Privacy Policy

1. Corporate identity and application

This policy applies to information under the control of Two Rivers Digital in connection with:

• the public website at protogrants.ca;
• product inquiries, demonstrations, procurement, implementation, training and support relating to ProtoGrants; and
• other correspondence voluntarily sent to Two Rivers Digital about ProtoGrants.

This policy does not govern information controlled by a Customer in the Customer's Microsoft environment. That information is subject to the Customer's policies, agreements and legal obligations. If this policy conflicts with a written agreement between Two Rivers Digital and a Customer, the written agreement governs to the extent of the conflict.

Two Rivers Digital administers this policy in accordance with applicable Canadian privacy and anti-spam law, including the Personal Information Protection and Electronic Documents Act where it applies and Canada's anti-spam legislation.

2. Definitions

Customer means an organization that acquires or evaluates ProtoGrants, contracts Two Rivers Digital for related professional services, or requests information about the product.

Personal information means information about an identifiable individual.

Business contact information means a person's name, job title, work address, work email address or work telephone number used to communicate with that person about their work.

Customer data means information stored by a Customer in its own instance of ProtoGrants or Microsoft Power Platform.

3. Customer data and the installed application

ProtoGrants is installed in the Microsoft tenant and Dataverse environment selected and controlled by the Customer. Customer data remains in that environment and is not transmitted to, hosted by or stored in a Two Rivers Digital system.

The installed application has no publisher telemetry, Two Rivers Digital analytics service, advertising tracker, external Two Rivers Digital application database or automatic export of Customer data. Installation does not grant Two Rivers Digital access to Customer users, records, files or grant-application information.

A Customer controls its users, security roles, data location, retention, deletion, backup and privacy obligations. Requests concerning Customer data must be directed to that Customer. Two Rivers Digital cannot access, correct, export or delete Customer data unless the Customer separately provides specific access or information for an authorized service engagement.

If a Customer voluntarily includes personal information in a support request or separately grants access for an authorized service engagement, that information is handled only for the requested service, under the Customer's instructions and the applicable agreement. It is not collected by the installed ProtoGrants application.

4. Information received directly by Two Rivers Digital

Two Rivers Digital may receive business contact information and correspondence when a person voluntarily contacts us, requests product information or a demonstration, participates in procurement, or works with us on implementation, training or support.

We use that information only to respond to the request; provide and administer the requested product information or services; manage the corresponding business relationship; maintain security; establish, exercise or defend legal rights; and satisfy contractual or legal obligations.

ProtoGrants.ca is a static information website. It has no user accounts, grant-application form, payment function, advertising service or analytics service. The hosting provider may automatically process limited network and security information necessary to deliver and protect the website.

Two Rivers Digital demonstrations are for fictional or deidentified information only. They must not be used for real grant applications or personal information.

5. Consent and lawful authority

Two Rivers Digital obtains consent for the collection, use and disclosure of personal information where consent is required. Consent may be express or implied, depending on the circumstances and the sensitivity of the information. We may handle information without consent where applicable law permits or requires it.

A person may withdraw consent on reasonable notice, subject to legal or contractual restrictions. Withdrawal does not affect handling that occurred lawfully before the withdrawal and may limit our ability to provide a requested service.

6. Disclosure and service providers

Two Rivers Digital does not sell, rent or trade personal information. We do not receive Customer data through the installed ProtoGrants application and do not use Customer data for advertising, profiling or marketing.

Information received directly by Two Rivers Digital may be disclosed only:

• to service providers acting for us under appropriate confidentiality and security obligations;
• to professional advisers who owe duties of confidentiality;
• as directed or authorized by the Customer or individual concerned;
• in connection with a proposed or completed corporate transaction, subject to applicable legal safeguards; or
• where disclosure is permitted or required by law, legal process, or the protection of people, rights, systems or services.

Microsoft provides the cloud infrastructure used for our website, email and business systems and may process limited information in that capacity.

7. Retention, destruction and safeguards

Business contact information and correspondence received directly by Two Rivers Digital may be stored in our Microsoft 365 or Dynamics 365 environment. We retain it only for as long as reasonably necessary for the purpose for which it was received and for applicable contractual, legal, accounting or dispute-resolution requirements. It is then securely deleted, destroyed or deidentified.

Two Rivers Digital uses administrative, technical and physical safeguards appropriate to the sensitivity of information under our control. These safeguards include identity and access controls, role-based permissions, encrypted network connections, logging and procedures intended to prevent unauthorized access, use, disclosure, alteration or loss.

No method of transmission or storage is completely secure. If a breach affecting personal information under our control occurs, Two Rivers Digital will investigate, mitigate and provide notices or reports required by applicable law.

8. Access, correction and complaints

Subject to applicable legal exceptions, a person may request access to personal information under the control of Two Rivers Digital, ask how it has been used or disclosed, request correction of inaccurate information, withdraw consent, or make a complaint about our practices. We may take reasonable steps to verify identity before responding.

For information in a Customer's installed ProtoGrants application, contact that Customer. Two Rivers Digital does not control those records and cannot process an access, correction, export or deletion request for them.

If a concern is not resolved after contacting us, a person may contact the Office of the Privacy Commissioner of Canada or another privacy regulator with jurisdiction.

9. Canada's anti-spam legislation

Two Rivers Digital sends commercial electronic messages only with consent or another lawful basis. A commercial message sent by us will identify the sender and include a practical unsubscribe method where required by law. We process unsubscribe requests without delay and within the period required by law.

Two Rivers Digital does not use information entered in ProtoGrants for marketing.

10. Third-party services, changes and governing law

Our website may link to third-party websites or services. Two Rivers Digital does not control and is not responsible for their privacy practices.

We may amend this policy from time to time. The revised policy will be posted on this page with a new effective date. Material changes affecting an active Customer relationship may also be communicated to the applicable business contact.

This policy is interpreted under the applicable laws of Canada and Manitoba. It does not create rights or obligations beyond those provided by applicable law or a binding written agreement.

11. Corporate information and Privacy Officer

Questions, requests and complaints concerning information under the control of Two Rivers Digital should be sent to: