Privacy Policy

Aligned with ISO/IEC 27001:2022 — PIPEDA / BC PIPA — GDPR / UK GDPR — CCPA/CPRA

New Value Solutions Group Inc. (“New Value Solutions,” “NVS,” “we,” “us,” or “our”) is an information technology consulting and staffing firm headquartered in Burnaby, British Columbia, Canada. We provide IT consulting, project delivery, and technology staffing services to clients across Canada and internationally.

This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you visit our website at newvaluegroup.com (the “Site”), engage us for services, apply for a role through us, or otherwise interact with us. It also describes your privacy rights and how to exercise them.

This Policy is maintained as part of our Information Security Management System (ISMS), which is aligned with ISO/IEC 27001:2022. It is reviewed at least annually, or sooner if our data practices, the tools we use, or applicable law change materially.

If you do not agree with this Policy, please do not use the Site or provide us with personal information.

For purposes of this Policy:

• “New Value Solutions,” “NVS,” “Company,” “we,” “us,” and “our” mean New Value Solutions Group Inc., 2025 Willingdon Ave, Suite 900, Burnaby, BC V5C 0J3, Canada.
• “Site” means our website at newvaluegroup.com and any associated subdomains or landing pages.
• “Personal Information” (referred to as “Personal Data” under the GDPR) means any information that identifies, relates to, or could reasonably be linked with an identified or identifiable individual.
• “Processing” means any operation performed on Personal Information, such as collecting, recording, storing, using, disclosing, or deleting it.
• “Controller” (or “Data Controller”) means the entity that determines the purposes and means of processing Personal Information.
• “Service Provider” or “Processor” means an entity that processes Personal Information on behalf of, and under the instructions of, a Controller.
• “Client” means an organization that engages New Value Solutions for IT consulting, project delivery, or staffing services.
• “Cookies” means small text files, pixels, tags, or similar technologies placed on your device by a website, described further in Section 6.
• “Sale” and “Share” have the meanings given to them under the CCPA/CPRA and other applicable U.S. state privacy laws.
• “You” or “Your” means the individual visiting the Site or otherwise interacting with us, or, where applicable, the organization on whose behalf that individual is acting.

New Value Solutions Group Inc. is the entity responsible for personal information collected through the Site and in the course of our consulting and staffing business (the “data controller” for purposes of applicable privacy laws, unless we are processing information on behalf of a client as described in Section 10).

Privacy Officer / Privacy Inquiries:

New Value Solutions Group Inc.
2025 Willingdon Ave, Suite 900
Burnaby, BC V5C 0J3, Canada
Email: privacy@newvaluegroup.com

If you have a complaint we cannot resolve, you may also contact the applicable regulator listed in Section 13.

This Policy applies to personal information we collect through:

• The Site and any subdomains, landing pages, or microsites we operate;
• Forms, downloads (e.g., whitepapers, case studies), newsletter sign-ups, and event registrations;
• Applications for employment or contract placement submitted directly or through recruiters/job boards;
• Business communications with clients, prospective clients, vendors, and partners; and
• Marketing and advertising activity conducted on our behalf across the Site and third-party platforms.

This Policy does not apply to personal information we process on behalf of clients as a service provider/processor under a separate services agreement or data processing agreement (see Section 10), nor does it apply to third-party websites or platforms we do not control, even if linked from the Site.

The categories of personal information we collect depend on how you interact with us.

a) Information you provide directly

• Identity and contact details: name, job title, company, email address, phone number, mailing address.
• Account and communication data submitted through contact forms, chat, email, or phone.
• Recruitment/candidate data: resume/CV, work history, education, certifications, references, work authorization/eligibility status, salary expectations, and interview notes. Where permitted and relevant to a role, this may include criminal record or background-check results, obtained only with your consent and in compliance with applicable law.
• Marketing preferences: newsletter and communication opt-ins, event registrations, survey responses.
• Payment and billing information for clients and vendors, processed via our finance systems and/or third-party payment processors; we do not store full payment card numbers.

b) Information collected automatically

When you visit the Site, we and our service providers automatically collect certain technical and usage information, including:

• IP address and approximate location (derived from IP address);
• Browser type and version, device type, and operating system;
• Referring/exit pages, pages viewed, time spent on pages, and click activity;
• Date and time of visit and other diagnostic data; and
• Information collected via cookies and similar tracking technologies (see Section 6).

c) Information from other sources

• Publicly available professional information (e.g., LinkedIn profiles, professional directories) used for business development and recruitment;
• Referrals from clients, colleagues, or recruitment partners;
• Information from background-check, reference-check, or credentialing providers (with consent, where required); and
• Information from analytics, advertising, and social media platforms, as described in Section 6.

We do not knowingly collect sensitive personal information (e.g., health, biometric, or government identification numbers) except where necessary for employment/placement purposes (e.g., work-eligibility verification) and in compliance with applicable law.

We use personal information for the following purposes:

• To operate, maintain, and improve the Site and our services;
• To respond to inquiries and provide requested information;
• To evaluate candidates and match consultants to client engagements;
• To manage client relationships, contracts, invoicing, and service delivery;
• To send marketing communications, newsletters, and event invitations, where you have consented or as otherwise permitted by law, and to measure their effectiveness;
• To personalize and measure the performance of our website and advertising campaigns;
• To maintain the security, integrity, and proper functioning of our systems, consistent with our ISO/IEC 27001–aligned ISMS;
• To comply with legal, regulatory, tax, and contractual obligations; and
• To establish, exercise, or defend legal claims.

We do not use automated decision-making that produces legal or similarly significant effects about individuals without human involvement.

Our Site uses cookies and similar tracking technologies. Full details — including each cookie’s exact name and retention period — are set out in our separate Cookie Policy. In summary:

Consent and control. You can accept or reject Statistics, Marketing, and Preferences cookies at any time using the “Cookie settings” control at the bottom of the Site. Your choice is remembered for six months, and disabling optional cookies will not affect core Site functionality. See our Cookie Policy for the complete, current list of cookies in use.

Do Not Track. The Site does not currently respond to browser “Do Not Track” signals, as no common industry standard for interpreting them has been adopted. Where required by law — including for California residents under the CCPA/CPRA — we honor recognized opt-out preference signals such as Global Privacy Control (GPC) as an opt-out of the sale/sharing of personal information described in Section 12(c).

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Consent — for marketing communications and non-essential cookies;
• Contract — to take steps at your request prior to entering into, and to perform, a contract with you (e.g., client or candidate engagement);
• Legitimate interests — for Site security, analytics, business development, and direct marketing to existing business contacts (balanced against your rights and interests); and
• Legal obligation — to comply with applicable law (e.g., tax, employment, and financial record-keeping).

You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

We do not sell personal information for monetary consideration. We may share personal information with:

• Service providers/processors who perform services on our behalf — including Zoho Corporation (CRM and contact-form/web form analytics, hosted in a Canadian data center) and Google LLC (Google Analytics and Google Ads), as well as our website host, IT support, payroll, and background-check providers — bound by contractual confidentiality and data-protection obligations;
• Clients, where necessary to evaluate or place a candidate/consultant, or to deliver contracted services;
• Professional advisors (legal, accounting, insurance) as needed;
• Regulators, courts, or law enforcement, where required by law or to protect our rights, property, or safety, or that of others;
• A successor entity, in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections; and
• Other parties, with your consent.

Where required by the CCPA/CPRA, we will identify any “sale” or “sharing” (as those terms are defined under California law, which can include certain advertising-cookie disclosures) and provide an opt-out mechanism if applicable. See Section 12(c).

We are based in Canada, and personal information may be stored or processed in Canada, the United States, or other countries where our service providers operate. Where personal information originating in the EU/UK or other jurisdictions with data-transfer restrictions is transferred internationally, we rely on appropriate safeguards, such as Standard Contractual Clauses, adequacy decisions, or other mechanisms recognized under applicable law, and we require service providers to maintain protections consistent with this Policy.

As an IT consultancy, we may process personal information that our clients control (for example, end-user or employee data encountered while delivering consulting, staffing, or technical services). In that context, we act as a service provider/processor, not a controller, and we process that information only under the client’s instructions and the terms of the applicable Master Services Agreement and/or Data Processing Agreement — not under this Policy. Questions about that processing should be directed to the relevant client, or to us with the client’s involvement.

We retain personal information only as long as reasonably necessary to fulfill the purposes described in this Policy, including to satisfy legal, accounting, tax, or reporting requirements, resolve disputes, and enforce agreements. Retention periods vary by data category (for example, candidate/recruitment records, marketing contact data, and client business records are subject to different retention schedules under our records-management procedures). When personal information is no longer required, we securely delete, anonymize, or destroy it in accordance with our information-security procedures.

a) Canada (PIPEDA / BC PIPA)

Subject to certain exceptions, you have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Withdraw consent to our collection, use, or disclosure of your information, subject to legal or contractual restrictions; and
• Ask questions about, or challenge, our compliance with this Policy.

To exercise these rights, contact our Privacy Officer at privacy@newvaluegroup.com. We will respond within the time limits required by applicable law.

b) European Economic Area / United Kingdom (GDPR / UK GDPR)

If GDPR or UK GDPR applies to you, you have the right to request access, correction, erasure, restriction, or portability of your personal information; to object to processing (including direct marketing); and to lodge a complaint with your local supervisory authority.

c) California and Other U.S. States (CCPA/CPRA and similar state laws)

If applicable state privacy law applies to you, you have the right to know what personal information we collect, use, disclose, and (if applicable) sell/share; to request deletion and correction; to opt out of sale/sharing and targeted advertising; and to non-discrimination for exercising these rights. We do not knowingly sell or share the personal information of individuals under 16 years of age.

To submit a rights request, email privacy@newvaluegroup.com or use the “Cookie Settings”/opt-out control in the Site footer. We will verify your request using information reasonably available to us before responding.

If you are not satisfied with our response, you may contact the applicable authority:

• Canada: Office of the Privacy Commissioner of Canada (priv.gc.ca) or the BC Office of the Information and Privacy Commissioner (oipc.bc.ca);
• EU/UK: Your local data protection authority or the UK Information Commissioner’s Office; and
• California: California Privacy Protection Agency / California Attorney General.

The Site is intended for business audiences and is not directed to children. We do not knowingly collect personal information from individuals under the age of 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

The Site may link to third-party websites, including client sites, job boards, and social media platforms. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction, as part of our ISO/IEC 27001–aligned Information Security Management System. These safeguards include, among others:

• Role-based access controls and authentication requirements;
• Encryption of information in transit and, where appropriate, at rest;
• Physical security controls at our offices and those of our hosting/data-center providers;
• Secure configuration and vetting of cloud service providers;
• Secure disposal of paper records and electronic media containing confidential or personal information;
• Mandatory information-security awareness training for all personnel, covering topics such as phishing, password hygiene, acceptable use, removable media, and incident reporting; and
• A documented security-incident response process, including notification to affected individuals and regulators where required by law.

No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

We may update this Policy from time to time to reflect changes in our practices, the technologies and marketing tools we use, or applicable law. The “Last Updated” date at the top of this Policy indicates when it was last revised. Material changes will be communicated through a notice on the Site or by other appropriate means.

For any questions about this Policy or our privacy practices, please contact:

New Value Solutions Group Inc.
Attn: Privacy Officer
2025 Willingdon Ave, Suite 900
Burnaby, BC V5C 0J3, Canada
Email: privacy@newvaluegroup.com