# APGI shared privacy notice

Version 1.0 · Effective 5 November 2026

## 1. Who is responsible

Assurance Protection Group Inc. (APGI) provides professional training, advisory services and digital tools for governance, risk management, operational assurance and resilience. This notice covers APGI-operated services that expressly link to it, including the public website, APGI Training, the Maturion ecosystem and the APGI Content Command Centre. It applies to personal information, including personal information within business records; it does not make confidential business information public.

For APGI's own enquiries, account administration, marketing and service operations, APGI determines the purposes and means of handling information. Where APGI operates a company portal or processes an organisation's records on that organisation's instructions, the relevant agreement identifies that organisation's responsibilities and APGI's service-provider role. In South African terminology these roles may be described as responsible party and operator.

A shareholder's or client's separate branding or domain does not by itself identify who controls the information. The company-specific notice and service agreement must identify the organisation responsible, its contact and any additional purposes. A company using APGI's platform cannot rely on this notice to describe processing it undertakes independently.

Primary privacy contact: Adriaan Jordaan, [jorrie.jordaan@apginc.ca](mailto:jorrie.jordaan@apginc.ca), telephone [+1 (416) 476-1407](tel:+14164761407). Alternate privacy contact and Africa contact: Johan Ras, [johan.ras@apginc.ca](mailto:johan.ras@apginc.ca), telephone [+27 62 995 7293](tel:+27629957293).

Business/postal address: Suite 310, 3660 Midland Avenue, Scarborough, Ontario M1V 0B8, Canada.

## 2. Information we handle and its sources

The information depends on the service and the features you use. We obtain it from you, your authorised organisation or administrator, your activity in the service, connected services you authorise, and service providers supporting delivery.

- Contact and account information: name, work email, organisation, role, contact details, account identifiers and sign-in/security events.
- Training information: invitations, enrolments, course access, learning activity, submitted assessments and practical work, marks, feedback, completion records and certificates.
- Company and operational information: authorised company profiles, governance and maturity assessments, risk registers, implementation actions, evidence documents and associated personal information supplied for an engagement.
- Support and communications: questions, messages, review comments, approvals, delivery records and correspondence. Where enabled and disclosed, communications may also generate engagement or read records; delivery is not proof that a person read or approved a document.
- AI interactions: the prompt, selected conversation context, uploaded material or retrieved extracts needed to answer the request, together with service and usage records where the relevant AI feature is enabled.
- Publishing information: prepared media and captions, Page identifiers, schedules, approvals, publication results and the credentials an authorised operator supplies to connect a service.
- Transaction information: purchase or allocation details, payment status, invoice references and processor identifiers where payments are enabled. Payment-card handling follows the checkout provider's notice; this statement does not claim that every payment feature is live.
- Technical information: IP address, browser/device information, timestamps, requested pages and diagnostic/security logs generated by hosting and delivery services.

Only provide personal information you are authorised to share. Do not put passwords, unrelated identity documents, medical information or confidential employee records into a general support message or AI prompt. A separate, authorised workflow and notice are needed where sensitive operational or employee information is genuinely required.

## 3. Why we use information

We use information to respond to enquiries; establish and administer accounts and organisation access; deliver training and preserve appropriate learning evidence; perform the advisory or operational service requested; process authorised transactions; provide support; prepare and publish approved communications; protect services; resolve disputes; and meet applicable record-keeping obligations.

An organisation's uploaded records are used for its authorised service purposes. A connection to payroll, HR, procurement, SCADA or another operational system requires its own agreed scope, access controls and appropriate notice before that processing begins. Describing a future integration in a product roadmap does not activate it or authorise unrestricted data collection.

Where consent is required, we ask for it at the relevant point. Other processing may be permitted or required for an agreement, a legal duty or another basis available under the law that applies. We explain material additional purposes and obtain further consent where required. This notice is not blanket consent to every possible use of an APGI app.

APGI does not sell personal information or use confidential client records, learner submissions or LinkedIn API information to train general-purpose AI models. External AI-provider handling must also match the actual service contract and configuration; a statement in this notice does not alter a provider's terms.

## 4. Details for each service

### APGI websites and this privacy centre

Public information pages provide company information and links to services. This privacy centre has no account registration, submission form, advertising tag or analytics script added by APGI in this release. Contact links open your email or telephone application. Hosting providers can still process technical request information and security logs. Other APGI websites may use different plugins or features and must provide appropriate additional information.

### APGI Training and company portals

The training service handles accounts, company permissions, enrolments, learning records, assessments, review decisions, communications and commercial records for the features enabled. Authorised company administrators and appointed assessors/reviewers can receive information needed for their role. Their access must be limited to the relevant organisation, learner or review assignment.

Course-access expiry and deletion of learning records are different matters. Ending a course or subscription does not automatically erase marks, certificates or records that remain necessary or lawfully retained. An employer or training sponsor may have its own responsibilities and retention rules. Contact APGI and the sponsoring organisation if you need to identify the responsible party or exercise a right.

### Maturion and integrated governance, maturity, risk and implementation tools

This section covers APGI-operated Maturion features and linked tools such as MMM, PIT, risk-management modules and the App Management Centre when made available. They may handle authorised organisational records, evidence, user actions and AI requests. A planned module is not represented as an active service merely because it is named here.

When an AI feature is used, the configured service may receive the question and relevant context or document extracts. These transfers must follow the engagement scope and provider arrangements. Do not assume every prompt remains on your device or in your country. Ask APGI which model provider, storage arrangement and regional configuration applies before supplying sensitive material. AI output can be incomplete or incorrect and needs appropriate human assessment before a consequential decision.

### APGI Content Command Centre and LinkedIn

The current desktop connector is designed to work with the APGI Company Page on an authorised administrator's instructions. It handles the Page identifier, prepared post text and video, approval records, scheduled times, API response/status information and publication receipts. It reads an existing APGI Page post to verify access and reads submitted posts to check their publication result. It is not designed to import a member's connection list or private inbox.

An authorised operator supplies an access token. The desktop implementation encrypts that token for the current Windows user and stores its working records in that user's local application-data folder. This description applies to the inspected desktop edition, not a future hosted service. A hosted edition must have its own verified credential-storage and retention arrangements before activation.

An approved post uploads its media and text to LinkedIn and, when published, becomes visible to the chosen audience under LinkedIn's terms and privacy notice. LinkedIn controls its own service records. Revoking a token or disconnecting access prevents subsequent authorised API use; it does not remove an already published post. Request removal of a post separately. You can revoke the relevant developer token or app authorisation through LinkedIn and contact APGI to request deletion of app-held credentials and related data, subject to applicable retention duties. LinkedIn information must also be deleted when required by LinkedIn's applicable API terms.

### AI-assisted media creation

Where APGI uses a media-generation service, the selected provider receives the submitted text, images, audio or other inputs needed to create the asset. The rights and permission to use a person's likeness or voice must be established before submission. This notice does not grant that permission. Generated marketing assets may be published or shared after the relevant approval.

## 5. Who may receive information

Access is limited to people and providers needing it for the relevant purpose: authorised APGI personnel; the applicable company administrators, assessors and reviewers; service providers for hosting, authentication, database/storage, email, payments, AI or media generation; and other recipients you authorise. Information may also be disclosed where required by law or where lawfully necessary to address fraud, a security incident or a legal claim.

Depending on the service and enabled features, providers include Vercel for application hosting; Supabase for training authentication, database and storage; Resend for training email; Render for hosted application/AI services; LinkedIn for connected social publishing; and configured AI/media-generation providers, including xAI for selected video creation. Not every provider processes every user's information. Ask APGI for the providers, processing locations and arrangements applicable to your service before supplying sensitive information.

Linked services have their own privacy notices. We require appropriate arrangements for providers processing information on our behalf. A provider's independent processing, including its handling of an account you hold directly with it, is governed by its own applicable notice and terms.

## 6. International processing

APGI serves organisations in different countries and uses cloud services. Information may be processed outside the country where you or your organisation are located, including where a service provider or its authorised subprocessors operate. The specific countries depend on the service and configuration. APGI can provide the relevant processing-location information for your engagement or company portal.

Before an international transfer requiring particular safeguards, APGI and the responsible organisation must establish the applicable contractual or other lawful arrangements, including any consent required by law. This notice does not promise exclusive Canadian or South African data residency. Ask the privacy contact about the arrangements for your service.

## 7. Retention and deletion

We retain information for the purposes described, the duration and terms of the relevant service, applicable legal/accounting obligations, and proportionate security or dispute requirements. We then delete, de-identify or return information as appropriate. The responsible organisation may direct the treatment of records APGI holds on its behalf, subject to applicable law.

Retention is assessed by category: account and access records; learning and assessment evidence; operational/client evidence; communications; publishing credentials and receipts; transaction records; and technical/security logs. Closing an account, expiring a course, deleting an uploaded source or revoking a connection does not necessarily delete every related record or backup. Backup copies and provider-held records follow the applicable deletion arrangements and retention cycle.

Retention periods differ between services and categories. We assess necessity against the agreed service, ongoing access to learning evidence, applicable law and documented security or dispute requirements, rather than retaining all records indefinitely by default. Contact the privacy contact for the retention applicable to your information, a deletion request and any limits on deletion. APGI coordinates requests affecting its local desktop records and its service providers; records held under a client's instructions may require the client's involvement.

## 8. Security and confidentiality

We use safeguards appropriate to the sensitivity and context of the information. Depending on the service, these include authentication, role and organisation-based access, restrictions on credentials, secure transmission, logging and controlled sharing. Safeguards and recovery arrangements differ by service. Ask APGI about the arrangements needed for your engagement before supplying sensitive operational or employee information.

No system can guarantee absolute security. If an incident affects personal information, APGI will investigate and carry out notifications and other actions required by applicable law and the relevant service agreement. Report a suspected incident to the privacy contact without including passwords or unnecessary sensitive records in an ordinary email.

## 9. Cookies, messages and your choices

Some APGI apps need cookies or similar storage for sign-in, session security, preferences or service delivery. Browser settings can limit storage, but essential functions may stop working. Optional analytics, advertising or tracking technologies need the relevant service's disclosures and choices; this central notice does not authorise undisclosed tracking across every APGI website.

Service messages, account-security notices and required training or agreement communications are distinct from optional marketing. We send optional marketing where consent or another lawful permission applies, and provide a way to opt out. Unsubscribing from marketing does not necessarily stop necessary service notices. Following or interacting with APGI on a social platform also involves that platform's own settings and notice.

## 10. Your rights and requests

Depending on applicable law and APGI's role, you may request access to your personal information, correction, deletion, restriction or objection, withdrawal of consent, or a copy/transfer of information where that right applies. Withdrawal normally concerns future consent-based processing and does not remove lawful retention duties or retrospectively invalidate prior lawful processing.

Email the privacy contact with the service, company and the request you want to make. We may ask for proportionate identity/authority verification through a suitable channel. Do not email a password or a complete identity document unless a secure and necessary verification arrangement has been agreed. We respond within the period required by the law that applies, explain any lawful restriction or extension, and help identify the responsible organisation if APGI processes the records on its behalf.

You can also raise a complaint with the relevant privacy regulator. Depending on jurisdiction, this may include the [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/report-a-concern/) or South Africa's [Information Regulator](https://inforegulator.org.za/contact-us/). Other national, provincial or regional authorities may be responsible in a particular case. Contacting APGI does not remove rights to complain to the appropriate authority.

## 11. Professional services and children

The services described here focus on professional and organisational use. An organisation arranging access for a child must first establish an appropriate arrangement, applicable age/consent requirements and a suitable service notice. APGI does not intend these services to collect information from children without that arrangement. If inappropriate collection involving a child is identified, contact APGI so it can assess and address the matter under applicable law.

## 12. Changes and service-specific notices

Each effective edition will show its version and effective date. Material changes will be communicated through appropriate service channels, with additional consent obtained where required. Earlier editions will be retained as a version history. A new feature, integration, company controller or material data use needs review before the central notice is used to describe it.

This notice describes privacy handling. It does not replace a client processing agreement, a company's own notice, course terms, platform participation agreement, a required employee notice or a statutory access-to-information manual. Inconsistencies must be resolved against the actual service and applicable law rather than by assuming a shared footer link is sufficient.