Data Privacy and Security Statement

Commitment to Data Privacy and Security

TalentMap is committed to protecting the privacy, confidentiality, integrity, and security of client information. We maintain administrative, technical, and physical safeguards designed to protect data against unauthorized access, disclosure, alteration, or destruction.

All client data is stored in Canada. Client data is managed in accordance with applicable privacy legislation, contractual obligations, and industry-standard security practices.

Data Residency

TalentMap distinguishes between where client data is stored and where it is processed. Storage is Canadian-only. Processing is Canadian-only except for specific transient operations described below.

Storage

All client data, including customer records, survey responses, application data, generated reports, system logs, and backups, is stored in Canadian-hosted cloud infrastructure. The authoritative copy of client data resides in Canada at all times. TalentMap does not maintain client data storage outside Canada.

Processing

Substantially all processing of client data occurs within Canadian infrastructure. A limited set of operations, most significantly artificial intelligence model inference, may be performed by service providers whose compute infrastructure is located outside Canada. Where this occurs:

• Data is transmitted for the duration of the operation only.
• No copy of the data is written to persistent storage outside Canada.
• The authoritative copy of the data remains in Canadian infrastructure throughout.

Access to client data is restricted to authorized personnel with a legitimate business need and is governed by appropriate confidentiality, security, and privacy controls.

Where clients have specific contractual or regulatory requirements regarding data residency, including requirements that processing occur exclusively within Canada, TalentMap will work with the client to identify an appropriate configuration or to determine which functionality can be provided within those constraints.

Use of Artificial Intelligence

TalentMap may use artificial intelligence (AI) technologies to enhance product functionality, improve user experience, automate processes, generate insights, and support service delivery.

AI model inference is performed by cloud-based AI service providers. Some of these providers operate inference infrastructure outside Canada. When client data is submitted to these services, it is transmitted, processed, and returned within the scope of a single request. It is not written to durable storage outside Canada, is not retained by the provider after the request completes, and is not used to train or improve the provider's models.

Cross-Border Processing

Where processing of client data occurs outside Canada, the following conditions apply:

• Transfer is limited to the minimum data necessary to perform the requested operation.
• Data is encrypted in transit using industry-standard protocols.
• Providers operate under zero-retention or equivalent contractual terms, so client data is not persisted in the provider's environment after the request completes.
• Providers are contractually prohibited from using client data to train or improve their models.
• Providers are subject to TalentMap's vendor security, privacy, and risk assessment process before approval.
• The authoritative copy of the data remains in Canadian infrastructure at all times.

Client data is not stored outside Canada. Cross-border transfer occurs only as transient processing under the conditions above, or where required by law, or where specifically authorized by the client.

Clients may request the current list of subprocessors involved in processing client data, including the jurisdictions in which each operates.

Human Oversight and Accountability

AI is used to assist TalentMap personnel, not to replace human judgment. AI-generated content is reviewed by a TalentMap employee before it is shared with clients, distributed externally, or used in reports, proposals, or other deliverables.

AI systems do not independently execute or approve actions within critical business systems, such as CRM, HRIS, finance, or client reporting environments, without human review and authorization. Where AI systems interact with these systems, they operate under restricted, least-privilege access and never with administrative or global permissions. Responsibility for all AI-assisted work remains with the responsible TalentMap employee.

Safeguards for AI Processing

To protect client information when AI services are used, TalentMap implements the following safeguards:

• Client data is not used to train public or shared AI models unless expressly authorized by the client.
• Only AI tools that have completed TalentMap's security and privacy review are approved for use; unapproved tools are not permitted to connect to company or client systems.
• AI providers are subject to security, privacy, data residency, and vendor risk assessments before use.
• Data submitted for AI processing is limited to the minimum information necessary to perform the intended function.
• Sensitive client information, including raw survey data and identifiable employee feedback, is not submitted to general-purpose AI tools and is restricted to enterprise-secured deployments with appropriate controls.
• Sensitive personal information is subject to additional controls and may be restricted from AI-enabled processing where appropriate.
• Data is encrypted in transit and at rest using industry-standard encryption protocols.
• Access to AI-enabled systems is restricted through role-based access controls and authentication requirements.
• AI service providers are contractually required to maintain appropriate confidentiality, security, and privacy protections, including retention and training restrictions.
• Logging, monitoring, and audit controls are maintained to support oversight and compliance activities.
• Records generated by AI processing, including inputs, outputs, and audit logs, are stored in Canada and retained in accordance with contractual commitments and approved operational requirements.

Governance and Compliance

TalentMap maintains an AI governance framework that includes:

• Privacy and security reviews of AI-enabled services
• Data residency and cross-border transfer assessment for each approved AI provider
• Vendor and subprocessor due diligence
• Data classification and handling standards
• A formal approval process for new AI tools and use cases, including security and privacy review before authorization
• Risk assessments for new AI use cases
• Introduction of new AI capabilities through controlled pilots before broader deployment
• Ongoing monitoring of legal, regulatory, and industry developments

Our approach is designed to balance innovation with responsible stewardship of client data while meeting the expectations of clients operating in public sector, regulated, and enterprise environments.

Clients requiring additional information regarding data residency, AI processing, subprocessors, or security controls may contact TalentMap for further details.