Our Privacy Principles

Environics Analytics (EA) adheres to strict privacy standards informed by Privacy by Design principles. The following are EA's privacy principles:

1. Privacy is the default setting. Privacy is not an afterthought but is an essential part of the development of our data products, the work we do with our clients and our business operations.

 

2. EA only uses only privacy-compliant data as inputs for product development. Environics Analytics does not use Personal Information to develop data products.

 

3. EA provides complete visibility and transparency regarding its privacy practices. We have designated a Chief Privacy Officer to establish policies, ensure compliance with those policies and be accessible to staff, clients, and the public. EA adheres to the highest standards and is System and Organization Controls (SOC)1 Type 2, SOC2 Type 2 and Health Insurance Portability and Accountability Act (HIPAA) compliant - the highest auditable data processing, security, and privacy standards. EA is aligned with industry self-regulatory standards such as the Digital Advertising Alliance Online Behavioral Advertising (DAA OBA) Principles, the Network Advertising Initiative (NAI) Code of Conduct and the Canadian Marketing Association (CMA) Ethical Guidelines. EA operates under Canadian, U.S. and EU privacy laws and regulations, including Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Law 25, other provincial privacy laws, the Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), and the California Consumer Privacy Act (CCPA) in the U.S., as well as with the General Data Protection Regulation (GDPR) in the European Union.

    

4. For the benefit of our clients, personal Information provided to EA by clients is used solely for their business and is safeguarded in client-specific firewalled locations in secure data centres. Personal Information held on behalf of clients is not shared with any third party under any circumstances unless there is explicit consent to the sharing. Personal Information we process for any purpose is not kept longer than we determine is reasonably necessary for that purpose or those purposes.

    

5. EA is committed to responsible data stewardship and ethical data use that prevents individual, group, and community harm. In the spirit of reconciliation with Indigenous peoples and in furtherance of the Truth & Reconciliation Commission's Call to Action #92, we are committed to an ongoing journey to ensure respect for Indigenous Data Sovereignty rights through staff training and awareness, community engagement and ongoing updates to our Data Strategy and company practices. EA is accountable for all the data in our care and ensures that all enterprise and client information will be accurate, accessible, and protected throughout its lifecycle. We manage data from ingestion to deletion using a robust data governance system. We use secure file transfer processes, data logging, access controls, state-of-the-art technological security, and data destruction methods to ensure the privacy and security of all data we hold.