PIPEDA Compliance

Kima Technologies Inc. is accountable for all personal information under our control. Our designated Privacy Officer can be reached at legal@usekima.com. We maintain this PIPEDA compliance program and review it annually. When we transfer data to sub-processors (such as AI providers), we require contractual commitments that protect personal information to an equivalent standard.

We identify the purpose for collecting personal information before or at the time of collection. Our Privacy Policy documents all collection purposes, including website analytics, demo request processing, and the processing of call recordings, client records, and deal documents through our platform products.

We collect, use, or disclose personal information only with the knowledge and consent of the individual, except where law permits otherwise. For website visitors, we rely on implied consent for functional cookies and seek explicit consent for analytics. Platform users provide explicit consent at account creation. We also contractually require that brokers using CallSmart obtain their clients' informed consent before recording any call.

We collect only the information necessary for the purposes we have identified. Our demo form collects professional details relevant to evaluating the platform. CallSmart processes only the content of calls submitted for analysis — we do not retain source audio beyond 90 days and apply data minimisation when transmitting content to AI sub-processors.

Personal information is used only for the purposes for which it was collected. We do not sell personal information. We do not use Customer Data to train AI models without explicit consent. Data is retained only as long as necessary for its identified purpose — call recordings are deleted after 90 days, uploaded documents after 7 days, and account data within 90 days of cancellation. Full retention periods are documented in our Privacy Policy.

We take reasonable steps to ensure that personal information is accurate, complete, and up to date. Users can update their account information at any time through their profile settings. We encourage users to correct any inaccuracies in AI-generated outputs before relying on or sharing them, and we provide editing tools within the platform for this purpose.

We protect personal information with security safeguards appropriate to its sensitivity. Our measures include: TLS 1.2+ encryption in transit, AES-256 encryption at rest, role-based access controls, Canadian server infrastructure, 7-day expiring document upload links, and regular security assessments. In the event of a breach posing real risk of significant harm, we will notify the Office of the Privacy Commissioner and affected individuals within 72 hours as required by PIPEDA.

We make our privacy policies and practices readily available. Our Privacy Policy is publicly accessible and written in plain language. This PIPEDA compliance page describes our practices in detail. We disclose all sub-processors and cross-border data flows. Questions about our privacy practices can be directed to legal@usekima.com.

Individuals have the right to access their personal information held by Kima and to challenge its accuracy. We will respond to access requests within 30 days. To submit a request, email legal@usekima.com with your name and account details. We may ask you to verify your identity before processing the request. In limited circumstances permitted by PIPEDA, we may decline to provide access (for example, if doing so would reveal confidential commercial information or another individual's personal information).

Individuals may challenge our compliance with PIPEDA by contacting our Privacy Officer at legal@usekima.com. We will investigate all complaints and respond within 30 days. If your concern is not resolved to your satisfaction, you may file a complaint with the Office of the Privacy Commissioner of Canada.