Privacy Policy
Effective date: [REPLACE: effective date] Last updated: [REPLACE: last-updated date]This Privacy Policy explains what personal information [REPLACE: Company legal name] (“we”, “us”, the “Platform”) collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it. We provide a multi-tenant consulting and resource-management service through which staffing and consulting companies (“tenants”) manage their workers, assignments, timesheets, approvals, invoicing and payments.
We are committed to handling personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Act respecting the protection of personal information in the private sector (Law 25), and applicable privacy laws in the United States and other jurisdictions where our users are located.
1. Roles: who controls your information
For most personal information processed in the Platform, the tenant that employs or engages you (your staffing company, consulting firm or operator) is the organization that decides how and why your information is used — under PIPEDA and Law 25 they are the organization accountable for it. We act as their service provider and process the information on their behalf and under their instructions, in addition to operating and securing the Platform for our own legitimate business purposes. If you are a worker or account contact, direct access and correction requests to your tenant first; we will assist them, or act directly where we are the accountable organization.
2. Information we collect — and from whom
We limit collection to what is necessary to provide the service. Depending on your role, we may collect:
Identity & contact details — name, email address, phone number, mailing/home address.
Demographic & HR details — date of birth, emergency-contact information, role/title, skills and certifications.
Banking information — direct-deposit bank account and routing/transit details used to pay workers.
Tax identifiers — government tax identification numbers (US SSN/EIN, Canadian SIN) required for tax reporting (e.g. 1099-NEC, T4/T4A) and identity verification.
Assignment & work records — timesheets, hours, allowances, expenses, approvals, pay and bill rates, invoices and payables.
Account & usage data — login records, IP/device information, and audit logs needed to operate and secure the Platform.
We collect this information directly from workers (for example, when you complete your profile, submit a timesheet or expense, or enter banking details) and from account contacts at the tenant and operator companies who manage assignments and approvals. Some information (such as assignments, pay rates and approvals) is entered about you by your tenant.
3. Why we collect it (purposes)
We use personal information to:
Process payroll and pay workers, including direct deposit;
Generate timesheets, invoices and payables, and manage the approval workflow;
Meet legal, tax and employment-reporting obligations (e.g. 1099-NEC, T4/T4A);
Manage tenant accounts, assignments and user access;
Secure the Platform, prevent fraud and abuse, and maintain audit trails;
Communicate with you about your account, assignments and approvals.
We will not use your information for a new purpose that is incompatible with these without your consent or unless permitted by law.
4. Legal basis & consent
Under PIPEDA we rely on your meaningful consent — given knowingly and in plain language — to collect, use and disclose your personal information for the purposes described above, except where the law allows or requires us to act without consent (for example, to meet a legal or tax obligation, or to establish, manage or terminate an employment or engagement relationship). Where Quebec’s Law 25 applies, we obtain express consent for sensitive personal information — which includes financial data such as banking details and tax identifiers — and that consent is requested separately and clearly for that purpose. You may withdraw your consent at any time, subject to legal and contractual restrictions and reasonable notice (see Your rights below); withdrawing consent may mean we can no longer provide some or all of the service.
5. Who we share it with
We disclose personal information only as needed to deliver the service:
Your tenant — the staffing/consulting company that employs or engages you, and, where relevant to an assignment, the operator/client account you are placed with;
Payment processors and financial institutions — to deposit pay and process payments;
Tax and government authorities — where required by law for tax reporting and compliance;
Sub-processors — vetted service providers (e.g. cloud hosting, email delivery) bound by confidentiality and data-protection obligations and permitted to use the data only to provide their service to us.
6. Retention
We keep personal information only as long as necessary for the purposes described above or as required by law. Certain financial and employment records — timesheets, invoices, payables and tax records — are retained for the periods mandated by tax and employment-standards legislation (for example, several years after the end of the relevant tax year) even after a worker leaves. When you exercise your right to erasure, we anonymize identifying personal information while preserving these legally required financial records in de-identified form. After applicable retention periods expire, information is securely deleted or irreversibly anonymized.
7. How we protect it (security safeguards)
We apply technical, physical and organizational safeguards appropriate to the sensitivity of the information, including:
Encryption — data is encrypted in transit (TLS) and at rest;
Role-based access control — access is restricted to authorized users on a need-to-know basis, enforced by per-tenant data isolation;
Masking — sensitive identifiers such as SSN/SIN and bank account numbers are masked in the interface and exposed only where strictly necessary;
Audit logging — access to and changes of records are logged.
No system is perfectly secure, but we work to protect your information and to limit and respond to any incident.
8. Your rights
Subject to legal limits, you have the right to:
Access — request confirmation of, and a copy of, the personal information we hold about you. Account administrators can produce this through the Platform’s Export personal data tool.
Correction — ask us to correct inaccurate or incomplete information.
Withdraw consent — withdraw consent to processing where applicable, subject to legal and contractual limits.
Erasure / anonymization — request that we delete or anonymize your personal information. The Platform provides an Anonymize administrative tool for this. Note that financial and employment records we are legally required to keep are retained (in de-identified form where possible) rather than deleted.
Portability — receive certain information in a structured, commonly used, machine-readable format.
To exercise these rights, contact us using the details in section 11, or ask your account administrator. We will respond within the timeframes required by applicable law. You also have the right to complain to your privacy regulator (see section 11).
9. Where your data is stored (cross-border)
Because data is stored and processed in the United States, it may be subject to US laws, including lawful access requests by US authorities. For users in Canada, and particularly in Quebec, this is a cross-border transfer: under Law 25 we have assessed the privacy implications of storing personal information outside Quebec and apply contractual and technical protections (including encryption and access controls) to provide an adequate level of protection. A Canada-resident hosting option is available for tenants who require their data to remain in Canada — contact us to enable it for your organization.
10. Quebec Law 25 specifics
Privacy Officer. Our designated person in charge of the protection of personal information is [REPLACE: Privacy Officer name / title], reachable at [REPLACE: privacy@yourcompany — replace].
Breach notification. If a confidentiality incident involving your personal information presents a risk of serious injury, we will notify the Commission d’accès à l’information du Québec and affected individuals as required, and keep a register of such incidents.
Automated decisions. We do not use your personal information to make decisions based exclusively on automated processing. If that changes, we will inform you and honour your right to request review.
11. Contact us & making a request
For privacy questions, requests or complaints, contact our Privacy Officer:
[REPLACE: privacy@yourcompany — replace]
[REPLACE: Company legal name and mailing address]
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for Quebec residents, the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).
12. Changes to this policy
We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, for material changes, provide additional notice as required by law. Your continued use of the Platform after an update takes effect indicates your awareness of the revised policy.