Privacy Policy

Effective date: July 29, 2026

Indigstree Consulting & Research Inc. (“Indigstree,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how we collect, use, disclose, retain, and safeguard personal information when you visit our website, contact us, request access to The Indigstree Matrix, explore a partnership, or otherwise interact with us.

1. Scope

This Privacy Policy applies to personal information collected through:

• The Indigstree website;

• Our contact, partnership, and platform-access forms;

• Email, telephone, and other business communications;

• Supplier research, verification, and onboarding activities; and

• Other services operated by Indigstree that refer to this Privacy Policy.

The Indigstree Matrix or another service may provide an additional privacy notice. If an additional notice applies, it should be read together with this policy.

2. Personal Information We Collect

The personal information we collect depends on how you interact with us.

Information You Provide

When you submit a form or communicate with us, we may collect:

• Your name;

• Organization or business name;

• Role or job title;

• Email address;

• Telephone number;

• Partnership or organization type;

• Information about the services, platform access, or assistance you are requesting;

• Messages, comments, and other information you choose to provide; and

• Records of our communications with you.

Please do not include sensitive personal information in an open-text field unless it is necessary for your request.

Supplier and Business Profile Information

As part of our Indigenous procurement intelligence, supplier verification, and consulting services, we may collect business and professional information such as:

• Business ownership and leadership information;

• Business contact information;

• Professional roles and affiliations;

• Supplier capabilities, service areas, industries, certifications, and qualifications;

• Procurement and project experience; and

• Verification documentation provided by the business or obtained from appropriate public or authorized sources.

Some business contact information may not be considered personal information under applicable law. We nevertheless handle this information responsibly.

Information Collected Automatically

When you visit our website, our website hosting and security systems may automatically collect limited technical information, including:

• Internet Protocol address;

• Browser and device type;

• Operating system;

• Date and time of access;

• Pages requested;

• Referring website; and

• Information contained in server and security logs.

This information is used to operate, secure, maintain, and troubleshoot the website.

3. How We Use Personal Information

We may use personal information to:

• Respond to inquiries and requests;

• Evaluate potential partnerships;

• Process requests for access to The Indigstree Matrix;

• Communicate about our services and business relationship;

• Research, create, maintain, and verify supplier profiles;

• Connect qualified Indigenous suppliers with appropriate procurement opportunities;

• Support procurement, compliance, reporting, and supplier-verification activities;

• Confirm Indigenous ownership, qualifications, certifications, and capabilities;

• Operate, maintain, secure, and improve our website and services;

• Detect and prevent fraud, misuse, security incidents, and technical problems;

• Maintain business, compliance, and transaction records;

• Meet contractual, regulatory, and legal obligations; and

• Establish, exercise, or defend legal rights.

If we want to use personal information for a materially different purpose, we will provide notice and obtain consent where required.

4. Consent and Your Choices

We collect, use, and disclose personal information with your knowledge and consent except where otherwise permitted or required by law.

Consent may be express or implied, depending on the circumstances and the sensitivity of the information. For example, submitting an inquiry form indicates that you consent to our using the submitted information to review and respond to your request.

You may withdraw your consent, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may prevent us from providing certain services or responding fully to a request.

We will obtain any consent required before sending commercial electronic messages. You may unsubscribe from promotional communications using the instructions provided in the message or by contacting us. We may still send service-related or transactional communications where permitted by law.

5. Cookies and Similar Technologies

Our website may use cookies or similar technologies that are necessary for website functionality, security, session management, accessibility, and user preferences.

Our website currently loads fonts supplied through Google Fonts. When these resources are loaded, your browser may connect to Google and transmit technical information such as your IP address, browser details, and the page requesting the font. Google’s handling of that information is governed by its own privacy terms.

If we introduce analytics, advertising, or other optional tracking technologies, we will update this Privacy Policy and provide any additional notice or consent controls required by law.

You can adjust your browser to block or delete cookies. Blocking essential cookies may affect parts of the website.

6. When We Disclose Personal Information

We may disclose personal information:

• To employees and authorized representatives who require it to perform their duties;

• To hosting, email, information technology, security, communications, and other service providers acting on our behalf;

• To professional advisers such as legal, accounting, insurance, and compliance advisers;

• To procurement organizations, project partners, clients, or other authorized parties where necessary to provide our supplier intelligence and consulting services;

• With your consent or at your direction;

• To comply with a subpoena, court order, regulatory requirement, or other legal obligation;

• To investigate fraud, security incidents, or unlawful activity;

• To protect the rights, property, or safety of Indigstree, our users, or others; or

• In connection with a proposed or completed financing, reorganization, merger, sale, or transfer of all or part of our business, subject to appropriate confidentiality protections.

We do not sell or rent personal information to third parties for their independent marketing purposes.

Where supplier information is intended to be included in a procurement profile or shared with authorized procurement users, we will limit the information to what is reasonably required for supplier discovery, verification, evaluation, and engagement.

7. Service Providers and Processing Outside Canada

Our service providers may store or process personal information in Canada or other jurisdictions. Information processed outside Canada may be subject to the laws of the jurisdiction where it is stored and may be accessible to courts, law enforcement, or government authorities in accordance with those laws.

We remain responsible for personal information transferred to service providers for processing and use contractual or other appropriate measures to require suitable protection.

8. Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected and to meet legal, contractual, accounting, security, and legitimate business requirements.

Retention periods may vary depending on the nature of the information and our relationship with you. When personal information is no longer required, we will securely delete, destroy, or anonymize it, subject to any legal retention requirement.

9. Safeguards

We use administrative, technical, and physical safeguards appropriate to the sensitivity and amount of the personal information under our control. These measures may include:

• Limiting access to authorized personnel;

• Account and access controls;

• Secure hosting and transmission measures;

• Spam and abuse prevention;

• System monitoring, maintenance, and backups;

• Confidentiality obligations; and

• Procedures for responding to privacy and security incidents.

No website, email system, or method of electronic storage is completely secure. We cannot guarantee absolute security, but we take reasonable steps to protect personal information.

10. Accuracy, Access, and Correction

You may request:

• Confirmation of whether we hold personal information about you;

• Access to that information;

• Information about how it has been used or disclosed;

• Correction of inaccurate or incomplete information; or

• Deletion of information where continued retention is not legally or reasonably required.

We may need to verify your identity before fulfilling a request. Access may be restricted where permitted or required by law, including where disclosure would reveal personal information about another person, confidential commercial information, or information protected by legal privilege.

If we cannot fulfill all or part of a request, we will explain the reason where legally permitted.

11. Supplier Profile Corrections

If you represent a business included in The Indigstree Matrix and believe its profile contains inaccurate, incomplete, or outdated information, contact us using the details below.

We may ask you to provide reasonable evidence that you are authorized to act for the business and documentation supporting the requested correction.

12. Third-Party Websites and Services

Our website may contain links to third-party websites or services, including a separately hosted platform login. We do not control the privacy practices of independent third parties. Review their privacy policies before submitting personal information.

13. Children’s Privacy

Our website and services are intended for businesses, procurement professionals, government organizations, industry participants, and adult representatives of Indigenous enterprises. They are not directed to children under 13, and we do not knowingly collect personal information from children under 13.

If you believe a child has provided personal information to us, please contact us so we can investigate and take appropriate action.

14. Privacy Questions and Complaints

Questions, access requests, correction requests, or complaints may be directed to:

Privacy Officer
Indigstree Consulting & Research Inc.
Regina, Saskatchewan, Canada
Email: hello@indigstree.com
Telephone: 306-518-7554

Please include enough detail for us to understand and respond to your request. We will investigate privacy complaints and respond within a reasonable period and within any timeframe required by applicable law.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or another privacy regulator with jurisdiction over the matter.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our services, technology, business practices, or legal obligations.

The revised policy will be posted on this website with an updated effective date. If a change materially affects how we handle personal information, we will provide additional notice or obtain consent where required.