Privacy policy

1. Introduction and who we are

This privacy policy explains how Corpshore Canada handles personal information when you visit corpshore.ca, contact us about our services, apply for a role, join our talent community, or subscribe to our communications. Corpshore Canada is the Canadian operation of Corpshore Solutions Corporation, a company headquartered in Toronto with its head office at The Exchange Tower, 130 King Street West, Suite 1900, Toronto, Ontario M5X 2A2, Canada. Where this policy says "Corpshore Canada", "we", "us" or "our", it means the Canadian operation of Corpshore Solutions Corporation acting through this website and the systems described below.

We are committed to handling your personal information in accordance with the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and its ten fair information principles, and with the applicable provincial privacy statutes, including Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, Alberta's Personal Information Protection Act, and British Columbia's Personal Information Protection Act. Where we process personal health information in Ontario, we also observe the Personal Health Information Protection Act. Where we handle the personal data of individuals in the European Union or the United Kingdom on our own account, we observe the General Data Protection Regulation and the United Kingdom GDPR, as described in our data governance and cross-border transfers notice.

2. Our Privacy Officer and how to contact us

We have designated a Privacy Officer who is accountable for our compliance with this policy and with applicable privacy law. You can reach the Privacy Officer at privacy@corpshore.ca, or by writing to the Privacy Officer, Corpshore Canada, at The Exchange Tower, 130 King Street West, Suite 1900, Toronto, Ontario M5X 2A2, Canada. Please use this contact for any question about this policy, to exercise your rights, or to raise a concern about how we have handled your personal information.

3. Scope of this policy

This policy covers the personal information we collect and control through corpshore.ca and its forms, scheduling tools and communications. It does not cover two things. First, where we process personal information on behalf of a client as part of a service engagement, for example when our teams handle a client's own customer records, we act as a service provider under the client's instructions and the client's privacy notice and our contract with the client govern that processing, not this policy. Second, third-party websites we link to have their own privacy practices, and we are not responsible for them. Please read this policy together with our cookie policy, our data governance and cross-border transfers notice, our candidate privacy notice, and our CASL and electronic communications policy.

4. Key terms

To keep this policy clear: "personal information" means information about an identifiable individual; "processing" means any operation performed on personal information, such as collection, use, disclosure, storage or disposal; a "service provider" or "processor" is an organisation that processes personal information on our behalf under our instructions; and "consent" means your voluntary agreement to the collection, use or disclosure of your personal information for identified purposes, which may be express or implied depending on the sensitivity of the information and the reasonable expectations of the individual.

5. The personal information we collect, by context

We collect only the personal information we need for the purposes described below, and only what you give us or what is generated automatically when you use the site. We describe the three contexts separately because the information differs in each.

5.1 Client and prospective-client context

When you enquire about our services, request a proposal, or book a discovery call, we collect your first and last name, your business email address, your company name, your role or title where you provide it, your telephone number where you choose to give it, the province or state and country you are enquiring from, the services, industry, team size and timeline you indicate, and the content of the message or requirement you write. Where you book a discovery call, the scheduling is operated through Calendly and we receive the booking details you enter so we can prepare for and attend the call.

5.2 Candidate context

When you apply for a role or join our talent community we collect the information described in full in our candidate privacy notice, including your name, contact details, city, province and country, right-to-work status, languages and proficiency, experience, current or most recent role, availability, salary expectation, work-mode preference, your resume and any documents, links or covering letter you provide, how you heard about us, and your answers to application questions. We also record the exact wording and version of the recruitment consent you agree to, with a timestamp, because we must be able to demonstrate that consent.

5.3 Visitor and subscriber context

When you simply browse the site we collect limited technical information: your internet protocol address and basic request metadata, which we use for security, rate limiting and abuse prevention, and, only if you accept analytics cookies, the aggregate usage and interaction data described in our cookie policy. When you subscribe to a newsletter or marketing communication you give us your email address and any name you provide, together with the record of your express consent as required by Canada's anti-spam legislation.

We do not deliberately collect sensitive information such as health, biometric, racial or ethnic origin, religious belief, or political opinion through this site. Please do not enter such information into free-text fields unless it is strictly necessary for your request.

6. Purposes and the basis for processing

We identify the purposes for which we collect personal information at or before the time of collection, and we limit collection to what those purposes require. Our purposes, and the basis for each, are:

• To respond to enquiries and prepare proposals. Basis: to take steps at your request before a possible engagement, and our legitimate interest in developing our business.
• To schedule and hold discovery calls. Basis: steps at your request and our legitimate interest.
• To evaluate applications and operate our recruitment and talent community. Basis: steps at your request before a possible employment relationship, and your consent for the specific processing described in the recruitment consent.
• To deliver newsletters and marketing communications you have expressly asked to receive. Basis: your express consent under Canada's anti-spam legislation.
• To secure the site and prevent fraud and abuse. Basis: our legitimate interest in the integrity and availability of our systems, and the exception in privacy law that permits processing necessary to protect our systems.
• To measure and improve the site. Basis: your consent to analytics cookies.
• To meet our legal and regulatory obligations and to establish, exercise or defend legal claims. Basis: compliance with a legal obligation and our legitimate interest.

For processing that relies on consent, we rely on your express or implied consent as described in section 7. We will not use your personal information for a new purpose that is inconsistent with the one we collected it for without first identifying that purpose and, where the law requires, obtaining your consent.

6a. The ten fair information principles

We handle personal information in accordance with the ten principles in Schedule 1 to PIPEDA: accountability, for which our Privacy Officer is responsible; identifying purposes, at or before collection; consent, appropriate to the sensitivity of the information; limiting collection to what our purposes require; limiting use, disclosure and retention to those purposes and the periods in section 10; accuracy, keeping information as accurate and up to date as the purpose needs; safeguards, as described in section 13; openness, through this policy and our related notices; individual access, as described in section 11; and the right to challenge our compliance, as described in section 17. Where Quebec, Alberta or British Columbia law applies, we meet the comparable requirements of that law as well.

7. Consent and how to withdraw it

We obtain consent that is appropriate to the sensitivity of the information. For marketing communications and analytics we rely on your express consent, given by a clear affirmative action such as ticking an unchecked opt-in box or accepting analytics cookies. For processing that a reasonable person would expect, such as using your enquiry details to reply to you, we may rely on implied consent. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent to analytics, use the cookie settings link in the site footer. To unsubscribe from marketing email, use the unsubscribe link in any such message, which we honour within ten business days. To withdraw any other consent, contact our Privacy Officer at privacy@corpshore.ca.

8. Who we share your personal information with

We share personal information only with the service providers that help us operate this site and our commercial and recruitment processes, and only to the extent each provider needs it for the service it performs for us:

• Zoho CRM (records of client and prospective-client enquiries, proposal requests and discovery-call bookings), operated by Zoho Corporation.
• Zoho Recruit (records of candidates and members of our talent community), operated by Zoho Corporation.
• Zoho Campaigns (delivery of newsletters and marketing email you have expressly asked to receive, and the related consent and unsubscribe records), operated by Zoho Corporation.
• Vercel (hosting, content delivery and privacy-respecting traffic measurement), operated by Vercel, Inc.
• Cloudflare Turnstile (bot and abuse protection on our forms), operated by Cloudflare, Inc.
• Resend (transactional email such as confirmation and acknowledgement messages), operated by Resend when enabled.
• Calendly (scheduling of discovery calls), operated by Calendly, LLC, when you choose to book a call.
• Google Analytics and Microsoft Clarity (aggregate usage and interaction measurement), loaded only after you accept analytics cookies.

Each provider processes personal information on our behalf under contractual terms that require a comparable level of protection, restrict use to our instructions, and impose security and confidentiality obligations. We may also share personal information within the Corpshore group where necessary to respond to your request under consistent governance. We may disclose personal information where the law requires or permits it, to comply with a subpoena, warrant or court order, to establish, exercise or defend legal claims, or in connection with a corporate transaction, in which case the recipient is bound to protect it. We do not sell your personal information.

9. Cross-border processing and transfers

Corpshore Canada is part of a group headquartered in Canada, and several of the providers listed above store or process personal information outside Canada, including in the United States and other countries. PIPEDA requires us to be transparent about this. While personal information is in another jurisdiction it may be accessible to the courts, law enforcement and national security authorities of that jurisdiction. We remain accountable for personal information we transfer to a provider for processing, and we use contractual and technical safeguards, including data-processing agreements and, where relevant, standard contractual clauses, to require a comparable level of protection. Our data governance and cross-border transfers notice explains this in more detail.

10. How long we keep your personal information

We keep personal information only for as long as it is needed for the purpose we collected it and to meet our legal obligations, then we securely destroy, erase or anonymise it. Our retention periods by category are:

• Client and prospective-client enquiry, proposal and discovery-call records in Zoho CRM: twenty-four months after our last substantive contact with you.
• Candidate application records in Zoho Recruit: twenty-four months after the recruitment decision, unless you ask us to keep you in the talent community.
• Talent community records: until you ask us to remove you, reviewed at least every twenty-four months for continued relevance.
• Newsletter and marketing subscriber records in Zoho Campaigns: until you unsubscribe.
• Proof of consent under Canada's anti-spam legislation: three years after the consent is withdrawn or the relationship ends.
• Cookie consent records: twelve months, after which we ask again.
• Server and security logs: ninety days, unless a longer period is needed to investigate an incident.
• Records of data subject requests: three years, so we can demonstrate how we responded.
• Financial and tax records where an engagement proceeds: for the period required by the Income Tax Act, generally six years from the end of the relevant tax year.

11. Your right of access and correction

Subject to the limited exceptions in PIPEDA and provincial privacy law, you have the right to ask whether we hold personal information about you, to access that information and to be told how it has been used and to whom it has been disclosed, and to have inaccurate or incomplete information corrected. To make a request, contact our Privacy Officer at privacy@corpshore.ca. We verify your identity before acting, we respond in writing, and we aim to respond within thirty days as PIPEDA requires, or within the shorter period that Quebec law requires where it applies. If we need more time we will tell you and explain why. There is normally no charge; if a request would involve a cost we will give you an estimate first. If we decline a request in whole or in part we will explain the reason and tell you how to challenge our decision.

12. Automated decision-making

We do not make decisions about you based solely on automated processing that produce a legal or similarly significant effect. We do not use automated lead scoring or candidate scoring that decides an outcome without a person. Our tools help our people organise and prioritise information, but a person reviews and makes the decision. If we introduce any system that renders a decision about you based exclusively on automated processing, we will disclose it, explain the personal information used and the principal factors, and tell you how to request a review by a person, as Quebec Law 25 requires.

13. How we safeguard your personal information

We apply physical, organisational and technical safeguards proportionate to the sensitivity of the information. These include encryption of personal information in transit, server-side input validation, rate limiting and bot protection on our forms, least-privilege and role-based access to the systems that hold personal information, logging and monitoring, secure software delivery, and vendor and sub-processor management under the group's information-security governance. No method of transmission or storage is perfectly secure, but we work continuously to protect your personal information and to detect and respond to incidents.

14. Breach of security safeguards

If a breach of our security safeguards creates a real risk of significant harm to you, we will report the breach to the Office of the Privacy Commissioner of Canada, notify you as soon as feasible, and keep a record of the breach as PIPEDA requires. Where Quebec Law 25 applies we will also notify the Commission d'acces a l'information du Quebec and the individuals concerned, and keep a register of confidentiality incidents. Our notice will describe the incident, the information involved and the steps you can take to reduce your risk.

15. Children's personal information

This site is directed at businesses and at adults seeking work. It is not intended for children, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact our Privacy Officer and we will delete it.

16. Changes to this policy

We may update this policy as our site, services, providers or legal obligations change. When we make a material change we will update the date shown on this page and, where appropriate, tell you by another means. The version published here is the version in force. Please review this policy from time to time.

17. Complaints

If you have a concern about how we have handled your personal information, please raise it first with our Privacy Officer at privacy@corpshore.ca so we can try to resolve it. You also have the right to complain to the Office of the Privacy Commissioner of Canada. If you are in Quebec, you may complain to the Commission d'acces a l'information du Quebec. If you are covered by Alberta's or British Columbia's Personal Information Protection Act, you may complain to the Office of the Information and Privacy Commissioner of that province.