Privacy Policy

This Privacy Policy explains how Ontario Criminal Record Check (“we”, “us”) handles personal information when you use Ontario Criminal Record Check. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and its fair information principles. We are a private service and are not a government body.

1. Accountability

We are responsible for personal information under our control. We have designated a Privacy Officer who is accountable for our compliance with this policy. You can reach the Privacy Officer through our contact form by choosing the “Privacy request” category.

2. Purposes for collecting information

• To create and secure your account.
• To process your criminal record check application with our screening provider.
• To verify your identity through the provider's approved methods.
• To process payment and keep financial records.
• To deliver your result to your secure account and, only with your authorization, share it with an organization you choose.
• To respond to support requests, prevent fraud and misuse, and meet legal obligations.

3. Consent

We collect, use and disclose your information with your consent. You give express consent to the screening, to the sharing of information with our screening provider, and separately to any later disclosure of your result. You may withdraw consent before your application is submitted to the provider; after submission, withdrawal may not stop processing already under way. See our Consent and Authorization page.

4. Limiting collection

We collect only what is needed: your legal name and any previous names, date of birth, contact details, address, purpose of the check and, if applicable, the requesting organization. We do not collect your Social Insurance Number. We do not ask you to email copies of identity documents; identity verification is completed with the screening provider.

5. Limiting use, disclosure and retention

Use and disclosure

• Your application information is shared with our screening provider, Triton Canada, and the record sources it is authorized to query, solely to verify your identity and conduct the check.
• Your result is never shared with an employer or any other organization, including one that requested or paid for the check, unless you authorize it after viewing your result, or where disclosure is required by law.
• We use service providers (subprocessors) to operate the service, listed below. We do not sell personal information.

Retention

• Check results are deleted 90 days after they are made available to you (the “result retention period”).
• Application data is minimized approximately two years after the application is completed, keeping only what is needed for records, disputes and legal obligations.
• Financial and transaction records are retained for as long as required by tax and accounting law.
• Consent records are kept as evidence of your authorization for as long as related records are kept.

6. Accuracy

Please make sure the information you provide is accurate and complete. You can edit your details before payment. After payment, contact support to request a correction. Questions about the content of a result may need to be directed to the screening provider or record source.

7. Safeguards

• Encryption of data in transit (TLS) and at rest.
• Additional field-level encryption for sensitive information such as date of birth and results.
• Multi-factor authentication for staff accounts, role-based access and the principle of least privilege.
• Logging of access to personal information and regular review of those logs.
• Results are delivered only through your secure account and are never sent by email.

8. Openness: hosting and subprocessors

We use Canadian hosting where practical. Subprocessors are to be confirmed before launch and will be listed here, including:

• Screening provider: Triton Canada
• Payment processor: Stripe
• Transactional email provider: [to be confirmed]
• Hosting and database provider: [to be confirmed]

Cross-border transfers

Some service providers may process or store information outside Canada, for example in the United States. When this happens, your information may be subject to the laws of that jurisdiction, including lawful access by its courts and authorities. We use contractual and other measures to require a comparable level of protection.

9. Individual access

You may request access to, or correction of, the personal information we hold about you. Submit a request through our contact form. We may need to verify your identity before responding, and we will respond within the time required by law (generally 30 days).

10. Challenging compliance

If you have a concern about our handling of your information, please contact our Privacy Officer first. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.

Breach notification

If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and report it to the Office of the Privacy Commissioner of Canada as required by PIPEDA, and keep a record of the breach.

Cookies

We use only strictly necessary cookies. See Cookie Preferences.

Changes to this policy

We will post any changes on this page with a new “last updated” date and, where changes are significant, notify account holders.