Data Processing Addendum

1. Preamble and conditional application #

This Data Processing Addendum describes processing by Instant Record Check when it provides screening technology to an organization. It applies when it is incorporated into a written organization service agreement that governs the relevant services.

2. Definitions #

“Applicable Privacy Law” means the privacy and consumer-reporting laws that apply to the processing, including applicable federal law, the Personal Information Protection Act of British Columbia, the Personal Information Protection Act of Alberta, and Quebec’s private-sector privacy legislation. “Personal Information” means information about an identifiable individual processed for the services. “Provider” means a service provider engaged to support the services.

3. Roles and instructions #

The organization is responsible for having a lawful basis to request each check, giving the applicant required notices, and obtaining the consent or authorization required by Applicable Privacy Law. Consent for the criminal record check, identity verification, optional result sharing, and marketing are separate purposes where applicable. The organization must not ask Instant Record Check to process information in a way that violates Applicable Privacy Law.

Instant Record Check processes information to administer the requested screening service and related support, security, legal, and operational functions described in its public notices. A completed result is provided to the organization only after the applicant’s separate, express, optional consent. Partner municipal police services access CPIC through their own official systems and make the criminal record determination. Instant Record Check’s platform generates and delivers the report based on the police result, without independently searching police databases or changing substantive police findings.

4. Personal information processed #

Depending on the service, processing may include the applicant’s name, other names, sex, date of birth, place of birth, current and prior addresses, telephone number, email address, mailing address, account and order details, consent and authorization records, and a voluntary declaration about past convictions. It may include the police result and its fields, including name, other names, sex, date of birth, place of birth, date, address, no record, declared record confirmed, incomplete or inaccurate data, confirmed offence/date/court information, enhanced cleared, not cleared or incomplete status, and a serial authentication number.

It may also include identity-verification questions, choices, answers, outcomes and reason codes; device, cookie, usage, support, and communications information; and payment transaction information handled by the payment provider. Payment details are not shared with the organization.

5. Confidentiality and personnel #

Personnel who are authorized to access personal information are subject to confidentiality obligations. Access is limited through proportionate controls to information needed for assigned work.

6. Safeguards #

Instant Record Check uses TLS for information in transit and encrypted scheduled external backup archives, together with technical and organizational safeguards proportionate to the sensitivity of the information. The primary application and database hosting is in Quebec and operations are in British Columbia. Production database and PDF filesystem data are not encrypted at rest.

7. Providers and issuing authorities #

We use providers for hosting, identity verification, payment, transactional email, customer support, analytics, advertising, and monitoring, including Stripe, TransUnion, OVH, Netlify, SendGrid, Klaviyo, Intercom, PostHog, Sentry, Google, and Microsoft. These providers may process limited information outside Quebec and Canada, including in the United States and the European Union; we use PostHog’s European Union hosting region. Foreign laws may permit lawful access.

Partner police services are issuing authorities acting under their own legal mandates, not Providers of Instant Record Check.

8. Applicant requests and disputes #

Applicants may download completed reports through their accounts when available and may send written access, correction, withdrawal, or privacy requests to privacy@instantrecordcheck.ca. Quebec-related requests may also be sent to confidentialite@instantrecordcheck.ca. Instant Record Check responds in writing within 30 days where that period applies and handles access and correction without charge, subject to reasonable charges allowed by law for transcription, reproduction, or transmission.

Instant Record Check corrects identification information it holds when correction is required. A dispute about substantive police result content is referred to the issuing police service, while Instant Record Check provides its own legally timely written response and does not modify the police finding. Corrections are notified to recipients from the preceding six months and the source where applicable.

9. Security and privacy incidents #

If an incident affects personal information processed under the services, Instant Record Check works to contain and assess it. It notifies the organization without undue delay where the governing written agreement requires that notice and provides reasonable cooperation for applicable reporting duties. It also makes notifications to regulators or affected individuals when the applicable serious-harm threshold or other law requires them and maintains required incident records.

10. Retention, return, and deletion #

Retention is described in the Data Retention & Safeguards Policy. The current configuration uses a seven-year period for checks and linked identity and TransUnion information, measured from completion for linked information and from creation for unlinked information; accounts remain while linked data exists. Long-horizon cleanup for screening files is currently handled in review mode, and automatic deletion is not yet enforced by that mechanism. Requests concerning screening-file deletion are handled under applicable legal duties, including statutory response deadlines. For Quebec personal-information-agent activity, the statutory seven-year period measured from collection is a maximum, not a minimum, and is distinct from the operational period.

Scheduled external encrypted backups are configured to expire after approximately 30–35 days, but that period is not universal for every operational copy or snapshot. Some shorter-lived records are deleted automatically: session tokens after 30 days, failed-login records after 90 days, certain entity-less audit context after 90 days, and advertising click identifiers in checkout and conversion records after 90 days. Provider retention periods, API-log periods, analytics-retention maxima, and other operational-copy periods may differ. On termination or written request under a governing agreement, active information may be returned or deleted subject to Applicable Privacy Law, legal obligations, and evidence needs.

11. Documentation and regulatory cooperation #

Instant Record Check will provide information about its public privacy and retention practices that is reasonably relevant to the services, subject to security, confidentiality, privilege, and legal restrictions. It will cooperate with applicable privacy commissioners and other authorities as required by law.

12. Governing law #

The governing written organization service agreement determines the contractual law and forum for the services. Applicable mandatory privacy, consumer, police, and other laws continue to apply. This Addendum applies to the services only when it is incorporated into that agreement.

13. Contact #

Questions about this Addendum or processing may be sent to privacy@instantrecordcheck.ca. Quebec-related privacy questions may also be sent to confidentialite@instantrecordcheck.ca. The operator is 1244527 B.C. Ltd., doing business as Instant Record Check.