How we collect, use, and protect your personal information.

1. Who we are and who you are

This Policy applies to the following groups:

• Consumers. Individuals whose information we process for our services.
• Clients. Organizations or individuals using our services.
• Website visitors. Individuals of legal age accessing our website.

Our services are intended for adults. You must be at least 18 years old, or the age of majority in your jurisdiction, to use our services or to be the subject of a check ordered through our platform. We do not knowingly collect personal information from children. If you believe a child’s information has been provided to us, contact [email protected].

Our role. When we perform checks at the instruction of a business client, we act as a processor and the client is the controller of the personal information concerned. When you deal with us directly, including when you purchase a personal check through MyCheck, when you visit our website, or when you apply for a role with us, we act as the controller. MyCheck is also subject to its own consumer terms.

2. What information we process

Non-personal information

We process non-personal information to analyze trends and usage patterns on our website and platform. Non-personal information refers to aggregated or anonymized data that does not identify individuals.

Website visitor information

We collect data such as operating system, device identifier, browser type, IP address, screen resolution, page views, duration on pages, access times, and general location information (city, state, geographic area).

Client personal information

When subscribing to our services, clients provide information such as name, email, business name, business and billing addresses, and phone number.

Consumer personal information

We collect personal information voluntarily provided for background checks, with the type of data varying based on local regulations and the services requested.

Personal information collection at Credibled

Personal information	Reason for collection	Source of collection
Name(s)	Identification; background checks	Provided by user, public records, credit agencies, third parties
Date of birth	Identification	Provided by user
Place of birth	Required for some services	Provided by user
ID documentation and biometric data	Identity verification, including facial comparison against an identity document	Provided by user
Contact information	Service provision; communication	Provided by user, credit agencies, public records
Government-issued ID numbers	Required for accessing records	Provided by user
Criminal history and police records	Criminal background checks	Law enforcement, government agencies, public records
Credit or bankruptcy history	Financial background checks	Credit reporting agencies, public records
Employment history	Employment verification	User, clients, employers, record-keeping service providers
Education history	Education verification	User, clients, educational institutions, government education authorities
Professional credentials and memberships	Professional standing verification	User, clients, professional organizations, public records
Opinions about you	Reference interviews, employment verification	User, clients, employers, record-keeping service providers
Government watch or sanctions lists	Compliance checks	Law enforcement, government agencies
Eligibility to work	Employment eligibility verification	User, clients, government agencies
Driving records	Driving history checks	User, clients, government agencies
Directorship and corporate governance history	Verification of corporate involvement	User, clients, public records, corporations
Public record information and negative media	Obtaining public record information	User, clients, government agencies, public records
Telephone call recordings	Quality assurance and training	Calls with user

3. How we process personal information

Collection and processing

• Most of the personal information we collect is provided directly by you or through our clients.
• Our processes for collecting and handling personal information are designed to be as automated and efficient as possible, subject to strict quality controls.
• We regularly audit our data and update any inaccuracies, whether identified internally or reported by you.

When providing services directly to consumers

• You decide the type of personal information we collect and its intended use.
• We process your information upon receiving your explicit consent, ensuring compliance with relevant laws.
• You may request correction or deletion of your personal information at any time. We will action such requests as described in section 10. Where a check was performed by a third-party screening provider, that provider holds its own copy of the underlying records under its own retention schedule, and we will pass your request on to them. We may also be required to keep certain records to meet a legal or contractual obligation. Where we cannot delete information, we will tell you why and for how long it must be kept.

When providing services to clients

• Clients instruct us on the specific personal information to be collected and the methods of collection.
• Clients are responsible for ensuring that consumers are adequately informed and have consented to the collection and processing of their personal information in line with applicable laws.
• Personal information is collected and processed in a lawful, fair, and transparent manner, aligned with the agreed-upon purposes.
• Clients ensure the accuracy of personal information and, where necessary, its timely update, rectification, or erasure.

Our responsibilities

• We execute services as instructed by our client or consumer, adhering to their guidelines and applicable legal standards.
• We implement robust safeguards to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification, considering the sensitivity of the data.
• We fulfill any legal responsibilities we have as a data processor or custodian under applicable laws.
• Collection of personal information for security purposes is grounded in our legitimate interest and legal obligations to secure the data we hold.

4. Updates to this Policy

This Policy may be updated periodically. Where we make a substantive change affecting how we use personal information, we will notify business clients by email or by a notice on our website before the change takes effect, and we will update the version number and date shown on this page. Previous versions are available on request from [email protected].

5. What we collect, why, how, and from whom

We collect various types of personal information for account management, service provision, and legal compliance. The legal basis for processing includes consent, contractual necessity, legal obligations, and legitimate interest.

6. Cross-border data processing

Personal information processed on the Credibled platform is hosted in Canada. Personal information may be transferred outside Canada where it is necessary to deliver a service you or our client has requested, for example a United States criminal record check, an international check, or a verification with an employer or institution located abroad. Some of our service providers are located outside Canada and may process personal information there. Where personal information is transferred outside Canada it may be accessible to courts, law enforcement and national security authorities of that jurisdiction. We use contractual and technical measures to require a comparable level of protection from the providers we engage.

7. Third-party access and data sharing

We share personal information with the service providers who help us deliver the services, including the third-party screening providers and consumer reporting agencies that prepare checks, identity verification providers, cloud hosting and infrastructure providers, communication and payment providers, and our support tooling. We also share information with our business client who ordered the check, and with auditors or authorities where required by law.

We maintain a current list of the subprocessors that handle personal data on behalf of business clients. Business clients may request it through our Trust page at credibled.com/trust. An individual who is the subject of a check may ask us which provider performed their check, and for that provider’s privacy policy and contact details, by writing to [email protected].

We do not sell personal information, and we do not disclose it for advertising or marketing purposes.

8. Data storage and protection

Personal information on the Credibled platform is hosted in Canada with a major cloud provider. We encrypt personal information in transit and at rest, restrict access to those staff who need it for their role, log administrative activity, and maintain documented security, access control and incident response policies together with automated backups and point-in-time recovery. Our safeguards are proportionate to the sensitivity of the information and to the size of our organization, and we review them regularly. Business clients may request our security documentation through our Trust page at credibled.com/trust.

9. Data retention

We keep personal information only as long as we need it for the purpose it was collected for, and to meet our legal and contractual obligations. Retention periods differ by record type.

Check results. Background and identity checks are performed by third-party screening providers, and those providers hold the underlying records and the results under their own retention schedules. When a report is viewed, we retrieve it from the provider at that moment. We do not maintain our own archive of completed check results. On request we can tell you which provider holds the records relating to a particular check, and how to contact them.

Information we hold ourselves. We hold the information needed to operate the platform and route a request: client account details, the contact details of the individual being checked, and a record of what was requested and when. Where we carry out automated reference checks ourselves, we also hold the responses given by the referees a candidate nominates.

Backups. Information you ask us to delete may persist for a limited period in encrypted backups before those backups expire. All backups are encrypted and held exclusively in Canada. Our backup retention window is documented in our Backup and Recovery Standard, which business clients may request through our Trust page at credibled.com/trust.

Minimum retention periods. Some records are subject to a minimum retention period that we cannot shorten, including records we must keep to demonstrate compliance with consumer reporting law and with our obligations to the providers we work with. Where you ask us to delete information that is subject to such a minimum, we will tell you and we will delete it once the period has expired. Account information is deleted or deactivated on request, subject to the same limits.

10. Exercising your privacy rights

You may ask us to confirm what personal information we hold about you, to give you access to it, to correct it if it is inaccurate or incomplete, to delete it, or to withdraw a consent you previously gave. Contact [email protected]. We may need to verify your identity before we act.

We respond to access and correction requests within 30 days, as required under PIPEDA. Where we need more time or must refuse a request in whole or in part, we will tell you in writing and explain why.

If you are the subject of a check and you want a copy of your report, we will provide it, or arrange for the provider who prepared it to provide it, within three business days of your request. If you believe information in a report is inaccurate or incomplete, tell us and we will convey the dispute to the provider that prepared the report without delay, and pass the results of any reinvestigation back to you and to the client who ordered the check.

Where we act as a processor for a business client, we may need to consult that client before actioning a request, and in some cases the client is responsible for responding. We will tell you if that is the case and who to contact. If you are not satisfied with how we have handled your request, you may complain to the Office of the Privacy Commissioner of Canada or to your provincial privacy regulator.

11. Additional jurisdictional considerations

Quebec. Where we transfer personal information about a Quebec resident outside the province, we assess the protection it will receive before the transfer, as required under Quebec privacy law.

United States. Background checks performed on individuals in the United States may be “consumer reports” under the Fair Credit Reporting Act. Those reports are prepared by a consumer reporting agency. The employer who ordered the report is the end user and is responsible for the disclosure, authorization and adverse action requirements that apply to it. Your rights of access and dispute in relation to a consumer report are set out at 15 U.S.C. sections 1681g and 1681i.

Other jurisdictions. Where the law of another jurisdiction applies to personal information we process, we meet the requirements that apply to our role in that processing.

12. Use of cookies

We use cookies for site functionality and analysis. You can manage cookie preferences through your browser settings.

13. Contact information and Privacy Officer

Questions, requests, or complaints related to this Policy can be directed to our Privacy Officer, Elvine Assouline, at [email protected], or by mail to Credibled Inc., 391 Keele Street, Toronto, Ontario, Canada, M6P 2K9. Data protection and security matters may be directed to [email protected].

14. Consent and notification

Where consent is the basis on which we process personal information, it is obtained before the processing begins, either directly from the individual or by our business client on our behalf. Consent to a background or identity check is obtained separately as part of that check, not by use of this website. You may withdraw consent at any time by contacting [email protected], subject to legal and contractual restrictions and to any minimum retention period described in section 9. Withdrawing consent does not affect processing that already took place, and it may mean we can no longer provide the service.

15. SMS terms and conditions