Privacy Policy

1. Scope and roles

CertiTrack is a B2B compliance platform. When an organization ("Customer") uses the Service to manage employees, brokers, licences, and certificates, the Customer typically determines the purposes of processing that workforce data. In that context we act as a service provider / processor. For account administration, billing, product analytics (where enabled), and our own websites, we act as an organization responsible for personal information under applicable law.

This Policy is designed for Canadian privacy expectations, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec’s Act respecting the protection of personal information in the private sector as modernized (Law 25), and similar provincial private-sector rules.

2. Information we collect

2.1 Account and organization data

• Name, work email, role, authentication identifiers, MFA status
• Organization name, billing contacts, subscription and seat usage
• SSO configuration metadata (e.g. IdP endpoints), when Customer enables SSO

2.2 Customer-managed compliance content

• Roster profiles, licence numbers, provinces, CE hours, certificate files
• Tasks, reviews, support tickets, audit packages Customer chooses to store
• Integration payloads (email-to-compliance, SFTP, HR sync) Customer configures

2.3 Technical and security data

• IP address, user agent, approximate location derived from IP (if any)
• Login events, session registry entries, security alerts
• Essential cookies and similar technologies (see Cookies)

2.4 Communications

• Support requests, feedback, and transactional email content
• Marketing email only where permitted (e.g. CASL consent or existing business relationship rules)

3. Purposes of use

• Provide, secure, and improve the Service
• Authenticate users, enforce roles, and prevent fraud or abuse
• Process Customer Data according to Customer instructions and configuration
• Bill subscriptions and provide support
• Comply with law, respond to lawful requests, and enforce agreements
• Send service notices; marketing only with a lawful basis under CASL and privacy law

4. Legal bases and consent (Canada)

We collect, use, and disclose personal information for purposes a reasonable person would consider appropriate in the circumstances, with consent where required, or as otherwise permitted (e.g. to investigate a breach of agreement, detect fraud, or meet a legal obligation). Where Quebec Law 25 applies, we implement privacy governance measures appropriate to sensitivity, including policies, access controls, and incident response.

5. Canadian data residency

Primary application data for CertiTrack is hosted in Canada (AWS Canada Central — Montréal region), subject to Customer configuration and subprocessors listed on Subprocessors. Limited processing outside Canada may occur for support tooling or email delivery; we require contractual protections consistent with Canadian expectations for cross-border transfers.

6. Sharing and subprocessors

We do not sell personal information. We share information with: (a) subprocessors that help run the Service under contract; (b) Customer’s own administrators and users under their tenant; (c) professional advisors under confidentiality; (d) authorities when required by law; (e) a successor in a corporate transaction with appropriate safeguards.

7. Retention

We retain personal information only as long as needed for the purposes above, including legal, accounting, and security requirements. Customer controls retention of much Customer-managed content through product features and subscription status. Upon contract end, export and deletion options are described in the DPA or order form.

8. Security

We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls, logging, and MFA options. Details: Security Policy. No method of transmission or storage is perfectly secure.

9. Individual rights

Depending on your role and applicable law, you may request access to, correction of, or deletion of personal information, or withdraw consent where processing is consent-based (subject to legal or contractual restrictions).

• Workforce members of a Customer: contact your organization first; they control most roster and certificate data.
• Account holders / public: email privacy@espyads.net or use Contact.

We will respond within timeframes required by applicable law (including PIPEDA guidance and Law 25 where applicable). You may complain to the Office of the Privacy Commissioner of Canada or a provincial commissioner if you are unsatisfied.

10. Children

The Service is directed at organizations and adult professionals. It is not intended for individuals under 16.

11. CASL (Canada’s anti-spam law)

Commercial electronic messages are sent in accordance with CASL. You may unsubscribe from marketing messages using the link in those messages. Transactional and product-security messages may still be sent as permitted.

12. Cookies

See Cookie Policy and Cookie settings. We prioritize essential cookies for authentication and tenant context.

13. Changes

We may update this Policy by posting a new version with a revised effective date. Material changes will be highlighted where practicable.

14. Contact / privacy officer

Privacy inquiries: privacy@espyads.net
Security: security@espyads.net
Postal inquiries can be requested via those addresses for formal notices.