Your Rights
The legal architecture governing this Policy is established upon three distinct Canadian statutory regimes:
The British Columbia Personal Information Protection Act, SBC 2003, c. 63 (BC PIPA), which exercises primary provincial jurisdiction over the handling of personal information by private-sector organizations within the province;
The federal Personal Information Protection and Electronic Documents Act, SC 2000, c. 5 (PIPEDA), which applies to cross-border, interprovincial, and international transmissions of personal information during commercial activities; and
Canada's Anti-Spam Legislation, formally titled An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, SC 2010, c. 23 (CASL), which establishes binding statutory requirements for all commercial electronic messages, promotional distributions, and electronic contact mechanisms.
Under Section 4(3) of BC PIPA and Schedule 1, Principle 1 of PIPEDA, InWest maintains corporate accountabilities for all personal information under its control or custody. This accountability extends to records transferred to, hosted by, or processed through external cloud infrastructure partners, including our primary educational platform provider, Thinkific Labs Inc., and integrated financial processors.
Statutory Definitions and Interpretive Standards
To ensure interpretive clarity and adherence to Canadian privacy jurisprudence, this Policy incorporates statutory terms defined across provincial and federal enactments.
Information Architecture, Collection Categories, and Lawful Processing Purposes
InWest limits the collection of personal data to information that a reasonable person would consider appropriate in the circumstances, strictly honoring the "reasonable purposes" doctrine set forth under Section 11 of BC PIPA and Principle 3 of PIPEDA. Data is collected directly from prospective applicants, enrolled students, newsletter subscribers, and website visitors.
The organization gathers personal information across four functional streams:
The first stream encompasses learner identity, administrative credentials, and professional profile records. When an individual creates an account, registers for the Canadian Startup Ideation course, or requests consulting support, InWest collects their legal first and last name, email address, telephone contact number, physical mailing address, and country of residence. For participants utilizing courses to support economic immigration evidence or foreign investment verification, additional background metrics may be collected with express consent, including nationality, venture sector, professional track record, and business concept documentation.
The second stream comprises academic progression and educational performance analytics. As a student advances through instructional content across the four core modules—Analyze, Build, Collaborate, and Scale—the learning platform logs topic completions, video play rates, time allocated per lesson, answers submitted to the sixteen-question multiple-choice module examinations, final score tabulations, and the issuance of formal Certificates of Completion.
The third stream involves commercial transactions and billing records. Tuition and advisory service fees, such as the standard enrollment fee for the foundational ideation syllabus, are processed through encrypted financial gateways. The system records billing contact details, invoice registers, transaction reference numbers, currency values, and masked payment tokens. InWest does not store full credit card primary account numbers (PANs) or cardholder verification values (CVV) on its localized systems.
The fourth stream includes technical telemetry, diagnostic logs, and platform interactions. Automated logging tools record visitor Internet Protocol (IP) addresses, unique device fingerprints, operating system profiles, browser user-agent classifications, click paths, timestamped network interactions, and localized session tokens necessary to sustain network security and performance.
InWest explicitly prohibits the collection of sensitive biometric records, genetic markers, health histories, or criminal backgrounds, as such information bears no relation to the lawful provision of online business acceleration services.
Cloud Infrastructure, Educational Hosting, and Third-Party Sub-Processors
The digital delivery of courses, modules, assessments, and multimedia learning assets offered by InWest through ideationlab.ventures relies on cloud software services provided by Thinkific Labs Inc. ("Thinkific"), a corporate software company headquartered in Vancouver, British Columbia, Canada, and publicly listed on the Toronto Stock Exchange.
InWest acts as the Data Controller retaining ownership, control, and legal responsibility for student data, while Thinkific functions as an authorized Data Processor and Cloud Hosting Provider. Student account profiles, instructional engagements, grading rubrics, and video assets transit through and reside within server environments managed by Thinkific.
Thinkific hosts its physical and virtual infrastructure within Amazon Web Services (AWS) data centers, deploying multi-tenant enterprise architectures. Technical and operational safeguards deployed across this infrastructure satisfy BC PIPA Section 34 and PIPEDA Principle 7:
All electronic communications and data transmitted between the end-user’s browser and the Thinkific platform are protected using Transport Layer Security (TLS 1.2 or TLS 1.3) cryptographic protocols.
Databases, cloud storage volumes, and user backups containing personal data are secured using Advanced Encryption Standard 256-bit (AES-256) cryptographic keys managed within hardware security modules.
The platform infrastructure undergoes annual SOC 2 Type II independent auditing to verify system security, confidentiality, operational availability, and boundary integrity.
Infrastructure perimeters are reinforced by network isolation, multi-factor authentication for administrative users, automated threat analysis, and continuous Security Information and Event Management (SIEM) monitoring.
Commercial payment transactions on ideationlab.ventures are handled through Thinkific’s performance checkout systems integrated with Stripe, Inc. Stripe operates as a certified Payment Card Industry Data Security Standard (PCI-DSS) Level 1 Service Provider. Financial data submitted during checkout is tokenized directly through Stripe's client-side interface, ensuring that unencrypted card numbers never traverse or reside upon InWest or Thinkific web application servers.
When platform functionalities incorporate artificial intelligence utilities—such as Thinkific's "Thinker" automated workflows supported by external computational engines like AWS Bedrock, OpenAI, or Google AI—InWest and Thinkific maintain binding data protection covenants. These agreements stipulate that proprietary course content, student forum submissions, exam papers, and personal queries are never used to train public machine learning or foundation models. Data processed through AI sub-processors is retained only for the transient window necessary to complete the computational request and monitor system health, after which it is deleted.
Digital Tracking, Cookie Taxonomy, and Consent Governance
The ideationlab.ventures website and its integrated Thinkific portal utilize first-party and third-party cookies, web beacons, and localized browser scripts to maintain account authentication, optimize interface stability, compile aggregated user telemetry, and support digital marketing campaigns.
Following regulatory guidance issued by the Office of the Privacy Commissioner of Canada (OPC) regarding deceptive design patterns (dark patterns), InWest has structured its consent capture systems to ensure that visitors exercise clear, informed, and unambiguous choice. The consent interface deployed across the domain avoids asymmetrical interface formatting, ambiguous terminology, or deceptive default selections. Visitors are presented with equally styled options to accept, configure, or reject non-essential data tracking, and scripts associated with non-essential categories remain blocked until affirmative consent is provided.
The tracking technologies utilized across the Platform are classified into three functional categories:
The first category consists of Essential Cookies, which are strictly required to ensure core technical operations, navigational routing, account authentication, and platform security. These identifiers manage user sessions as learners move between course lessons, support Cloudflare web application firewall verification (cf_clearance) to protect the platform against bot-driven attacks, and maintain checkout stability during billing workflows. Because the website cannot function without these mechanisms, Essential Cookies do not require prior consent under Canadian privacy guidance, though their operational scope is transparently disclosed.
The second category comprises Analytics Cookies, which evaluate how visitors and learners interact with ideationlab.ventures and its course modules. These scripts record aggregated metrics regarding page load velocities, lesson duration, navigation drop-off rates, bounce statistics, and interface errors. Analytics technologies, such as Google Analytics 4 tags and internal Thinkific platform performance trackers (s7), collect pseudonymous metrics without directly recording identity details. In compliance with Canadian meaningful consent principles, Analytics Cookies are deactivated by default and load only after an individual provides express consent via the Platform consent banner.
The third category encompasses Marketing Cookies, which monitor browsing habits, referring channels, and conversion actions to deliver relevant informational materials, course updates, and prospective founder advertisements. Third-party tracking tools, including referral identifiers (lastExternalReferrer), evaluate campaign efficacy across external digital networks. These tracking scripts build interest profiles to prevent ad fatigue and measure user acquisition channels. Marketing Cookies remain blocked until the user provides affirmative consent through the consent interface.
Website visitors may choose to withhold their consent for Analytics and Marketing cookies at any time by selecting the desired option in the "Cookie Banner" floating dialog modal integrated into ideationlab.ventures. Modifying these preferences immediately halts subsequent script execution and unlinks active tracking sessions. Users may also manage cookie reception directly within their browser software by adjusting security parameters to reject or purge tracking files, acknowledging that disabling Essential cookies will affect authenticated course access and checkout performance.
Canada's Anti-Spam Legislation (CASL) Compliance Architecture
InWest administers all electronic mail broadcasts, program newsletters, commercial announcements, and instructional updates in strict conformity with Canada's Anti-Spam Legislation (CASL), SC 2010, c. 23, and its associated regulations.
The transmission of Commercial Electronic Messages (CEMs) requires either verified express consent or valid statutory implied consent:
Express consent is secured when an individual actively opts into electronic mailings via an un-ticked checkbox or dedicated email subscription form on ideationlab.ventures. The consent mechanism discloses the identity of InWest Ventures Corp., operating as IdeationLab, outlines the nature of the communications, and confirms the recipient's right to withdraw consent at any time.
Implied consent is recognized solely under circumstances authorized by Section 10(9) of CASL, primarily the Existing Business Relationship (EBR) provision. An EBR arises when an individual purchases an educational curriculum, advisory package, or enrollment seat from InWest, creating implied consent for promotional communications that remains valid for up to twenty-four (24) months following the transaction date. When an individual submits a business inquiry or mentorship question via an online web form, implied consent is limited to six (6) months following the inquiry date.
Every Commercial Electronic Message transmitted by InWest incorporates:
Clear sender identification confirming InWest Ventures Corp., doing business as IdeationLab, as the entity authorizing transmission;
Complete corporate physical postal address: 409 Granville St, Suite 1310, Vancouver, British Columbia, V6C 1T2, Canada;
Active electronic and telephone contact channels: +1 (604) 559-8472 and services@ideationlab.ventures; and
A prominent, functional unsubscribe mechanism enabling the recipient to opt out of commercial distributions with a single action.
Unsubscribe requests are processed immediately and completed within ten (10) business days from transmission, without imposing administrative fees or requiring extraneous information. Unsubscribe links remain operational for at least sixty (60) days following message dispatch.
Withdrawing consent from commercial electronic messages does not prohibit InWest from sending non-commercial transactional notices. Active students will continue to receive communications concerning account security, password resets, syllabus revisions, exam results, billing invoices, or statutory legal notices.
Cross-Border Transfers and Transnational Information Flows
While InWest is headquartered in British Columbia, the integration of enterprise cloud infrastructure and international processors necessitates the transit and storage of personal records outside the province, primarily within the United States of America.
Under Section 11 of BC PIPA and Principle 1 of PIPEDA, InWest informs all users that personal data may be stored, transferred, and processed across provincial and international boundaries. Information hosted in foreign jurisdictions is subject to local legal systems, including foreign statutes that permit judicial, law enforcement, or national security authorities to access records under local court orders, warrants, or subpoenas.
To protect personal information transferred abroad, InWest establishes contractual and operational safeguards:
Processors are bound by written agreements requiring technical and organizational protections comparable to Canadian legal standards.
Third-party vendors are prohibited from utilizing personal records for their own commercial objectives, model training, or unapproved data disclosures.
All cross-border transmissions are secured using end-to-end cryptographic protocols (TLS 1.2 or higher) to protect personal data against intercept during network transit.
Retention Schedules, Data Minimization, and Cryptographic Sanitization
Pursuant to Section 35 of BC PIPA and Schedule 1, Principle 5 of PIPEDA, InWest does not retain personal records indefinitely. Personal data is held only as long as necessary to satisfy the specific purposes for which it was collected, support commercial auditing, enforce contractual rights, or meet statutory retention requirements.
Data classifications and retention periods are managed according to the following schedule:
Once the governing retention window expires, or upon receipt of a verified deletion request, personal data is permanently destroyed or anonymized. Electronic records are deleted from cloud databases and backup volumes using cryptographic erasure and permanent sector overwriting conforming to the NIST SP 800-88 Revision 1 Guidelines for Media Sanitization. Where aggregate statistics are preserved for historical reporting, all direct and indirect personal identifiers are stripped to ensure the data cannot be re-identified.
Security Safeguards and Statutory Data Breach Response Protocol
InWest maintains administrative, technical, and physical security safeguards designed to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification, in compliance with Section 34 of BC PIPA and Principle 7 of PIPEDA.
Administrative controls include role-based data partitioning, mandatory non-disclosure covenants for corporate personnel, and annual privacy and information handling training. Physical controls restrict access to corporate facilities, ensuring that visitor access is monitored and electronic devices containing business records are encrypted. Technical controls enforce least-privilege API authentications, firewalls, network monitoring, and end-to-end cryptographic transit and storage protocols.
InWest maintains a documented incident response procedure to identify, contain, and remediate unauthorized data access, disclosure, or loss. Under Section 10.1 of PIPEDA and regulatory guidance issued by the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC), any security incident involving personal data undergoes a statutory Real Risk of Significant Harm (RROSH) evaluation.
The RROSH determination evaluates:
The sensitivity of the compromised records, including whether financial tokens, identity credentials, immigration business plans, or passwords were exposed;
The probability of misuse, assessed by analyzing whether the data was encrypted, recovered before unauthorized access occurred, or targeted by bad actors;
The scope of the incident, encompassing the number of affected learners and systems involved; and
The foreseeable consequences to the individual, including potential financial loss, identity theft, credit impairment, reputational damage, or humiliation.
When an incident satisfies the RROSH threshold, InWest executes the following statutory actions:
Regulators are notified as soon as feasible, submitting comprehensive breach reports to both the Privacy Commissioner of Canada (OPC) and the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC).
Affected individuals are notified directly without unreasonable delay via email or written communication, unless an official law enforcement agency instructs otherwise to protect an investigation. Notifications detail the circumstances of the incident, the specific categories of information involved, the protective actions taken by InWest, steps the individual should take to mitigate personal risks, and contact details for both InWest's Privacy Officer and regulatory oversight offices.
Under Section 10.3 of PIPEDA, InWest logs the incident within its central internal breach registry. All incidents involving security safeguards are recorded and preserved for a statutory minimum of twenty-four (24) months, regardless of whether the incident reached the RROSH threshold.
Regulatory Changes & Policy Updates
InWest reserves the right to modify this Privacy Policy at any time to reflect changes in legal frameworks, regulatory requirements, or our data processing practices.
Notification of Changes: If we make material changes to this policy, we will notify you by updating the "Last Revised" date at the bottom of this document. For significant updates, we may provide a more prominent notice, such as an email notification or a banner on our website.
Your Responsibility: We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
Acceptance of Terms: Your continued use of our services after any modifications constitutes your acknowledgment and acceptance of the revised Privacy Policy.
Individual Access Rights, Rectification, and Regulatory Recourse
Under Sections 23 through 25 of BC PIPA and Schedule 1, Principles 9 and 10 of PIPEDA, individuals possess legal rights regarding personal data held by InWest.
Individuals hold the right to submit an access request to verify whether InWest processes their personal data, review the specific contents of their records, and receive an explanation of how their data has been used or disclosed, including an itemization of third-party organizations to which the records were transferred. If an individual identifies errors or omissions in their records, they may request correction under Section 24 of BC PIPA. Upon verifying the inaccuracy, InWest corrects the data and transmits updated records to third-party processors who received the incorrect information within the preceding twelve months. Individuals may also withdraw consent for ongoing data processing upon giving reasonable advance notice, subject to contractual terms or legal reporting mandates. Withdrawing consent may limit an individual's ability to access course content or receive credentials.
Requests are processed through a structured verification and fulfillment workflow:
InWest may decline access to personal records only under narrow statutory exceptions, including scenarios where disclosure would reveal personal data about another individual who has not consented to disclosure, where the information is protected by solicitor-client privilege, or where release could reasonably be expected to threaten the safety or health of another person.
Corporate Privacy Officer Contact Information
Pursuant to Section 4(3) of BC PIPA and Schedule 1, Principle 1 of PIPEDA, InWest has designated a corporate Privacy Officer responsible for organizational compliance, administering internal policies, and managing privacy inquiries.
Inquiries, formal access requests, correction submissions, or complaints may be directed to:
Attention: Corporate Privacy Officer, InWest Ventures Corp.
Operating Brand: IdeationLab (ideationlab.ventures)
Registered Office: Suite 1310, 409 Granville Street, Vancouver, British Columbia, V6C 1T2, Canada
Telephone Contact: +1 (604) 559-8472
Primary Privacy Inquiries: services@ideationlab.ventures
General Support Communications: support@ideationlab.ventures
Alternate Corporate Inquiries: office.inwest@gmail.com
If an individual is dissatisfied with the outcome of a request or believes their personal data has been handled inconsistently with Canadian privacy law, they have the statutory right to lodge a complaint with provincial or federal supervisory authorities.
Amendments, Policy Governance, and Revision Ledger
InWest reviews and updates this Policy periodically to reflect enhancements to the ideationlab.ventures educational environment, adjustments in sub-processor relationships, and evolving standards under BC PIPA, PIPEDA, CASL, or relevant judicial precedents.
When substantive modifications occur, InWest publishes a clear notice across the website banner and course platform dashboard and updates the revision date at the beginning of this document.
For registered students, material alterations impacting active processing rights are communicated via direct electronic notification at least thirty (30) days prior to the effective implementation date.
.png)
.svg){kind=small}
