Privacy with purpose.

01 / Introduction and Who We Are

Nouveau Engineering and Innovation Inc. (“Nouveau Engineering,” “Nouveau,” “we,” “us,” or “our”) is a founder-led engineering consultancy based in Campbellton, New Brunswick, Canada.

We respect the privacy of website visitors, prospective clients, clients, business partners, technical collaborators, and individuals who communicate with us.

This Privacy Policy explains how we collect, use, disclose, store, retain, and protect personal information in connection with nouveaueng.ca, project inquiries, and related business communications. It is intended to support compliance with applicable Canadian private-sector privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA), where applicable.

This policy applies to personal information. Technical, commercial, or confidential engineering information that is not personal information may be protected through separate professional, contractual, and confidentiality obligations.

02 / Personal Information We Collect

We collect information voluntarily provided when you contact Nouveau, submit an engineering project inquiry, request information, or begin discussing a potential engagement. Depending on the circumstances, it may include:

• First and last name and business email address.
• Company or organization name and telephone number, when provided.
• The engineering service or area of interest selected.
• A brief description of a mechanical, process, reliability, operational improvement, safety-conscious engineering, or project-support request.
• Business correspondence, proposal communications, and related contact details.
• Where relevant to an authorized engagement, project contacts, meeting participants, site-visit arrangements, or other limited personal information reasonably needed to perform the work.

Our hosting, form, email, and security systems may also process technical data such as IP addresses, browser and device information, access dates and times, transmission details, and security-related events.

Please do not submit passwords, personal medical information, confidential engineering drawings, proprietary process data, or sensitive operational or business records through the public inquiry form. Contact us first to discuss appropriate arrangements for sharing restricted materials.

03 / Purposes for Collecting and Using Information

We use personal information for clearly identified and reasonably necessary purposes, including:

• Responding to general business and engineering project inquiries.
• Understanding proposed work and determining whether it fits our available capabilities and professional scope.
• Assessing technical requirements and preparing requested quotations, proposals, and agreements.
• Coordinating engagements related to our engineering services, including Mechanical & Process Engineering; Reliability Engineering & Root-Cause Analysis; Operational Excellence & Innovation; and Engineering Safety & Project Support.
• Coordinating project communications with authorized client representatives and appropriately qualified professional collaborators, where necessary.
• Managing client and supplier relationships and maintaining essential business or professional records.
• Administering, securing, and troubleshooting our website and communications systems.
• Meeting applicable legal, regulatory, professional, contractual, and insurance-related obligations.

Where required, we seek meaningful consent appropriate to the circumstances. Submitting a project inquiry does not automatically subscribe you to a newsletter or authorize unrelated promotional email. Any commercial electronic messaging is subject to applicable requirements, including Canada’s anti-spam legislation (CASL).

04 / Website Contact Forms

Our Contact Us page uses WPForms Lite to process a project inquiry form. The form requests a name, email address, engineering service of interest, brief non-confidential project description, and a required Privacy Acknowledgement. Company details and a telephone number are optional.

When a form is submitted, our WordPress website and supporting services process the entry and generate a notification directed to our authorized projects@nouveaueng.ca mailbox. Notifications are routed using our configured FluentSMTP email connection and received using Microsoft 365.

WPForms Lite does not ordinarily provide locally accessible storage of complete form entries in its WordPress entries interface. However, copies of inquiry information can exist in delivered email messages, email-delivery logs, server systems, or backups.

WPForms offers an optional feature called Lite Connect for encrypted off-site backups. If activated and functioning, form-entry backups may be processed on WPForms infrastructure. Availability and use depend on our actual settings and provider connectivity; this policy does not imply that backups are currently functioning.

Submissions may be checked through anti-spam and website-security mechanisms. We use inquiry details to respond to the sender, assess potential engagements, and conduct related administration, not for unrelated promotional mailings without any legally required permission.

05 / Business Email Communications

Nouveau Engineering uses Microsoft 365 for business email and related communications. General inquiries may be directed to info@nouveaueng.ca and engineering project inquiries to projects@nouveaueng.ca.

Emails, attachments, sender and recipient details, and related correspondence may be stored and processed through Microsoft 365 and made available to personnel authorized to manage relevant inquiries or engagements.

We ask clients and visitors to contact us to arrange a more appropriate communication method before transmitting confidential drawings, sensitive personnel information, or restricted industrial information.

06 / Cookies and Website Technologies

Our WordPress site and supporting services may use cookies or comparable technologies for essential operation, logged-in administrative sessions, site preferences, spam prevention, and security.

Specific technologies depend on the plugins and security features in use and may change as the website develops. You can manage many cookies through your browser; blocking necessary cookies may affect functionality.

We do not rely on this statement as authorization to deploy non-essential analytics, advertising, or tracking technology without considering applicable notice and consent requirements. If such technologies are introduced, we will review our disclosures and practices.

07 / Website Analytics and Technical Logs

Our web host and security services may generate technical logs, including IP addresses, request timestamps, browser information, requested resources, and security alerts. These records help us maintain the website, diagnose errors, prevent abuse, and protect information.

FluentSMTP may retain message delivery details and, depending on log settings, content associated with website-generated inquiry emails. Such logs may be reviewed by authorized administrators for email troubleshooting and verification.

If we add analytics or monitoring tools that process additional personal information, we will evaluate the resulting privacy obligations and update this policy where appropriate.

08 / Third-Party Service Providers and Data Sharing

We use technology and professional service providers to operate the website and support legitimate engineering business activities. Depending on our configurations, they may include:

• Web Hosting Canada (WHC): website hosting, servers, and related technical infrastructure.
• WordPress and installed plugins: website publication and functionality.
• WPForms: form processing and optional Lite Connect encrypted entry backups, if enabled and functioning.
• FluentSMTP: website-generated email routing and configured delivery logs.
• Microsoft 365: business email and related correspondence processing.
• Website security providers: access protection, monitoring, and anti-spam functions.
• Authorized technical collaborators or professional advisers: project information required for an authorized engagement, subject to suitable confidentiality and professional arrangements.

We seek to limit provider and collaborator access to information relevant to their roles. We may disclose information where legally required, or where reasonably necessary to perform an authorized service, subject to applicable consent, contractual, and confidentiality requirements.

We do not sell personal information collected through the website.

09 / Data Retention

We retain personal information only for as long as reasonably necessary for its identified purposes and for applicable legal, professional, contractual, or legitimate business requirements. Different types of records may need different retention periods.

9.1 General and Preliminary Project Inquiries

We periodically review general and preliminary project inquiries that do not develop into business engagements. Personal information is retained only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal, professional, contractual, and legitimate business requirements. Information no longer required will be securely deleted or anonymized, as appropriate.

9.2 Engineering Projects and Client Records

Where an inquiry becomes a proposal, contract, engineering project, or client relationship, relevant correspondence and records may be retained longer based on professional practice, applicable law, contractual terms, insurance considerations, and potential legal claims. The duration may differ from that for general website inquiries. We do not apply a universal 12-month deletion period to professional engineering documents.

9.3 Website, Email and Technical Records

Hosting logs, security events, email delivery logs, and provider backups may follow technical retention periods and disposal controls appropriate to the relevant system, subject to applicable obligations.

9.4 Records of Privacy Breaches

Where PIPEDA applies, we maintain records of breaches of security safeguards for at least two years as required by applicable regulations, even if a breach does not require notification. Other legal requirements may require longer retention.

Our retention and disposal practices will be reviewed as our services, systems, and professional responsibilities evolve.

10 / Storage and International Data Processing

Personal information may be stored or processed using website hosting, cloud computing, business email, security, and other service infrastructure in Canada or other jurisdictions.

Information processed outside Canada may be subject to the laws and lawful access requirements of the jurisdiction where it is processed. We remain responsible for applying reasonable safeguards to personal information under our control, including information handled by service providers.

11 / Information Security

We aim to maintain administrative, technical, and organizational safeguards appropriate to the sensitivity of the information and the associated risks. Depending on the system, these measures may include:

• HTTPS encryption for website connections.
• Restricted access to WordPress administration and business email accounts.
• Appropriate login and authentication controls.
• Website updates, anti-spam controls, and security monitoring.
• Controls on access to business communications and engineering project information.
• Review of retained messages, logs, and technical records.

No internet-based communication or information system can be guaranteed completely secure. Visitors should avoid sending confidential project or personal information through the public form before suitable arrangements are established.

12 / Privacy and Data Breach Management

We aim to assess suspected privacy or information-security incidents promptly, contain exposure, determine what information and individuals may be affected, and take reasonable corrective steps.

Where PIPEDA applies, a breach presenting a real risk of significant harm may require reporting to the Office of the Privacy Commissioner of Canada and notification to affected individuals as soon as feasible after the organization determines that the breach has occurred.

Records of breaches of security safeguards are maintained as required by applicable law, including the minimum two-year recordkeeping rule under PIPEDA regulations where applicable, even where a breach does not meet the reporting threshold.

Anyone concerned about the handling or security of their information may contact us using the privacy contact details below.

13 / Your Privacy Rights

Subject to applicable law, individuals may contact us to:

• Request access to personal information held about them.
• Request correction of incomplete or inaccurate information.
• Ask about the purposes of collection, use, and disclosure.
• Request relevant information about disclosures or service-provider processing.
• Withdraw consent where applicable, subject to legal or contractual restrictions.
• Request deletion where appropriate and legally permissible.
• Raise questions or complaints about our privacy practices.

We may verify a requester’s identity before releasing personal information. Where PIPEDA applies, requests for access are generally answered within 30 calendar days, subject to permitted extensions or exceptions. We will consider requests and any applicable limitations in accordance with the law.

14 / Automated Processing and Decision-Making

Our website may use automated processes for spam screening, security monitoring, and routine email routing. Inquiries are intended for human review by authorized personnel rather than automated eligibility decisions for engineering services.

If we introduce profiling or additional automated decision-making that affects personal information, we will review relevant legal obligations and update our disclosures as appropriate.

15 / External Links and Third-Party Content

Our website may contain links to external websites, professional resources, or third-party services.

External websites may operate independently and apply their own privacy practices. We encourage visitors to review the privacy policies of external websites before providing personal information.

If third-party embedded content is introduced, it may involve processing by the external provider. We will review relevant disclosure requirements before implementing such functionality.

16 / Changes to This Privacy Policy

We may update this policy when our website, services, privacy practices, technology providers, or applicable legal requirements change. Material changes will be reflected in an updated policy, and we will seek any additional notice or consent required by law.

Any updated version will appear on this page with a revised effective date. We encourage periodic review of this policy.

17 / Privacy Contact Information

For privacy inquiries, requests for access or correction, or questions about the handling of personal information, please contact our designated privacy contact:

We aim to respond to privacy concerns and requests in a timely and responsible manner, consistently with applicable legal requirements.