Nuvocare SASU, trading as TheRework, takes your privacy seriously. This policy explains what personal information we collect through www.therework.ca, why we collect it, who we share it with, how long we keep it and what rights you can exercise.
Last updated: 26 August 2026
Who is accountable for your information
- Organization
- Nuvocare SASU, trading as TheRework
- Registered office
- 36 rue Boussingault, 75013 Paris, France
- Registration
- Paris Trade and Companies Register (RCS) 952 222 438
- Person responsible for personal information
- Paul-Arno Garrido, President
- Privacy contact
- hello@therework.ca
We are accountable for the personal information in our custody, including information handled by the service providers we work with. Any privacy question, request or complaint can be sent to hello@therework.ca and will be handled by Paul-Arno Garrido, designated as the person responsible for the protection of personal information.
Information we collect
We apply the principle of data minimization: we only collect what we need in order to assess your project and reply to you. No account is required to browse the site.
| Category | Information concerned | Source |
|---|---|---|
| Contact form | Name, work email address, website URL, company name, industry, biggest bottleneck, tools and CRM in use, budget range, timeline, project notes, browsing language | Provided by you |
| Correspondence | The content of emails and exchanges relating to your enquiry | Provided by you |
| Technical data | IP address, date and time of the request, pages viewed, browser and operating system type, referring site | Collected automatically in the hosting provider's logs |
| Approximate location | ISO country code derived from your IP address (for example "CA"), not retained | Computed by the hosting provider, used only to point you to the right regional site |
We collect no sensitive information — health, financial account numbers, government identifiers, biometrics. Please do not send any through the form.
The site performs no profiling and no automated decision-making that produces legal or similarly significant effects.
The form contains a hidden "honeypot" field used to detect bots. It is never visible to, or filled in by, a human visitor and collects no personal information.
Why we collect it, and how long we keep it
Under PIPEDA we identify our purposes before collecting information and rely on your consent. Submitting the contact form is an express indication of consent to be contacted about your enquiry. For visitors in the European Economic Area or the United Kingdom, the corresponding GDPR legal basis is shown below.
| Purpose | Basis | Retention period |
|---|---|---|
| Responding to your audit or project enquiry and corresponding with you | Your consent (PIPEDA) / steps taken at your request before entering into a contract, art. 6(1)(b) GDPR | 3 years from your last contact |
| Business development and follow-up with prospects | Your consent (PIPEDA) / legitimate interest, art. 6(1)(f) GDPR | 3 years from your last contact |
| Delivering our services and managing the client relationship | Performance of the contract | Duration of the engagement, then archived for evidential purposes |
| Site security, abuse prevention and technical diagnostics | Legitimate interest | Technical logs: 30 days maximum |
| Remembering the regional site and language you chose | Necessary to deliver the service you asked for | 12 months (geo_stay and NEXT_LOCALE cookies) |
| Meeting our accounting and tax obligations | Legal obligation | As required by law, up to 10 years for accounting records |
We will not use your information for a new purpose without telling you and, where required, obtaining your consent. Once these periods expire, information is deleted or irreversibly anonymized.
You can withdraw your consent at any time, subject to legal and contractual restrictions and reasonable notice, by writing to hello@therework.ca. Withdrawing consent may mean we can no longer respond to your enquiry.
Service providers and cross-border processing
Your information is never sold, rented or traded. It is accessible only to the people at TheRework who need it in order to handle your enquiry, and to the service providers listed below, which are contractually bound to protect it and to use it only for the purposes we specify.
| Provider | Role | Country of processing |
|---|---|---|
| Vercel Inc. | Site hosting and technical logs | United States |
| Resend (Plus Five Five, Inc.) | Delivery of the emails generated by the contact form | United States |
| Google Ireland Limited (Google Workspace) | Business email: receipt and storage of the emails relating to your enquiry | Ireland / United States |
Information may be stored or processed outside Canada, including in the United States and the European Union. While it is in another country, it is subject to the laws of that country and may be accessible to its courts, law enforcement and national-security authorities under those laws. This is required by PIPEDA to be disclosed to you.
Transfers to the United States from the European Economic Area are covered either by the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, where the provider is certified under it, or by the European Commission's standard contractual clauses.
Google Workspace is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be processed on its infrastructure in the European Union and in the United States. Your information may finally be disclosed to our professional advisers, or to authorities where the law requires it.
Safeguards
The site is served exclusively over HTTPS: anything you type into the contact form is encrypted in transit.
We apply physical, organizational and technological safeguards proportionate to the sensitivity of the information: access limited to authorized people only, strong authentication on our tools, minimization of what we collect, and no payment data stored on the site.
No system is infallible. Should a breach of security safeguards create a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify the individuals concerned, as PIPEDA requires.
Your rights
Wherever you live, you can ask us to:
- Access — confirm whether we hold information about you, tell you how it has been used, and give you a copy.
- Correct — update information that is inaccurate or incomplete.
- Delete — remove your information, within the limits of our legal retention obligations.
- Withdraw consent — stop using your information for the purposes you consented to, subject to legal and contractual restrictions.
- Port — receive the information you gave us in a structured, commonly used, machine-readable format.
If you are a Quebec resident, Law 25 also gives you the right to de-index information published online about you and the right to be informed of any automated decision — we make none.
If you are in the European Economic Area or the United Kingdom, the GDPR additionally gives you the right to restrict processing, to object to processing based on our legitimate interest, and to set instructions on what happens to your data after your death.
To exercise any of these rights, write to hello@therework.ca stating what you are asking for. We reply within 30 days. Proof of identity may be requested if there is reasonable doubt as to who you are.
Complaints
If you are not satisfied with how we have handled your information, please tell us first — most issues are resolved quickly.
You may also complain to the regulator: the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3 — priv.gc.ca. Quebec residents may complain to the Commission d'accès à l'information du Québec — cai.gouv.qc.ca. Visitors in the European Union may complain to their national supervisory authority or, for our company, to the French CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.
Changes to this policy
This policy may be updated to reflect legal, technical or organizational changes. The version that applies is the one published on this page, and its last-updated date appears at the top of the document.
Where a change is significant, we will inform the individuals concerned by any appropriate means.