How we handle your information.

Effective September 2026. EZAI is a division of Agility IT Inc., Calgary, Alberta, Canada. In this notice, "EZAI", "we" and "us" mean Agility IT Inc. acting through its EZAI division.

1. Scope

This notice applies to personal data we process in the course of our recruitment, staffing and automation services, and to visitors to this website. It applies to candidates, contractors, client contacts, referees and anyone else whose personal data reaches us through those activities.

Where we determine the purposes and means of processing, we act as a data controller. Where we process personal data on documented instructions from a client, for example during an onboarding or compliance process operated by that client, we act as a data processor under a written agreement with that client.

2. Personal data we process

Candidates and contractors

• Identifying and contact information: name, email address, telephone number, location and, where relevant, work authorization status.
• Professional information: curriculum vitae, employment history, technical skills, certifications, availability, current and expected remuneration, references and interview feedback.
• Records of our correspondence and of screening and placement conversations.
• Where a placement proceeds, the identity and eligibility documentation required to complete right to work and contractual onboarding checks.

Client contacts

• Business contact details, role requirements, commercial terms and correspondence relating to live and completed assignments.

Website visitors

• Information you submit through the contact form, and standard server log information recorded by our hosting provider for security and abuse prevention.

3. Purposes and lawful bases

• Legitimate interests. Operating a recruitment and staffing business, matching candidates to assignments, maintaining our talent network, and managing client relationships. We have assessed that these interests are not overridden by your rights and freedoms.
• Consent. Submitting your details to a named client, retaining your profile beyond our standard retention period, and any processing for which consent is required under applicable law. Consent may be withdrawn at any time.
• Performance of a contract. Placing you on an assignment and administering the resulting contractual relationship.
• Legal obligation. Right to work verification, tax and payroll records, and other statutory record-keeping.

We do not sell personal data, we do not share it for advertising or profiling purposes, and we do not operate marketing mailing lists.

4. Where your data is held

All personal data we process is stored and processed within the Google environment. We use Google Cloud, Google Workspace Business and Google Workspace Enterprise services as our sole platform for email, documents, file storage, calendars and candidate records.

Personal data does not leave that environment. We do not copy candidate or client data into third-party applicant tracking systems, customer relationship management platforms, marketing tools, analytics services, artificial intelligence training services or personal devices outside managed Google accounts. Access is limited to named EZAI and Agility IT personnel working on the relevant assignment, is controlled through Google Workspace administrative policy, and is protected by enforced multi-factor authentication.

Google, as our infrastructure and productivity provider, maintains independently audited certifications for these services, including ISO/IEC 27001 (information security), ISO/IEC 27017 (cloud security), ISO/IEC 27018 (protection of personal data in the cloud), ISO/IEC 27701 (privacy information management) and SOC 1, SOC 2 and SOC 3 reports. Those certifications are held by Google in respect of its platform. Our own compliance obligations as a controller and processor rest with us, and this notice describes how we meet them.

The one exception to the above is our website contact form, which is transmitted through our hosting provider, Netlify, before it reaches our Google Workspace mailboxes. Do not use the website form to send sensitive personal information. See section 6.

5. Regulatory frameworks

We operate from Canada and deliver across India, Asia, Europe and Latin America. Our data protection practices are designed and maintained to meet the requirements of the frameworks applicable to those markets, including the following.

• Europe. The EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK GDPR together with the Data Protection Act 2018, and the revised Swiss Federal Act on Data Protection.
• Canada. The Personal Information Protection and Electronic Documents Act, the Alberta Personal Information Protection Act, and Quebec's Law 25 where applicable.
• India and Asia Pacific. The Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025, Singapore's Personal Data Protection Act, Japan's Act on the Protection of Personal Information, Korea's Personal Information Protection Act, and the Australian Privacy Act 1988.
• Latin America. Brazil's Lei Geral de Proteção de Dados (Law 13.709/2018) and Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, together with equivalent national regimes in the other markets in which we operate.

Where more than one framework applies to a given processing activity, we apply the more protective standard.

6. Sensitive information and secure transmission

We ask for the minimum information necessary at each stage, and we do not request sensitive or identifying documentation by ordinary email or through the website form.

Where identity documents, proof of work authorization, banking details for payroll or other sensitive information are required, we issue a secure upload link. The link is time limited, delivers directly into the Google environment described in section 4, and is issued only after the assignment and the specific requirement have been confirmed with you. If you receive a request purporting to come from EZAI that asks you to send such documents by email, by messaging application, or to any address outside a link we have issued, treat it as suspect and contact us using the details in section 11.

7. Disclosure

We disclose personal data only in the following circumstances.

• To a client, with your prior agreement. A candidate profile is submitted to a client only after you have been told the client's identity, the rate and the scope of the assignment, and have confirmed that we may proceed.
• To a partner vendor or managed service provider, where an assignment is contracted through one. We identify any such intermediary to you before submission, because it affects who else will see your profile.
• To professional advisers, insurers, auditors and regulators, where we are required or entitled to do so.
• Where required by law, including a valid order of a competent court or authority.

We do not disclose a client's requirements, rates or commercial terms to other clients.

8. International transfers

Because we operate across multiple regions, personal data may be accessed by our personnel outside your country of residence, and is stored in Google data centre regions selected by us. Where personal data originating in the European Economic Area, the United Kingdom or Switzerland is transferred outside those territories, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, supported by the Google Cloud Data Processing Addendum. Transfers from other jurisdictions are made in accordance with the transfer conditions of the applicable framework listed in section 5.

9. Retention

• Candidate records are retained while there is an active relationship and for a period afterwards so that we can approach you about further assignments. Where there has been no contact for 24 months, the record is deleted unless you have asked us to retain it or we are required to keep it.
• Placement, payroll and compliance records are retained for the period required by applicable tax, employment and limitation law in the relevant jurisdiction.
• Client records are retained for the duration of the commercial relationship and for the period required for legal and accounting purposes.
• Sensitive documentation collected through a secure link is retained only for as long as the verification purpose requires, and is then deleted.

You may ask us to shorten any of these periods, and we will do so unless a legal obligation prevents it.

10. Your rights

Subject to the framework that applies to you, you have the right to:

• be informed about how your personal data is processed;
• obtain access to the personal data we hold about you, and a copy of it;
• have inaccurate personal data corrected and incomplete data completed;
• have your personal data erased;
• restrict or object to processing, including processing based on legitimate interests;
• receive your personal data in a portable format;
• withdraw consent at any time, without affecting processing carried out before withdrawal;
• lodge a complaint with your supervisory authority. In Canada this is the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta; in the United Kingdom the Information Commissioner's Office; in the European Economic Area your national supervisory authority; in India the Data Protection Board of India; and the equivalent authority in the other jurisdictions listed in section 5.

We do not carry out automated decision-making that produces legal or similarly significant effects. Shortlisting decisions are made by a person.

11. Exercising your rights, and complaints

Email hello@theezai.com or telephone +91 98039 29010 and describe your request. We acknowledge requests promptly and respond within 30 days, or within the shorter period required by the framework that applies to you. We may ask you to verify your identity before disclosing personal data.

The same contact route applies to any concern about how an assignment or a placement has been handled. Every search we run has one named owner. If you would prefer to escalate beyond that person, say so in your message and it will be directed to the business owner.

12. Security

We apply technical and organizational measures appropriate to the risk, including access control on a need-to-know basis, enforced multi-factor authentication on all accounts, encryption in transit and at rest as provided by the Google platform, administrative controls on external sharing, endpoint management, and periodic review of access rights. We maintain a documented process for identifying and reporting personal data breaches, and we notify affected individuals and the relevant supervisory authority where the applicable framework requires it.

13. This website

This website sets no advertising or tracking cookies. There is no analytics tracker, no advertising pixel and no third-party script on this site. The contact form is processed by our hosting provider, Netlify, which stores the submission and delivers it to our Google Workspace mailbox, and which records standard server information such as IP address for security purposes.

14. Changes to this notice

We review this notice periodically. Where we make a material change we update the effective date at the top of this page. The version published here is the current version.