Privacy Policy

Definitions

The following definitions clarify key terms used in this policy to help you understand how we treat personal information in the context of our Executive Leadership Academy.

Personal data (or personal information) means any information that identifies or can be used to identify an individual, either alone or in combination with other information. Examples include name, contact details, employer, professional qualifications and billing information.

Processing means any operation performed on personal data, such as collection, recording, storage, adaptation, retrieval, use, disclosure, erasure or destruction.

User means an individual who visits the ChiefLabLead website, registers for an account, enrolls in a program or otherwise interacts with our services.

Service means the Executive Leadership Academy programs, training modules, workshops, cohorts, resources and online tools provided by ChiefLabLead via the website and related platforms.

Cookies and similar technologies are small data files or identifiers stored on a device to support site functionality, remember preferences and collect analytics about site usage.

How We Use Your Information

We process personal information to operate the academy, fulfill contractual obligations, maintain communications, improve offerings and meet legal or safety obligations. Processing is limited to purposes that are relevant and proportionate.

• To register and administer program enrollment, schedules, attendance and certificates.
• To process payments, issue invoices and manage business records.
• To communicate important program information, confirmations, reminders and administrative updates.
• To personalize participant experience, group assignments and recommended resources based on stated preferences and professional background.
• To evaluate program outcomes, perform research and improve curriculum based on aggregated and anonymized data.
• To protect the security of the platform and detect, prevent or respond to security incidents or misuse.
• To comply with legal obligations, regulatory requirements and requests from law enforcement or other authorities as required by law.
• To send marketing communications about programs and events when you have consented or where permitted under applicable law; you can opt out at any time.

Legal Basis for Processing (where applicable)

Where data protection law requires a legal basis for processing, we rely on one or more of the bases below depending on the context and the type of processing.

• Performance of a contract: processing necessary to perform services you requested or to fulfill an agreement with you or your sponsor.
• Consent: processing based on explicit consent for specific purposes such as marketing or optional assessments.
• Legal obligation: processing required to comply with applicable laws, tax or accounting obligations and regulatory requests.
• Legitimate interests: processing necessary for business operations, fraud prevention and improving services, balanced against individual rights and expectations.

Rights Under GDPR (for EU/EEA individuals)

Although ChiefLabLead operates in Canada, we respect the rights available to EU/EEA residents where applicable. Individuals may have the following rights with respect to their personal data.

• Right of access: to request confirmation of processing and to obtain a copy of personal data we hold.
• Right to rectification: to request correction of inaccurate or incomplete data.
• Right to erasure: to request deletion of data in certain circumstances, subject to legal and contractual retention requirements.
• Right to restrict processing: to request limitation of processing where accuracy or lawfulness is disputed.
• Right to data portability: to request transfer of provided data in a structured, commonly used and machine-readable format where applicable.
• Right to object: to object to processing for direct marketing or based on legitimate interests, subject to applicable exemptions.

Cookies and Similar Technologies

We use cookies and similar technologies to support website functionality, collect analytics and deliver relevant content. Cookies help us maintain session state, remember preferences and understand how the site is used.

Cookies we use include essential cookies required for site operation, performance cookies for analytics, functionality cookies to remember preferences and targeting cookies used to tailor content and marketing where permitted.

Essential cookies enable basic features and are necessary for secure login and site navigation. Performance cookies collect anonymous usage data. Functionality cookies store preferences. Targeting cookies may be used to measure and tailor marketing activity.

Most browsers allow you to delete or block cookies through settings. You can manage cookie preferences via browser controls or opt-out mechanisms provided by certain analytics and advertising providers. Disabling some cookies may affect site functionality.

Cookie Policy

Data Sharing and Disclosure

We share personal information only as needed to deliver services, with service providers who process data on our behalf, and when required by law. Disclosures are limited and governed by contracts that require appropriate protections.

• Service providers and vendors such as hosting providers, payment processors and learning platform partners who process data under our instructions.
• Employers, sponsors or third parties who register participants or cover program fees, where they have a legitimate interest in participant information.
• Legal and regulatory bodies in response to lawful requests, subpoenas or to comply with legal obligations.
• Professional advisors such as auditors, lawyers and accountants who provide services to ChiefLabLead subject to confidentiality obligations.
• In connection with a business transfer such as a merger, acquisition or sale, subject to standard due diligence and confidentiality safeguards.
• Aggregated or anonymized data that does not identify individuals may be shared for research, reporting or program evaluation purposes.

International Data Transfers

Because we work with international service providers and participants, personal information may be transferred to and processed in other countries. Transfers are managed in accordance with applicable law and only where appropriate safeguards are in place.

Safeguards may include contractual protections, standard contractual clauses, data processing agreements, technical measures such as encryption, and assessments of vendor security practices to protect data during and after transfer.

Data Retention

We retain personal information for as long as necessary to provide services, meet legal obligations and for legitimate business purposes such as recordkeeping and program evaluation. Retention periods are determined by the nature of the data and applicable legal requirements.

Account and enrollment records are retained for the duration of the participant relationship and for a reasonable period afterward to support certificates, references and compliance obligations, typically several years consistent with accounting and regulatory requirements.

Communications, messages and support interactions are retained for a period necessary to address requests, resolve issues and for quality assurance. Specific retention periods depend on the type of communication and the applicable legal framework.

System logs and technical records are retained for operational and security purposes for a period consistent with our monitoring and incident response needs, after which they are securely deleted or archived.

When retention periods expire or on valid deletion requests, we take reasonable steps to securely delete or anonymize personal information unless further retention is required by law. Deletion requests are handled according to applicable procedures described below.

Security

We implement administrative, technical and physical measures to protect personal information against unauthorized access, disclosure, alteration or destruction. Security measures are designed to reflect the sensitivity of the data and current industry practices.

• Encryption of data in transit using secure protocols and encryption at rest for select systems.
• Access controls, role-based permissions and multi-factor authentication for staff systems that handle personal data.
• Regular security assessments, vendor due diligence, staff training and incident response procedures to identify and address vulnerabilities.

Your Rights

Depending on jurisdiction and applicable law, you may have rights regarding your personal information. Below is a summary of common rights and how they apply to interactions with ChiefLabLead.

• Right to access personal data we hold about you and to receive a copy in a commonly used format.
• Right to request correction of inaccurate or incomplete information.
• Right to request deletion of personal data, subject to legal and contractual retention obligations.
• Right to request restriction of processing in certain circumstances, for example when accuracy is contested.
• Right to data portability where applicable to receive provided data in a structured, machine-readable format.
• Right to object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent to processing where processing is based on consent; withdrawal does not affect prior lawful processing.
• Right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated.

How to Exercise Your Rights

To exercise your rights, submit a request by mail to our address or contact us via the website contact form. Include sufficient information to identify yourself and specify the request. We may need to verify your identity before fulfilling a request to protect your data and privacy.

[email protected]

We aim to respond to rights requests promptly and normally within 30 calendar days. Complex requests or those requiring third-party coordination may take longer; if so, we will provide an update and a reasonable timeframe, generally not exceeding 60 days unless additional legal requirements apply.