Privacy Policy

This notice explains how LOGICIELS HADALY INC. ("Hadaly", "we", "us"), collects and uses personal information, and what rights you have over it. It applies to our website at hadaly.ai and to the Hadaly platform.

For any privacy question, write to our Data Privacy Lead at info@hadaly.ca. Our representative in the European Union under Article 27 of the GDPR is CLEMENT BOUTIER, clement.boutier@hadaly.ai; individuals in the EEA may contact either our representative or us directly.

We handle personal information in two ways. Where we decide why and how information is used (your visit to this website, your account and billing details, contacts in our business search database, and people referred to us by partners), we are the controller, and this notice describes what we do. Where our customers upload documents, accounting records or other content to the platform for a transaction, that content often contains information about other people, and we hold it on the customer's instructions as their processor. If your information reached us that way, the business that uploaded it decides how it is used; contact them, or contact us and we will pass your request to them.

The personal information you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point where we ask you to provide your personal information. If you contact us directly, we may receive additional information about you such as your name, e-mail address, telephone number, the content of any message and/or attachments you may send to us, and any other information you may choose to provide. When you register for an account, we may request your contact information, including items such as name, company name, address, email address, and telephone number.

In addition, we collect: your profile and company details, including telephone number, address, job title, language and a profile photo; what you tell us during onboarding; your billing details and invoice history, though card numbers are collected and held by our payment processor and never reach us; everything you enter in the platform, including deal names, comments, questionnaire answers and manual financial corrections; the documents you upload and any accounting ledger you choose to connect; and, automatically, log and device data and a record of your activity in the platform, including documents viewed, downloaded and shared inside a data room.

We use the information we collect for the purposes set out below. For each one we give the legal basis we rely on under Article 6 of the GDPR.

You are not required by law to give us your personal information. But we need your email address and name to open and secure an account, and your billing details to process a paid subscription; without these we cannot provide the service. Everything else, including your telephone number, address, company details, job title and profile photo, is optional; leaving it out makes some features less useful but the service still works.

Hadaly follows a standard procedure for the use of log files. These files record visitors when they visit websites. All hosting companies do this as part of their hosting analytics. Information collected by log files includes Internet Protocol (IP) addresses, browser type, Internet Service Provider (ISP), date/time stamp, referring/exit pages and possibly number of clicks. Under the GDPR an IP address is personal information, and we treat it as such. The purpose of the information is for analyzing trends, administering the site, tracking users' movement on the website, and gathering demographic information.

Like any other website, Hadaly Software Inc. uses 'cookies'. These cookies are used to store information, including visitor preferences, and the pages on the website that the visitor has accessed or visited. The information is used to optimize the user experience by customizing the content of our web page based on the visitor's browser type and/or other information. Cookies that are strictly necessary for the site to work are set on the basis of our legitimate interest. All other cookies, including analytics and advertising cookies, are set only with your consent, which you can change or withdraw at any time through the cookie settings on this site. Withdrawing consent is as easy as giving it, and does not affect anything done beforehand.

You can consult this list to find the Privacy Policy of each of Hadaly Software Inc.'s advertising partners. Third-party ad servers or ad networks use technologies such as cookies, JavaScript or Web beacons that are used in their respective advertisements and links that appear on Hadaly Software Inc. that are sent directly to the user's browser. They automatically receive your IP address when this happens. These technologies are used to measure the effectiveness of their advertising campaigns and/or to personalize the advertising content that you see on websites that you visit.

The Hadaly Software Inc. Privacy Policy does not apply to other advertisers or websites. Thus, we advise you to consult the respective Privacy Policies of these third-party ad servers for more detailed information. This may include their practices and instructions on how to opt-out of certain options. You can choose to disable cookies through your individual browser options. For more detailed information on cookie management with specific web browsers, they can be found on the browsers' respective websites.

Hadaly uses third-party service providers to operate, secure and support its website, platform and services. These providers may process personal information on our behalf only to the extent necessary to provide their services. Our service providers and subprocessors include Amazon Web Services (AWS), Anthropic (Claude), Google, HubSpot, Okta, OpenAI, Pennylane,, Sage,, Stripe,Xero and Slack

The personal information processed by these providers may include names, email addresses, business contact information, account information, billing information, platform activity and other information necessary to provide the relevant services.

These providers process personal information in accordance with their own privacy policies and applicable data-protection laws.

Hadaly takes reasonable steps to ensure that service providers processing personal information on its behalf maintain appropriate confidentiality, security and data-protection safeguards.

Your information is hosted in Canada, in Amazon Web Services' Canada Central region. If you are in the European Economic Area, that is a transfer of your information out of the EEA. It is lawful because the European Commission has decided that Canada provides an adequate level of protection for personal data processed by organisations subject to the Canadian Personal Information Protection and Electronic Documents Act, and we are subject to that Act. No further safeguard is needed for information transferred from the EEA to us in Canada.

Some of our providers process information in the United States or in other countries without an adequacy decision. For each of those transfers we rely on the European Commission's Standard Contractual Clauses, incorporated into our contract with the provider, together with an assessment of the laws of the destination country and technical measures including encryption in transit and at rest. If you are in the United Kingdom, transfers to us rely on the United Kingdom's own adequacy regulations for Canada, and onward transfers on the UK International Data Transfer Agreement or the UK Addendum.

We use automated processing, including large language models, to read and classify documents uploaded to the platform, to extract figures from them, and to produce valuations, comparables, rankings, estimated age ranges and a Combined Score. These outputs are there to help a professional make a judgement. They are not decisions, and we do not use them to make a decision that produces a legal effect for you or that similarly significantly affects you; our terms require our users to verify our outputs independently and not to rely on them alone. Estimated values are estimates and may be inaccurate or out of date. You can ask a person at Hadaly to review any estimate or score we hold about you, and to correct or remove it. Document content processed by our models is not used to train general-purpose AI models.

Under PIPEDA, among other rights, Canadian consumers have the right to:

• Ask a company that collects personal data from a consumer to disclose the specific categories and pieces of personal data that a company has collected on consumers
• Ask a company to delete any personal consumer data it has collected
• Ask a company that sells a consumer's personal data not to sell the consumer's personal data

If you make a request, we have one month to respond. If you wish to exercise any of these rights, please contact us.

We want to make sure that you are fully aware of all your data protection rights. Every user is entitled to the following:

• The right of access – You have the right to request copies of your personal data. There is no charge. We may charge a reasonable fee, or refuse, only if a request is manifestly unfounded or excessive, and we will explain our reasoning if we ever do.
• The right of rectification – You have the right to request that we correct any information that you believe to be inaccurate. You also have the right to request that we complete any information you believe to be incomplete.
• The right to erasure – You have the right to request that we erase your personal data, under certain conditions.
• The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions. These are: while we check accuracy you have contested; where our processing is unlawful but you would rather we restricted it than deleted it; where we no longer need the information but you need it for a legal claim; and while we consider an objection you have made. We will tell you before we lift a restriction.
• The right to object to processing – You have the right to object to our processing of your personal data, under certain conditions. If you object to direct marketing we will stop, with no exceptions and no need to give a reason. For other processing based on our legitimate interests, we will stop unless we can show compelling grounds that override your interests, or we need the information for legal claims.
• The right to data portability – You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
• The right to withdraw consent – where we rely on your consent, you can withdraw it at any time, as easily as you gave it. This does not affect anything we did beforehand.
• The right to complain – you can complain to the data protection supervisory authority in the country where you live, where you work, or where you think the problem happened. A list is published at edpb.europa.eu. In the United Kingdom the authority is the Information Commissioner's Office at ico.org.uk, and in Canada the Office of the Privacy Commissioner. In Quebec you may also contact the Commission d'accès à l'information.

To exercise any of these rights, write to info@hadaly.ca, or to our representative in the European Union. You do not need an account with us. We respond within one month, free of charge. If your request is complex or you have made several, we may extend that by up to two further months, and we will tell you within the first month if we do and why. We may ask you for enough information to satisfy ourselves who you are, so that we do not disclose your information to someone else.

Another part of our priority is to add protection for children when they use the Internet. We encourage parents and guardians to observe, participate and/or monitor and guide their online activity. Hadaly does not knowingly collect personally identifiable information from children under the age of 16, and our service is a business service that is not offered to anyone under 18. If you believe that your child has provided us with such information on our website, we strongly encourage you to contact us immediately and we will use our best efforts to promptly remove such information from our records.

Hadaly takes the protection of your sensitive data seriously. We implement industry-standard security measures, including encryption, access controls, and secure data storage, to safeguard your information from unauthorized access, alteration, disclosure, or destruction. Sensitive information, such as financial data, is encrypted both in transit and at rest. Access to this data is restricted to authorized personnel who need it to perform their job functions. If a breach of security affects your personal information and is likely to put your rights at high risk, we will tell you without undue delay, and we will notify the relevant supervisory authority within 72 hours where the law requires it.

Hadaly retains Google user data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by applicable laws and regulations. Upon the termination of your account or upon request, we will delete your Google user data from our systems. Please note that certain data may be retained for a period to comply with legal obligations or resolve disputes. If you wish to request the deletion of your Google user data, please contact us using the information provided on our contact page.

Sources of Information

Hadaly obtains this information primarily from sources publicly accessible on the Internet, including:

• government registries;
• open data sets;
• company websites;
• professional directories;
• publicly available professional publications;
• other Internet pages accessible without a private account or special authorization.

Hadaly may also produce matches, calculations, estimates, and inferences from this public information. Hadaly does not seek to collect a contact detail or piece of information whose visibility the person has limited to a private account or a restricted circle. Upon request and to the extent the information is available, Hadaly can indicate the specific source or the applicable categories of sources.

Purposes

Hadaly uses this information to:

• allow business buyers and other professionals to search for Canadian businesses;
• identify, rank, and present businesses that may be relevant to a professional project;
• verify or complete contact details and professional roles;
• produce estimates, ranges, rankings, and search-assistance indicators;
• ensure the accuracy, security, and compliance of the platform;
• prevent abuse and investigate complaints;
• respond to requests for access, correction, objection, or removal.

Our legal basis is legitimate interests under Article 6(1)(f) of the GDPR: our interest, and our professional users' interest, in maintaining an accurate searchable directory of businesses for transaction purposes. We have weighed that against the interests and rights of the people concerned and we apply the safeguards described in this section. You can ask us for a copy of that assessment.

Estimated Age Range

The age presented by Hadaly is an estimate displayed as a range. It does not constitute confirmation of the person's date of birth or actual age. This range may be produced from various publicly accessible indicators and may be inaccurate, incomplete, or outdated. The estimated age range may be viewed within Hadaly, but it may not be exported or redistributed by users. It must never be used alone to contact, target, exclude, disadvantage, or pressure a person.

Combined Score

Hadaly may display a Combined Score based on several pieces of information relating to a business and its context. This score is intended to help a user assess a business's general relevance to a takeover project and certain transferability indicators. The Combined Score:

• does not mean that the business is for sale;
• does not mean that the owner wishes to sell;
• does not constitute a definitive assessment of the person or the business;
• must not be used alone to make a decision producing legal or significant effects;
• must be accompanied by independent verification and human analysis.

Commercialization of Access

Hadaly commercializes access to certain business data and professional contact details to authorized users who search for businesses in a professional context. These users are contractually limited to the permitted purposes, may not resell the data, and must comply with the applicable rules regarding privacy, prospecting, and objections. Hadaly may also disclose certain information to its service providers, professional advisers, or competent authorities where such disclosure is necessary and permitted by law.

Processing Outside Quebec or Canada

Some of Hadaly's technology providers may process information outside Quebec or Canada, including in the United States. Before such a disclosure, Hadaly assesses the privacy-related factors and puts in place the appropriate contractual, technical, and organizational measures.

The mechanisms we rely on under European law are set out in the international transfers section above.

Retention and Updating

Hadaly retains information only for the period necessary for the purposes described in this Policy and in accordance with its retention schedule. Hadaly periodically reviews the information in order to remove or archive data that has become manifestly outdated, inaccurate, or unnecessary. Minimal information may be retained longer in a secure suppression list in order to honour an objection, prevent renewed solicitation, or demonstrate compliance with a legal obligation.

Requests for Correction, Objection, or Removal

Any person may request:

• access to the information Hadaly holds about them;
• disclosure of its source or categories of sources;
• correction of inaccurate or incomplete information;
• removal of their contact details or estimated age range;
• deletion of certain information, where permitted by law;
• objection to its use for prospecting purposes;
• human review of an estimated piece of information or a Combined Score.

Requests may be sent to info@hadaly.ca. Hadaly may verify the requester's identity in a proportionate manner before processing a request. An objection or removal request is applied free of charge and does not require the creation of an account.

Centralized Suppression List

Hadaly maintains a centralized list of persons who have requested the removal of their information or who have objected to its use for prospecting purposes. This list contains only the minimal information necessary to prevent renewed collection, enrichment, or solicitation. Users may not circumvent this list by re-importing or obtaining the same information from another source.

Informing Individuals

Where required by law, Hadaly informs the person concerned of the collection or use of their information obtained from another source. The notice explains, among other things, the categories of information processed, the purposes, the sources or categories of sources, the persons who may have access to it, the retention period, and the rights of the person concerned.

LOGICIELS HADALY INC.

NEQ: 1177916393

6795 Marconi Street, Suite 200

Montreal, Quebec H2S 3H8, Canada

Person in charge of the protection of personal information: Data Protection Lead

Email for access, correction, objection, or removal requests, or complaints: info@hadaly.ca

We may update this Privacy Policy from time to time Where a change materially affects how we use your information we will tell you before it takes effect, rather than only posting a new version. Every version we publish is dated, and we keep previous versions so it is always clear which notice applied at a given time.