Privacy Policy

1. Overview

This Privacy Policy describes how Gridkawa ("we," "us," or "our") collects, uses, stores, discloses, and protects personal information in connection with the Event Grid platform at eg.gridkawa.com and its organization-specific addresses (the "Service"), and our public website at gridkawa.com (the "Website"). Event Grid is a cloud-hosted course and event management platform.

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other privacy laws that apply to us.

2. Who Controls Your Data

Most people use Event Grid through an organization — for example a school district, employer, association, or training provider — that subscribes to the Service (our "Customer"). In that case:

• Your organization decides what information is collected (including which optional and custom registration fields are used), who can see it, how long it is kept, and what it is used for. It is responsible for giving you any required notice and obtaining any required consent.
• Gridkawa processes that information on your organization's behalf, as its service provider, and only to provide, secure, support, and improve the Service under our agreement with the organization.

Gridkawa is directly responsible for information we collect for our own purposes: Customer account and billing contacts, messages sent through our Website contact form, and Website analytics.

If you have a question or request about information your organization holds in Event Grid, please contact your organization first. We will help your organization respond, and you may contact us at any time using the details in Section 22.

3. Information We Collect

Account Information

• Email address — your sign-in identifier and where notifications are sent.
• First and last name.
• Password — stored only in cryptographically hashed form; we never store your plaintext password. Not collected if you sign in through single sign-on or a sign-in link.
• Title/Position, Facility/Department, and Site/Location — optional unless your organization requires them.
• Role assignments — for example Student/Participant, Instructor, Course or Event Manager, Program Administrator, Administrator, Billing Administrator, or Archive Manager.
• Organization and program memberships — which organization(s) and program(s) you belong to.

Registration Details

• The "Register as" option you chose (for example staff, student, or member of the public), and whether your registration is awaiting or has received approval.
• The program you registered for, and your answers to any additional information fields your organization adds to its registration form. Your organization defines these fields and is responsible for what they ask.

Email Notification Preferences

• Your choices about enrollment, course update, instructor message, and system notification emails.

4. Health, Dietary & Accessibility Information

Some courses and events invite you to share information that may be sensitive. Providing it is optional unless your organization tells you otherwise, and you can update or remove it at any time.

• Medical alerts — health information you choose to record on your profile (for example a serious allergy or a condition staff should know about in an emergency), or a confirmation that you have none. When you enroll in a course that collects medical alerts, a copy of what you declared at that moment is kept with that enrollment. Within Event Grid, medical alerts are visible only to your organization's Administrators and Course Managers.
• Dietary needs and meal choices — dietary preferences and restrictions (for example vegetarian, vegan, gluten-free, dairy-free, nut or shellfish allergy, halal, kosher, or other needs) and the meal, snack, or beverage options you select for a course or event.
• Accessibility requirements — accommodations you request so you can take part in a course or event.

This information is used only for your safety, catering, and accommodation at the course or event concerned. It is never used for marketing. Staff may include it in rosters or exports they prepare for those purposes.

5. How We Use Your Data

We use personal information to:

• Provide, operate, and maintain the Service on behalf of your organization.
• Authenticate you and manage your account and access.
• Process registrations, enrollments, waitlists, attendance, assessments, certificates, and payments.
• Send service emails such as confirmations, reminders, waitlist notices, quiz and survey notifications, and scheduled reports.
• Produce reports and analytics for your organization's authorized staff.
• Keep the Service secure, investigate misuse, and maintain audit records.
• Provide support, troubleshoot problems, and improve the Service.
• Meet our legal obligations.

We do not sell or rent personal information, and we do not share it with third parties for their own marketing.

6. Authentication & Security Data

To secure your account, we collect and store:

• Last sign-in date and time.
• Failed sign-in counts and account lockout status.
• Two-factor authentication keys and recovery codes — if two-factor authentication is enabled on your account.
• Temporary tokens — for password resets, email confirmation, sign-in links, one-time codes, and course or event invitation links.
• Single sign-on (SAML) data — if your organization uses single sign-on, we receive identity information (such as your name and email) from its identity provider.
• IP addresses — used for rate limiting and recorded in security and audit logs.

7. Course & Enrollment Data

Enrollment Records

• Courses and events you enroll in, enrollment date, and status (for example enrolled, dropped, or completed).
• Invitations sent to you, including the email address an invitation was sent to and when it was used.
• Certificates issued to you, and the date they were issued.

Payment Records

• Amount, currency, taxes, payment status, refunds, and the payment provider's transaction and receipt references.
• Card details are entered directly with the payment provider (Square or Stripe). Gridkawa never receives or stores full card numbers.

Attendance Records

• Date and attendance status (Present, Absent, Late, or Excused), optional notes, and who recorded the entry.

Engagement Observations

• Engagement and interest ratings recorded by instructors, the date, optional notes, and who recorded them.

Waitlist Data

• Date joined, position, promotion status, whether you accepted or declined a promotion offer, and the reason for removal (if any).

8. Assessments & Feedback

Quizzes & Assessments

• Your answers, including written short answers, which your instructor may review and grade.
• Scores, pass/fail results, number of attempts, time spent, and start and completion times.

Feedback & Surveys

• Your ratings and written responses.
• If a form or survey is anonymous, your identity is not linked to your response.
• If it is not anonymous, your response is linked to your account.
• Organizations can send surveys to people who do not have an account. For those invitations we store the recipient's email address, a unique link, and when the survey was sent and answered.

9. File Uploads

Instructors and administrators can upload course materials, certificate templates, and branding images such as logos. For each upload we record the file name, size, type, upload date, and who uploaded it. Course materials are limited to .pdf, .docx, .pptx, .xlsx, .txt, and .zip files of up to 10 MB. Files are only as private as their content: please do not upload personal information that is not needed.

10. Audit & Application Logs

Audit Logs

For security and accountability, Event Grid records significant actions. Each entry includes:

• The action performed (for example course created, enrollment dropped, user updated).
• The name and email of the person who performed it.
• The date and time, and the IP address it came from.
• Previous and new values of any data that changed.

Audit entries are a historical record. They keep the name and email they recorded even if the account is later deleted, until they are removed under the retention rules in Section 15.

Application Logs

The Service keeps diagnostic logs for troubleshooting and security. They may contain the pages requested, IP addresses, the ID of the signed-in user, and error details. Log files are automatically deleted after 30 days.

11. Automated Communications

Event Grid sends service emails such as enrollment confirmations, waitlist notices, course reminders, quiz and survey notifications, certificates, and reports that administrators schedule for chosen recipients. Emails are sent through Amazon Simple Email Service (SES) or, if your organization configures one, through its own mail server. For each email we record the recipient, subject, time sent, and whether delivery succeeded. You can turn off optional notification categories in your account settings.

12. Data Import & Export

Authorized staff can import users and courses from CSV files and export data to CSV, Excel, PDF, or Word. Exports can include personal information such as names, emails, enrollment status, assessment results, and — if staff choose those columns — dietary, meal, or accessibility information. Medical alerts are never included in exports. Once a file is exported, its security is the responsibility of your organization.

13. Cookies & Website Analytics

In Event Grid, we use only cookies that are needed for the Service to work: a sign-in cookie (kept for up to 7 days of inactivity), a session cookie (expires after 30 minutes of inactivity), a security cookie that protects forms against cross-site request forgery, and a cookie that remembers which program you are viewing. Event Grid does not use advertising or analytics cookies.

On our Website (gridkawa.com), we use Google Analytics to understand how visitors use the site. Google Analytics sets cookies and collects information such as pages viewed, referring site, device and browser type, and approximate location derived from your IP address. You can block these cookies in your browser or use Google's opt-out browser add-on. If you use our contact form, we receive your name, email, subject, and message so that we can reply.

14. Data Storage & Security

We protect personal information with safeguards appropriate to its sensitivity, including:

• Encryption in transit: all connections use HTTPS/TLS.
• Password security: passwords are cryptographically hashed, never stored in plaintext.
• Secure cookies: authentication cookies are marked Secure and HTTP-only.
• Rate limiting and lockout: sign-in and registration are rate-limited, and repeated failed sign-ins lock the account.
• Optional two-factor authentication and single sign-on, which organizations can require for specific roles.
• Access control: role-based permissions and per-organization and per-program separation limit who can see what.
• Request protection: all forms are protected against cross-site request forgery.
• Staff access: only a small number of authorized Gridkawa personnel can access Customer data, and only when needed to operate, support, secure, or maintain the Service, or to meet a legal requirement.

15. Data Retention & Deletion

Your organization controls most retention settings. Unless it changes them:

• Account and course data: kept while the account exists, or until your organization deletes it.
• Application log files: automatically deleted after 30 days.
• Audit logs, reminder logs, waitlist history, dropped enrollments, quiz attempts, and feedback: kept until your organization deletes them or turns on automatic cleanup. When automatic cleanup is turned on, the default periods are 365 days for audit logs, 90 days for reminder logs, and 180 days for inactive waitlist entries. Dropped enrollments, quiz attempts, and feedback are kept until a period is set.
• Inactive accounts: can be deleted automatically after a period your organization chooses (off by default).

When an account is deleted, its profile and the records linked to it — such as enrollments, quiz attempts, and non-anonymous responses — are permanently deleted. Audit log entries that recorded the person's name, email, or IP address remain until they are removed under the rules above. Copies may also remain in our encrypted backups until those backups are deleted in the normal course.

When a Customer's subscription ends, we delete its data in accordance with our agreement with that Customer, after giving it the opportunity to export its data.

16. Third-Party Services

We use the following service providers, depending on how the Service and your organization are configured:

• Amazon Web Services: hosting, storage, email delivery (SES), and our Website contact form.
• Your organization's mail server: if your organization configures its own server for sending email.
• Identity providers (for example Microsoft Entra ID / Azure AD, Okta, or Google Workspace): if your organization uses single sign-on.
• Square and Stripe: if your organization collects payments. The payment provider processes your payment details under its own privacy policy.
• Google Analytics: on our Website only, as described in Section 13.

Our service providers may use personal information only to provide their services to us. We may also disclose personal information if required by law, to protect the rights, safety, or security of people or the Service, or as part of a merger, acquisition, or sale of our business, subject to equivalent protections.

17. Where Data Is Processed

Event Grid data is stored in Canada. Some service providers — for example payment providers, identity providers your organization chooses, and Google Analytics on our Website — may process information in other countries, including the United States, where it may be accessible to courts, law enforcement, and national security authorities under the laws of those countries.

18. Your Rights

Depending on where you live, you may have the right to:

• Access the personal information held about you.
• Correct inaccurate information. You can update much of it yourself in your account settings.
• Delete your account and associated information, subject to legal or contractual requirements to keep it.
• Withdraw consent to optional information, such as medical alerts or accessibility requirements, by removing it from your profile or enrollment.
• Receive a copy of your information in a portable format.
• Opt out of optional emails in your account settings.

For information held by your organization, please contact your organization, which controls that information (see Section 2). Otherwise, or if you need help, contact us at support@gridkawa.com. We will respond within 30 days and may need to verify your identity first. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or to the privacy regulator in your province or country.

19. Security Incidents

If we become aware of a security incident affecting personal information in the Service, we will notify the affected Customers without undue delay and help them meet their own obligations. Where the law requires, we will report the incident to privacy regulators and notify affected individuals.

20. Children & Students

Event Grid is designed for organizations and adult learners. It is not directed to children, and we do not knowingly collect personal information directly from children under 13. If an organization uses Event Grid with students or participants under the age of majority, that organization is responsible for obtaining any consent and giving any notice required by law (including school and education privacy laws). If you believe a child's information was provided to us without proper consent, please contact us and we will work with the organization to address it.

21. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Notify registered users by email or in the Service.
• Give at least 30 days' notice before changes that reduce your rights take effect.

22. Contact Us

Gridkawa has designated a Privacy Officer who is accountable for our compliance with this Policy. For questions, requests, or complaints about privacy:

• Email: support@gridkawa.com (subject: "Attention: Privacy Officer")
• Contact Form: gridkawa.com/contact