» Privacy Policy

Effective Date: May 4, 2026 | Last Updated: May 4, 2026
Applies to: Canada (PIPEDA / Law 25) and International Operations including Africa

1. Introduction

NACKI Advisory Group (“Nacki Advisory,” “we,” “our,” or “us”) is committed to protecting the privacy and confidentiality of personal information that we collect, use, and disclose in the course of our business activities. This Privacy Policy explains how we handle personal information in accordance with applicable privacy laws, including:

The Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, as it applies federally across Canada;
Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (Law 25 / Bill 64), which imposes additional obligations on our Quebec operations;
Applicable African data protection frameworks, including but not limited to the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention), as well as national laws in jurisdictions where we conduct business (such as POPIA in South Africa, NDPR in Nigeria, and DPA equivalents in other African nations where operative);
Any other applicable provincial or territorial privacy legislation in Canada.

This Policy applies to personal information collected through our website at https://nackiadvisory.ca/ (“Site”), by email, telephone, in person, or through any other means in connection with our services.

By using our Site or engaging our services, you acknowledge that you have read and understood this Privacy Policy.

2. Who We Are

NACKI Advisory Group is a professional advisory firm with offices in Ontario and Quebec, Canada. We provide a full range of project management, market development, engineering, and business advisory services to clients across Canada and internationally, with a significant presence in African markets.

Contact NACKI Advisory Group

3. Scope of This Policy

This Policy governs personal information collected from or about:

Visitors to our website (nackiadvisory.ca);
Prospective and existing clients in Canada and internationally;
Business contacts, partners, and collaborators including government entities and strategic partners in Africa;
Job applicants and independent contractors;
Any other individual whose personal information we handle in the course of our operations.

4. Personal Information We Collect

Personal information means any information about an identifiable individual. We may collect the following categories of personal information:

4.1 Information You Provide Directly

Contact information: Contact information:
- Full name
- Business and personal email address
- Telephone number
- Mailing address (business or personal)
Professional and business information: Professional and business information:
- Job title, company name, industry sector
- Business needs, project requirements, and scope details
- Financial information necessary to deliver advisory services
Communication records: Communication records:
- Correspondence, meeting notes, and project communications
- Responses to surveys or feedback forms
Account and transaction details: Account and transaction details:
- Contract and engagement records
- Billing and invoicing information

4.2 Information Collected Automatically

When you visit our Site, we may automatically collect:

IP address and approximate geographic location;
Browser type, operating system, and device identifiers;
Pages viewed, time spent, and navigation paths;
Referring URLs and search terms;
Cookie and similar tracking technology data (see Section 10).

4.3 Information from Third Parties

We may receive personal information from:

Business partners, referral sources, or government agencies in Canada or Africa who engage us on your behalf;
Publicly available sources (e.g., LinkedIn, government procurement portals, industry directories);
African government agencies, development banks, or international organizations that collaborate with us on projects.

5. Purposes for Collecting and Using Personal Information

We collect and use personal information only for purposes that a reasonable person would consider appropriate in the circumstances, including:

Delivering our advisory, project management, engineering, and market development services;
Facilitating business matching, brokering, negotiations, and international market access across Canada and Africa;
Managing client accounts, contracts, and project engagements;
Communicating with you about our services, proposals, or project updates;
Responding to enquiries submitted through our website, phone, or email;
Conducting market research to improve our services and expand our sector knowledge;
Complying with legal, regulatory, and contractual obligations in Canada, Africa, and other jurisdictions;
Liaising with government bodies at local, provincial, federal, and international levels on your behalf or in connection with our engagements;
Managing our business operations, including billing, accounting, and record-keeping;
Sending updates, thought leadership, or invitations to events where you have consented or where a legitimate interest applies;
Evaluating job applications and engaging independent consultants;
Improving and securing our website and digital infrastructure.

We will not use your personal information for purposes other than those identified above without your consent or as otherwise permitted by law.

6. Legal Bases for Processing

Under PIPEDA and applicable African data protection laws, we rely on the following legal bases to collect, use, and disclose personal information:

Consent: Consent:
- Express consent: where we obtain your clear affirmative agreement, such as subscribing to communications.
- Implied consent: where the purpose of collection is obvious from the context of our relationship (e.g., providing your contact details to receive a service proposal).
- You may withdraw consent at any time, subject to legal and contractual restrictions (see Section 12).
Contractual necessity: Contractual necessity:
- Processing is necessary to perform a contract to which you are a party or to take steps at your request before entering into a contract.
Legal obligation: Legal obligation:
- Processing is necessary to comply with a legal obligation in Canada or any applicable African jurisdiction.
Legitimate interests: Legitimate interests:
- Processing is necessary for our legitimate business interests (e.g., maintaining client relationships, improving services), provided those interests are not overridden by your rights and freedoms.

7. Disclosure of Personal Information

We do not sell personal information. We may share your personal information with the following categories of recipients, and only to the extent necessary for the stated purposes:

Service providers and sub-contractors who assist us in delivering services (e.g., IT service providers, accountants, legal counsel, engineering sub-consultants), under confidentiality and data processing agreements;
Strategic partners, joint-venture partners, or industry collaborators in Canada and Africa, where necessary to fulfil a project engagement and with your knowledge;
Government agencies, regulatory bodies, development banks, or international organizations (e.g., African Union, African Development Bank, Export Development Canada) as required by the nature of the engagement;
Legal and compliance authorities where disclosure is required by law, court order, or regulatory obligation in any jurisdiction where we operate;
Professional advisors including lawyers, auditors, and insurers on a confidential basis;
Successor entities in the event of a merger, acquisition, or reorganization of Nacki Advisory, with notice to affected individuals where required by law.

Where we disclose personal information to third parties, we take appropriate contractual and organizational measures to ensure they provide a comparable level of protection.

8. Cross-Border Transfers of Personal Information

Given our international operations, personal information may be transferred to, stored in, or accessed from jurisdictions outside Canada, including countries in Africa and other parts of the world. Such jurisdictions may have different privacy laws than Canada.

8.1 Transfers to African Jurisdictions

Nacki Advisory regularly operates in African markets including, but not limited to, West Africa, East Africa, Central Africa, and Southern Africa. When we transfer personal information to or from African countries, we:

Apply PIPEDA’s accountability principle, meaning we remain responsible for personal information transferred to third parties in Africa;
Use contractual protections (such as data processing agreements or model clauses) to require that recipients provide appropriate protection;
Comply with applicable national laws in the destination country, including POPIA (South Africa), NDPR (Nigeria), Kenya’s Data Protection Act 2019, and equivalent legislation where enacted;
Inform you before or at the time of collection that your information may be transferred to another jurisdiction for processing.

8.2 Transfers Within Canada

Personal information may also be transferred between our Ontario and Quebec offices and to service providers located in other provinces. Quebec Law 25 requires that, prior to disclosing personal information outside Quebec, we conduct a privacy impact assessment (PIA) and ensure that the receiving jurisdiction offers comparable protections.

8.3 International Clients and Projects

Where Nacki Advisory is engaged by African governmental entities, development agencies, or private sector clients in Africa, personal information related to those engagements may be subject to applicable local requirements. We endeavor to meet the highest applicable standard in each jurisdiction.

9. Retention of Personal Information

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required or permitted by applicable law. Retention periods are guided by:

The nature and duration of the client engagement or contract;
Canadian tax and accounting requirements (generally six to seven years);
Applicable African jurisdiction requirements for business and project records;
Legal hold requirements in the event of a dispute or regulatory investigation;
Our legitimate interests in maintaining adequate records of our professional engagements.

When personal information is no longer required, we securely destroy, erase, or anonymize it in accordance with our records management procedures.

10. Cookies and Tracking Technologies

Our website (nackiadvisory.ca) may use cookies and similar technologies to enhance your browsing experience and gather analytics information. Types of cookies we may use:

Essential cookies: Essential cookies:
- Necessary for the website to function properly. These cannot be disabled.
Analytics cookies: Analytics cookies:
- Help us understand how visitors interact with our site (e.g., Google Analytics or equivalent). Data is typically aggregated and anonymized.
Functional cookies: Functional cookies:
- Remember your preferences to improve your experience.
Marketing cookies: Marketing cookies:
- Track your activity to deliver relevant content. These are only used with your consent.

You can manage or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of our website. Where required by applicable law (including Quebec Law 25), we will seek your consent before placing non-essential cookies.

11. Safeguarding Your Personal Information

Nacki Advisory takes the security of personal information seriously. We implement technical, administrative, and physical safeguards appropriate to the sensitivity of the information and the risks of unauthorized access, use, disclosure, copying, modification, or disposal. These measures include:

Secure email and encrypted communication channels for sensitive project information;
Access controls and role-based permissions for internal systems;
Confidentiality obligations for employees, advisors, and contractors;
Regular review of our data protection practices;
Secure disposal of personal information when no longer required.

No method of transmission over the internet or electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. In the event of a breach that poses a real risk of significant harm, we will notify affected individuals and applicable regulatory authorities as required by PIPEDA, Quebec Law 25, or applicable African law.

12. Your Privacy Rights

Subject to applicable law, you have the following rights regarding your personal information:

12.1 Rights Under PIPEDA and Quebec Law 25 (Canadian Residents)

Right of access: Right of access:
- Request access to the personal information we hold about you and obtain an account of how it has been used and disclosed.
Right to correction: Right to correction:
- Request correction of inaccurate or incomplete personal information.
Right to withdraw consent: Right to withdraw consent:
- Withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal and contractual restrictions.
Right to complain: Right to complain:
- Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) or, for Quebec, the Commission d’accès à l’information (CAI).
Right to data portability (Quebec Law 25): Right to data portability (Quebec Law 25):
- Where technologically feasible, request that personal information collected by automated means be communicated in a structured, commonly used technological format.
Right to de-indexing / erasure (Quebec Law 25): Right to de-indexing / erasure (Quebec Law 25):
- Request that personal information collected online be de-indexed or that hyperlinks attached to your name be de-listed where collection was done without authorization or is no longer necessary.

12.2 Rights Under African Data Protection Laws

Where applicable African legislation grants you additional rights (such as the right to object to processing, the right to erasure, or the right to restrict processing), Nacki Advisory will respect those rights to the extent it is technically and legally feasible. These rights may include:

Right of access and correction under POPIA (South Africa), NDPR (Nigeria), Kenya DPA 2019, and equivalent legislation;
Right to object to processing for direct marketing purposes;
Rights of data subjects against automated decision-making where provided by local law.

To exercise any of your rights, please contact us using the details in Section 15.

13. Children’s Privacy

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us immediately and we will take steps to delete it.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated Policy on our website at https://nackiadvisory.ca/ with a revised “Last Updated” date. Where changes are material, we will take reasonable steps to notify affected individuals (e.g., by email notice or a prominent notice on our website).

Your continued use of our website or services after any changes have been posted constitutes your acceptance of the updated Policy, to the extent permitted by law.

15. How to Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or the handling of your personal information, please contact us.

We will respond to access and correction requests within 30 days, or as otherwise required by applicable law. We may need to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to contact the relevant supervisory authority:

Office of the Privacy Commissioner of Canada (OPC): www.priv.gc.ca — 1-800-282-1376
Commission d’accès à l’information du Québec (CAI): www.cai.gouv.qc.ca — 1-888-528-7741
Relevant African data protection authority in your country of residence (e.g., Information Regulator of South Africa, NITDA in Nigeria, Office of the Data Protection Commissioner in Kenya).