Privacy Policy

Last updated: January 9, 2026

This Privacy Policy explains how Ruby Industries Inc. (doing business as CityViz) (“CityViz”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal data in connection with the CityViz Data Platform, including client‑specific instances (the “Platform”).

This policy is intended to align with the EU General Data Protection Regulation (GDPR) and related privacy principles. It should be read in conjunction with any client‑specific terms or notices that apply to a particular CityViz instance.

1. Data Controller

For the purposes of the GDPR:

Data Controller: Ruby Industries Inc. (DBA CityViz)
Role: In most cases, CityViz acts as a data processor on behalf of client organizations (e.g., municipalities). For certain administrative and operational data (e.g., platform administration, communications), CityViz acts as a data controller.

Client organizations using the Platform may be independent data controllers for personal data they submit or manage within their own CityViz instance.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

2.1 Information You Provide Directly

Name
Email address
Organization and role
Information submitted through forms (e.g., dataset requests, contact forms, newsletter sign‑ups)
Account credentials and access information for administrative users

2.2 Automatically Collected Information

When you access the Platform, we may automatically collect:

IP address
Browser type and version
Device type and operating system
Pages visited and interactions with the Platform
Date and time of access

2.3 Cookies and Analytics

We use cookies and similar technologies to:

Operate and secure the Platform
Analyze usage and performance
Improve user experience

We may use third‑party analytics services (e.g., Google Analytics). These providers may process usage data on our behalf in accordance with their own privacy policies.

You can manage cookies through your browser settings.

3. Purposes of Processing

We process personal data for the following purposes:

Providing and operating the Platform
Managing user accounts and access
Responding to inquiries and requests
Communicating with users about updates, features, or relevant information
Monitoring usage, performance, and security
Improving and maintaining the Platform
Complying with legal and regulatory obligations

Under the GDPR, we rely on one or more of the following lawful bases:

Consent: Where you have explicitly consented (e.g., newsletter subscriptions)
Contractual necessity: To provide access to and operate the Platform
Legitimate interests: To operate, secure, and improve the Platform, provided such interests are not overridden by your rights
Legal obligation: To comply with applicable laws and regulations

Where processing is based on consent, you may withdraw your consent at any time.

We may share personal data only as necessary with:

Client organizations that operate their own CityViz instances
Service providers and processors who support Platform operations (e.g., hosting, analytics, email delivery)
Legal or regulatory authorities where required by law

All processors are required to process personal data only on our documented instructions and to implement appropriate safeguards.

6. International Data Transfers

Personal data may be processed or stored outside of your country of residence, including in jurisdictions that may not provide the same level of data protection.

Where personal data is transferred outside the European Economic Area (EEA), we rely on appropriate safeguards, such as:

Standard Contractual Clauses approved by the European Commission
Transfers to jurisdictions subject to adequacy decisions, where applicable

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, including:

The duration of a contractual relationship
Compliance with legal, accounting, or reporting obligations
Resolution of disputes and enforcement of agreements

When personal data is no longer required, it is securely deleted or anonymized.

Subject to applicable law, you have the following rights:

Right of access: Request confirmation of whether we process your personal data and obtain a copy
Right to rectification: Request correction of inaccurate or incomplete data
Right to erasure: Request deletion of your personal data (“right to be forgotten”)
Right to restriction: Request limited processing of your data
Right to data portability: Receive your data in a structured, commonly used format
Right to object: Object to processing based on legitimate interests
Right to withdraw consent: Where processing is based on consent
Right to lodge a complaint: With a supervisory authority in your EU member state

To exercise these rights, contact us using the details below.

9. Security Measures

We implement appropriate technical and organizational measures to protect personal data, including:

Secure hosting environments
Encryption of data in transit
Access controls and authentication mechanisms
Monitoring and logging of system activity

Despite these measures, no system can be guaranteed to be completely secure.

10. Third‑Party Content and Links

The Platform may include embedded content or links to third‑party websites. We are not responsible for the privacy practices of third parties, and we encourage you to review their privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date. Continued use of the Platform constitutes acceptance of the revised policy.

12. Supervisory Authority (EU Users)

If you are located in the European Union or European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EU supervisory authorities is available from the European Data Protection Board.

13. Canadian Privacy Rights (PIPEDA)

For users located in Canada, personal information is collected, used, and disclosed in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

Under PIPEDA, individuals have the right to:

Know why personal information is collected, used, or disclosed
Expect that personal information will be collected, used, or disclosed only for reasonable purposes
Access their personal information and request corrections
Withdraw consent, subject to legal or contractual restrictions

CityViz limits collection to information necessary for identified purposes and retains personal information only as long as required to fulfill those purposes.

14. Contact Information

If you have questions about this Privacy Policy or our data protection practices, or if you wish to exercise your rights, please contact:

Privacy Coordinator
Ruby Industries Inc. (DBA CityViz)
Email: privacy@cityviz.ca