Privacy notice

Who runs this service

Interchange is a staffing and HR platform run in Canada. Each agency that uses it decides what it collects from its candidates and workers and why; its own privacy notice, shown on its job board, names its contact for privacy questions. This notice covers what the platform itself does with the information every agency stores in it.

The privacy officer has not been named yet; the platform owner holds the role until then. The notice will show the operating company and its address once set: [Privacy officer to be named: contact the agency you deal with in the meantime].

What the platform stores

Depending on how you use it, the platform holds:

• Your account: name, email address, when you signed in, and the agencies you belong to.
• Applications: your resume, licence or certification details, your answers to the application form, and the terms you accepted when you applied.
• Your HR file, as the agency collects it: addresses, employment and education history, documents such as photo identification and a void cheque, bank details for payroll, and legal entity details including a Social Insurance Number when the engagement requires one for payroll or tax reporting.
• Scheduling: shifts, assignments, availability, time off, and time entries.
• Where your phone was when you punched in, out or for a break at a site the agency has fenced, and when your phone reported leaving it, kept with the time entry. Nothing else about where you are is sent or kept.
• Notifications sent to you and whether you read them.
• The audit log: which account changed a record, read a full Social Insurance Number or bank account number, or opened an identity document or a void cheque, when, and from which network address and browser.
• Sign-ins: when your account signed in or out and how. An address typed at a sign-in that was refused is kept only as a keyed digest, never as the address.

Where it is kept

The database and the uploaded documents are kept on a server in Canada operated for the platform; documents live in an object store on that same host. Social Insurance Numbers and bank account numbers are encrypted before they are stored, every read of a full number is recorded in the audit log, and the database enforces row-level access controls so that one agency never sees another agency's records. Connections use TLS.

Email

Sign-in links, application confirmations and shift notices are sent through Google Workspace, an email service operated by Google LLC, whose servers are outside Canada. Message contents and recipient addresses are processed outside Canada for that purpose; this is the notice section 13.1 of Alberta's Personal Information Protection Act asks for when a service provider outside Canada is used.

Delivery to your mailbox is handled by your own mail provider, which is outside our control.

Analytics and tracking

The platform uses no third-party analytics, advertising or tracking services. No analytics service hosted in the United States, or anywhere else, receives data about your visits.

How long it is kept

What the platform keeps, and for how long:

• The audit log and the record of sign-ins: kept for as long as the platform runs. They name the account that acted, the record it acted on, when and from where, and the fields that changed, never your name, your contact details, an amount or anything you wrote, so nothing a deletion removes stays behind in them.
• Records of the terms you accepted (which text, when, from which network address and browser) and of the agreements you signed: kept for as long as the platform runs, as the evidence of what you agreed to.
• Records of a shift or a punch that went against an agency's rule, and what the rule said then: kept for as long as the platform runs.
• Notifications sent to you, read or not: deleted ninety days after they were sent.
• The record of each request your phone sends to take a shift, answer an offer, punch the clock or report an issue, kept so that one sent again after a dropped connection counts once: deleted thirty days after it was sent.
• A document you or the agency delete: removed from storage thirty days later.
• Backups of the database: kept for up to four weeks, so a record deleted from the platform is gone from every backup within four weeks.
• Your HR file (profile, addresses, history, documents, bank details, legal entity) and your pay records: kept while you work through an agency, and afterwards for as long as its obligations as an employer require. Nothing deletes them on a schedule, so a request to delete what the agency is not required to keep is answered by the privacy officer, as below.

Your choices

You can ask the agency you deal with, or the privacy officer, to show you the information held about you, to correct it, or to delete what the agency is not required to keep. The privacy officer answers within thirty days. You can withdraw a consent you gave at any time; withdrawing the consent given with an application ends the processing of that application, and the link at the foot of an agency's marketing email stops any more of it.

If a question is not resolved with the agency or the privacy officer, you can contact the Office of the Information and Privacy Commissioner of your province or the Office of the Privacy Commissioner of Canada.