Privacy Policy

Effective date: September 28, 2026

This policy covers personal information connected with the Niki Techen consulting website, enquiries, and client work. It explains our use of service providers and AI-assisted tools, the purposes for retaining records, and how to ask a privacy question or exercise an applicable right.

1. Who we are and what this policy covers

Notch Trading Inc. operates the Niki Techen consulting business and nikitechen.com from Nanaimo, British Columbia, Canada. In this policy, “we,” “us,” and “our” mean Notch Trading Inc. Niki Techen is the Privacy Officer responsible for our privacy practices. Contact details appear in section 16.

This policy explains how we collect, use, disclose, protect, and retain personal information when you visit the website, contact us, or participate in a consulting engagement. Our services include Amazon Operations Analysis, Sourcing & Purchasing Analysis, Operational Analysis & Improvement, and Business & Data Analysis.

Personal information is information about an identifiable individual. A combination of records, identifiers, or other details can identify someone even after names have been removed. Some business contact information is treated differently under applicable law. Confidential corporate and product-level information also remains protected by our contractual confidentiality commitments, whether or not it is personal information.

We follow the privacy laws applicable to the information and activity involved, including British Columbia’s Personal Information Protection Act and, where applicable, the federal Personal Information Protection and Electronic Documents Act. This policy explains our practices; it does not waive privacy rights or replace any required consent. A project-specific agreement may provide additional protections but cannot remove obligations imposed by law.

2. Information we receive

Enquiries and correspondence

Our contact form asks for your first name, last name, email address, service or enquiry category, and a description of what you would like to understand or improve. You may also provide a phone number and preferred contact method. Selecting Amazon Operations Analysis opens an approximate annual-revenue field used to help assess fit. You choose the additional business context included in your message.

We also receive information you provide through email, calls, meetings, referrals, or shared files. This may include your role, organization, business website, scheduling details, and records of our correspondence. Employment or recruiting enquiries are handled for the opportunity discussed.

Engagement records and analytical work

For an agreed engagement, we receive the records needed for the scope, which may include sales, purchase costs, returns, inventory, fees, shipping, aggregate labour costs, workflows, and supporting business records. Some files can contain personal information about clients’ customers, employees, contractors, or suppliers. We also create analyses, calculations, notes, reports, and correspondence that may contain personal information.

Administrative records can include proposals, accepted agreements, billing contacts, invoices, payment confirmations, transaction references, and approval records. Technical information associated with website visits and form submissions is addressed in section 5.

3. Client-supplied information and sensitive details

Clients must have the authority and any required consent or other lawful basis to provide information about other people for the agreed work. Where we process personal information on a client’s behalf, we use it for the authorized engagement, agreed administration, and limited lawful archival purposes. We remain responsible for our own handling of that information.

Provide only information reasonably needed for the question being investigated. Use aggregate departmental costs where individual payroll detail is unnecessary, and remove or replace unnecessary customer, employee, and supplier identifiers. Aggregation or replacement identifiers do not establish anonymity if someone can still be identified from the remaining information.

Do not send Social Insurance Numbers, Social Security numbers, passwords, authentication codes, banking credentials, full payment-card details, or unnecessary health or identity records through the contact form. If sensitive information is genuinely necessary, discuss the purpose, authority, and transfer method with us before sending it. For Amazon engagements, Seller Central login credentials are neither required nor requested.

Our website and services are directed to business and professional enquiries. We do not solicit personal information directly from children. Please contact the Privacy Officer if unnecessary sensitive information or information about a child has been supplied so we can address it appropriately.

4. Purposes, consent, and choices

We use information to respond to enquiries, assess fit, scope and deliver engagements, communicate findings, administer payments and agreements, protect our systems, address complaints or suspected errors, preserve necessary evidence of our work, and meet legal obligations. Use is limited to appropriate purposes supported by the applicable consent, authority, or legal permission.

When you voluntarily contact us for an obvious purpose, such as requesting a discussion about a service, we use the information to address that request. We seek additional consent or authorization where required, including for uses that would not reasonably be expected. Necessary service-related handling and optional uses are distinguished when permission is requested.

You can ask questions about a proposed use before providing information. Where handling is based on consent, you may withdraw it on reasonable notice, subject to applicable law. We will explain any practical consequences, such as being unable to complete an analysis without essential records. Withdrawal does not automatically require deletion of records that may lawfully be retained under section 10.

A client’s authorization for consulting or AI processing does not by itself establish legal authority to use another person’s information. Merely visiting this website does not provide blanket consent to unrelated processing.

5. Website records, cookies, and form handling

Contact-form submissions and email

The website uses WordPress and Fluent Forms. Submitted enquiries are stored in the website’s WordPress database. Form information includes the name, email address, phone number, selected service or enquiry category, enquiry text, and preferred contact method, where supplied. The conditional approximate annual-revenue field is described in section 2.

IP-address logging is enabled. Fluent Forms’ documented submission records also provide for timestamps, the source-page URL, browser and platform information, form and submission identifiers, and a WordPress user ID where applicable.

Namecheap provides website and email hosting through its Stellar Plus shared-hosting service. WP Mail SMTP handles website email delivery through the configured Namecheap email service. Form notification emails include the submitted answers, creating separate copies in the website database and the receiving mailbox.

Spam protection

Fluent Forms’ built-in honeypot protection and Google reCAPTCHA v3 are enabled to help protect the form against automated submissions. Google is an external provider involved in this protection. Its reCAPTCHA service performs risk analysis for security, fraud prevention, and abuse prevention. Google documents the use of the _GRECAPTCHA cookie when the service runs and describes the processing of reCAPTCHA customer data under its Google Cloud terms and Cloud Data Processing Addendum.

Further information is available in Google’s reCAPTCHA documentation. The expiry of a browser cookie does not establish how long Google retains information processed by the service.

Cookies and consent preferences

We use Complianz to present cookie information and manage visitors’ consent preferences. Functional cookies remember the choices you make through the consent banner.

We have configured Complianz to respect Do Not Track (DNT) and Global Privacy Control (GPC) signals sent by your browser. When either signal is detected, Complianz treats the optional consent preferences it manages as declined, and the consent banner may not be displayed.

You can select the available options in the banner. You can also use your browser’s settings to block or delete cookies, although this may affect website functions. Deleting cookies does not delete information already held in our systems or a service provider’s systems. For questions about cookies or requests concerning your consent, contact the Privacy Officer in section 16.

Analytics and advertising

Google Analytics is not currently installed, and we do not currently use visitor-analytics or advertising-tracking tools on this website. Fluent Forms’ built-in form analytics are disabled. Form submissions, IP-address logging, technical logs, and spam protection continue as described in this policy.

Before introducing an optional analytics, advertising, or tracking function, we will update the relevant privacy information and provide any choice or consent required by applicable law. This policy does not authorize future tracking simply because you visit the website today.

Technical and diagnostic records

Website delivery and security can involve technical records such as an IP address, browser or device details, requested pages, referring pages, request times, and error or security events. These records support website operation, security, troubleshooting, and email delivery.

Cookie expiry periods describe storage in the visitor’s browser. Retention of submitted enquiries, email, application and server logs, backups, and information held by providers is separate, as described in section 10.

6. Service providers and other disclosures

We use service providers for functions needed to operate the business and perform authorized work. This includes Namecheap for website and email hosting and its documented AutoBackup service, Google reCAPTCHA for form spam protection as described in section 5, and Google Drive and Microsoft OneDrive for receiving, storing, organizing, backing up, and sharing engagement files. Files may also be held on the computers and storage used for our work. Generative AI services used for consulting engagements are addressed separately in section 7.

Provider access is limited to information relevant to the service, with confidentiality, security, and processing arrangements appropriate to the information. Client-specific provider or location restrictions must be addressed before a transfer. Using a provider does not remove our responsibility for obligations we have accepted or obligations imposed by law.

Where an engagement requires an additional service for payments, scheduling, meetings, recording, transcription, or another agreed function, the relevant provider and handling arrangements will be explained when that service is arranged. Any necessary notice, authorization, or consent must be addressed before information is supplied to the service.

We may share relevant information with authorized client contacts and, where necessary and permitted, consulting subcontractors, professional advisers, insurers, or service personnel. Access is limited to the permitted purpose and appropriate confidentiality obligations. Legal disclosures are limited to what is required or otherwise permitted by applicable law.

We do not sell or rent client contact lists or confidential engagement datasets. We do not authorize providers to use confidential client records for their independent marketing.

7. AI-assisted analysis

Generative AI-assisted analysis is used in consulting work under separately agreed arrangements. The website’s contact form has no integration that automatically sends submissions to ChatGPT, Gemini, or another generative AI service.

We may use spreadsheets, scripts, automation, and generative AI tools to support an engagement. AI assistance can include reviewing and organizing data, developing or checking calculations and code, identifying patterns, and preparing explanations or draft findings. Niki Techen reviews tool-assisted output used in final deliverables on behalf of Notch Trading Inc.

Before confidential client information is submitted to a third-party AI service, the selected provider, intended use, relevant account or service arrangements, and information-handling restrictions are disclosed and authorized in writing through the consulting agreement or a separate approval. The disclosure addresses the data involved, the purpose, and applicable retention, training, access, and processing-location arrangements.

Written authorization can cover recurring AI use throughout an engagement. Separate approval is not required for each prompt, upload, or analysis that remains within the authorized purposes, data categories, and disclosed processing arrangements. A materially different use requires review and any further authorization or consent that is needed. A client’s authorization does not replace any additional legal authority required to process another person’s personal information.

We limit AI inputs to what is reasonably needed, remove or replace unnecessary personal identifiers, and assess whether the remaining information could identify an individual. De-identified information remains subject to applicable privacy requirements and agreed confidentiality restrictions. Corporate financial or operational figures may still be confidential even when no individual is identifiable.

For routine client work, optional general-purpose model training is disabled through the account settings or excluded by the selected service arrangements. We do not submit confidential client material through optional feedback channels that permit general-purpose training. Confidential client information must not be used to train general-purpose AI models without separate express written authorization and a lawful basis.

Training restrictions do not by themselves eliminate provider-side storage, service-delivery processing, security review, or legally required retention. The processing arrangements for the selected service must be appropriate for the authorized information. Publishing this policy or receiving an enquiry does not itself authorize uploading confidential client records to an AI service.

8. Processing outside Canada

Cloud, email, and AI services may involve storage, processing, or access outside Canada, including in the United States or other countries in which the selected providers operate. The location depends on the service, account arrangements, and any applicable regional settings.

Information processed outside Canada may be subject to the laws and lawful access requests of the relevant jurisdiction. Contractual safeguards cannot prevent a disclosure that applicable law requires. We remain responsible for our own privacy obligations and use appropriate contractual or other safeguards for information transferred to providers.

Material location or provider restrictions must be addressed before transfer. Where additional notices, permissions, assessments, or transfer arrangements are required by applicable law, they must be addressed for the relevant engagement. We do not represent that all records remain in Canada.

9. Security and incidents

We apply reasonable administrative, technical, and organizational safeguards appropriate to the sensitivity, amount, and use of information. These include limiting access to authorized people, protecting the devices and accounts used for work, selecting appropriate transfer and storage arrangements, and controlling file-sharing permissions. No transmission or storage method is entirely risk-free.

If we become aware of a breach of security safeguards affecting client information in our possession or control, we will notify the client without undue delay, unless prohibited by law. We will provide relevant information available to us, take reasonable steps to contain and address the breach, comply with applicable reporting, notification, and recordkeeping obligations, and reasonably cooperate with the client’s response. Individuals and regulators are notified where required by applicable law.

10. Retention and archival copies

Our retention standard is to keep personal information only for as long as reasonably necessary for the identified purposes and applicable legal requirements. The appropriate period depends on the type of record, the engagement, legal or insurance requirements, and any controlling written agreement. Technical storage settings do not, by themselves, authorize indefinite retention.

Current website, email, log, and backup settings

Contact-form submissions are stored in the website database, and notification emails are stored separately in the receiving mailbox. Technical and diagnostic records support website operation, security, and troubleshooting. Backup copies may remain after information is deleted from live systems. Retention and deletion are subject to the purposes and legal requirements described in this section.

Retention criteria and engagement archives

Enquiry records serve the purposes of responding, following up appropriately, and documenting the exchange. Contract, invoice, and payment records support administration and applicable recordkeeping requirements. Technical records support website operation, security, and troubleshooting. Continued retention must remain reasonably necessary for the relevant purpose or another lawful legal or business requirement.

Subject to applicable law and any controlling written agreement, we may retain archival copies of final deliverables and the client-provided records, supporting analyses, assumptions, approvals, and correspondence reasonably needed to document the work performed, investigate alleged errors, respond to disputes or reasonably anticipated legal claims, and meet legal or insurance requirements. Completion or termination of an engagement does not itself require deletion of records that may lawfully be retained for those purposes.

Archival retention is limited to the information and period reasonably necessary for those purposes. Retained copies remain protected and may be used only for permitted purposes. Archival retention does not authorize reuse of client records in another engagement, a public example, or an AI-training dataset.

When continued retention is no longer reasonably necessary or is no longer permitted, we will securely delete the information or, where appropriate, remove the means of associating it with identifiable individuals. Lawful preservation requirements continue to apply. Retention and deletion arrangements must also address backup copies, including any lawful delay needed for protected backup expiry or a preservation hold. An absence of automatic deletion does not suspend these obligations or make them dependent on an individual requesting deletion.

Where applicable law requires information to be retained to allow an individual to obtain access or challenge a decision, we preserve it for the required period. Project-specific deletion schedules and individual requests are assessed alongside those duties. You can contact the Privacy Officer for information about the retention criteria applicable to your records.

11. Access, correction, withdrawal, and deletion requests

Subject to applicable law, you may ask whether we hold personal information about you, request access to it and an account of its use and disclosure, and seek correction of an error or omission. You may also withdraw consent where consent is the basis for the handling or request deletion. The availability and extent of these rights depend on the applicable law and the circumstances.

Send a written request to the Privacy Officer with enough detail to identify the records or concern. We may request limited additional information to verify identity or representative authority and prevent disclosure to the wrong person. Do not send identity documents or sensitive account details unless we explain why they are needed and arrange an appropriate method.

We respond within the applicable legal period and explain any lawful extension. Access may be limited by specific legal exceptions, such as protection of another person’s information, privilege, or protected commercial information. Where required, we provide the accessible portion and explain the reason for any refusal and available review rights. Any permitted access fee is limited to what the law allows and is disclosed in advance.

When a correction is warranted, we update or annotate the relevant records and notify recipients as required by law. Where preserving the original record of work is lawful and necessary, a correction may also be recorded alongside the original so the history remains accurate. We explain any refusal to correct and record a disputed correction where required.

Requests concerning personal information held for a client may require coordination with that client. You may contact either the relevant organization or our Privacy Officer; coordination does not remove our own duties. Any continued retention after a deletion request must have a lawful basis, and we explain applicable limits on deletion.

12. Communications and meeting information

We use your contact details to address your enquiry, arrange discussions, and communicate about agreed work. Submitting an enquiry does not subscribe you to a newsletter or grant permission for unrelated marketing. Any optional promotional communications must meet applicable consent and electronic-messaging requirements, and you may ask to stop them. Necessary engagement or legal communications may continue where appropriate.

Before recording a meeting or using a transcription or AI meeting-assistant service, we will explain the proposed purpose and handling and obtain any agreement or consent required. Recording or transcription is not authorized merely because a person visits the website or submits the contact form.

13. Testimonials, case studies, and examples

We obtain separate written permission before publishing a client’s name, logo, testimonial, report excerpt, or client-derived case study or result, including an anonymized case study. If publication includes another person’s personal information, any additional required permission or authority must also be addressed.

Synthetic examples may be used to explain a method or deliverable and are identified as illustrative. Removing a name alone does not establish that a real person or client cannot be identified from an example.

14. External links and third-party content

The website includes a link to Niki Techen’s LinkedIn profile and may link to other external resources. Following a link takes you to a service with its own privacy practices. Information you provide directly to that service is handled under its applicable arrangements.

An external link is different from third-party content loaded within a webpage. When a browser requests a resource directly from a third-party service, that service receives the technical information needed to respond to the request. Our responsibility for selecting and using providers to process information on our behalf continues even where a provider also has its own privacy notice. New integrations that change the handling of personal information require corresponding privacy information and any necessary consent.

15. Changes to this policy

Updates will show a revised effective date. Where a change introduces a materially different purpose or other handling requiring notice or consent, we will provide the necessary notice and obtain the required consent before proceeding. Continued website use does not automatically authorize an incompatible new use of previously collected information.

Publishing an update does not silently change an accepted engagement agreement, confidentiality agreement, or data-processing restriction. Mandatory privacy rights and obligations continue to apply.

16. Privacy contact and complaints

For privacy questions, requests, or complaints, contact:

Notch Trading Inc.
Attention: Niki Techen, Privacy Officer
c/o Heath Law LLP
200-1808 Bowen Road
Nanaimo, BC, V9S 5W4
Canada

Email: info at notchtrading.com

Please identify the enquiry or engagement involved and explain the information or concern clearly, without including unnecessary sensitive details. We will review the concern, communicate our findings or next steps, and take appropriate corrective action where needed.

You may also raise a concern with the Office of the Information and Privacy Commissioner for British Columbia or, for issues within its jurisdiction, the Office of the Privacy Commissioner of Canada. Our complaint process does not prevent you from contacting a regulator or exercising another available right.