Canada (PIPEDA) Supplement

The Personal Information Protection and Electronic Documents Act, “PIPEDA”, applies to private-sector organisations that collect, use, or disclose personal information in the course of commercial activities. We are a commercial operator and PIPEDA applies to our processing of personal information about individuals in Canada. In British Columbia, Alberta, and Quebec, the equivalent provincial Personal Information Protection Acts (PIPAs) and Quebec's Law 25 apply in addition to or in lieu of PIPEDA where the processing is wholly intra-provincial.

We process personal information in accordance with the ten fair-information principles set out in PIPEDA Schedule 1: accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance. The global Privacy Policy describes each in operational terms.

We rely on express consent when you create an account and provide your email and other identifiers. We rely on implied consent for processing that any reasonable person would expect in connection with delivering the Service you have signed up for (e.g., logging requests for security). For sensitive information — none of which we currently collect — we would obtain express, opt-in consent before processing.

You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by deleting your account or contacting us. Withdrawal applies prospectively only.

Personal information about Canadian users is processed by us and our sub-processors outside Canada (principally in the European Union and the United States). PIPEDA does not restrict cross-border transfer but imposes accountability: we remain responsible for personal information transferred to a third party for processing and use contractual safeguards comparable to those required by the OPC's guidance.

Quebec: we conduct a privacy-impact assessment before disclosing personal information outside Quebec, as required by Law 25.

Where a breach of security safeguards involving personal information presents a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada (and, in Quebec, the Commission d'accès à l'information) and the affected individuals as soon as feasible. We maintain records of all breaches as required by PIPEDA Regulation SOR/2018-64.

• Access — confirm what personal information we hold about you and obtain a copy.
• Correction — request correction of inaccurate or incomplete information.
• Withdraw consent — subject to the limits in Section 3 above.
• Account portability — receive your data in a machine-readable format.
• Quebec only — right to data portability (Art. 27) and the right to be informed about automated decisions (Art. 12.1) of Law 25.

We respond to access requests within thirty (30) days, extendable by up to thirty (30) additional days where reasonably necessary, with written notice to you.

If you are not satisfied with how we have handled your personal information, you may complain to:

• Office of the Privacy Commissioner of Canada — priv.gc.ca
• British Columbia: Office of the Information and Privacy Commissioner — oipc.bc.ca
• Alberta: Office of the Information and Privacy Commissioner — oipc.ab.ca
• Quebec: Commission d'accès à l'information — cai.gouv.qc.ca

We ask that you contact us first so we can try to resolve the matter directly.

Email privacy@poigeo.app. Our Privacy Officer (the person accountable for our compliance with PIPEDA) can be reached at dpo@poigeo.app.