This Privacy and Security Policy (“Policy”) describes how Changoo & Associates (“C&A,” “we,” “our,” or “us”) collects, uses, discloses, safeguards, and retains personal information in connection with our corporate website (the “Site”) and professional advisory activities. In particular, it explains our approach to confidentiality, data protection, and individual privacy rights.
Last Updated: October 13, 2026
The Policy explains our information-handling practices and the choices available to individuals whose personal information we process.
The Privacy and Security Policy of Changoo & Associates (“C&A,” “we,” “our,” or “us”) describes how we collect, use, disclose, safeguard, and retain personal information in connection with our corporate website and professional advisory activities.
This Policy is intended to explain our information-handling practices and the choices available to individuals whose personal information we process.
1. Scope & Accountability
This Policy applies to personal information processed in connection with:
- Use of the Site, including inquiry and subscription forms;
- Prospective and existing advisory relationships;
- Business development and professional communications;
- Meetings, events, and mandate coordination;
- Recruitment, contractor, and professional-collaboration activities; and
- Other interactions with C&A where personal information is provided or collected.
C&A is responsible for personal information under its control in accordance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”), where applicable.
Where the EU General Data Protection Regulation (“EU GDPR”), UK GDPR, or another privacy law applies to a particular processing activity, C&A will process personal information in accordance with the applicable requirements of that law.
Privacy Accountability
C&A has designated responsibility for privacy compliance to its Privacy Officer.
Questions, access requests, corrections, complaints, or other privacy inquiries may be directed to:
Privacy Officer
Changoo & Associates
Toronto, Ontario, Canada
Email: [email protected]
2. Information We May Collect
Depending on the nature of the interaction, we may collect the following categories of personal information.
Contact & Identity Information
Name, professional title, organization, email address, telephone number, mailing address, and related contact information.
Business & Mandate Information
Company information, project or transaction details, ownership or organizational information, capital requirements, professional correspondence, and other information relevant to evaluating or performing an advisory mandate.
Due-Diligence & Compliance Information
Where appropriate, we may collect information required for identity verification, conflict review, sanctions screening, counterparty diligence, or other compliance procedures required by law, contract, professional standards, counterparties, or the nature of the engagement.
Recruitment & Professional Collaboration Information
Curricula vitae, professional biographies, qualifications, references, professional experience, and other information voluntarily submitted in connection with employment, contractor, referral, or advisory-collaboration opportunities.
Technical & Usage Information
Information generated through use of the Site, which may include IP address, browser type, device information, pages viewed, timestamps, referral information, and analytics data.
Voluntary Submissions
Information contained in forms, correspondence, meeting requests, surveys, event registrations, newsletters, data-room submissions, and other materials voluntarily provided to C&A.
Information may be collected directly from you, from organizations with which you are associated, from publicly available sources, from professional or commercial counterparties, or from service providers where permitted by applicable law.
3. Purposes for Processing
We may use personal information to:
- Respond to inquiries and communicate with prospective or existing clients;
- Evaluate potential advisory mandates;
- Provide and administer professional advisory services;
- Conduct appropriate identity, conflict, sanctions, compliance, or counterparty reviews;
- Coordinate diligence and advisory workstreams;
- Administer contracts, billing, records, and professional relationships;
- Operate, secure, maintain, and improve the Site;
- Administer recruitment and professional-collaboration processes;
- Protect C&A, its clients, counterparties, systems, and legal rights;
- Comply with applicable legal, regulatory, contractual, tax, accounting, and recordkeeping requirements; and
- Send professional updates, publications, invitations, or other communications where permitted by applicable law.
We limit collection, use, and disclosure of personal information to purposes that are identified, appropriate, and reasonably necessary in the circumstances.
4. Consent & Other Legal Bases
Where consent is required, C&A seeks consent appropriate to the sensitivity of the information and the circumstances in which it is collected, used, or disclosed.
Consent may be express or implied where permitted by applicable law and may be withdrawn subject to legal, contractual, or operational limitations.
We do not condition access to unrelated services on consent to unnecessary collections, uses, or disclosures.
EU/UK Processing
Where the EU GDPR or UK GDPR applies, C&A may process personal information on one or more of the following bases:
- Performance of a contract or steps taken at an individual’s request before entering into a contract;
- Compliance with a legal obligation;
- C&A’s or a third party’s legitimate interests, where those interests are not overridden by the individual’s rights and freedoms; or
- Consent, where consent is the appropriate lawful basis.
The applicable basis depends on the nature and purpose of the processing.
5. Professional Communications & Marketing
C&A may send newsletters, publications, event invitations, professional updates, or other commercial electronic communications where we have consent or another basis permitted under applicable law.
Communications will include an appropriate method to unsubscribe where required.
An individual may opt out of non-essential marketing communications at any time. Opting out of marketing does not prevent C&A from sending communications necessary to administer an existing professional or contractual relationship.
6. Disclosure of Information
C&A does not sell personal information.
We may disclose personal information where reasonably necessary to the following categories of recipients.
Service Providers
Technology, hosting, communications, document-management, analytics, professional, compliance, or other service providers supporting our operations, subject to appropriate confidentiality or contractual safeguards.
Professional Advisors
Legal counsel, accountants, auditors, consultants, technical specialists, and other professional advisors where relevant to C&A’s operations or an advisory mandate.
Mandate Counterparties
Financial institutions, professional advisors, transaction counterparties, diligence providers, or other participants where disclosure is relevant to an advisory mandate and is authorized, reasonably expected, contractually permitted, or otherwise lawful.
Governmental or Regulatory Authorities
Courts, regulators, law-enforcement bodies, governmental authorities, or other entities where disclosure is required or permitted by law.
Corporate Transactions
A potential purchaser, successor, assignee, or professional advisor in connection with a proposed or completed merger, sale, restructuring, financing, or transfer of all or part of C&A’s business, subject to appropriate safeguards.
C&A seeks to disclose only information reasonably necessary for the relevant purpose.
7. International Processing & Transfers
C&A operates in a cross-border advisory environment and may use service providers or work with professional counterparties located outside Canada.
Accordingly, personal information may be processed or stored in Canada or other jurisdictions.
Where information is transferred to a service provider outside Canada, C&A remains responsible for personal information under its control and uses contractual, organizational, or other appropriate measures to address privacy and security requirements.
Information processed in another jurisdiction may also be subject to the laws of that jurisdiction and may be accessible to courts, law-enforcement agencies, national-security authorities, or other governmental bodies in accordance with applicable local law.
8. Privacy and Security Policy: Confidentiality & Information Security
C&A maintains administrative, technical, contractual, and organizational safeguards appropriate to the sensitivity of the personal information and the risks associated with its processing.
Depending on the systems and information involved, safeguards may include measures relating to:
- Access authorization and account controls;
- Secure transmission and storage;
- Confidentiality obligations;
- Service-provider and contractual protections;
- Information handling and retention procedures; and
- Incident identification and response.
No method of electronic transmission, processing, or storage is completely secure. Accordingly, while C&A takes reasonable measures to protect information under its control, absolute security cannot be guaranteed.
Users and counterparties are also responsible for maintaining appropriate safeguards over their own systems, accounts, credentials, and communications.
9. Security Incidents & Privacy Breaches
C&A maintains procedures for assessing and responding to suspected loss, unauthorized access, use, disclosure, or other compromise of personal information.
Where required by applicable law, C&A will:
- Assess the nature and potential consequences of the incident;
- Take reasonable steps to contain and mitigate the incident;
- Notify affected individuals;
- Report the incident to the appropriate privacy or regulatory authority; and
- Maintain required records of security incidents and privacy breaches.
10. Data Retention
C&A retains personal information only for as long as reasonably necessary for the purposes for which it was collected or as required to satisfy legal, contractual, tax, accounting, professional, dispute-resolution, or recordkeeping requirements.
Retention periods vary according to:
- The type and sensitivity of the information;
- The nature and duration of the professional relationship;
- Applicable contractual and legal requirements;
- Potential or actual disputes or claims; and
- Legitimate business and recordkeeping requirements.
When personal information is no longer required, C&A will take reasonable steps to securely delete, destroy, de-identify, or anonymize it, as appropriate.
11. Access, Correction & Privacy Rights
Under this Privacy and Security Policy, and subject to applicable law, individuals may request information regarding the personal information C&A holds about them. In addition, individuals may request correction of inaccurate or incomplete information.
Depending on the applicable jurisdiction, additional rights may include the right to:
- Withdraw consent where processing is based on consent;
- Request deletion of personal information, subject to applicable exceptions;
- Object to or restrict certain processing;
- Request portability of certain information; and
- Lodge a complaint with an applicable privacy or supervisory authority.
Certain requests may be subject to identity verification and limitations imposed by law, privilege, confidentiality obligations, contractual requirements, or the rights of other individuals.
Requests may be directed to [email protected].
Individuals may also have the right to contact the Office of the Privacy Commissioner of Canada or another applicable privacy or supervisory authority.
12. Cookies & Analytics
The Site may use cookies and similar technologies necessary for website operation, security, functionality, performance, and analytics.
Depending on the Site configuration, these technologies may include:
- Essential or functional cookies;
- Security-related technologies;
- Traffic and performance analytics; and
- Third-party analytics services such as Google Analytics.
Where required by applicable law, C&A obtains consent before placing or accessing non-essential cookies or similar technologies.
Users may also control certain cookies through browser settings or available Site preference controls. Disabling certain technologies may affect Site functionality.
Third-party providers process information in accordance with their own terms and privacy policies.
13. Third-Party Websites & Platforms
The Site may contain links to websites, social networks, publications, data rooms, or other third-party services.
C&A does not control the privacy or security practices of third parties and is not responsible for their independent handling of personal information.
Users should review the applicable privacy terms before submitting information to third-party services.
14. Children’s Privacy
C&A’s Site and professional services are intended for businesses and professional users and are not directed to children.
We do not knowingly solicit personal information from individuals under 18 for purposes unrelated to legitimate professional, recruitment, or contractual activities permitted by applicable law.
If you believe personal information concerning a minor has been submitted inappropriately, please contact us.
15. Legal & Compelled Disclosures
C&A may collect, use, preserve, or disclose information where reasonably necessary and permitted by law to:
- Comply with legal process or an enforceable governmental request;
- Satisfy applicable legal, regulatory, professional, or contractual requirements;
- Investigate suspected fraud, misconduct, or security incidents;
- Enforce agreements or protect legal rights;
- Establish, exercise, or defend legal claims; or
- Protect the safety, rights, or property of C&A, its clients, counterparties, or others.
16. Changes to This Policy
C&A may update this Policy periodically to reflect changes in its practices, technology, legal requirements, or professional activities.
The date shown at the top of this Policy will indicate the most recent revision.
Where a change materially affects how personal information is collected, used, or disclosed, C&A will provide additional notice or obtain consent where required by applicable law.
17. Contact
For privacy questions, requests, or complaints:
Privacy Officer
Changoo & Associates
Toronto, Ontario, Canada
Email: [email protected]