Effective Date: October 1, 2022

 

This Privacy Policy ("Policy") is published by DataTrail Corp. an Alberta corporation with its head office at Calgary, Alberta, Canada, operating as DataTrail ("DataTrail", or "we", "us", "our", etc.).  Generally, the Personal Information Protection Act of Alberta will apply to DataTrail, but it is possible that in certain circumstances the Personal Information Protection and Electronic Documents Act (Canada) or other laws or legislation may govern.  It is the policy of DataTrail to comply with laws and legislation applicable to DataTrail.

 

Definitions

 

• "Personal Information" means information about an identifiable individual.

 

• "Customer" means (i) any person or entity which purchases or uses a Tracking Device, and/or any person or entity, including an end user, which subscribes for or uses online services (including software as a service) made available by DataTrail.  

 

• "Service" means any services, including online services and software as a service, made available by DataTrail permitting Customers to use a Tracking Device to obtain GPS and other data and information, including Personal Information, and then access, store, process and/or modify data and information, including Personal Information.

 

• "Tracking Device" means a device, including any firmware or other software installed on such a device, marketed and sold by DataTrail. A Tracking Device is capable of capturing GPS and locational data regarding the location and movements of the device.  A Tracking Device is also capable of proving a history of locations and movements and making that data available to a Customer using the Service for purposes that may, for example, include monitoring or tracking the location and travel history of the device, including any person or container, such as a vehicle, luggage or personal effects in which or on which the Tracking Device is or may be contained or situated.

 

This Policy summarizes our practices with respect to individual privacy and Personal Information concerning Customers and other individuals.

 

DataTrail will collect, use or disclose Personal Information only with the subject individual’s knowledge and consent, except as may be required or permitted by law. 

 

It is our policy to protect Personal Information in our custody or control and not disclose it except without the subject individual’s consent or as permitted or required by law. If required to do so by law, DataTrail reserves the right to preserve Customer Data and Personal Information for as long as may be required and, if deletion or destruction is prohibited by law, DataTrail may refuse to delete such data or Personal Information until the law permits.

 

DataTrail does not sell any mailing or distribution lists it may have.

 

Customers subscribing to Service are required to enter into a contract with DataTrail whereby they agree to use each Tracking Device and the Service only for lawful purposes and specifically to not use the Tracking Device or the Service to collect, use or disclose Personal Information without the knowledge of the subject individual except to the extent the subject individual’s consent is obtained, or where doing so may be permitted by applicable law.

 

DataTrail has no way of fully monitoring use by Customers of a Tracking Device or the Service.  DataTrail therefore accepts no obligation or liability to monitor use by Customers of a Tracking Device or the Service. DataTrail retains its right, but not the obligation, to exercise and enforce its rights under its agreements with Customers who are in breach of such agreements.  DataTrail's rights include suspension of a Customer's access to the Service, or termination of a Customer's agreement with DataTrail.

 

This Policy applies to the collection, use and disclosure of Personal Information in the custody or control of DataTrail in the course of providing access to the Service and does not apply to the conduct of Customers except as stated in this Policy.

 

DataTrail contractually requires that each Customer using a Tracking Device shall be required to obtain in advance legally valid consent from subject individuals permitting the Customer to collect Personal Information regarding such individuals in the course of using Tracking Devices and the Service.  

 

Customers are required to export and archive information which they wish to keep longer than 60 days to their own storage devices or Service.  DataTrail generally retains such information for no longer than 60 days for the purposes of providing the Service.

 

Collection, Use, and Disclosure of Personal Information

 

DataTrail generally collects, uses, and discloses Personal Information for reasonable purposes related to carrying on our business and the functions and purposes of the Service and Tracking Devices.

 

Personal Information DataTrail collects, uses, and discloses includes the following:

 

• Personal Information from Customers with their consent, including name, address, phone number and credit card numbers, and related identifiers, for the purposes of processing payment for goods and services, generally by the use of credit cards.

 

• Personal Information (including Personal Information that may be contained in GPS data) in the course of providing the Service to Customers. DataTrail does so as a service provider in response to requests of the Service made by Customers, and such collection, use and any related disclosure is controlled by Customers and users of the Service. 
• Personal Information consisting of personal employee information with any required notifications or consents for the purpose of establishing, managing, and terminating employment relationships.
• Login credentials to the Service, or any other services made available by DataTrail.
• Correspondence, messages, comments, and other information you may choose to send or disclose to DataTrail.
• DataTrail may also automatically collect information about how Customers and users access and use the Service, including, for example, the device used, the times at which, how frequently and for how long Customers access the Service, which documents, records, or data Customers access, whether Customers access the Service from multiple devices, and generally Customer's activities in using the Service.
• DataTrail may anonymize and aggregate any of the personal information we collect. “Anonymize” means that DataTrail removes any identifiers so that the information no longer identifies an individual, and “aggregate” means that DataTrail combines that anonymized information with other anonymized information. DataTrail may use anonymized and/or aggregated information for business analytics purposes or research for internal purposes.   DataTrail may also share such anonymized and/or aggregated information with others, but individuals cannot be identified from such anonymized and/or aggregated information.
• Internet Protocol or IP addresses, browser type and version, Internet Service Provider or ISP, referring or exit web pages, date/time stamp, operating system, and some types of “clickstream” data may also be collected automatically by DataTrail, or by our service providers and then provided to DataTrail.
• Cookies: To make our website operate properly, we sometimes place small data files called cookies on your device. Many major websites do so. A cookie is a small text file that a website saves on your computer or mobile device when you visit our website. It enables the website to remember your actions and preferences (such as login, language, font size and other display preferences) over a period of time, so you don’t have to keep re-entering them whenever you come back to the site or browse from one page to another. Our store, managed by Shopify, uses cookies to let you perform authenticated actions like signing into your personal account. Additionally, cookies may be used for advertising purposes. You can control and/or delete cookies as you wish – for details, see aboutcookies.org. You can delete all cookies that are already on your computer, and you can set most browsers to prevent them from being placed. If you do this, however, you may have to manually adjust some preferences every time you visit a site, and some services and functionalities may not work.

DataTrail contractually requires Customers to comply with applicable privacy legislation, and to not input, upload, download or extract Personal Information into or from the Service without the consent and knowledge of the subject individuals. 

 

Customers generally have primary custody and control of Personal Information related to their respective users and other individuals. Customers and users of the Service, and not DataTrail, directly control whether or not the Tracking Devices and Service are used in compliance with applicable laws.

 

Tracking Devices and the Service are intended for use only by adults.  DataTrail does not knowingly collect any Personal Information from individuals under the age of 18.  Those under the age of 18 should not use the Service or provide DataTrail with any Personal Information.

 

Lawful Exceptions to Consent

Under Alberta law, DataTrail may collect, use, or disclose personal information without consent in circumstances that may include but are not limited to the following:

• Where collection, use or disclosure of the information is clearly in the interests of the individual and consent of the individual cannot be obtained in a timely way;
• Where the collection, use, or disclosure of the information is required or authorized by law;
• Where the collection, use or disclosure of the information is reasonable for the purposes of an investigation or a legal proceeding;
• Where the information is publicly available from a source DataTrail is allowed legally to receive the information from without consent;
• Where the collection of the information is necessary to collect a debt owed to DataTrail or for DataTrail to repay to an individual money owed by us;
• In certain situations, DataTrail may be required by law to disclose personal information in response to lawful requests by governmental or public authorities, including to meet securities regulators and law enforcement requirements. It is our policy to comply with all such legal requirements.

Outsourcing and Service Providers

DataTrail may contract with third party service providers with respect to the collection, use or disclosure of Personal Information for purposes of billing Customers by the use of credit cards, or for storage of Personal Information on an out-sourced basis, in either of which cases DataTrail will enter into contractual arrangements with such service providers requiring them to protect any Personal Information received from DataTrail to provide services to DataTrail in a manner consistent with this Policy.

In the event that, with respect to Customers and individuals located in Canada, DataTrail contracts with a service provider outside of Canada, if DataTrail uses that service provider to collect Personal Information with consent, or if Personal Information is transferred to the service provider outside of Canada, DataTrail will notify any affected individuals in Canada orally or in writing as to the way in which individuals may obtain access to written information about DataTrail's policies and practices with respect to service providers outside of Canada, and the name or position or title of a person able to answer on behalf of DataTrail any questions about the collection, use or disclosure of Personal Information outside of Canada on behalf of DataTrail.  Persons outside of Canada to whom Personal Information is transferred may be required to disclose Personal Information under the laws of their jurisdiction.

DataTrail does use service providers outside of Canada for the processing of anonymous information, or supplying services such as maps in response to anonymous information, but such service providers have no way of connecting such information to any identifiable individual.

Customer dealings directly with third parties that may relate to the Service are carried out by Customers on their own behalf, and DataTrail has no control over what Personal Information Customers and such third parties may collect, use or disclose.

Accuracy and Completeness

 

When DataTrail collects, uses or discloses Personal Information, DataTrail will use reasonable efforts to ensure that it is accurate, up to date, and complete. Personal Information collected by use of the Service is collected by the use of third-party suppliers of services such as GPS services, maps and similar materials, and is subject to any inaccuracies that may result from the use of such technologies.

 

Retention and Destruction

 

Alberta law allows DataTrail, for legal or business purposes, to retain Personal Information for as long as is reasonable.  Upon expiry of an appropriate retention period, bearing in mind reasonable legal and business requirements, Personal Information will either be destroyed in a secure manner or made anonymous. 

 

Should consent to DataTrail's collection, use, disclosure or retention of Personal Information be revoked, Alberta law also allows DataTrail to continue to retain the information for as long as is reasonable for legal or business purposes. In the event that revocation of consent may have consequences to the individual concerned, and if reasonable to do so, DataTrail will advise the individual of the consequences of revoking their consent where it is reasonable in the circumstances to do so.

 

Data collected by the use of the Service may include Personal Information, such as the movements, speed, location and travel history of a Tracking Device.  DataTrail does not collect information about the identity of individuals carrying, or located with or traveling with a Tracking Device, but Customers may have possession of such information.

 

DataTrail generally collects and retains, on behalf of Customers, data collected by use of the Service. Such data may or may not include or consist of Personal Information.  DataTrail assumes no obligation to retain such data for any set period of time.  Generally, retention of such data will be for limited periods of time, following which DataTrail has the right, but not the obligation, to delete it, provided that such information may be retained for longer periods of time, including for other purposes such as legal purposes. Customers using the Service are able to export and archive such data, and their activities with such data, including any Personal Information, once exported are not subject to the control or knowledge of DataTrail but may be subject to any policies such Customers may have.

 

Security of Personal Information

 

DataTrail recognizes its legal obligations to protect confidential information and Personal Information in its custody or control. DataTrail has therefore made arrangements to secure against the unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction of Personal Information. These arrangements may include physical security measures, network security measures, and organizational measures such as non-disclosure agreements and need-to-know access.  

 

Notification of Loss or Unauthorized Access or Disclosure

Where an incident occurs involving the loss of or unauthorized access to or disclosure of Personal Information under the control of DataTrail, where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure, DataTrail will, without unreasonable delay, provide notice to the Information and Privacy Commissioner for Alberta of the incident, including any information required by law at the time to be provided to the Commissioner.  While Alberta law provides that the Commissioner has the authority to require DataTrail to notify individuals of the unauthorized access or disclosure, DataTrail may elect to immediately do so in the event DataTrail considers it reasonable in the circumstances.  In some circumstances, DataTrail may notify the Privacy Commissioner of Canada and follow any directions provided by the Commissioner.

Communicating with Customers and CASL Compliance

 

Canada has implemented legislation (Generally referred to as Canadian Anti-Spam Legislation, or "CASL") prohibiting commercial electronic communications without adequate consent, and without an adequate unsubscribe mechanism.  Commercial electronic communications ("CEM's") are defined as emails and text messages.  It is DataTrail's policy to not send CEMs without valid legal consent from the recipient, and it is DataTrail's policy to always use the unsubscribe mechanisms prescribed by CASL.  CASL limits how long DataTrail can keep and use your information so, unless you have given DataTrail a permanent and express consent to contact you or send messages to you regularly, we may cease corresponding with you without notice once applicable time limits have passed.   

 

In addition to CASL, and subject to DataTrail's obligations under CASL, DataTrail obtains consent from Customers to communicate with them. DataTrail communicates with its Customers for purposes of providing products and services, including Tracking Devices and the Service, providing Customers with notification of changes to the Service or the terms and conditions of legal agreements with Customers. DataTrail may also notify Customers and other individuals who have asked to be kept advised of information related to the Service, Tracking Devices, or other products or services of DataTrail or third parties.

 

Requests for Access to Personal Information

 

The law permits individuals to submit written requests to DataTrail to provide them with:

• access to Personal Information about them under DataTrail's custody or control;
• information about our collection, use or disclosure of Personal Information about them and the purposes for doing so; and
• if we have in our custody or under our control a record about an individual, the purposes for which their Personal Information under our custody or control has been and is being used by us, and the names of persons to whom, and the circumstances in which their Personal Information has been and is being disclosed by DataTrail.

Requests must be in writing and include sufficient detail to allow us to identify any record in our custody or under our control containing the Personal Information requested.

Except for billing and related information received from Customers, DataTrail has no control over, or access to information provided by Customers or other users in the course of using the Service. Requests from users under a Customer account may be directed to the applicable Customer.    

DataTrail will respond to applicable requests in the time allowed by Alberta law and will make a reasonable effort to assist applicants and to respond as accurately and completely as reasonably possible. All requests may be subject to any fees and disbursements Alberta law permits DataTrail to charge.  Where appropriate to do so, DataTrail may require advance payment of a deposit or the entire costs of responding to a request for access to Personal Information.  DataTrail is not permitted to charge fees for corrections to errors or omissions in Personal Information.  

 

An individual’s ability to access his or her Personal Information under the control of DataTrail is not absolute.

 

Alberta law provides that DataTrail is not permitted to disclose Personal Information where:

 

• the disclosure could reasonably be expected to threaten the safety or physical or mental health of an individual other than the individual who made the request;

 

• the disclosure would reveal Personal Information about another individual; or

 

• the disclosure would reveal the identity of an individual who has in confidence provided us with an opinion about another individual and the individual providing the opinion does not consent to the disclosure of his or her identity.

 

Alberta law further provides that DataTrail may choose not to disclose Personal Information where:

 

• the Personal Information is protected by any legal privilege;

 

• the disclosure of the information would reveal confidential commercial information and it is not unreasonable to withhold that information;

 

• the Personal Information was collected by DataTrail for an investigation or legal proceeding;

 

• the disclosure of the Personal Information might result in similar information no longer being provided to us when it is reasonable that it would be provided;

 

• the Personal Information was collected or created by a mediator or arbitrator in the conduct of a mediation or arbitration for which he or she was appointed to act

 

• under an agreement,
• under a statute of Alberta, or of Canada, or of another Canadian province,
• under a regulation of Alberta, a regulation of Canada or similar provision of the law of another Canadian province that, if enacted in Alberta, would constitute a regulation of Alberta,
• under a legislative instrument of a professional regulatory organization, or
• by a court; or

• the Personal Information relates to or may be used in the exercise of prosecutorial discretion.

 

DataTrail reserves all its rights under applicable law.

 

Generally, Alberta's privacy legislation states that it is not to be applied so as to affect any legal privilege so communications between DataTrail and its legal counsel and other records and documents subject to legal privilege will generally not be subject to disclosure. 

 

Responses to Requests for Access to Personal Information

 

DataTrail's response to requests for access to Personal Information will be in writing and will confirm whether DataTrail is providing all or part of the requested information, whether or not DataTrail is allowing access or providing copies, and, if access is being provided, when that will be given.  Where DataTrail is able to sever information it cannot or is not required to provide from information it is required to provide, DataTrail will provide the individual with access to the part of the record remaining after such information has been severed.

It is the policy of DataTrail to respond to requests for information within the time periods required by Alberta law, but DataTrail reserves its rights to extend the time period where applicable law permits our doing so. Examples of where DataTrail can extend the time period include where the applicant does not give sufficient detail to enable DataTrail to identify the applicable records, or more time is needed to consult with another organization, a public body or a government or agency of a government of a jurisdiction in Canada.

If access to information or copies are refused by DataTrail, DataTrail will provide written reasons for such refusal and the section of Alberta's privacy legislation on which that refusal is based, along with the name of person who can answer questions about the refusal, and particulars of how the requesting individual can ask the Information and Privacy Commissioner for Alberta to review the decision of DataTrail. 

 

Requests for Correction of Personal Information

 

Alberta law permits individuals to submit written requests to DataTrail to correct errors or omissions in their Personal Information that is in the custody or control of DataTrail.  DataTrail reserves the right to require sufficient information and detail from the individual in question in order to properly locate the information and provide a response. 

 

In the event that an individual alleges errors or omissions in the Personal Information in the custody or control of DataTrail, DataTrail will either:

 

• correct the Personal Information and, if reasonable to do so, and not contrary to law, or any legal or client privilege, send correction notifications to any other organizations to which DataTrail disclosed the incorrect information; or

 

• decide not to correct the Personal Information but annotate the Personal Information that a correction was requested but not made.  

 

Alberta law provides that corrections or alterations cannot be made to opinions, including expert or professional opinions, as opposed to factual information.

Certain Additional Rights

Applicable privacy law may also provide you with rights including the following (some of which may also be applicable under Alberta law as described above):

• Right of access and portability. The right to obtain access to your personal information along with certain information, and to receive that personal information in a commonly used format and to have it ported to another data controller.
• Right to rectification. The right to obtain rectification of your personal information without undue delay where that personal information is inaccurate or incomplete.
• Right to erasure. The right to obtain the erasure of your personal information without undue delay in certain circumstances, such as where the personal information is no longer necessary in relation to the purposes for which it was collected or processed, or where we have no other lawful basis for retaining the information.
• Right to restriction. The right to obtain the restriction of the processing undertaken by us on your personal information in certain circumstances, such as where the accuracy of the personal information is contested by you.
• Right to object. The right to object, on grounds relating to your particular circumstances, to the processing of your personal information, and to object to the processing of your personal information for direct marketing purposes, to the extent it is related to such direct marketing.
• Right to non-discrimination. The right to non-discrimination for exercising your rights as outlined in this policy. This includes, but is not limited to, denying you goods or services, charging you different prices for similar services, or providing a different level or quality of service as a result of your exercising your lawful rights.

If you wish to exercise one of these rights, subject to it being available to you under applicable privacy law, please contact us using the contact details at the end of this Policy.

Amendment of Policy

 

DataTrail reserves the right to amend this Policy from time to time as required, and without notice, in order to better meet its obligations under applicable law.

 

Contacting or Communicating with Us

 

If you have any questions with respect to our policies concerning the handling of your Personal Information, or if you wish to request access to, or correction of your Personal Information under the care and control of DataTrail, please contact DataTrail's Privacy Officer at:

 

Mailing address:  7056B Farrell Rd, SE; Calgary, AB; T2H 0T2

Email address: privacyofficer@datatrail.com

Phone number: 403.668.9106

 

If you are dissatisfied with the manner in which DataTrail handles your Personal Information, you may contact our Privacy Officer in writing, setting out the reasons for your concern.

 

If you remain dissatisfied after our Privacy Officer has reviewed and responded to your concern, you have the right to contact the Office of the Information and Privacy Commissioner for Alberta at:

 

410, 9925 - 109 Street

Edmonton, AB T5K 2J8

Telephone (780) 422-6860 or Fax (780) 422-5682

You may also contact the Privacy Commissioner for Canada as follows:

 

            For general inquiries:

 

            Toll-free: 1-800-282-1376

            Phone: (613) 947-1698

            Fax: (613) 947-6850

            TTY: (613) 992-9190

 

            By mail:

 

            112 Kent Street

            Place de Ville

            Tower B, 3rd Floor

            Ottawa, Ontario

            K1A 1H3