Exposoft Solutions — Privacy Policy

 

Effective date: June 15, 2026

Last updated: June 15, 2026

Exposoft Solutions (“Exposoft,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains what information we collect, how we use and protect it, who we share it with, how long we keep it, and the rights you have over your data.

This policy covers:

  • The Exposoft public website (exposoft.agency, exposoft.ca and related domains);
  • The event Web Registration Sites we host and operate on behalf of our clients;
    and
  • The Exposoft marketing platform, through which we connect to and manage third-party advertising and website accounts on behalf of our clients.

By using our websites or services, you acknowledge that you have read and understood this Privacy Policy.

 

1. Who We Are 

Exposoft Solutions is a data and marketing services provider that has operated in the event-management industry since 1996. We act both as a data controller (for information you provide to us directly) and as a data processor (for information we handle under the instruction and authority of our clients). We comply with applicable data-protection laws, including Canada’s PIPEDA, the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).

Chief Privacy Officer
Exposoft Solutions Ltd.
2011 Crystal Drive, 4th Floor, Arlington, VA, USA 22202
Email: info@exposoft.ca

 

2. Information We Collect

2.1 Information collected from our website

We will not collect personal information about you without your permission. Your consent is implied when you choose to complete any online form on our website requesting personal information from you (for example, a contact or demonstration request form). At the time of collection, we will tell you how that information will be used if it is to be used for any purpose other than the one for which it was collected.

2.2 Information collected on event Web Registration Sites

As a data processor for our clients in the event industry, we may collect personal information from the third-party Web Registration Sites that we host. These sites often link to, and appear integrated with, our clients’ websites, but the registration and data-processing software is set up and administered by us.

Personal information collected on these Registration Sites is used and processed in accordance with the privacy policies of the client who authorized and instructed us to operate the site on their behalf. We strongly encourage you to review the privacy policy of the client whose Registration Site you are using before submitting information. Where a Registration Site is e-commerce enabled, we share the personal and financial information necessary to process a payment with our merchant and financial service providers, using SSL encryption.

2.3 Information collected through the Exposoft marketing platform

When a client engages us to manage their digital advertising or website properties, the client (or their authorized representative) connects their own third-party accounts to our marketing platform. To operate those accounts on the client’s behalf, we collect and store:

  • Authentication credentials for each connected account — such as OAuth 2.0 access tokens, refresh tokens, API keys, and developer tokens;
  • Account identifiers — such as advertising account IDs, customer IDs, and site IDs; and
  • Campaign and performance data we retrieve from the connected platform — such as campaigns, ad spend, impressions, clicks, and conversions, reported in aggregate and excluding individual end-user identities.

Where a client runs lead-generation advertising through a connected platform, we also process the contact and professional details that individuals voluntarily submit through those lead forms (see Section 6).

2.4 Technical and usage information

To improve our websites and platform, our servers automatically collect general, non-identifiable technical information such as language preference, screen resolution, browser type, platform type, and page-load times. We use this aggregate information only to improve the design and operation of our services.
For information about cookies and authentication technologies, see **Section 5**.

 

3. Third-Party Platform Integrations

The Exposoft marketing platform connects to the following third-party services on behalf of our clients. For each, we store only the credentials and identifiers needed to operate the client’s account, and we access only the data required to manage campaigns or content and to report on performance. We do not use any data obtained through these platforms for credit, insurance, employment-eligibility decisions, or any other prohibited profiling, and we use each platform strictly in accordance with that platform’s developer terms.

Connected platform

What we access

Purpose

Google Ads

OAuth credentials, developer token, customer/account IDs, campaign + performance data

Create, manage, and report on advertising campaigns

Microsoft Advertising (Bing Ads)

OAuth credentials, developer token, customer/account IDs, campaign + performance data

Create, manage, and report on advertising campaigns

LinkedIn Ads (Marketing Developer Platform)

OAuth credentials, advertising account ID, campaign + performance data

Create, manage, and report on advertising campaigns; process Lead Gen form submissions

Meta — Facebook & Instagram Ads

Access token, ad account ID, campaign + performance data

Create, manage, and report on advertising campaigns

TikTok Ads

Access token, advertiser ID, campaign + performance data

Create, manage, and report on advertising campaigns

Twitter / X Ads

OAuth keys + tokens, ads account ID, campaign + performance data

Create, manage, and report on advertising campaigns

Pinterest Ads

OAuth credentials, ad account ID, campaign + performance data

Create, manage, and report on advertising campaigns

Snapchat Ads

OAuth credentials, ad account ID, campaign + performance data

Create, manage, and report on advertising campaigns

Reddit Ads

OAuth credentials, ads account ID, campaign + performance data

Create, manage, and report on advertising campaigns

Programmatic — DV360 / The Trade Desk

OAuth or API token, advertiser ID, campaign + performance data

Manage and report on programmatic advertising

Webflow

Site API token, site ID

Manage and publish website (CMS) content on the client’s behalf

 

Connecting an account is always initiated by the client or their authorized representative, and the client may disconnect any account at any time (see Section 7). Each connected platform also maintains its own privacy policy governing how it handles data on its side; we encourage clients and end users to review those policies.

 

4. How We Use Information

We use the information described above to:

  • Provide, operate, and improve our websites, Registration Sites, and marketing platform;
  • Manage and optimize advertising campaigns and website content that clients authorize us to run;
  • Produce performance reports for our clients;
  • Process event registrations and payments;
  • Respond to enquiries and provide customer support; and
  • Meet legal, regulatory, and contractual obligations.

We do not use personal information for any purpose other than the one for which it was collected without your consent or as required by law.

 

5. Cookies & Tracking Technologies

To operate secure sign-in and to connect to third-party platforms, our websites and platform use strictly-necessary cookies and related technologies, including:

  • Session and authentication cookies that keep you signed in to our platform;
  • OAuth 2.0 redirect and state parameters — including a cryptographically signed, short-lived anti–cross-site-request-forgery (CSRF) token —used during the authorization handshake when a client connects a third-party account such as Google, Microsoft, LinkedIn, or Meta; and
  • Server request logs that record connection and security events for troubleshooting and fraud prevention.

These technologies are required for authentication and account-connection features to function. Where we deploy advertising-measurement tags on properties we manage for a client (for example, the LinkedIn Insight Tag, the Meta Pixel, or the Google tag), those tags may set additional cookies to measure ad performance; their use is disclosed and consented to separately at the point of collection.

We do not make blanket claims that we never use cookies or automated technologies— the authentication and measurement functions described above necessarily rely on them.

 

6. Lead Generation Data

When we run lead-generation advertising on a client’s behalf (for example, LinkedIn Lead Gen Ads or equivalent formats on other platforms) and an individual submits a lead form, we collect the information that individual chose to provide—typically name, contact details, location, and professional information.

  • Purpose: to fulfil the request the individual made and to enable the advertiser (our client) to follow up about the advertised product or service.
  • Storage: lead data is stored in access-controlled marketing databases, isolated from unrelated operational data.
  • Sharing lead data is shared only with the advertiser who ran the campaign and with processors strictly necessary to deliver it.
  • Consent: lead capture forms link to this Privacy Policy and use an unchecked (not pre-selected) consent control.
  • Rights: individuals may request access, correction, or deletion of their lead data at any time (see **Section 7**).

 

7. Your Privacy Rights & Data Deletion

You have the right to access, correct, export, and delete your personal information, and to withdraw your consent at any time. These rights apply under PIPEDA, the GDPR (including Article 17, the right to erasure), and the CCPA.

To exercise any of these rights — including correcting your information or asking us to stop keeping information about you — contact our Chief Privacy Officer a info@exposoft.ca, or write to the address in Section 1. We will confirm when the requested change or deletion has been completed.

For client-connected advertising accounts: a client may disconnect any connected platform at any time. When an account is disconnected, or when a client or individual requests deletion, we delete the associated authentication credentials and the data retrieved for that account from our systems, subject to the retention limits and legal-hold exceptions in Section 8.

Because we act as a data processor for event Registration Sites, requests relating to data collected on a client’s Registration Site may be referred to, or coordinated with, that client, who is the controller of that data.

 

8. Data Retention & Caching

We keep personal information only as long as necessary for the purpose it was collected, or as required by law or contract.

  • Event registration data: personal information is erased from our servers when it is no longer needed — usually shortly after the event you registered for is completed. Archived information is destroyed when it is no longer required to be retained by law or contract.
  • Connected-platform data: we follow the data-retention and caching limits required by each connected platform. In line with the LinkedIn Marketing API data-storage requirements, we apply the following maximum retention periods to data retrieved through the platform integrations:

Data type

Maximum retention

A connected account’s identifiers and credentials

Life of the active connection

Other individuals’ profile data (e.g., people who interact with a managed post)

24 hours

Social activity data (comments, reactions, shares on managed posts)

6 weeks

Authenticated organization profile data

8 weeks

Non-authenticated organization data

Not stored, except name and logo URL (30 days)

Aggregate campaign / page reporting metrics (no individual identities)

1 year

Lead-generation form responses

Retained as first-party customer data per Section 6

 

If our access to a connected platform is suspended or terminated, we permanently delete all content retrieved from that platform, and records derived from it, from our production systems and backups within the period that platform requires (for LinkedIn, within 10 days).

 

9. Security

Exposoft takes all reasonably commercial steps to protect the information you submit to us. Up-to-date SSL/TLS encryption is used across our Web Registration Sites to protect financial information submitted during e-commerce transactions.
Authentication credentials for connected advertising and website accounts are stored in encrypted form with restricted access.

Information stored on our servers or archived for future reference is held in secure, continuously-monitored facilities and is accessible only by our qualified personnel. Given the inherent security limitations of the internet, we recommend that you not send confidential or proprietary information to us by email.

 

10. International Transfers & Governing Law

Exposoft operates in Canada and the United States, and information may be processed in either country. We make no representation that our services are appropriate or available for use in every jurisdiction; you are responsible for compliance with applicable local laws where you access our services.

Claims relating to our website and services are governed by the laws of the Province of Ontario, Canada, exclusive of its conflict-of-law provisions, except where mandatory local data-protection law applies.

 

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of the page. We encourage you to review this page periodically. Material changes will be communicated as required by applicable law.

 

12. Contact Us

If you have any questions about this Privacy Policy, or about privacy and security at Exposoft, contact:

Chief Privacy Officer
Exposoft Solutions Ltd.
2011 Crystal Drive, 4th Floor, Arlington, VA, USA 22202
Email: info@exposoft.ca