you are interested in, and any meeting times you propose
• anything else you write in your message

Some of what you send us describes a building rather than a person: utility bills, meter data, equipment lists, drawings. That is commercial information, not personal information, and we treat it as confidential under our engagement terms. Where a document happens to name an individual, such as a building operator on a site contact list, that name is handled under this policy.

How we use it

We use the information you send us to:

• answer your question and continue the conversation you started
• arrange and confirm a no-cost assessment call or a site visit
• prepare a proposal, a scope of work or a fee estimate
• deliver and administer work you engage us for, including funding and incentive applications made on your behalf
• send you occasional updates about our services, events or published insights, where you have asked for them or where we have an existing business relationship with you
• meet our professional, regulatory, insurance and tax obligations

If we ever want to use your information for a purpose that is not listed here and not obviously part of the reason you gave it to us, we will ask you first, and we will use it only for the purpose you agree to, unless the law requires otherwise.

Cookies, analytics and similar technologies

The Sites currently set no cookies and load no analytics, advertising or session recording scripts. Nothing is written to your browser's local storage. There is no consent banner because, as things stand, there is nothing to consent to.

We may add privacy-respecting website analytics in future, to understand which pages are read and which are not. If we do:

• we will update this page and change the effective date at the top before or at the same time as the change goes live
• we will name the provider and say what is collected
• where consent is required for the technology we choose, we will ask for it before setting anything, and you will be able to decline without losing access to any part of the Sites
• we will not deploy advertising networks, cross-site tracking pixels or profiling for targeted advertising on the Sites

That last point is a commitment, not a description of a gap. Marketing our engineering services does not require following you around the internet.

Third-party services the pages load

The Sites request two things from third-party servers to render correctly. Those servers see your IP address and browser user agent as a consequence, in the same way any web request reveals them:

• Google Fonts (fonts.googleapis.com and fonts.gstatic.com), which supplies the two typefaces the Sites use. Google states that Google Fonts does not set cookies and does not use these requests to build advertising profiles. See the Google Privacy Policy.
• jsDelivr (cdn.jsdelivr.net), an open-source content delivery network, which supplies the 3D graphics library used by the animated illustration on the Q-Peak pages. If it is unreachable, the page falls back to a simpler illustration and still works.

Beyond those two, the Sites embed no third-party content: no advertising, no social media trackers, no chat widgets, no embedded video, no third-party comment systems.

When we share information, and when we do not

We do not sell, rent, trade or licence your personal information to anyone. We do not share it with data brokers, list vendors or advertising networks, and we do not disclose it to a third party for that party's own marketing.

We share personal information only in these situations:

• Service providers who operate our systems. Our email runs on Microsoft 365, and our websites are hosted on Amazon Web Services. These providers process information on our instructions in order to deliver their service to us, and are not permitted to use it for their own purposes.
• Partners on a specific project, with your knowledge. Delivering an engagement sometimes requires a named subconsultant, or submitting an incentive application to a utility or program administrator such as your local distribution company or the Independent Electricity System Operator. We share only what the task requires, and only where you have engaged us to do it.
• Our professional advisors, such as our auditors, insurers and legal counsel, where they need it and are bound by confidentiality.
• Where the law requires it, to comply with applicable law, a regulation, a court order, a subpoena or other lawful process, to establish or defend our legal rights, or to prevent fraud or a threat to someone's safety.
• In a business transaction. If Quwa is merged with or acquired by another organization, or sells part of its business, personal information may be transferred as part of that transaction. Any recipient would remain bound by this policy until you are told otherwise, and we would post notice on this page.

Where we transfer personal information to a service provider, we require by contract that it be used only for the purpose it was transferred for, protected to a comparable standard, and not retained longer than that purpose needs.

Where your information is kept

Our website files are stored in Amazon Web Services' Canadian region (ca-central-1, Montreal). The pages themselves contain no personal information, and they are distributed through a global content delivery network so that they load quickly.

Email you send us is delivered into mailboxes hosted on Microsoft 365. Depending on how a cloud provider operates its service, that information may be stored or processed outside Canada, including in the United States, where it can be subject to the laws of that country and accessible to its courts and law enforcement under those laws. If where your information is stored is material to you, tell us before you send it and we will agree an alternative.

Separate and stricter commitments apply to some of our platform work, where client data is required to remain in Canada. Those are set out in the relevant client agreement rather than here.

How long we keep it

We keep personal information only as long as it serves the purpose it was collected for, or as long as the law requires.

• An enquiry that does not become work is kept while the conversation is live and then deleted, normally within 24 months of the last contact.
• Records of an engagement, including correspondence, reports and the documents supporting an incentive application, are kept for the period our professional, insurance and tax obligations require, generally seven years after the work closes.
• Marketing contact details are kept until you unsubscribe or ask us to remove you, after which we retain only the minimum needed to honour that request.

Aggregated or anonymized information that can no longer identify you, directly or indirectly, may be kept indefinitely.

Security

We protect personal information with safeguards appropriate to how sensitive it is. Our websites are served only over HTTPS. Access to our email and file storage requires multi-factor authentication, is limited to staff who need it for their work, and our cloud storage is encrypted at rest. Our infrastructure is reviewed and backed up on a schedule.

No system is perfectly secure, and information sent over the internet, email included, always carries some risk. We cannot guarantee absolute security, so please use your judgement about what you send us by email. If you need to send us something sensitive, ask and we will arrange a secure transfer.

Your rights

Under Canada's Personal Information Protection and Electronic Documents Act and other privacy laws that may apply to you, you have the right to:

• ask whether we hold personal information about you, and get access to it
• have inaccurate or incomplete information corrected
• ask us to delete information we no longer have a reason to keep
• withdraw a consent you previously gave, subject to legal and contractual limits, on reasonable notice
• ask how your information has been used and who it has been disclosed to
• receive a copy of the information you provided to us, in a portable form, or ask us to transfer it to another organization, where the applicable law provides for that
• object to or ask us to restrict a particular use of your information
• complain to a privacy regulator

To exercise any of these, write to info@quwaservices.com. We will respond within 30 days, and we will ask you to confirm your identity before we release information so that we do not disclose it to the wrong person. There is no charge for a reasonable request.

If you are not satisfied with how we have handled your request, you may complain to the Office of the Privacy Commissioner of Canada, or to the privacy regulator in your own province or country. We would rather you raise it with us first so we have the chance to put it right.

If you decline to give us information we genuinely need, or withdraw your consent to our using it, we may not be able to answer your enquiry or carry out work you have asked for. We will tell you if that is the case.

Marketing, and how to stop it

We send commercial messages only where Canada's Anti-Spam Legislation allows it: with your consent, or on the basis of an existing business relationship. Every such message identifies us and carries a way to unsubscribe. You can also opt out at any time, for any message, by writing to info@quwaservices.com. We act on it promptly and it costs you nothing.

Opting out of marketing does not stop messages we need to send you about work already under way, such as a site visit confirmation or a report.

Children

The Sites are aimed at building owners, property managers and facility professionals. They are not directed at children, and we do not knowingly collect personal information from anyone under the age of 18. If you believe a child has sent us personal information, write to us and we will delete it.

Links to other websites

The Sites link to other organizations, including program administrators, standards bodies, utilities and our own LinkedIn page. This policy does not cover them. Once you follow a link you are on someone else's website, subject to their privacy practices, over which we have no control and for which we take no responsibility. We suggest reading the privacy policy of any site you give information to.

Changes to this policy

We may update this policy as our services, our tools or the law change. When we do, we will post the revised version on this page and change the effective date at the top. A change that materially affects how we handle information already collected from you will be brought to your attention directly where we have a way to reach you, and where the law requires your consent we will ask for it rather than assume it.

Continuing to use the Sites after a revised policy is posted means you accept it. Because we do not hold a contact record for most visitors, we suggest checking this page from time to time.

Contact our Privacy Officer

Questions, requests and complaints about privacy at Quwa all go to the same place, and a person reads them.

• Email: info@quwaservices.com
• Telephone: 416-556-5339
• Post: Privacy Officer, Quwa Smart Services Inc., 100 King Street West, Suite 5700, Toronto, Ontario M5X 1C7, Canada

Effective 31 August 2026. This is the first published version of this policy. Superseded versions are kept on file and are available on request.