Privacy Policy

Techwillow STEM Education Inc. is an Ontario corporation operating STEM education studios at three locations in Tillsonburg, St. Thomas, and Simcoe, Ontario. We offer robotics, coding, AI, and other technology programs to students aged 6 to 18, as well as adult learners.

For all privacy enquiries, our Privacy Officer can be reached at:

This policy applies to personal information we collect in connection with our programmes, website (techwillow.ca), and related services. We operate in Canada and comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), the Ontario Freedom of Information and Protection of Privacy Act (FIPPA)where applicable, and Canada’s Anti-Spam Legislation (CASL).

Where students are under the age of 18, we require consent from a parent or legal guardian for enrollment and for the collection of any personal information specific to the child.

We may collect the following categories of personal information:

We collect only the minimum personal information necessary for the purposes identified above (“data minimisation” principle under PIPEDA).

Many of our students are under 18. We take the privacy of minors very seriously.

• We do not knowingly collect personal information directly from children under 13 without the verifiable consent of a parent or legal guardian.
• Enrollment forms must be completed by a parent or guardian for any student under 18.
• Photos or videos of minors are only published or used in marketing with explicit written consent from a parent or guardian, which may be withdrawn at any time.
• If you believe we have inadvertently collected information from a child without appropriate consent, please contact us immediately and we will delete it.

We use personal information for the following purposes:

• Processing enrollment and registration
• Delivering educational programmes and related services
• Communicating about class schedules, changes, and events
• Processing payments and issuing receipts
• Ensuring student safety (including health and emergency contact data)
• Complying with legal and regulatory obligations
• Sending marketing and promotional communications (only with your consent, as required by CASL)
• Improving our website, services, and curriculum through aggregated analytics
• Responding to enquiries and resolving disputes

We will not use your personal information for any new purpose without obtaining your consent, unless required or permitted by law.

We process personal information on the following bases:

• Consent — where you have given clear, freely-given consent (e.g., marketing emails, photography)
• Contract — where processing is necessary to fulfil our agreement with you (enrollment, billing)
• Legal obligation — where we are required to process data by law
• Legitimate interests — for purposes such as fraud prevention, site security, and service improvement, balanced against your rights

We do not sell, rent, or trade personal information. We may share it in limited circumstances:

• Service providers — vendors who assist us in operating our business. They access data only as necessary to perform their services and are contractually bound to protect it. Our principal sub-processors are:
  • Supabase— database, authentication, and file storage. All of your personal information (registration data, lead enquiries, gallery photos) is hosted on Supabase’s Canadian region (aws-1-ca-central-1, Montréal).
  • Stripe — secure payment processing. Stripe is PCI-DSS certified and processes card data on its own globally distributed infrastructure; we do not store card details on our servers.
  • Brevo (Sendinblue) — transactional and marketing email delivery on our behalf.
• Partner organisations — Mechatron Robotics, solely to the extent required for curriculum delivery and certification.
• Legal requirements — if disclosure is required by a court order, law enforcement request, or applicable law.
• Business transfers — in connection with a merger, acquisition, or sale of all or part of our business, on the condition that the recipient provides equivalent privacy protections.
• With your consent — in any other circumstance where you have expressly authorised disclosure.

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, plus any additional period required by law:

• Student enrollment records: 7 years from the last date of service (for tax and audit purposes under the Income Tax Act)
• Payment transaction records: 7 years
• Marketing consent records: duration of the relationship plus 3 years
• Website analytics data: 26 months in anonymised/aggregated form
• Photographs and videos: until consent is withdrawn

When personal information is no longer required, we securely destroy or anonymise it.

Our website uses cookies and similar technologies to improve user experience, measure traffic, and provide relevant content. Please read our Cookie Policy for full details, including how to manage or withdraw cookie consent.

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, or destruction. These measures include:

• TLS/HTTPS encryption for all data transmitted via our website
• Payment processing via PCI-DSS-compliant third-party processors (card data is never stored on Techwillow servers)
• Access controls limiting staff access to personal data on a need-to-know basis
• Regular security assessments of our systems

While we take these measures seriously, no method of transmission or storage is 100% secure. If we become aware of a breach that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA.

Our database, authentication system, and file storage (gallery photos, course and camp images) are hosted in Canada on Supabase’s ca-central-1region (Montréal). Personal information you submit through our website — including your name, your child’s name, contact details, lead enquiries, and any photographs uploaded to the gallery — is stored on Canadian servers and remains subject to Canadian privacy law.

The only personal information that necessarily leaves Canadian-hosted infrastructure is payment data, which is processed directly by Stripe on its own PCI-DSS-compliant global infrastructure. Stripe operates under contractual safeguards equivalent to PIPEDA. Email delivery via Brevo may also be routed through European servers; we share only the minimum recipient information necessary to deliver each message.

We take contractual steps to ensure that any transfer of personal information outside Canada receives protection equivalent to that required by PIPEDA, including through Standard Contractual Clauses where appropriate.

Under PIPEDA and applicable Ontario law, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — ask us to correct inaccurate or incomplete information
• Withdrawal of consent — withdraw consent to optional processing (e.g., marketing) at any time
• Deletion — request deletion of personal information where retention is no longer required by law or contract
• Complaint — lodge a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) if you believe your privacy rights have been violated

To exercise any of these rights, please contact our Privacy Officer at the details below. We will respond within 30 days. We may require identity verification before fulfilling a request.

We send commercial electronic messages only to individuals who have provided express or implied consent as defined by Canada’s Anti-Spam Legislation (CASL). Every marketing email includes a clear, easy unsubscribe mechanism. Unsubscribe requests will be processed within 10 business days.

Our website may contain links to third-party websites (e.g., Mechatron Robotics, social media platforms). This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the revised policy on this page with an updated effective date. For material changes affecting minors’ data or significant new uses of personal information, we will provide direct notice (e.g., by email) before the change takes effect.

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our Privacy Officer:

You also have the right to escalate unresolved complaints to the Office of the Privacy Commissioner of Canada: www.priv.gc.ca · 1-800-282-1376