Privacy Policy

This policy explains how EPR Compliance Engine Inc., a Nova Scotia company (registered address placeholder: Halifax, Nova Scotia, Canada — to be confirmed), handles personal information and client business data in connection with the NorthEPR platform. NorthEPR is an operating name of EPR Compliance Engine Inc.

We apply the ten fair information principles of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). Our Privacy Officer is reachable at the contact address in section 11 and is accountable for the information under our control, including information handled by our subprocessors.

Account information. Name and work email address, the organisation you belong to, your role, authentication data (a hashed password, and multi-factor enrolment status and secrets), sign-in timestamps and, for audit records, the IP address of the request where available.

Client business data you enter. Company profile and fiscal details, revenue figures used for obligation tests, products, packaging components and material specifications, sales volumes by jurisdiction and year, obligation and fee calculation results, generated reports and filing confirmations, and any evidence documents you upload (for example supplier specifications, weight verifications and sales extracts). This data is mostly commercial rather than personal, but documents you upload may contain personal information — please upload only what is needed.

Usage and operational data. An append-only audit log of significant actions taken in the application (who did what, when, and a short summary), and error reports capturing an error message, the route, and browser user-agent when the interface fails.

Enquiries. Details you submit through the waitlist or by email.

We do not collect or store payment card numbers.

We collect this information to provide the Service you have asked for: authenticating users, isolating each client’s data, determining obligations, calculating fees, producing filings and audit packs, sending deadline reminders, providing support, securing the platform, meeting our own legal and record-keeping obligations, and responding to enquiries.

Our basis is your consent, given when your organisation subscribes and when a user creates an account, together with the performance of our contract with your organisation. We do not use your information for advertising, and we do not sell it.

We do not run our own data centres. The Service is hosted on managed cloud infrastructure operated by our subprocessors. The database and file storage region is a placeholder pending confirmation: North America (Canada — Central, to be confirmed). Application code is served from a global edge network, which means requests may be routed through points of presence outside Canada even where the data at rest remains in the stated region.

Where information is stored or processed outside Canada, it may be accessible to the courts, law enforcement and national security authorities of that jurisdiction. If you require a contractually fixed data residency region, contact us before subscribing.

We use a small number of subprocessors, each bound to confidentiality and security obligations. This list is a placeholder pending confirmation and will be finalised, with notice of changes, before general availability:

• Managed cloud application hosting and edge delivery — placeholder
• Managed Postgres database, authentication and object storage — placeholder
• Transactional and notification email delivery — not yet connected
• Payment processing — not yet connected; no card data is stored by us
• Error and performance monitoring — placeholder

We will publish an up-to-date subprocessor list and notify subscribed clients before adding a new subprocessor that processes Client Data.

Client users can only see data belonging to their own organisation. This is enforced in the database with row-level security, not only in the interface.

Our own staff can access client organisations in order to operate the Service on your behalf, provide support and maintain the regulatory rules database. Staff accounts are required to use multi-factor authentication, and staff actions are recorded in the append-only audit log that your organisation’s owners can read.

We disclose information to third parties only to our subprocessors as described above, where you direct us to (for example, when filing with a regulator on your behalf), or where required by law. If we receive a lawful demand for your data, we will notify you unless legally prohibited from doing so.

Your organisation owns its data. We act as a service provider handling it on your instructions. You can export a complete copy at any time from Settings → Export my data, and you can ask us to correct or delete it, subject to the retention rules below.

We keep Client Data for as long as your subscription is active. After termination you have 30 days to export, after which we delete or de-identify Client Data within 90 days, except where a longer period is required.

Because this is compliance software, some records are deliberately durable: fee calculation snapshots, filed reports and audit-log entries are immutable by design and are retained for seven years (placeholder, aligned to typical Canadian records-retention practice — to be confirmed) so that a past filing can be substantiated. Backups roll off within 35 days. Error reports are retained for 90 days.

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Tenant isolation is enforced at the database layer, multi-factor authentication is available to all users and required for staff, calculation snapshots and filed reports are immutable, and privileged actions are written to an append-only audit log. Our security page describes the controls actually in place today.

We maintain an incident response process. If we determine that a breach of security safeguards involving personal information under our control creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals and the affected client organisation as soon as feasible in the circumstances, consistent with PIPEDA’s breach reporting requirements. We will keep records of breaches as required, and we will tell affected clients what happened, what data was involved and what we are doing about it.

You may ask us for access to the personal information we hold about you, ask us to correct it, withdraw consent (subject to legal and contractual limits), or complain about how we have handled it. Write to our Privacy Officer at support@northepr.com. We respond to access requests within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.

We will post any change to this policy on this page and update the date at the top. Material changes affecting Client Data will be notified to subscribed clients in advance.