Let's ReWork
000
Your data

Nuvocare SASU, trading as TheRework, takes your privacy seriously. This policy explains what personal information we collect through www.therework.ca, why we collect it, who we share it with, how long we keep it and what rights you can exercise.

Last updated: 26 August 2026

Who is accountable for your information

Organization
Nuvocare SASU, trading as TheRework
Registered office
36 rue Boussingault, 75013 Paris, France
Registration
Paris Trade and Companies Register (RCS) 952 222 438
Person responsible for personal information
Paul-Arno Garrido, President
Privacy contact
hello@therework.ca

We are accountable for the personal information in our custody, including information handled by the service providers we work with. Any privacy question, request or complaint can be sent to hello@therework.ca and will be handled by Paul-Arno Garrido, designated as the person responsible for the protection of personal information.

Information we collect

We apply the principle of data minimization: we only collect what we need in order to assess your project and reply to you. No account is required to browse the site.

CategoryInformation concernedSource
Contact formName, work email address, website URL, company name, industry, biggest bottleneck, tools and CRM in use, budget range, timeline, project notes, browsing languageProvided by you
CorrespondenceThe content of emails and exchanges relating to your enquiryProvided by you
Technical dataIP address, date and time of the request, pages viewed, browser and operating system type, referring siteCollected automatically in the hosting provider's logs
Approximate locationISO country code derived from your IP address (for example "CA"), not retainedComputed by the hosting provider, used only to point you to the right regional site

We collect no sensitive information — health, financial account numbers, government identifiers, biometrics. Please do not send any through the form.

The site performs no profiling and no automated decision-making that produces legal or similarly significant effects.

The form contains a hidden "honeypot" field used to detect bots. It is never visible to, or filled in by, a human visitor and collects no personal information.

Why we collect it, and how long we keep it

Under PIPEDA we identify our purposes before collecting information and rely on your consent. Submitting the contact form is an express indication of consent to be contacted about your enquiry. For visitors in the European Economic Area or the United Kingdom, the corresponding GDPR legal basis is shown below.

PurposeBasisRetention period
Responding to your audit or project enquiry and corresponding with youYour consent (PIPEDA) / steps taken at your request before entering into a contract, art. 6(1)(b) GDPR3 years from your last contact
Business development and follow-up with prospectsYour consent (PIPEDA) / legitimate interest, art. 6(1)(f) GDPR3 years from your last contact
Delivering our services and managing the client relationshipPerformance of the contractDuration of the engagement, then archived for evidential purposes
Site security, abuse prevention and technical diagnosticsLegitimate interestTechnical logs: 30 days maximum
Remembering the regional site and language you choseNecessary to deliver the service you asked for12 months (geo_stay and NEXT_LOCALE cookies)
Meeting our accounting and tax obligationsLegal obligationAs required by law, up to 10 years for accounting records

We will not use your information for a new purpose without telling you and, where required, obtaining your consent. Once these periods expire, information is deleted or irreversibly anonymized.

You can withdraw your consent at any time, subject to legal and contractual restrictions and reasonable notice, by writing to hello@therework.ca. Withdrawing consent may mean we can no longer respond to your enquiry.

Service providers and cross-border processing

Your information is never sold, rented or traded. It is accessible only to the people at TheRework who need it in order to handle your enquiry, and to the service providers listed below, which are contractually bound to protect it and to use it only for the purposes we specify.

ProviderRoleCountry of processing
Vercel Inc.Site hosting and technical logsUnited States
Resend (Plus Five Five, Inc.)Delivery of the emails generated by the contact formUnited States
Google Ireland Limited (Google Workspace)Business email: receipt and storage of the emails relating to your enquiryIreland / United States

Information may be stored or processed outside Canada, including in the United States and the European Union. While it is in another country, it is subject to the laws of that country and may be accessible to its courts, law enforcement and national-security authorities under those laws. This is required by PIPEDA to be disclosed to you.

Transfers to the United States from the European Economic Area are covered either by the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, where the provider is certified under it, or by the European Commission's standard contractual clauses.

Google Workspace is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be processed on its infrastructure in the European Union and in the United States. Your information may finally be disclosed to our professional advisers, or to authorities where the law requires it.

Cookies and tracking

The site uses no advertising cookies, no analytics tools and no behavioural tracking, and we do not sell or share personal information for advertising purposes.

The only items stored on your device are those strictly necessary to deliver the service you asked for:

NameTypePurposeLifetime
geo_stayCookieRemembers the regional site (.ca, .us or .fr) you chose, so you are no longer redirected automatically12 months
NEXT_LOCALECookieRemembers the display language you selected (English or French)12 months
geo-banner-dismissedLocal storageRemembers that you dismissed the banner offering your region's siteUntil you clear it

Fonts, images and video are all served from our own servers: displaying them triggers no connection to a third-party service.

You can delete these items at any time from your browser settings. The site will remain fully functional, but your regional site and language preferences will no longer be remembered.

Safeguards

The site is served exclusively over HTTPS: anything you type into the contact form is encrypted in transit.

We apply physical, organizational and technological safeguards proportionate to the sensitivity of the information: access limited to authorized people only, strong authentication on our tools, minimization of what we collect, and no payment data stored on the site.

No system is infallible. Should a breach of security safeguards create a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify the individuals concerned, as PIPEDA requires.

Your rights

Wherever you live, you can ask us to:

  • Access — confirm whether we hold information about you, tell you how it has been used, and give you a copy.
  • Correct — update information that is inaccurate or incomplete.
  • Delete — remove your information, within the limits of our legal retention obligations.
  • Withdraw consent — stop using your information for the purposes you consented to, subject to legal and contractual restrictions.
  • Port — receive the information you gave us in a structured, commonly used, machine-readable format.

If you are a Quebec resident, Law 25 also gives you the right to de-index information published online about you and the right to be informed of any automated decision — we make none.

If you are in the European Economic Area or the United Kingdom, the GDPR additionally gives you the right to restrict processing, to object to processing based on our legitimate interest, and to set instructions on what happens to your data after your death.

To exercise any of these rights, write to hello@therework.ca stating what you are asking for. We reply within 30 days. Proof of identity may be requested if there is reasonable doubt as to who you are.

Complaints

If you are not satisfied with how we have handled your information, please tell us first — most issues are resolved quickly.

You may also complain to the regulator: the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3 — priv.gc.ca. Quebec residents may complain to the Commission d'accès à l'information du Québec — cai.gouv.qc.ca. Visitors in the European Union may complain to their national supervisory authority or, for our company, to the French CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.

Changes to this policy

This policy may be updated to reflect legal, technical or organizational changes. The version that applies is the one published on this page, and its last-updated date appears at the top of the document.

Where a change is significant, we will inform the individuals concerned by any appropriate means.