Privacy Notice
This Privacy Notice describes how Roalla Business Enablement Group, through The Business Cocoon, handles personal information in connection with Course Blueprint. We operate as a Canadian company and seek to comply with applicable privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial private-sector privacy laws, where applicable.
Effective date and scope
Effective Date: April 30, 2026. This Privacy Notice applies to personal information processed in connection with Course Blueprint, related websites, and associated service operations.
Definitions
- Personal information means information about an identifiable individual.
- Customer data means data submitted by or on behalf of customers through the services.
- Services means the Course Blueprint platform and related workflow products offered through The Business Cocoon.
Information we process
We may process account credentials (via Roalla Auth Hub), workspace and organization details, plan content you save, collaboration and comment data, audit logs for support, and technical usage information required to operate, secure, support, and improve the services.
Purpose and legal basis
Personal information is processed for defined business purposes, including service delivery, identity and account administration, platform security, customer support, service analytics, and legal compliance. Depending on context and jurisdiction, processing is based on consent, contractual necessity, compliance with legal obligations, or other lawful grounds recognized under applicable law.
Service providers and cross-border processing
- We engage third-party service providers to support hosting, infrastructure, analytics, communications, and billing operations.
- Service providers are selected and managed with due regard to data sensitivity and contractual privacy and security commitments. See our Subprocessors page.
- Personal information may be processed outside Canada, including in the United States or other jurisdictions.
- Where cross-border processing occurs, personal information may be subject to lawful access requests under local laws.
Retention and your choices
Personal information is retained only for as long as reasonably necessary to fulfill identified purposes, comply with legal obligations, resolve disputes, and enforce contractual rights. Organization owners may export or suspend their workspace from admin Settings. Subject to applicable law, individuals may request access to, correction of, or deletion of personal information under our control.
Safeguards
We implement administrative, technical, and physical safeguards proportionate to the sensitivity of personal information processed. No method of transmission or storage is entirely secure, and we cannot guarantee absolute security. See also our Security page.
Quebec residents
If you are in Quebec, the Act respecting the protection of personal information in the private sector (Law 25) and related regulations may afford you additional rights and expectations regarding transparency, consent, data portability, de-indexing, and automated processing. We aim to honor applicable Quebec requirements alongside PIPEDA.
Electronic messages (CASL)
We send transactional and account-related messages (for example, sign-in links, security notices, and service updates) as needed to operate the services. If we introduce commercial electronic messages that are not purely transactional, we will obtain appropriate consent, identify the sender, and provide an unsubscribe mechanism where CASL requires it.
International transfers and GDPR-aligned safeguards
Where personal information is transferred outside Canada, including to the United States, we rely on contractual safeguards (such as standard contractual clauses) and vendor due diligence where appropriate for customers and regulators in the European Economic Area, United Kingdom, Switzerland, and other jurisdictions that require transfer assessments.
AI-assisted product features
Certain optional features may process content you submit using third-party AI services configured by your workspace or The Business Cocoon, such as OpenAI, Google (Gemini), or other providers. Processing is performed to deliver the feature you invoke and is described on our Subprocessors page and in the AI Policy. Outputs are decision-support only and not professional advice.
Changes to this notice
We may update this Privacy Notice from time to time to reflect legal, technical, or business developments. The revised version will be posted on this page with an updated effective date.
Contact and complaints
Individuals may submit privacy inquiries, rights requests, or complaints using the contact methods below. We will review and respond in accordance with applicable law.
Privacy inquiries and rights requests: ux@businesscocoon.com · Contact