Our Privacy Policy

Digital Gateway is operated by Denys Matrosov, Founder & CEO, who acts as the designated Privacy Officer accountable for compliance with this Policy.

• Location: Vancouver, British Columbia, Canada
• Email: [email protected]
• Phone: +1 (236) 989-0935

This Policy applies to personal information we collect through our website (igateway.digital), business communications (email, phone, messaging), social media interactions, and in the course of providing our services.

Our handling of personal information is guided by applicable law, which may include:

• Canada: the Personal Information Protection and Electronic Documents Act (PIPEDA) and, as a British Columbia–based organization, the BC Personal Information Protection Act (PIPA);
• Canada anti-spam: Canada's Anti-Spam Legislation (CASL) for commercial electronic messages;
• United States: the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and other applicable US state privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey and Nebraska, as applicable).

Rights and obligations depend on your location and the circumstances in which information is collected.

• Identifiers: name, email address, phone number, mailing address.
• Professional information: company, job title, business contact details (including from professional networks such as LinkedIn, where lawful).
• Commercial information: records of inquiries, proposals, and services requested.
• Internet and device information: IP address, device and browser type, pages visited, time spent, referring URLs.
• Audio information: phone call recordings, only where we have given prior notice and where lawful.
• We do not intentionally collect sensitive personal information (e.g., health, biometric, or precise geolocation data). Please do not send it to us.

• Directly from you (forms, email, phone, meetings, social media messages).
• Automatically via cookies and similar technologies (see §6).
• From business contacts and public professional sources, in compliance with applicable law.
• From service providers acting on our behalf.

We collect and use personal information only for the following purposes:

1. Providing and quoting services — software development, AI implementation, and related engineering services (contract performance / legitimate business purposes).
2. Responding to inquiries and maintaining business relationships.
3. Marketing communications — only with your express or implied consent as required by CASL; you may unsubscribe at any time (see §13).
4. Analytics and service improvement — measuring website performance and engagement (consent-based where required, see §6).
5. Security, fraud prevention, and legal compliance — protecting our systems and meeting legal obligations.

We do not use your personal information to train AI models.

We do not make decisions producing legal or similarly significant effects based solely on automated processing of your personal information.

We use Cloudflare to deliver and protect the website, including Turnstile on job application forms. Contact, assessment, STEP AI demo, and newsletter forms submit directly to Zoho CRM; the information you enter in those forms is transmitted to Zoho when you submit. We use Yandex Metrica (counter 99109979) to measure visits, navigation, clicks, form completions, and session replays. We disable keystroke recording in Webvisor, mask forms, and do not include names, email addresses, messages, or uploaded files in analytics events. Yandex may use cookies or browser storage and process analytics information outside Canada.

We use Microsoft Clarity for heatmaps and session replays, and Google Analytics 4 to understand aggregate traffic and confirmed form conversions. These providers may process usage data outside Canada, including in the United States. We do not use these tools to collect the contents of contact or job application fields.

Your browser can block or clear cookies. Where a site preference control is provided, you can use it to manage optional analytics. Browser-level privacy controls and provider opt-out tools may also be available. Blocking analytics should not prevent you from viewing the site, although some functions may work differently.

We are based in Canada and serve clients in the United States. Your personal information may therefore be stored and processed in Canada and the United States (including by our cloud, analytics, and communications providers). We use contractual and organizational safeguards with our providers. By providing information to us, you acknowledge that it may be processed outside your home jurisdiction and subject to the laws there.

• We do not sell your personal information. We do not share it for cross-context behavioral advertising.
• Service providers: hosting, Zoho CRM, analytics, email, and communications providers who process data on our behalf under contracts that limit use to our instructions and require confidentiality and security safeguards.
• Legal and safety: where required by law, court order, or to protect the rights, safety, and property of Digital Gateway and others.
• Business transfers: in a merger, acquisition, or asset sale, personal information may transfer subject to this Policy; we will notify you of material changes.

We keep personal information only as long as reasonably needed for the purposes described above or to meet legal obligations. Job application receipts stored in Cloudflare are scheduled to have their submitted payload removed after 180 days once synchronized. CRM records and job applications may be kept while there is a business or recruitment relationship and for an appropriate follow-up period. Financial and contract records may be retained longer where required by law. Analytics retention depends on each provider's settings and product rules.

To request deletion of information we control, contact us using the details below. Some records may need to be retained to comply with law, resolve disputes, or honour an opt-out request.

We apply technical and organizational measures including encryption in transit and at rest, access controls on a least-privilege basis, and limited personnel access. No system is completely secure.

If a breach creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada / BC Office of the Information and Privacy Commissioner as required by law, and cooperate with US state notification requirements as applicable.

Under PIPEDA/PIPA you may: request access to your personal information; request correction of inaccuracies; challenge our compliance and receive a response within the time required by applicable law. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the BC OIPC (oipc.bc.ca).

Depending on your state of residence, you may have the right to: know/access the categories and specific pieces of personal information we hold; request deletion; request correction; opt out of the sale or sharing of personal information (we do not sell or share as defined by these laws); limit the use of sensitive personal information (we do not intentionally collect it); and not be discriminated against for exercising these rights.

To exercise a right, email [email protected] with "Privacy Request" in the subject. We will verify your identity (and your authorized agent's authority, if applicable) and respond within the time required by applicable law.

We send commercial electronic messages only with express or implied consent as defined by CASL. Every marketing message includes a working unsubscribe mechanism; opt-outs are honored within 10 business days, and we keep a suppression list to prevent re-contact.

We do not knowingly collect personal information from children under 13 (under 14 in Quebec). If you believe we have done so, contact us and we will delete it promptly.

Our website may link to third-party sites. We are not responsible for their privacy practices; review their policies separately.

We may update this Policy to reflect changes in our practices or the law. Material changes will be posted on this page with a new effective date. Where required, we will provide additional notice or seek consent.

Privacy questions or requests: [email protected], +1 (236) 989-0935, Vancouver, British Columbia, Canada.

• Office of the Privacy Commissioner of Canada: priv.gc.ca
• BC Office of the Information and Privacy Commissioner: oipc.bc.ca
• California Attorney General (CCPA): oag.ca.gov/privacy