NDI Privacy Notice
Last Reviewed: April 8, 2026
Northern Digital Inc. (“NDI”) is committed to protecting the privacy of Personal Data (i.e., information reasonably related to a specific individual). This Privacy Notice describes how we process Personal Data collected through our websites, social media accounts, mobile applications, and other online interactions and communications such as email (collectively, our “Digital Properties”); in-person events and purchases; and other online and offline interactions.
This Privacy Notice applies to information we collect about individual consumers, such as general website visitors (“Individuals”) as well as information we collect about the personnel of our business partners, including vendors and business customers, in business-to-business interactions (“Business Contacts”).
1. Collection of Personal Data
We collect three types of Personal Data from you:
Directly from you. We may collect Personal Data you provide to us directly, such as when you contact us through our Digital Properties; interact with us in person; sign up for offers or newsletters; communicate with us; place or customize orders; or sign up for an account or other services.
Data collected automatically and through Cookies. We may automatically collect information or inferences about you, such as through cookies, pixels, tags, scripts, and similar technologies (collectively, “Cookies”), when you interact with our Digital Properties. This may include information about how you use and interact with our Digital Properties, information about your device, and internet usage information. For more information about Cookies, please see our Cookie Policy below.
From third parties. We may collect Personal Data from third parties, such as service and content providers, our affiliated companies and subsidiaries, business partners, data brokers, social media companies or other parties who interact with us.
From publicly available sources. We may collect Personal Data about you from publicly available sources, such as public profiles and websites.
In some cases, the collection and processing (see Section 2 below) of Personal Data does not include information that is anonymized or aggregated such that you cannot be identified from it. We may combine information that we receive from the various sources described in this Privacy Notice, including third party sources, and use or disclose the combined information for the purposes identified below.
If you provide us or our service providers with any Personal Data relating to other individuals, you represent that you have the authority to do so and have obtained any necessary consent for the information to be used in accordance with this Privacy Notice. If you believe that your Personal Data has been provided to us improperly or want to exercise your rights relating to your Personal Data, please contact us by using the information in the Contact Us section (Section 15) below.
2. Types of Personal Data We Collect
We may collect the following types of Personal Data about you.
a. Identifiers, such as your name, email address, physical address, telephone number, business contact information, and device identifiers (e.g., cookie IDs and IP address).
b. Records about you, such as signatures; and the content, timing and method of communications you have with us, such as online chats, calls, and emails.
c. Commercial information, such as information related to your transactions; products or services purchased, obtained, or considered; or other purchasing or consuming histories or tendencies.
d. Internet or other electronic network activity information, such as your browsing history, search history, preference information (including marketing and purchasing preferences), account settings (including any default preferences), and other information regarding your interactions with and use of the Digital Properties. For more information about Cookies, please see Section 5 / our Cookies Policy.
e. Non-precise geolocation data, such as your location as derived from your IP address.
f. Professional or employment-related information (for Business Contacts), such as job title; organization; professional licenses, credentials, or affiliations; and other professional information.
g. Sensitive personal information, including account log-in information and any inferences drawn therefrom.
3. Processing your Personal Data
Where required by law, we obtain your consent to use and process your Personal Data for these purposes. Otherwise, we rely on other legal bases to collect and process your Personal Data. We process your Personal Data for the following purposes:
a. Providing our services, products, and website access: We process your Personal Data relating to your access of our services, products, website, and other Digital Properties (e.g., IP address, internet activity, account information, etc.) to ensure both you and we meet our obligations under the applicable contract, terms of use, or service agreement and to project future demand as well as improve our websites and services; absent a contractual relationship, we process your Personal Data to further our legitimate interest in operating and improving our websites and services.
b. Internal business purposes: We process your Personal Data to operate, maintain, and improve our services, products, and website, including customizing the content; maintaining internal business records, such as accounting, managing user accounts, document management and similar activities; enforcing our policies and rules; monitoring service usage, management reporting; auditing; and IT security and administration to meet our obligations to you to perform our contract with you, or, if no contract applies, to the extent it is necessary for our legitimate interest in operating our business in a secure and efficient manner.
c. Internal research and product improvement purposes: We process your Personal Data to verify and maintain the quality or safety of our products or services; improve our products or services; design new products and services; evaluate the effectiveness of our advertising or marketing efforts; and debug and repair errors with our systems, networks, and equipment to perform our contract with you, or, if no contract applies, to the extent it is necessary for our legitimate interest in improving our products and services.
d. Securing our facilities, websites and services: We process your Personal Data (e.g., name, IP address, account information, internet activity) as part of our efforts to maintain, monitor and secure our facilities, websites, services, and products. This may include aggregating data, verifying accounts, investigating suspicious activity, and enforcing our terms and policies to the extent necessary to further our legitimate interest in maintaining a safe and secure website, products and services and in protecting our rights and the rights of others.
e. Responding to contact requests: If you contact us electronically or by phone, we process your Personal Data (e.g., name, account information, government identifiers) to perform our contract with you, or, if no contract applies, to the extent it is necessary for our legitimate interest in responding to your inquiry and communicating with you. We may record and process communications for training, quality assurance, and administration purposes. If required under applicable law, we will obtain your prior consent or give you the option to object to a call being recorded.
f. Managing payments: We may process your financial information and other Personal Data (e.g., name, account information, financial history) to verify financial information and to collect or make payments to the extent that doing so is required to fulfil our contract with you.
g. Marketing and advertising: We may process your Personal Data (e.g., name, account information, purchase history, internet activity) to advertise to you, conduct market research, and to provide other personalized content based upon your Personal Data to the extent it is necessary for our legitimate interest in advertising our websites, services or products. Where legally required, we will obtain your consent before engaging in any marketing or advertising.
h. Complying with legal and safety obligations: We process your Personal Data (e.g., name, account information, payment history, internet history) when cooperating with public and government authorities, protecting our legal rights, conducting audits, and protecting against abuse of our services and products. Any such processing is based on our legitimate interest in protecting our legal rights or, when applicable, complying with a legal obligation to which we are subject.
i. In connection with a corporate transaction: We may process your information if we sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy and other forms of corporate change in furtherance of our legitimate interest in operating and transacting the business of the company.
In some cases, we may provide specific services or offerings subject to separate or supplemental privacy policies. In those cases, we will prominently inform you of those policies and provide those policies in an easily accessible format.
4. Exclusions
This Privacy Policy does not apply to Personal Data that we process about current or former employees, job applicants, and other individuals who interact with us for employment-related purposes.
5. Cookies
Our Digital Properties and authorized third parties use Cookies to collect information about you, your device, and how you interact with our Digital Properties via Cookies. Please see our Cookie Policy available at Cookies Declaration – NDI for further information.
6. How We Disclose Personal Data
We may disclose Personal Data to third parties, including the categories of recipients described below:
a. NDI’s divisions, holding companies, subsidiaries, and affiliates.
b. Service providers that work on our behalf to provide the products and services you request or support our relationship with you, such as IT providers, internet service providers, data and web hosting providers, software service providers, email marketing providers, payment processing companies, data analytics providers, and companies that provide business support services, financial administration, or event organization.
c. Professional consultants, such as accountants, lawyers, financial advisors, and audit firms.
d. Vendors necessary to complete transactions you request, such as shipping companies and logistics providers.
e. Law enforcement, government agencies, or other regulators to comply with law or legal requirements, to enforce our agreements, and to protect our rights and the property or safety of NDI, our users, or third parties.
f. Business partners that may use Personal Data for their own purposes such as:
- Advertisers, ad platforms and networks, and social media platforms;
- Third parties whose cookies and tracking tools we use as described in our Cookie Policy
g. Transactional parties if we, or some or all of our assets, acquire or are acquired by another entity, including through a sale or in connection with a bankruptcy.
h. Your employer or coworkers if you receive our products or services in connection with your employment.
i. The public, or others with access to our Services, such as when you have an opportunity to make comments, post information, or otherwise share your Personal Data in public areas of our products, services, or website.
j. Entities to which you have consented to the disclosure.
Where required by law, we will obtain your consent prior to disclosing your Personal Data to our business partners. Where our business partners use your Personal Data for their own purposes independently from us, we are not responsible for their privacy practices or personal data processing policies. You should consult the privacy notices of those business partners for details on their practices. We may also sell or share deidentified or aggregated data derived from your Personal Data to third parties for any purpose subject to reasonable protections to prevent reidentification.
7. Protecting Personal Data
Although we maintain reasonable security safeguards, no security measures or communications over the Internet can be 100% secure, and we cannot guarantee the security of your information. Your Personal Data will be retained as long as necessary to fulfill the purposes we have outlined above unless we are required to do otherwise by applicable law. This includes retaining your Personal Data to provide you with the products or services you have requested and interact with you; maintain our business relationship with you; improve our business over time; ensure the ongoing legality, safety and security of our services and relationships; or otherwise in accordance with our internal retention procedures. Once you have terminated your relationship with us, we may retain your Personal Data in our systems and records to ensure adequate fulfillment of surviving provisions in terminated contracts or for other legitimate business purposes, such as to enable easier future user onboarding, demonstrate our business practices and contractual obligations, or provide you with information about our products and services in case of interest. If you would like to know more about the retention periods applicable to your Personal Data, you can contact us using details provided in the Contact Information below.
8. Children
Our Digital Properties are intended for individuals 18 years of age and older. The Digital Properties are not directed at, marketed to, nor intended for, children under 18 years of age. Generally, we do not knowingly collect any information, including Personal Data, from children under 18 years of age. If you believe that we have inadvertently collected Personal Data from a child under the age of 18, please contact us at the address in the Contact Information section below, and we will take prompt steps to delete the information.
9. Promotional and Marketing Policy
We may ask you to consent to being contacted by us for promotional and marketing purposes. However, you may opt-out of receiving promotional or marketing emails at any time by notifying us as a reply to any unwanted e-mail, by using the unsubscribe function in our newsletter, contacting us at privacy@ndigital.com, or by writing to us at Northern Digital Inc., 103 Randall Drive, Waterloo, Ontario, Canada, N2V 1C5. Requests to unsubscribe from NDI e-mails may take 5 business days to process.
10. External Links
Our Digital Properties may contain links to external sites or other online services that we do not control, including those embedded in third party advertisements or sponsor information. We are not responsible for the privacy practices or data collection policies of such third-party services. You should consult the privacy notices of those third-party services for details on their practices.
11. Supplemental U.S. States Privacy Disclosures
a. Data Subject Rights. Depending on our relationship with you (i.e., whether you are an Individual or a Business Contact), and in which state you reside within the United States (such as California, Colorado, Oregon, or Delaware), you may have certain rights regarding Personal Data that you can exercise by emailing us at privacy@ndigital.com:
- Right to Know. You may have the right to request information about the categories of Personal Data we have collected about you, the categories of sources from which we collected the Personal Data, the purposes for collecting, selling, or sharing the Personal Data, and to whom we have disclosed your Personal Data and why. You may also request the specific pieces of Personal Data we have collected about you. Oregon and Minnesota residents may also request a specific list of third parties to whom we disclose your Personal Data.
- Right to Delete. You may have the right to request that we delete Personal Data that we have collected about you.
- Right to Correct. You may have the right to request that we correct inaccurate Personal Data that we maintain about you.
- Right to Opt Out of Sale, Sharing, and Targeted Advertising. You may have the right to opt out of selling, sharing, and targeted advertising (as such terms are defined under applicable laws). We do not knowingly sell data about minors under 18. In order to exercise the Right to Opt Out of Sale, Sharing, and Targeted Advertising, you must undertake both of the following steps:
- Submit an Opt Out of Sale, Sharing, and Targeted Advertising request through our webform Cookies Declaration – NDI.
- Disable the use of advertising Cookies in the preference center Cookies Declaration – NDI. You must complete this step on each of our websites from each browser and on each device that you use. These steps are necessary so that we can place a first-party Cookie signaling that you have opted out on each browser and each device you use.
Please note: If you block Cookies, we will be unable to comply with your request to Opt Out of Sale, Sharing, and Targeted Advertising with respect to device data that we automatically collect and disclose to third parties online using Cookies. If you clear Cookies, you will need to disable the use of all advertising Cookies in the preference center again on each browser on each device where you have cleared Cookies.
To the extent required by law, we will honor opt-out preference signals sent in a format commonly used and recognized by businesses, such as an HTTP header field or JavaScript object. We will process opt-out preference signals at the browser level.
We will not discriminate against you for exercising your privacy rights.
To process rights requests, we may need to obtain information to locate you in our records or verify your identity depending on the nature of the request.
- For Requests to Opt-Out of Sale, Sharing, and Targeted Advertising: We collect your name and email to locate you in our records.
- For Requests to Know, Delete, and Correct: We collect information necessary to verify your identity and that you are a resident of a state that provides for these rights, including name, mailing address, email address, phone number, relationship to NDI.
b. Authorized Agents. Authorized agents may exercise rights on your behalf by submitting a request via privacy@ndigital.com.
- If you designate an authorized agent to submit a Request to Know, Delete, or Correct, we may reach out to you directly to verify your own identity or to confirm that you provided the authorized agent with permission to submit the request.
- If you designate an authorized agent to submit a Request to Opt Out of Sale, Sharing, and Targeted Advertising, we may seek additional information directly from the authorized agent to process the request.
c. Appeal. If we deny your rights request, you may have the right to appeal. To submit an appeal, email privacy@ndigital.com. We will inform you in writing of our response to your appeal.
d. Nevada residents: Individuals may contact us at privacy@ndigital.com to inquire about your right to opt out of the sale of your Personal Data.
12. Additional Data Processing Disclosures for California Residents
In addition to the disclosures above, this section provides supplemental information about how we process Personal Data. These additional disclosures apply only to individuals who reside in California as required by the California Consumer Privacy Act (“CCPA”).
a. Disclosure of Personal Data
Below please find a chart detailing the categories of Personal Data we collected and with whom it was sold, shared, or disclosed for a business purpose in the past 12 months.
| Categories of Personal Data We Collect | Categories of Third Parties With Whom We Disclose Personal Data for a Business Purpose | Categories of Third Parties to Whom Personal Data is Sold or Shared for Targeted Advertising |
|---|---|---|
| Identifiers (Section 2.A) | Affiliates and subsidiaries Professional consultants Vendors necessary to complete transactions you request Law enforcement, government agencies, and other recipients for legal, security, or safety purposes In connection with a corporate transaction Entities to which you have consented to the disclosure | Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies) Partners who work with us on promotional opportunities, including co-branded products and services |
| Records about you (Section 2.B) | Affiliates and subsidiaries Vendors necessary to complete transactions you request Law enforcement, government agencies, and other recipients for legal, security, or safety purposes In connection with a corporate transaction | Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies) Partners who work with us on promotional opportunities, including co-branded products and services |
| Demographic Information (Section 2.C) | Affiliates and subsidiaries Law enforcement, government agencies, and other recipients for legal, security, or safety purposes In connection with a corporate transaction | Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies) Partners who work with us on promotional opportunities, including co-branded products and services |
| Financial & Commercial information (Section 2.D) | Affiliates and subsidiaries | Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies) |
| Biometric information (Section 2.E) | Affiliates and subsidiaries Service providers Professional consultants Law enforcement, government agencies, and other recipients for legal, security, or safety purposes In connection with a corporate transaction Entities to which you have consented to the disclosure | Not sold or shared |
| Internet or other electronic network activity (Section 2.F) | Affiliates and subsidiaries | Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies) |
| Geolocation data (Section 2.G) | Affiliates and subsidiaries Vendors necessary to complete transactions you request Law enforcement, government agencies, and other recipients for legal, security, or safety purposes In connection with a corporate transaction | Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies) Partners who work with us on promotional opportunities, including co-branded products and services |
| Audio, electronic, visual, or other sensory information (Section 2.H) | Affiliates and subsidiaries Service providers Professional consultants Law enforcement, government agencies, and other recipients for legal, security, or safety purposes In connection with a corporate transaction Entities to which you have consented to the disclosure | Not sold or shared |
| Professional or employment-related information (Section 2.I) | Affiliates and subsidiaries Law enforcement, government agencies, and other recipients for legal, security, or safety purposes In connection with a corporate transaction | Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies) Partners who work with us on promotional opportunities, including co-branded products and services |
| Inferences (Section 2.K) | Affiliates and subsidiaries Vendors necessary to complete transactions you request Law enforcement, government agencies, and other recipients for legal, security, or safety purposes In connection with a corporate transaction Entities to which you have consented to the disclosure | Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies) Partners who work with us on promotional opportunities, including co-branded products and services |
| Sensitive personal information (Section 2.L) | Affiliates and subsidiaries Service providers Professional consultants Law enforcement, government agencies, and other recipients for legal, security, or safety purposes In connection with a corporate transaction Entities to which you have consented to the disclosure | Not sold or shared |
b. Sensitive Personal Data: We do not collect Sensitive Personal Information.
13. Canadian Residents
Canadian residents may contact our Privacy Advocate at privacy@ndigital.com. Canadian individuals have the right to complain to the Office of the Privacy Commissioner of Canada (OPC), or in Quebec to the Commission d’accès à l’information (CAI).
14. Supplemental Information for the EEA, Switzerland and the UK
The following terms supplement the above disclosures with respect to our processing of EEA, Swiss, and UK Personal Data, and only apply to the extent that EEA, Swiss, or UK data protection laws apply to our processing of your Personal Data. To the extent applicable, in the event of any conflict or inconsistency between the other parts of the Privacy Notice and the terms of this Section 14, this Section 14 shall govern and prevail with regards to the processing of such EEA, Swiss and UK Personal Data.
a. Data Controller
Unless otherwise specified, the NDI entity responsible for the processing of your Personal Data as the controller is the entity that has the primary relationship with you. This may be the NDI group entity whose Digital Property you are viewing or using, that provides services to and accepts payment from you, that markets or provides promotional materials to you or the primary NDI group entity in the region where you interact with us.
In some cases, more than one NDI group entity may make decisions on how your Personal Data is processed, such as when two NDI group entities co-sign a contract with you or multiple NDI group entities organize an event. In these situations, all such entities are jointly responsible for the lawfulness of the specific processing activities as joint controllers.
In other cases, different NDI group entities may independently determine how your Personal Data is processed as independent controllers, such as when one NDI group entity uses Personal Data received from another NDI group entity to market to you.
You can view NDI group companies’ locations here: https://www.ndigital.com/contact/. For further details, please do not hesitate to contact us using the contact details in the Contact Information section above. For information regarding how to contact NDI’s controller under the GDPR, please contact privacy@ndigital.com.
b. Legal Bases for Processing
We process the following categories of personal data for the following processing purposes based on the following legal bases:
| Processing purposes | Categories of personal data | Legal basis |
|---|---|---|
| To provide you with products and services (Section 3.A) | Identifiers (Section 2.A) Records about you (Section 2.B) Commercial information (Section 2.D) Professional or employment-related information (Section 2.I) | Performance of a contract to which you are a party or to take steps at your request prior to entering into a contract. Legitimate interests as set out in the How We Use Personal Data section above. Your consent, when appropriate. |
| For our internal business purposes (Section 3.B) | Identifiers (Section 2.A) Commercial information (Section 2.D) | Performance of a contract to which you are a party or to take steps at your request prior to entering into a contract. Compliance with a legal or statutory obligation to which we are subject. Legitimate interests as set out in the How We Use Personal Data section above. Your consent, when appropriate. |
| For our internal research and product improvement purposes (Section 3.C) | Commercial information (Section 2.D) Demographic information (Section 2.C) Internet or other electronic network activity information (Section 2.F) Inferences (Section 2.K) | Legitimate interests as set out in the How We Use Personal Data section above. Your consent, when appropriate. |
| For legal, safety or security reasons (Section 3.D) | Identifiers (Section 2.A) Records about you (Section 2.B) Commercial information (Section 2.D) Sensitive Personal Data (Section 2.L) | Performance of a contract to which you are a party or to take steps at your request prior to entering into a contract. Compliance with a legal or statutory obligation to which we are subject. Legitimate interests as set out in the How We Use Personal Data section above. Establishment, exercise or defense of legal claims. Protection of vital interests. Your consent, when appropriate. |
| In connection with a corporate transaction (Section 3.E) | Commercial information (Section 2.D) | Legitimate interests as set out in the How We Use Personal Data section above. |
| For marketing and targeted advertising (Section 3.F) | Identifiers (Section 2.A) Demographic information (Section 2.C) Commercial information (Section 2.D) Internet or other electronic network activity information (Section 2.F) Non-precise geolocation data (Section 2.G) Inferences (Section 2.K) | Legitimate interests as set out in the How We Use Personal Data section above. Your consent, when appropriate. |
c. Your Data Protection Rights
Under the conditions set by applicable data protection laws, you may exercise certain rights regarding your Personal Data.
- Right to Access. You have the right to obtain confirmation from us whether we are processing your Personal Data and related information, as well as the right to obtain a copy of your Personal Data undergoing processing.
- Right to Data Portability. You may receive your Personal Data that you have provided to us in a structured, commonly used and machine-readable format.
- Right to Rectification. You have the right to request the rectification of inaccurate Personal Data and to have incomplete data completed.
- Right to Objection. You have the right to object to the processing of your Personal Data in certain cases.
- Right to Restrict Processing. You may request that we restrict the processing of your Personal Data in certain cases.
- Right to Erasure. You may request that we erase your Personal Data in certain cases.
- Right to Lodge a Complaint. You have the right to lodge a complaint with a supervisory authority in the country where you reside or where the conduct that is the subject of the complaint occurred.
- Right to Refuse or Withdraw Consent. In case we ask for your consent to process your Personal Data, you are free to refuse to give it. If you have given your consent, you may withdraw it at any time without any adverse consequences. The lawfulness of any processing of your Personal Data that occurred prior to the withdrawal of your consent will not be affected.
- Right to Not Be Subject to Automated Decision-making. You have the right not to be subject to a decision based solely on automated processing and to be given more information about why any such decision was made.
You may exercise these rights by contacting us using the details in the Contact Information section above.
A. International Transfers of Personal Data
Any Personal Data you provide to us may be processed in the United States or countries other than yours unless we make express statement to the contrary. Due to the global nature of our operations, some of these locations may be outside the EEA, Switzerland or the UK and that do not provide an adequate level of data protection as defined by data protection laws in the EEA, Switzerland and the UK. Certain third countries have been officially recognized by the European Commission, Switzerland, and the UK Secretary of State as providing an adequate level of protection. Transfers within our corporate group or to third parties located in third countries that have not received such recognition take place using an acceptable data transfer mechanism, such as the EU and/or UK Standard Contractual Clauses, Binding Corporate Rules, approved Codes of Conduct and Certifications, on the basis of permissible statutory derogations, or any other valid data transfer mechanism issued by the EEA, Swiss or UK authorities.
Please reach out to us using the contact information in the Contact Information section above if you want to receive further information about how we transfer Personal Data or, where available, a copy of the relevant data transfer mechanism.
15. Contact Us
We welcome comments and questions regarding this Privacy Policy. Any such questions should be directed via e-mail to privacy@ndigital.com. Additionally, you may make your request in writing to NDI, 103 Randall Drive, Waterloo, Ontario, Canada, N2V 1C5.