Privacy notice

Who runs this service

Vprism is a staffing and HR platform run in Canada. Each agency that uses it decides what it collects from its candidates and workers and why; its own privacy notice, shown on its job board, names its contact for privacy questions. This notice covers what the platform itself does with the information every agency stores in it.

The privacy officer has not been named yet; the platform owner holds the role until then. The notice will show the name and address once set: [Privacy officer to be named: contact the agency you deal with in the meantime].

What the platform stores

Depending on how you use it, the platform holds:

• Your account: name, email address, when you signed in, and the agencies you belong to.
• Applications: your resume, licence or certification details, your answers to the application form, and the terms you accepted when you applied.
• Your HR file, as the agency collects it: addresses, employment and education history, documents such as photo identification and a void cheque, bank details for payroll, and legal entity details including a Social Insurance Number when the engagement requires one for payroll or tax reporting.
• Scheduling: shifts, assignments, availability, time off, and time entries.
• Notifications sent to you and whether you read them.
• Audit logs: which account read or changed a record, when, from which network address and browser.

Where it is kept

The database and the uploaded documents are kept on a server in Canada operated for the platform; documents live in an object store on that same host. Social Insurance Numbers and bank account numbers are encrypted before they are stored, every read of them by agency staff is recorded in the audit log, and the database enforces row-level access controls so that one agency never sees another agency's records. Connections use TLS.

Email

Sign-in links, application confirmations and shift notices are sent through Amazon Simple Email Service (SES), operated by Amazon Web Services Canada, Inc. in the Canada (Central) region in Montreal. Messages are stored and processed in Canada for that purpose.

Delivery to your mailbox is handled by your own mail provider, which is outside our control.

Analytics and tracking

The platform uses no third-party analytics, advertising or tracking services. No analytics service hosted in the United States, or anywhere else, receives data about your visits.

How long it is kept

The platform applies these retention periods:

• Audit logs of who accessed or changed a record: 7 years.
• Records of the terms you accepted (which text, when, from which network address and browser): 7 years, with the audit log.
• Notifications sent to you: 12 months.
• Rule evaluation records (why a shift or an assignment was allowed or refused): 400 days, or 3 years when the decision affected pay.
• Signed agreements, terms and acknowledgements: 7 years after they end; memos and reference letters: 3 years. An agreement linked to a placement is kept under legal hold by default, so it is not deleted while the hold stands.
• Your HR file (profile, addresses, history, documents, bank details, legal entity): for as long as your relationship with the agency lasts and then for the period the agency states in its own notice, which its legal obligations as an employer or client of record set.

Your choices

You can ask the agency you deal with, or the privacy officer, to show you the information held about you, to correct it, or to delete what the agency is not required to keep. You can withdraw a consent you gave at any time; withdrawing the consent given with an application ends the processing of that application.

If a question is not resolved with the agency or the privacy officer, you can contact the Office of the Information and Privacy Commissioner of your province or the Office of the Privacy Commissioner of Canada.