This privacy policy provides information regarding Ulula’s management and protection of personal information collected through

  • its website,
  • its platform and
  • its services.

This policy also provides information regarding the process to obtain access to one’s personal information held by Ulula and rectify it as appropriate. Personal information refers to any information relating to an identifiable individual. Ulula provides supply chain management, stakeholder engagement and software to clients for global auditing and engagement (“Services”) through the Ulula platform. In providing the Services to clients, Ulula collects and processes personal information as a service provider to its clients. This privacy policy does not apply to our client’s handling of your personal information. If you have any questions about how clients process personal information through Ulula’s software, please contact the client directly.

How we collect information from the website

Ulula’s website uses cookies to identify the user’s computer and track access to the server to support user access to the website. It also helps Ulula better understand how visitors use its site so that it can be improved. Information collected through cookies, such as IP addresses or pages visited, is only used to assist the user to navigate the website and to capture visit trends that help Ulula improve its website. Visitors are informed, up front, that they can opt out of the cookies via their browser’s privacy settings.

Ulula collects information users provide when they post comments on Ulula’s blog site or when contacting Ulula through the website contact form. The information collected includes the name and email address of individuals interacting with the website and any information they choose to include in the comment or contact form. Individuals can have the information removed at any time by emailing privacy@ulula.com.

Children

Ulula’s website is intended for a general audience and we do not knowingly collect personal information from anyone under the age of 13.

How we collect information from Ulula services

Information collected through the platform

In the course of providing Services to our clients, and with the user’s express consent, Ulula collects data on behalf of clients through online surveys, messaging subscriptions (which may be via SMS, voice, social media, messenger applications or other means), digital feedback, and complaint and grievance forms. This information is collected from individuals responding to an inquiry commissioned by Ulula’s clients and may include username and password, phone number and responses and feedback that the individual chooses to provide. Ulula uses this information to send communications and requests for information on behalf of our clients, and to generate aggregate and anonymous insights, data and recommendations, which are shared with Ulula’s clients in a non-identified, anonymous form.

How we collect information to manage our client relationships

We collect information from our clients and their representatives including name, email address, username, and password, Internet Protocol addresses, location data, use of the Services as well as payment information, usage data in relation to the Services and other information relevant for the purpose of providing the Services and manage the client relationship, specifically to:

  • Process transactions with Ulula;
  • Send emails about Ulula services or respond to inquiries;
  • Send emails and updates about Ulula services, including newsletters;
  • Provide support for Ulula services;
  • Enhance or improve Ulula services;
  • Monitor data and user activity to ensure compliance with contractual requirements;
  • Perform any other function reasonably necessary to protect the security or proper functioning of Ulula services.

With express consent from clients, Ulula may post personal testimonials of clients in addition to other endorsements. If you are a registered user of the Services and have supplied your email address, Ulula may occasionally send you an email to tell you about new features, solicit your feedback, or just keep you up-to-date with what’s going on with Ulula and its products and services.

Sharing personal information

Whether it was collected through the website, the platform or Ulula Services, personal information is never sold or disclosed without consent except as described in this Privacy Policy.

In the course of business, Ulula may hire third party individuals and organizations that may have access to information and data collected by Ulula. These third parties include the web host provider, other SaaS providers, such as an email hosting service, payment processors or outside contractors hired to perform maintenance or assist in securing our website. Ulula may also hire third parties to operate, maintain, repair, or otherwise improve or preserve files or systems. In those cases, third parties process personal information collected by Ulula on Ulula’s behalf, under written instructions and with specific contractual clauses that ensure security of the personal information shared with them. The third parties are subject to this Privacy Policy and to compliance monitoring in that regard.

We may transfer personal information as an asset in connection with a prospective or completed merger, acquisition or sale (including transfers made as part of insolvency or bankruptcy proceeding) involving all or part of Ulula or as part of a corporate reorganization or other change in corporate control.

Where Ulula is required by law to disclose personal information, it is always upon demonstrated lawful authority to do so and on the basis of legal advice. As permitted by law, Ulula provides access or discloses personal information when it is reasonable to believe that such disclosure is necessary to (i) enforce applicable terms of service, including investigation of potential violations; (ii) detect, prevent, or otherwise address fraud, security or technical issues; or (iii) protect the rights, property or safety of users and the public. This includes exchanging information with other companies and organizations for fraud protection and spam/malware prevention.

LEGAL BASIS FOR PROCESSING

We rely on one or more of the following legal grounds (as appropriate) to process personal information:

  • To enter and perform a contract or to perform any steps required of us before entering into a contract.
  • To pursue our legitimate business interests in establishing, managing or concluding relationships with our clients.
  • With specific consent to our processing of personal information.
  • To comply with our legal obligations and establish, exercise or defend our legal rights.

If your non-identifiable data are used for research purposes, then the limitation of liability and indemnity clauses contained within the End User License Agreement/Terms of Service Agreement are waived with respect to any harms suffered or liabilities incurred as a result of any research activities”.

Right to access, edit, and remove user’s information

Individuals may contact Ulula at privacy@ulula.com to request access to their personal information in order to edit or to remove it from Ulula’s database. Individuals with login privileges can access, edit, and remove their personal information. Individuals may also have the right, in specified circumstances, to object to our use of their personal information, to restrict its use, to withdraw their consent to our processing of their personal information, to request a copy of their information for their own purposes, or to lodge a complaint with a supervisory authority.

Individuals’ right with respect to their personal information held by Ulula includes:

  • Assurance by Ulula that their personal information is accurate and correction will be made as requested and necessary;
  • Deletion by Ulula of any inaccurate personal information and personal information for which consent has been withdrawn.

An access request cannot be accepted if it puts at risk the privacy of others. The rights outlined above are subject to certain legal restrictions. Where the request requires disproportionate technical effort (for example, developing a new system or fundamentally changing an existing practice), or would be extremely impractical (for instance, requests concerning information residing on backup systems), Ulula will charge a fee corresponding to administrative costs and provide justification. Otherwise, access, correction and deletion are provided for free.

If the request relates to personal information controlled by a client of Ulula, the request is redirected to that client to respond because the client is the data controller in that case.

While Ulula will seek to address any request and resolve any complaint regarding this policy, other complaint mechanisms exist. Ulula is subject to the investigatory and enforcement powers of the Offices of the Privacy Commissioner of Canada in Canada and the national data protection authorities in Europe. Ulula informs individuals of those recourses as relevant.

RETENTION OF PERSONAL INFORMATION

Personal information is maintained on our servers or those of our service providers and is accessible by authorized employees, representatives and agents who require access for the purposes identified in this Privacy Policy. We have personal information retention processes designed to retain personal information for no longer than necessary for the purposes for which such information was provided or to otherwise meet legal requirements.

Security measures for all personal information

Ulula applies physical, technological and administrative measures to protect personal information at the level appropriate to its sensitivity. This includes:

  • Limiting access to employees, representatives and agents who require access for the purposes described in this policy;
  • Entry-exit registration of visitors;
  • Secure areas for the protection of servers and devices;
  • Use of SSL Certificates to protect users against unauthorized access;
  • Policies governing the management and protection of personal information, made easily accessible and distributed to staff for implementation;
  • Risk management plans, identifying threats and mitigation measures.

Please note that no security measures offer absolute security. As such, we cannot guarantee that personal information will not be lost or stolen or accessed without authorization.

Ulula and its service providers store and process personal information on computers located in Canada and/or the United States. This means Canadian and US privacy laws apply according to where the information is stored. Wherever it stores personal information, Ulula ensures, through contractual clauses, that the information will be protected with a comparable and adequate level of safeguards.

Changes

This Privacy Policy is updated as necessary to reflect Ulula’s activities that may entail collection and use of personal information as well as the measures developed to protect it.

Addressing questions or concerns

Ulula addresses questions and concerns through its Data Privacy Officer. All queries regarding privacy at Ulula Services are directed to privacy@ulula.com or via postal mail at:

5E-4773 Yonge St
Toronto, Ontario
M2N 0G3

Ulula makes every effort to respond in a timely and satisfactory manner.

Effective date

This Privacy Policy became effective on July 12, 2018.