Privacy
policy

It applies to four groups, because we hold different information about each:

• Website visitors — anyone browsing glexim.io.
• Clients and prospective clients — the people we deal with at businesses that engage us, or enquire about doing so.
• Suppliers, counterparties and service providers — contacts at manufacturers, exporters, agents, inspection firms, freight forwarders and customs brokers we work with on a client’s behalf.
• Individuals named in trade records — people who appear on documentation we handle without ever dealing with us directly: a signatory on a contract, a named consignee, a director listed on a company registration.

Most of what we hold is business contact information used for business purposes. Some of it — particularly in due diligence — is information about identifiable individuals, and we treat it accordingly.

We do not ask for sensitive personal information — health, biometric, racial or ethnic origin, political or religious belief, or similar — and you should not send it to us. If it reaches us inside a document, we remove it or restrict access to it.

• To deliver the engagement — identifying and shortlisting suppliers, requesting and comparing quotes, negotiating terms, coordinating inspection and logistics, and preparing or reviewing trade documentation.
• To assess risk before we recommend a counterparty — see section 4.
• To meet legal obligations — customs and import record-keeping, tax and accounting, sanctions and export-control compliance, and responding to lawful requests from authorities.
• To run the business — invoicing, credit control, insurance, professional advice and dispute resolution.
• To stay in touch — replying to enquiries and, subject to section 11, sending occasional business updates.
• To improve the website — only with your consent.

Under PIPEDA we rely on your consent, which may be express or implied by the context — giving us your card at a trade fair implies consent to be contacted about that business. Where the law requires us to keep or check something, we do so whether or not consent is given, because that obligation overrides it.

Where the GDPR applies, our lawful bases are: contract (delivering an engagement), legal obligation (customs, tax and sanctions requirements), legitimate interests (assessing counterparty risk, business correspondence and securing our operations — balanced against the interests of the people concerned), and consent (website analytics and marketing email).

This is the part of our work with the greatest privacy weight, so we set it out separately.

Before we recommend a supplier we verify who they are. That means checking company registration and ownership records, trading history, certifications and production capacity, taking up references, and — where the order value warrants it — coordinating a third-party inspection. Some of that information identifies individuals: directors, beneficial owners, signing officers and the referees we speak to.

Where an engagement requires it, we also screen businesses and the individuals connected to them against published sanctions and denied-party lists. We do this to establish whether a transaction is lawful. It is a compliance step, not a judgement about any individual, and a potential match is verified before it is acted on.

What we do not do: we do not run consumer credit checks on individuals, we do not buy personal data from data brokers for marketing, and we do not make automated decisions that produce legal effects about a person without a human reviewing them. Findings are reported to the client who commissioned the work — they are not published, pooled into a shared database, or sold.

If you are named in a due diligence file and believe it is wrong, see section 9. We will correct demonstrable errors and tell anyone we gave the incorrect information to in the previous twelve months.

We do not sell personal information. We share it only as needed to do the work or to meet the law:

• Our client — supplier findings, quotes and diligence reports go to the client who commissioned them.
• Suppliers and their agents — enough of your requirement, and the contact details of the person managing it, to quote and produce.
• Inspection and testing firms — where inspection is coordinated.
• Freight forwarders, carriers and customs brokers — shipper, consignee and notify-party details are required to move and clear goods.
• Customs and border authorities — in Canada and in the importing or exporting country, where declarations require it.
• Banks and payment providers — for settlement, letters of credit and trade finance.
• Insurers, lawyers and accountants — where we need professional advice, cover, or to establish or defend a claim.
• Technology providers — email, file storage, hosting and accounting software, acting on our instructions.
• Authorities and regulators — where we are legally required to disclose, or to report a privacy breach.

Service providers act for us under contract, are limited to the purpose we give them, and may not use the information for their own ends. If the business is ever sold or reorganised, information may transfer with it, subject to the same protections.

International trade cannot be done without this, so we want to be direct about it. To source from or sell into another country, we transfer information to parties in that country — suppliers, agents, inspectors, forwarders, brokers and customs authorities. Depending on the engagement, that may include countries in Asia, Europe, the Middle East, Latin America and the United States. Some of our technology providers also store data outside Canada.

While information is in another country it is subject to that country’s laws, and may be accessible to its courts, law enforcement and national security authorities. That is true of any cross-border transaction, and it is a consequence you should assume.

Before transferring, we limit what is sent to what the recipient actually needs, put contractual protections in place with providers acting for us, and assess the risk where a transfer is significant. Quebec residents: where Law 25 applies we conduct the privacy impact assessment it requires before transferring outside Quebec. For transfers of EU or UK personal data we rely on the UK and European Commission adequacy findings for Canada where they apply, and on standard contractual clauses where they do not.

You can ask us where information about you has been sent by writing to privacy@glexim.io.

We keep personal information only as long as it serves the purpose it was collected for, or as long as the law requires — whichever is longer. Trade work has statutory floors we cannot go below:

When a retention period ends, records are deleted or anonymised.

Access is restricted to the people who need it for a specific engagement. Accounts require multi-factor authentication, devices are encrypted, data is encrypted in transit, and engagement files are segregated by client so that one client’s commercial information is not visible to another.

No safeguard is absolute. If a breach creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify the people affected as soon as feasible, as PIPEDA requires, and keep a record of the breach.

A particular caution for trade: payment-redirection fraud is common in this industry. We will never tell you about a change to bank details by email alone. If you receive payment instructions that appear to come from us or from a supplier, verify them by phone on a number you already hold before sending funds.

Wherever you are, you can ask us to:

• Tell you what we hold about you, and who we have disclosed it to.
• Correct it if it is inaccurate or incomplete.
• Withdraw consent at any time, subject to legal and contractual limits — we cannot delete a customs record we are required to keep, and withdrawing consent may mean we can no longer act on an engagement.
• Stop marketing email, immediately and without condition.
• Complain if you think we have it wrong — see section 13.

Quebec residents additionally have rights to de-indexing and data portability, and to be informed about automated decision-making, under Law 25.

If the GDPR applies to you, you also have the rights to erasure, restriction of processing, portability, and to object to processing based on legitimate interests. Where we rely on legitimate interests, you can object and we will stop unless we have compelling grounds that override your interests, or we need the information for legal claims.

Write to privacy@glexim.io. We will confirm receipt and respond within 30 days, and will tell you if we need longer and why. We may need to verify your identity first, and there is no charge unless a request is repetitive or excessive, in which case we will tell you the cost before doing the work.

We may withhold information where the law requires or allows it — for example where releasing it would reveal another person’s personal or confidential commercial information, breach privilege, or prejudice an investigation. If we withhold something, we will tell you why.

One cookie is set without asking: the one recording your cookie choice. Everything else stays off until you switch it on, and switching it off deletes what it set. Our analytics are first-party — the data is written to our own server and is not sold, shared, or sent to an advertising network. We do not store your IP address; we keep a one-way, daily-salted hash of a shortened version of it to separate real visits from bots.

Change your cookie choices ↗

Business updates are sent under CASL. We send them where you have consented, or where consent is implied — for example because you are an existing client, you gave us your business card, or your business address is published without a statement that you do not want unsolicited email, and the message is relevant to your role.

Every message identifies us, gives our contact details, and carries an unsubscribe link that works for at least 60 days. Unsubscribing is actioned within ten business days and does not affect the correspondence needed to run a live engagement.

We update this policy when our practices or the law change. The version in effect is dated at the top of this page. If a change materially affects how we use information about you, we will tell you directly where we can, rather than relying on you to re-read the page.

Privacy Officer is accountable for personal information at Glexim and for this policy.

Raise a concern with us first — most are resolved quickly. We will acknowledge a complaint, investigate it, and give you a written answer.

If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada. Quebec residents may complain to the Commission d’accès à l’information du Québec. If you are in the EU or UK, you may complain to your national supervisory authority or the UK Information Commissioner’s Office.