Privacy Policy
Last updated: June 2026
Introduction
Nextal Solutions inc. ("Nextal", "we") takes the protection of personal information seriously. This policy explains what information we collect, why, how we use and protect it, and what your rights are. It applies to our website and to our recruiting and HR platform.
Privacy officer
In accordance with Québec’s Law 25 (modernising personal-information protection legislation), Nextal has designated a privacy officer. For any question or request, write to privacy@nextal.com.
Information we collect
We collect: account information (name, email, organisation); data entered into the platform by our clients (candidates, employees, jobs); and technical usage data (logs, device type, pages visited) needed to operate and secure the service.
How we use information
Information is used to provide and improve the service, ensure security, offer support, and meet our legal obligations. We never sell your personal information and do not use it for third-party advertising.
Consent and withdrawal
We process personal information based on your consent, the performance of our service contract, or compliance with legal obligations. Where we request consent for a secondary purpose (such as marketing), you may decline. You may withdraw your consent at any time by writing to privacy@nextal.com. When you act as a platform client, you remain responsible for your candidates’ and employees’ information; Nextal acts as a processor on your behalf.
Sharing and processors
We share information only with vendors necessary to operate the service (hosting, email, payment, artificial intelligence, etc.), bound by confidentiality commitments, or where required by law or in the event of a breach of our terms of service. Some vendors have their own privacy policies, which we encourage you to review.
Artificial intelligence
Some features (matching, recommendation and description generation) rely on Microsoft’s Azure OpenAI Service, hosted in a data centre located in Canada, so your data remains in Canada for this processing. Only the data necessary is sent to the model. In accordance with the Azure OpenAI Service terms, this data is not used to train Microsoft’s or OpenAI’s models and is not shared with OpenAI. Azure may retain it for up to 30 days to detect potential misuse, after which it is deleted. We do not use your data to train general AI models shared with third parties.
Transfers outside Canada
If you enable the Google integrations (Gmail, Calendar), processing by Google may involve facilities located abroad, notably in the United States; your information may then be subject to the laws of that jurisdiction, including government access requests. Before any disclosure outside Québec, we carry out a privacy impact assessment, in line with Law 25.
Gmail integration
If you enable the Gmail integration, you authorise us to access information associated with your Google account: emails, labels and calendar events, and to read and send emails from the connected account. The service scans content to identify the emails you chose to synchronise and store in Nextal (replies, outgoing mail, headers, subject line, time sent and email bodies). Only emails related to existing candidates or clients are stored. Nextal adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Google Calendar integration
The service accesses your Google Calendar (and other calendars accessible via Google) to power our meetings tool and associate events with your contacts and candidates. It can view your events and create, update or delete events created by Nextal.
Hosting and security
Your platform data is hosted in Canada. It is isolated per tenant (multi-tenant architecture) and protected with encryption in transit, role-based access controls, access logging, and regular backups. No method of transmission or storage is 100% secure, but we follow industry best practices. In the event of a confidentiality incident posing a risk of serious harm, we follow a notification procedure consistent with Law 25.
Retention
We keep information as long as necessary for the purposes above, for the duration of the contractual relationship, and then according to applicable legal periods. Upon expiry, information is securely destroyed or anonymised.
Your rights
You may request access to your information, its correction, deletion, withdrawal of consent, or data portability. To exercise these rights or file a complaint, write to privacy@nextal.com; we respond within the timeframes set by law.
Cookies
Our site uses cookies essential to its operation and, where applicable, audience-measurement cookies. You can configure your browser to refuse them; some features may then be limited.
Third-party links
Our site and platform may contain links to third-party sites. Once you leave our site, you are no longer governed by this policy. We are not responsible for the privacy practices of those sites and encourage you to review their own policies.
Age requirement
By using this site, you represent that you are at least the age of majority in your province or state of residence. Our service is intended for organisations and their representatives, not for children.
Business transfer
In the event of a merger, acquisition or sale of assets, your information may be transferred to the new entity to ensure continuity of service; you would be informed where applicable.
Changes
We may update this policy. The update date below indicates the version in force; material changes will be communicated where required.