Privacy Governance Policy

This policy sits alongside our Privacy Policy. The Privacy Policy explains individual rights and how we collect, use, disclose, retain and protect personal information. This policy explains how we govern personal information inside CredScape.

It is published to meet the requirement in section 3.2 of Quebec's Law 25 for a separate, plain-language policy describing an organization's governance of personal information. We have written it to be read by anyone, not only by lawyers.

Who is responsible

François Lachapelle is our designated Privacy Officer. He can be contacted at privacy@credscape.io.

The Privacy Officer oversees compliance, handles access and correction requests, approves privacy impact assessments, maintains the incident register and acts as the point of contact for complaints. CredScape is a small team. A company officer holds this role rather than a separate department.

What information we hold and why

We hold account information for people who use the product. We hold contact information for prospective customers. We collect website analytics. We also maintain a corpus of publicly published information about institutional programs, which is not personal information.

Our Privacy Policy explains what we collect and why in more detail.

How long we keep it

We keep account data for the life of the subscription. We delete or anonymize it within 90 days after termination. Product event records are retained for usage accounting. Incident register entries are retained for five years.

We do not keep personal information longer than needed for the purpose for which it was collected. We destroy it securely.

Roles and access

Access to personal information is limited to team members who need it to do their work. Service-role database credentials are held server side. Row Level Security is enabled on every table in the application schema.

Privacy impact assessments

We complete a privacy impact assessment before personal information is transferred outside Quebec. We also complete one before any new processing that could affect privacy. The Privacy Officer approves these assessments.

Service providers

Every service provider that handles personal information is bound by a written data processing agreement. We provide thirty days' advance written notice before adding a new subprocessor. Customers then have a thirty-day objection window.

See our subprocessor list.

Handling complaints and requests

Send privacy complaints and requests to privacy@credscape.io. We answer requests within 30 days.

If you are unhappy with our response, you may complain to the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec.

Incidents

We keep a register of every confidentiality incident, whether or not it is serious. We retain each entry for five years.

Where an incident presents a real risk of significant harm, we notify affected individuals, affected customers and the applicable regulator without delay.

Keeping this policy current

We review this policy annually and after any incident. We notify you of material changes at least thirty days before they take effect.