NOKARIS.

Privacy policy

Your data is yours. For real.

Last updated: 2026-08-24. Written to meet the requirements of Quebec's Law 25, PIPEDA (Canada) and the GDPR (European Union) where it applies.

Identity of the data controller

NOKARIS, operated by Sergio Nokam, sole proprietorship based in Gatineau, Quebec, Canada. Contact: hello@nokaris.ca.

For any request related to your personal data (Quebec Law 25 — rights of access, rectification, withdrawal of consent): privacy@nokaris.ca.

The role of person in charge of the protection of personal information, within the meaning of Law 25, is held by Sergio Nokam, founder.

Cookies and trackers

Until you have accepted, this site places no measurement or advertising cookies. Declining is the default state: closing the banner or ignoring the question is not consent, and triggers nothing.

A single strictly necessary flag is kept in your browser, to remember your choice. It enables no tracking.

Our baseline analytics tool, Plausible Analytics, is privacy-first: no cookies, no persistent identifiers, no cross-site tracking. It runs for everyone, including if you decline, because it cannot identify you — only aggregate counters (visits, page views, sources). Data is hosted in Frankfurt (EU).

Two additional tools, off by default, only load after your explicit agreement. They serve two distinct purposes, and the banner lets you accept them separately: accepting audience measurement does not imply accepting advertising measurement, and vice versa.

  • Google Analytics 4 — detailed audience measurement (navigation paths, entry and exit pages, conversions). It places persistent first-party cookies (_ga, _ga_<identifier>, 2-year lifetime) carrying a browser identifier. Data is processed by Google in the United States. We never attach your name or email to it.
  • Meta pixel (Facebook, Instagram) — measures visits coming from our ads. Places cookies (_fbp, _fbc) for that sole purpose. Data processed in the United States.

If you decline, neither script is loaded: no cookie, and no network request to Google or Meta. You can reverse your choice at any time by clearing site data in your browser — the banner will reappear — or by writing to privacy@nokaris.ca.

Plausible data policy →

Data we collect

We collect only:

  • Contact / discovery form: name, email, project context. Stored to respond to your request and, if there is a commercial opportunity, continue the conversation.
  • Cal.com bookings: name, email, chosen slot. Managed by Cal.com (hosted EU / US depending on your region).
  • Lead ad forms (Meta Lead Ads): if you respond to an ad on Facebook or Instagram, the details you enter there (name, email, phone, context) are passed to us by Meta. They follow exactly the same rules as our contact form.
  • Aggregate Plausible metrics: no personal identifier.
  • Google Analytics 4 metrics — only if you consent to it: page views, navigation paths, traffic source, device type and approximate region, tied to a pseudonymous browser identifier.

Processing purposes

  • Respond to your requests via form or Cal.com
  • Send a commercial proposal if you request one
  • Anonymously measure the site's audience (Plausible)
  • Understand in detail how the site is used, in order to improve it (Google Analytics 4), only if you consent to it
  • Measure the effectiveness of our advertising campaigns, only if you consent to it

Information submitted through a form is used solely to respond to your request or deliver the service you asked for. It is never sold, never rented, and never shared for advertising purposes. No profiling, no unsolicited prospecting.

Legal basis for processing

Depending on the case, we process your data because:

  • You consented — form, booking, marketing communications.
  • You approached us — responding to your request and preparing a possible engagement.
  • A contract binds us — delivering the agreed mandate.
  • The law requires it — tax and accounting obligations.
  • We have a legitimate interest — securing the site, preventing abuse and improving our services, without overriding your rights.

Marketing communications

We send no marketing communication without your prior consent. As of today, we send none at all.

Should that change, you can withdraw your consent at any time — through the unsubscribe link included in every message, or by writing to privacy@nokaris.ca, in line with Canada's Anti-Spam Legislation. Answering your request or following up on a mandate does not count as marketing.

Retention period

  • Unconverted contact requests: 12 months then deletion.
  • Email exchanges: 24 months after the last exchange, then deletion — unless they relate to a mandate, in which case the rule below applies.
  • Active clients: duration of mandate + 7 years (tax and accounting obligations).
  • Plausible metrics: aggregate and non-personal — no retention limit applies.
  • Google Analytics 4 metrics: 14 months, the maximum Google allows, then automatic deletion. The _ga cookies expire after 2 years, or as soon as you clear site data.

Your rights (Quebec Law 25 + GDPR)

You have, at any time, the right to:

  • Access your personal data
  • Request its rectification or deletion
  • Withdraw your consent
  • Receive your data in a readable format (portability)
  • Object to a processing activity or request its restriction
  • Request de-indexation of information concerning you
  • File a complaint with the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada, or your national data protection authority if you reside in the European Union

To exercise these rights: privacy@nokaris.ca. Reply within 30 days maximum (often within 5 business days).

Sub-processors

The following tools may process your data:

  • Cloudflare (site hosting, DNS, Workers, Email Routing) — Canada region
  • Cloudflare Turnstile (invisible anti-spam on the contact form) — privacy-first, cookieless
  • Plausible Analytics (anonymous audience measurement) — Frankfurt, EU
  • Cal.com (discovery call bookings) — EU/US
  • Resend (transactional emails sent via the send.nokaris.ca subdomain) — EU/US
  • Google (Google Analytics 4, detailed audience measurement — only if you consent to it) — United States
  • Meta (Lead Ads forms if you respond to an ad; advertising measurement pixel if you consent to it) — United States

Data transfers outside Quebec

Some of these providers — Cal.com, Resend, Cloudflare and Plausible — may process or host information outside Quebec, notably in the European Union and the United States. Google and Meta, when you consent to their trackers, process data in the United States.

Before entrusting information to a provider located outside Quebec, we assess the protection it offers and frame the relationship with appropriate contractual commitments, including standard contractual clauses where they apply. All else being equal, we favour Canadian or European hosting.

Security

All communications with this site are TLS 1.3 encrypted. Your information is kept on secure servers and access is strictly limited to those who need it — as of today, the founder alone.

We apply reasonable technical and organisational measures to protect your information against unauthorised access, loss, destruction, alteration and disclosure: encryption in transit, strong authentication, least privilege, and periodic review of access rights and providers.

In the event of a confidentiality incident presenting a risk of serious injury, we record it and promptly notify the Commission d'accès à l'information and the individuals concerned, in accordance with Law 25.

Minors

Our services are aimed at businesses and are not intended for people under 14. We do not knowingly collect their personal information. If you notice that such information has reached us, write to privacy@nokaris.ca and we will delete it.

Changes

This policy may evolve. Any significant change will be flagged on the site with a new update date.