Privacy Policy

Effective date: October 19, 2026 · Governed by the laws of Ontario and Canada

In short

We handle personal information in two roles: as a business (for our website, prospects, clients and applicants) and as a service provider processing information on behalf of our business customers. We collect only what we need for identified purposes, we don't sell personal information, we use reasonable safeguards, and you have rights of access and correction. If your information was collected during a visit arranged by a company that uses Norwon, that company is the first point of contact and we assist them.

1. About this policy and who we are

Norwon Inc. ("Norwon", "we", "us", "our") is a Canadian company that provides on-site field-visit and assessment software, together with related professional and managed field services, to businesses across Canada. Our registered contact details appear at the end of this policy.

This Privacy Policy explains how we collect, use, disclose, retain and protect personal information, and the choices and rights available to you. It is designed to reflect the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), British Columbia's and Alberta's Personal Information Protection Acts (PIPA), and Canada's Anti-Spam Legislation (CASL) where electronic messages are involved.

"Personal information" means information about an identifiable individual, as defined under applicable Canadian law.

2. Our two roles

We handle personal information in two distinct capacities:

As an organization acting for our own purposes. When we operate our website, respond to enquiries, market our services, manage client relationships, recruit, and run our business, we determine the purposes and means and are accountable for that information.
As a service provider processing on behalf of our business customers. When a business uses the Norwon platform or engages our field services, we process personal information about that business's own customers and contacts (for example, homeowners and occupants assessed during a visit) under that business's instructions and for its purposes. In that context, our business customer is the organization primarily accountable to those individuals, and we act on its behalf under contract.

Where you are an individual whose information we process on behalf of a business customer, Section 15 explains how to exercise your rights.

3. Personal information we collect

The categories of personal information we handle depend on your relationship with us:

Website visitors and prospects

Contact and enquiry details you submit (name, business, email, phone, province, industry, message)
Technical and usage data (IP address, device and browser information, pages viewed, referring links, and similar analytics data)

Business customers and authorized users

Account, contact, role and authentication information
Configuration, coverage areas, forms, branding and messaging settings
Billing and transaction records
Support communications

Individuals assessed on behalf of a business customer (e.g. homeowners and occupants)

Name, service address, email and phone number
Appointment, scheduling and arrival details
Property, building, roof, electrical, structural and systems information, measurements and notes
Photographs and drone imagery of the property, including annotations
Approximate location/geolocation associated with a visit
Electronic signatures and signed documents
Survey responses and ratings

Job applicants

Name, contact details, resume/CV link, work history and the information you choose to provide

We do not intentionally collect sensitive categories of information (such as health, financial account numbers or government identifiers) through our website, and we ask that you not submit them to us.

4. How we collect personal information

We collect personal information:

Directly from you — when you fill in a form, book or attend a visit, sign a document, communicate with us, or apply for a role;
Automatically — through cookies and similar technologies when you use our website (see Section 7);
From our business customers and their systems — including customer relationship management (CRM) tools they connect, which may send us a job and contact details to create a visit;
From our field specialists — who capture assessment data, photographs and measurements during a visit; and
From third-party service providers — such as mapping, geocoding, messaging and e-signature providers used to deliver the service.

5. Why we use personal information

We use personal information for the following identified purposes:

To provide, operate, secure and improve the Norwon platform and our services;
To schedule, dispatch, confirm and deliver on-site visits and assessments;
To generate reports and documents and to facilitate electronic signing;
To send transactional messages such as booking confirmations, reminders and arrival notifications (on behalf of our business customers and under their sender identity);
To respond to enquiries and provide customer support;
To administer accounts, billing and our relationship with business customers;
To evaluate job applications and for recruitment;
To understand and improve website performance and user experience;
To detect, prevent and address fraud, abuse, security incidents and technical issues; and
To comply with legal obligations and to establish, exercise or defend legal claims.

We do not sell personal information, and we do not use the personal information we process on behalf of business customers for our own unrelated purposes.

We collect, use and disclose personal information with your consent, except where the law permits or requires us to act without it. Consent may be express (for example, when you submit a form) or implied from the circumstances and the purpose, and the form of consent we seek takes into account the sensitivity of the information. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice; withdrawing consent may limit our ability to provide certain services.

Where we send commercial electronic messages, we rely on consent obtained in accordance with CASL (see Section 8). Where we process information on behalf of a business customer, that customer is responsible for obtaining any consents required from the individuals concerned.

7. Cookies, analytics and similar technologies

Our website uses cookies and similar technologies to operate the site, remember preferences, measure performance and understand how the site is used. Some are necessary for the site to function; others help us analyze and improve it. You can control cookies through your browser settings; disabling some cookies may affect site functionality. Where required by law, we seek consent for non-essential cookies.

8. Electronic messages (CASL)

We and our business customers may send commercial and transactional electronic messages (email and SMS). We aim to comply with CASL, including obtaining consent where required, identifying the sender, and providing an easy way to unsubscribe. Transactional messages tied to a booked visit — such as confirmations, reminders and arrival notifications — are generally sent on behalf of, and under the sender identity of, the business customer that arranged the visit. You can opt out of marketing messages at any time using the unsubscribe link, by replying STOP to a text, or by contacting us.

We disclose personal information only as needed to operate, and as described here:

Service providers and subprocessors — including cloud hosting and database infrastructure, email delivery, SMS/voice, electronic-signature, mapping/geocoding, analytics and, where enabled, AI image-analysis providers. They are authorized to use the information only to provide services to us and are bound by confidentiality and comparable protection obligations;
With your or your organization's direction — for example, syncing results back to a connected CRM or integration;
Business transfers — in connection with a merger, acquisition, financing or sale of assets, subject to appropriate confidentiality protections;
Legal and safety — where required to comply with applicable law, legal process or a lawful request, to enforce our agreements, or to protect the rights, safety and property of Norwon, our customers or others.

We do not sell personal information or disclose it for third-party advertising.

10. Service providers and cross-border data transfers

To deliver our services, personal information may be stored and processed in Canada and in the United States, and may be handled by service providers located in those or other countries. When personal information is processed outside the province or country in which it was collected, it may be subject to the laws of that jurisdiction, including lawful access by courts, law enforcement and national authorities.

We remain accountable for personal information transferred to a service provider for processing. We use contractual and other means to require a comparable level of protection while the information is being processed on our behalf. For transfers subject to Quebec's Law 25, we conduct the assessments required before transferring personal information outside Quebec. You may contact us for more information about the safeguards we use.

11. Automated processing and AI features

The platform offers optional automated analysis of photographs captured during a visit — for example, reads on roof condition, electrical panels or structural framing. These features are assistive: they produce a structured summary and a confidence level to help a qualified person review the visit faster, and a human always makes the final decision. We do not use photographs or assessment data processed on behalf of a business customer to train publicly available AI models. Where a decision producing legal or similarly significant effects would be based exclusively on automated processing, applicable law (including Quebec's Law 25) gives individuals rights to be informed and to request a review; in practice, Norwon's AI reads are not a substitute for human and professional judgment.

12. How long we keep information

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, to provide our services, and to meet legal, accounting, tax and contractual requirements, after which we delete, anonymize or de-identify it. For information we process on behalf of a business customer, retention is governed by our agreement with that customer and, on termination, we return or delete the information as described in that agreement, subject to legal retention obligations.

13. How we protect information

We maintain reasonable technical, administrative and physical safeguards appropriate to the sensitivity of the information, including multi-tenant data isolation enforced at the data layer, role-based access controls, authenticated and scoped integrations, encryption in transit, and logging. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we experience a breach of security safeguards involving personal information that poses a real risk of significant harm, we will notify affected individuals and the relevant privacy regulator(s) as required by law, keep records of breaches, and work with our business customers to support their own notification obligations.

14. Your privacy rights and choices

Subject to applicable law, you have the right to:

access the personal information we hold about you and be informed of how it has been used and disclosed;
request correction of inaccurate or incomplete information;
withdraw consent to further use or disclosure, subject to legal or contractual limits;
request deletion of your information where the law provides for it; and
in Quebec and where otherwise applicable, request portability of computerized personal information, and the de-indexing or ceasing of dissemination of information in certain circumstances.

To exercise a right, contact us using the details in Section 20. We will ask you to verify your identity, respond within the timeframes required by law (generally within 30 days under PIPEDA), and explain any refusal and your recourse. We generally do not charge a fee to respond to a reasonable request. You may also authorize someone to make a request on your behalf.

15. If your information was collected during a visit

If a company that uses Norwon arranged a visit to your home or business, that company is the organization that controls your information for that purpose and is your first point of contact for access, correction, deletion and other requests. If you contact us directly, we will, where appropriate, refer your request to that company and assist them in responding. We will not use your information for our own unrelated purposes.

16. Children and minors

Our website and services are directed to businesses and are not intended for children. We do not knowingly collect personal information directly from children. Where information about a minor is captured as part of a property assessment arranged by a business customer (for example, as an occupant), that information is handled under the business customer's instructions and applicable law.

17. Third-party links and services

Our website and platform may link to or integrate with third-party websites and services (such as CRM, mapping, messaging and e-signature providers, and a login portal at app.norwon.com). We are not responsible for the privacy practices of third parties, and we encourage you to review their policies.

18. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new effective date and, where changes are material, take additional steps to notify you as appropriate. Your continued use of our website or services after an update constitutes acceptance of the revised policy, to the extent permitted by law.

19. Provincial notes

In Quebec, our practices are intended to reflect the requirements of Law 25, including transparency about automated decision-making and transfers outside Quebec. In British Columbia and Alberta, our practices reflect the applicable Personal Information Protection Acts. Nothing in this policy limits any rights you have under the privacy law that applies to you.

20. Contact us and how to complain

We have designated an individual accountable for our compliance with this policy. To ask a question, exercise a right, or make a complaint, contact:

Privacy Officer, Norwon Inc.
Email: hello@norwon.com (Attention: Privacy Officer)
Phone: 1 (888) 417-1308

We will acknowledge and investigate your concern. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca). Residents of Quebec may contact the Commission d'accès à l'information du Québec; residents of British Columbia or Alberta may contact their provincial Office of the Information and Privacy Commissioner.