Privacy Policy

Last updated: [date]

This Privacy Policy explains how [legal name of business] ("FacilityNorth", "we") collects, uses and protects personal information, in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

1. Our role

• For our customers' data: when organizations use FacilityNorth, they decide what information goes into it. We process that information on their behalf to provide the Service. Questions about information an organization has entered about you should go to that organization first.
• For our own records: we are responsible for the information we collect to run our business, such as customer account contacts, billing details, website enquiries and support requests.

2. What we collect

• Account information: names, work email addresses, phone numbers (optional), roles, language and time-zone preferences.
• Work records: information users enter, such as buildings, equipment, work orders, notes, photos, documents, inventory and activity history, including who did what and when.
• Problem reports from posters: anyone (including staff, visitors or tenants) can scan a "Report a problem" poster without an account. We collect the description and photos they submit, and optionally their name, email and phone number. If they give an email, we use it only to send status updates about that report. To limit spam, we keep a one-way coded identifier of the device or connection that sent the report, which cannot be turned back into the original details.
• Technical information: sign-in times, device and browser type, and security logs, used to keep the Service secure and working.
• Billing information: billing contacts and payment details, processed by our payment provider. We do not store full card numbers.
• Website and enquiries: information you send us through forms, demos or support.

We do not want personal health information. The Service is not designed to hold information about patients, residents or clients, and our customers agree not to enter it. If it is entered by mistake, it can be reported and removed.

3. How we use it

To provide, secure and support the Service; send sign-in links, invitations, reminders and briefings; process payments; respond to enquiries; improve the Service using anonymized statistics; and meet legal obligations. We do not sell personal information, and we do not use customer data for advertising.

4. Where your information is stored

Our primary database and file storage are hosted in Canada. Some service providers process limited information outside Canada, as listed below. Information processed outside Canada may be accessible to authorities in that country under its laws.

5. Service providers

Providers may only use information to provide services to us and must protect it. We will update this list when providers change.

6. How we protect it

Each organization's data is kept separate at the database level; access is limited by role; files are stored privately and opened through short-lived links; connections are encrypted; and secret keys are kept out of our code. No system is perfectly secure, but we use reasonable safeguards appropriate to the sensitivity of the information.

7. How long we keep it

We keep information while an account is active and as needed to provide the Service. After cancellation, customer data is available for export for [30] days and then deleted from active systems, with backups expiring within [90] days, unless the law requires us to keep it longer. Activity history is kept as part of the customer's records while their account is active.

8. Your rights

You may ask to access or correct your personal information, or withdraw consent where applicable, subject to legal and contractual limits. If your information was entered by an organization using FacilityNorth, we may refer your request to that organization. Contact our Privacy Officer below. You may also complain to the Office of the Privacy Commissioner of Canada.

9. Privacy breaches

If a breach of security safeguards involving personal information creates a real risk of significant harm, we will notify affected organizations and individuals, and report to the Office of the Privacy Commissioner of Canada, as required by law.

10. Cookies

We use only the cookies and browser storage needed to keep you signed in, remember preferences, and keep the Service secure. [Update this section if the marketing website uses analytics or advertising tools.]

11. Changes

We may update this policy and will post the new date at the top. Significant changes will be communicated to customer account contacts.

12. Contact

Privacy Officer: [name], [business name], [address], [privacy email].