Privacy Policy

Effective Date: August 3, 2024

1. Purpose and Scope

Boris & Associates Inc. is a construction enterprise transformation consulting firm. We help construction contractors, construction managers, developers, engineering and capital-project organizations, and construction technology companies improve their organizational structures, processes, governance, systems, data, reporting, and adoption capabilities.

This Privacy Policy explains how Boris & Associates Inc., referred to as “Boris & Associates,” “BAI,” “we,” “us,” or “our,” collects, uses, discloses, stores, transfers, and protects personal information.
‍

This Privacy Policy applies when you:
‍

Visit borisai.co;
<

Submit a website or landing-page form;

Request information about our services;

Schedule a discovery call or other meeting;

Communicate with our AI receptionist

Call or text us;
Communicate by email;
Apply for an employment or consulting opportunity;
Submit a vendor or partnership inquiry;
Participate in a consultation before signing an engagement; or

Otherwise communicate with us in a context not governed by a separate privacy agreement.
‍

Consulting engagements may be subject to additional privacy, confidentiality, cybersecurity, data-processing, or contractual terms contained in a master services agreement, statement of work, nondisclosure agreement, or data-processing agreement.

2. Responsibility for Personal Information

Boris & Associates is responsible for personal information under its control, including information processed on its behalf by authorized service providers.

Our Privacy Officer oversees our privacy-management practices, subject to delegation permitted by law.

Privacy questions and requests may be directed to:

Samantha Spinelli
General Counsel and Privacy Officer
Boris & Associates Inc.
Email: samantha.spinelli@borisai.co
‍

3. Personal Information We Collect

The personal information collected depends on how you interact with us.

Contact and identity information

We may collect:

First and last name;

Business or personal email address;

Telephone or mobile number;

Mailing or business address;

City, province, state, and country;

Language preference; and

Time zone.

Professional and organizational information

We may collect:

Company or organization;
Job title;
Department;
Professional responsibilities;
Business sector;
Geographic footprint;
Approximate organizational size;
Project or engagement information;
Current technology systems;
Business requirements;
Operational challenges;
Desired outcomes;
Procurement requirements;
RFP or RFQ information;
Project timeframe; and
Referral source.

Communications information

We may collect:

Website-form submissions;
Email correspondence;
Telephone and voicemail information;
Text messages;
Meeting notes;
Call recordings where permitted;
Call transcripts;
AI-generated call summaries;
Scheduling information;
Support requests;
Questions and feedback; and
Communication preferences.

Website and device information

We may automatically collect:

Internet Protocol address;
Approximate location derived from an IP address;
Browser type;
Device type;
Operating system;
Referring source;
Pages viewed;
Links selected;
Date and time of access;
Session duration;
Cookie and preference identifiers; and
Website performance and interaction information.

Recruitment information

When you apply for employment or a consulting opportunity, we may collect:

Résumé or curriculum vitae;
Employment history;
Education;
Professional qualifications;
Skills;
Location;
LinkedIn profile;
Work authorization information;
Interview information;
References where appropriate; and
Other information you voluntarily submit.

Do not provide protected or highly sensitive personal information unless it is specifically requested and reasonably necessary.

Vendor and partner information

We may collect:

Company and representative information;
Product or service descriptions;
Partnership proposals;
Construction-industry relevance;
Geographic coverage;
Commercial and technical capabilities;
Website information; and
Communications concerning a potential relationship.

4. How We Collect Personal Information

We may collect personal information:

Directly from you;
From an organization you represent;
From a person who refers or introduces you;
Through public professional sources;
Through our website;
Through our AI receptionist and telephone systems;
Through meeting-scheduling platforms;
Through email and text-message platforms;
Through videoconferencing platforms;
Through analytics and cookie technologies;
Through recruitment platforms;
From existing clients where appropriate; and
From service providers acting on our behalf.

We will not collect personal information through unlawful or misleading means.

5. Why We Use Personal Information

We may use personal information to:

Respond to inquiries;
Explain our services;
Assess whether our services may be relevant;
Qualify potential consulting opportunities;
Schedule discovery calls and other meetings;
Prepare for consultations;
Communicate with prospective and existing clients;
Develop proposals and engagement documents;
Administer consulting engagements;
Maintain client and professional relationships;
Respond to RFPs and procurement opportunities;
Evaluate vendor and partnership proposals;
Process employment and consulting applications;
Maintain business records;
Improve our website and communications;
Measure website performance;
Protect the security of our systems;
Prevent fraud, misuse, and unauthorized access;
Comply with contractual and legal requirements;
Establish, exercise, or defend legal rights;
Obtain professional advice;
Complete corporate transactions; and
Send marketing communications when permitted by law.

We limit collection, use, and disclosure to purposes that a reasonable person would consider appropriate in the circumstances and to purposes otherwise permitted or required by law.

6. Consent and Other Authorized Processing

Where consent is required, we seek consent that is meaningful and appropriate to:

The sensitivity of the information;
The purpose of collection;
The method of collection;
The reasonable expectations of the individual; and
Applicable legal requirements.

Consent may be express or implied where legally permitted.

You may withdraw consent, subject to reasonable notice and legal or contractual restrictions. Withdrawal may affect our ability to respond to a request, maintain a communication channel, or provide a requested service.

We may also collect, use, retain, or disclose information without consent when authorized or required by law.

7. AI Receptionist, Call Recording, and Transcription

Boris & Associates may use an AI-assisted receptionist and related telephone technologies to:

Answer calls;
Understand the reason for a call;
Provide approved general information;
Route calls;
Collect caller information;
Schedule consultations;
Prepare call summaries;
Support follow-up; and
Maintain an appropriate record of business communications.

Depending on the configuration and applicable law, calls may be recorded, transcribed, summarized, or analyzed.

When a call will be recorded or transcribed, we will provide an appropriate notice at or near the beginning of the call and identify the relevant purposes.

Information processed may include:

The caller’s voice;
Telephone number;
Name and company;
Reason for calling;
Business information voluntarily provided;
Call transcript;
Call summary;
Scheduling information;
Call-routing decisions; and
Technical call metadata.

The AI receptionist is intended to support administrative communication and scheduling. It is not intended to make decisions producing legal or similarly significant effects concerning employment, credit, eligibility, contracting, or access to essential services.

A person who does not wish to interact with an AI receptionist or participate in recording or transcription may request another reasonably available communication method, such as email.

8. Discovery Calls and Scheduling Platforms

When you schedule a discovery call or another meeting, we may collect:

Name;
Company;
Job title;
Email;
Telephone number;
Time zone;
Selected meeting time;
Meeting subject;
Business challenge;
Desired outcome; and
Other information included in the scheduling form.

We and our scheduling provider may process this information to:

Display meeting availability;
Create the meeting;
Send confirmation and reminder messages;
Reschedule or cancel the meeting;
Prevent scheduling conflicts; and
Prepare for the discussion.

Submitting a scheduling form does not create a consulting engagement.

9. Text Messaging and Mobile Information

When you provide a mobile number and expressly consent to receive text messages, we may send:

Responses to inquiries;
Consultation confirmations;
Appointment reminders;
Scheduling changes;
Requested business information;
Client-service communications; and
Marketing or promotional messages where separately authorized.

Message frequency may vary. Message and data rates may apply.

Consent to receive marketing text messages is not a condition of purchasing or receiving services.

You may opt out at any time by replying STOP. You may reply HELP for assistance or contact info@borisai.co.

After an opt-out request, we may send one final message confirming that the request has been processed.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

Text-messaging originator opt-in data and consent will not be shared with any third parties for their independent purposes.

Providers that are strictly necessary to transmit or administer our messages may process mobile information on our behalf. They are not authorized to use it for their own marketing or promotional purposes.

We do not sell, rent, or provide mobile telephone numbers or text-message consent records to third parties or affiliates for their independent marketing.

10. Marketing Emails and Commercial Electronic Messages

Where permitted by law, we may send communications concerning:

Boris & Associates services;
Construction enterprise transformation;
Business events;
Educational materials;
Reports;
Articles;
Webinars;
Consultations; and
Relevant professional updates.

Commercial electronic messages will include identification information and an unsubscribe mechanism where required.

You may unsubscribe by:

Selecting the unsubscribe link in the message; or
Contacting info@borisai.co.

Unsubscribing from marketing messages does not prevent us from sending transactional, contractual, scheduling, security, or service-related communications.

We maintain records of consent and unsubscribe requests as reasonably necessary to demonstrate compliance.

11. Cookies and Similar Technologies

We may use cookies, pixels, local storage, and related technologies for:

Essential website operation;
Security;
Preference management;
Website analytics;
Performance measurement;
Form functionality;
Scheduling integrations; and
Marketing measurement where enabled.

Essential technologies

Essential technologies support security, navigation, forms, preferences, and basic website functions.

Analytics technologies

Analytics technologies help us understand how visitors use the Site and improve its content, performance, and usability.

Advertising or targeting technologies

Advertising or targeting technologies will be used only when enabled and when permitted by applicable law.

Where consent is required, nonessential technologies will not be activated until the appropriate choice has been made.

Users will be provided with a reasonable means to manage or deactivate nonessential technologies where required.

Browser settings may also permit cookies to be blocked or deleted, although this may affect Site functionality.

12. How We Disclose Personal Information

We may disclose personal information to employees and authorized representatives who reasonably require it for the purposes described in this Privacy Policy.

We may also use service providers supporting:

Website hosting;
Cloud storage;
Cybersecurity;
Telephone services;
AI receptionist services;
Call transcription;
Text messaging;
Email delivery;
Meeting scheduling;
Videoconferencing;
Customer relationship management;
Website analytics;
Document management;
Recruitment;
Accounting;
Legal services; and
Other professional or administrative functions.

Service providers are expected to process information only for authorized purposes and to maintain appropriate confidentiality and security safeguards.

We may also disclose information:

With your direction or consent;
To an organization you represent;
To professional advisors;
To investigate fraud or security incidents;
To establish or defend legal rights;
To comply with a court order, subpoena, warrant, or lawful governmental request;
Where required or permitted by law;
To protect a person’s safety;
In connection with a merger, financing, reorganization, sale, or transfer of business assets; or
As otherwise described at the time of collection.

Boris & Associates does not sell personal information.

All information-sharing categories described above exclude text-messaging originator opt-in data and consent from use for third-party or affiliate marketing or promotional purposes.

13. Cross-Border Processing and Storage

Boris & Associates operates in Canada and the United States and may use service providers located in either country or other jurisdictions.

Personal information may therefore be processed or stored outside your province, state, or country, including in Canada and the United States.

Information processed in another jurisdiction may be subject to the laws of that jurisdiction and may be accessible to courts, regulators, governments, or law-enforcement authorities where legally authorized.

Before transferring personal information outside Quebec where required, we assess relevant privacy and security considerations and establish appropriate contractual or other safeguards.

You may contact the Privacy Officer for additional information about cross-border processing relevant to your information.

14. Confidential Client and Project Information

A public website form, discovery-call form, general email address, or AI receptionist should not be used to transmit:

Trade secrets;
Legally privileged communications;
Classified information;
Export-controlled data;
Detailed security credentials;
Personal health information;
Payment-card information;
Government identification numbers; or
Confidential project documents not approved for that method of transmission.

Once a consulting or confidentiality agreement is in effect, client information will also be handled in accordance with that agreement.

Client project information is not used for public case studies, testimonials, or marketing unless authorized or appropriately anonymized.

15. Retention

We retain personal information only as long as reasonably necessary for:

The identified business purpose;
An active or potential consulting relationship;
Contract administration;
Consent and communication records;
Security;
Legal, tax, accounting, insurance, and regulatory obligations;
Dispute resolution; and
The establishment or defence of legal rights.

Retention periods vary by information category and context.

For example:

Routine inquiry records may be retained while the opportunity remains active and for a reasonable follow-up period;
Call recordings and transcripts are retained according to an approved operational retention schedule;
Client records may be retained for the engagement period and an appropriate legal and professional recordkeeping period;
Marketing consent and opt-out records may be retained as evidence of compliance;
Recruitment information may be retained for current and reasonably anticipated opportunities; and
Security logs may be retained for an appropriate investigation and security period.

When information is no longer required, it is securely deleted, destroyed, or anonymized, subject to legal and technical limitations.

16. Security

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity and context of the information.

Safeguards may include:

Access controls;
Authentication;
Encryption where appropriate;
Secure cloud services;
Role-based permissions;
Confidentiality obligations;
Security monitoring;
Backup controls;
Vendor assessment;
Retention controls;
Incident-response procedures; and
Secure disposal practices.

No electronic system, website, transmission method, or storage environment can be guaranteed to be completely secure.

17. Privacy Incidents

We maintain procedures for evaluating and responding to confidentiality and privacy incidents.

Where required by law, we may:

Investigate the incident;
Take reasonable mitigation measures;
Maintain an incident record;
Notify affected individuals;
Notify applicable regulators; and
Notify other organizations that may reduce the risk of harm.

18. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

Ask whether we hold personal information about you;
Request access;
Request correction;
Request deletion where applicable;
Withdraw consent;
Object to or restrict certain uses;
Request information about disclosures;
Request information concerning cross-border processing;
Request computerized information in a structured and commonly used format where applicable;
Request cessation of dissemination or de-indexing in circumstances recognized by law;
Opt out of marketing communications;
Challenge compliance with this Privacy Policy; and
Submit a complaint to an applicable privacy authority.

Certain rights may be subject to identity verification, legal exceptions, privilege, confidentiality duties, record-retention requirements, and the rights of other persons.

We will not discriminate against a person for exercising a privacy right protected by law.

19. Exercising Your Rights

A privacy request should include:

Your name;
Contact information;
Nature of the request;
Relevant interaction with Boris & Associates; and
Enough information to locate the applicable records.

Send requests to:

Samantha Spinelli
General Counsel and Privacy Officer
Email: samantha.spinelli@borisai.co
Telephone: (877) 814-5498

We may request reasonable information to verify identity and authority.

Authorized agents may submit requests where permitted by law, subject to appropriate verification.

If we cannot fully satisfy a request, we will explain the reason where required.

20. Children

The Site and our consulting services are intended for business and professional users who are at least 18 years old.

We do not knowingly collect personal information from children through the Site.

If we learn that personal information from a child was collected without appropriate authorization, we will take reasonable steps to delete it.

21. Third-Party Websites

The Site may link to third-party websites and platforms.

We do not control independent third parties and are not responsible for their privacy, security, content, or business practices.

Review the applicable third-party privacy policy before submitting personal information.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

Our services;
Technology;
Vendors;
Data practices;
Legal requirements; or
Business operations.

The effective date will be updated when revisions are made.

Material changes will apply prospectively. We will not retroactively use previously collected personal information for a materially different purpose without providing notice or obtaining consent when required.

We may provide additional notice of a material change through the Site, email, or another appropriate method.

23. Language

A complete French version of this Privacy Policy will be made available for Quebec users.

La version française de la présente politique de confidentialité est disponible sur le Site.

24. Contact and Complaints

Questions, concerns, requests, or complaints may be directed to:

Samantha Spinelli
General Counsel and Privacy Officer
Boris & Associates Inc.
Email: samantha.spinelli@borisai.co
‍

You may also have the right to contact the privacy regulator responsible for your jurisdiction.

‍