Privacy & Data Protection Policy

Catalyst Convoy is a human capital consulting firm. Trust is the basis of everything we do, whether we are advising a Board, placing a candidate, or simply answering a question from someone exploring our site. We collect the minimum personal data needed to do our work, we protect it deliberately rather than as an afterthought, and we give you real, exercisable control over it.

We have designed our data practices with reference to the leading privacy frameworks that apply across the regions we serve, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the EU/UK General Data Protection Regulation (GDPR), the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), India's Digital Personal Data Protection Act, 2023 (DPDPA), and the California Consumer Privacy Act / Privacy Rights Act (CCPA/CPRA). We extend the substantive rights described in this policy, access, correction, deletion, and more, to every individual who contacts us, regardless of whether the specific law of your region legally requires it of a firm our size.

Catalyst Convoy Inc. (“Catalyst Convoy,” “we,” “us,” or “our”) is the entity responsible for the personal data described in this policy. We are headquartered in Toronto, Canada, and operate through consultants and client engagements across North America, the Middle East, and India.

This policy applies to personal data we collect from:

• Website visitors who browse catalystconvoy.com or interact with our AI chat assistant.
• Prospective clients and business contacts who submit an inquiry through our contact form or book a discovery call.
• Job applicants who apply to an open position or send an open application to our careers team.
• Clients and partners with whom we hold an active or prospective business relationship.

This policy does not cover personal data we process on behalf of a client during a consulting engagement, for example, workforce data reviewed as part of an HR transformation project, which is instead governed by the confidentiality and data processing terms of that specific client agreement.

We only collect what a specific interaction genuinely requires. In practice, this means:

We do not use advertising trackers, third-party analytics pixels, or sell personal data to data brokers, and we never have.

• To respond to your inquiry or discovery call request.
• To evaluate your job application and communicate with you about it.
• To operate our AI chat assistant and generate a response to your question.
• To maintain the security, integrity, and availability of our website.
• To meet our own legal, accounting, and regulatory obligations.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

Where a framework such as GDPR or UAE PDPL requires us to identify a specific legal basis, we rely on the following:

• Consent, for the messages you choose to send us and the data you choose to submit through our forms.
• Contractual necessity, when processing your data is required to evaluate a job application or deliver a service you have requested.
• Legitimate interest, for keeping our website secure and responding to business inquiries, balanced against your right to privacy.
• Legal obligation, where retention or disclosure is required by applicable law.

We do not sell, rent, or trade personal data. We share it only with the service providers who help us operate the website and our business, each acting on our instructions:

We may also disclose personal data if required by law, court order, or governmental regulation, or to protect the rights, property, or safety of Catalyst Convoy, our people, or the public.

Because we operate across North America, the Middle East, and India, and because some of our service providers process data outside your home country, your personal data may be transferred to and processed in a country other than the one in which you are located. Where we transfer personal data internationally, we take steps appropriate to the sensitivity of that data and the destination, which may include relying on service providers that maintain recognized safeguards such as standard contractual clauses.

• Job applications (resume, cover letter, contact details): retained for 24 months from the date of submission, so we can consider you for other suitable roles that open during that window, after which they are deleted.
• General inquiries submitted through our contact form: retained for 36 months from your last contact with us.
• AI chat assistant conversations: held only in your own browser for up to 30 minutes of inactivity, then cleared automatically. We do not retain a server-side copy.
• Active client and partner data: retained for the duration of the business relationship and for a reasonable period afterward to meet our legal, accounting, and contractual obligations.

You may ask us to delete your data sooner at any time; see Section 12.

We apply security measures appropriate to the sensitivity of the data we hold, including encrypted transmission (HTTPS/TLS) across our website and email communications, restricted access to personal data on a need-to-know basis, and minimization of what we collect and store in the first place. No system is perfectly secure, and we continue to review and improve our safeguards as our organization grows.

We do not use advertising cookies, analytics trackers, or third-party ad pixels on this website. The only browser storage we use is functional: our AI chat assistant uses your browser's local storage to remember your conversation for up to 30 minutes, purely so the chat window doesn't reset if you close and reopen it. This is never used to track you across other websites. If you use our Calendly booking widget, Calendly may set its own cookies under its own privacy policy, which we encourage you to review before booking.

Wherever you are located, we extend you the following rights over your personal data:

• Access: ask us what personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Deletion: ask us to delete your personal data, subject to any legal obligation we have to retain it.
• Restriction: ask us to limit how we use your data.
• Portability: ask us for a copy of your data in a portable format, where technically feasible.
• Objection: object to our processing of your data based on legitimate interest.
• Withdraw consent: withdraw any consent you previously gave us, at any time.

To exercise any of these rights, contact us at privacy@catalystconvoy.com. We will respond within 30 days.

Our website and services are directed at working professionals and organizations, not children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

If a breach of personal data occurs that poses a risk to your rights or freedoms, we will notify affected individuals and the relevant regulatory authority without undue delay, and in line with the timelines required in your jurisdiction (for example, 72 hours under GDPR and UAE PDPL), once we become aware of the breach.

We may update this policy as our practices, our services, or applicable law evolve. We will revise the effective date at the top of this page whenever we make a material change, and we encourage you to review it periodically.

For any question about this policy or to exercise your privacy rights, contact our designated Privacy Officer: