Privacy & information handling
Personal Information Retention and Destruction Policy - Instant Record Check
This English version follows the French text filed with Québec's Commission d'accès à l'information. Where a rule applies only in Québec, this version says so. In Québec, the French text governs.
Effective date: [DATE]
Last updated: 10 September 2026
1. Purpose and legal basis #
This policy sets out the framework applicable to the retention and destruction of personal information held by Instant Record Check. In Québec, it is established in accordance with the first paragraph of section 3.2 of the Act respecting the protection of personal information in the private sector (RLRQ c. P-39.1), referred to below as “the Act” or “LPRPSP”.
2. Principle #
Personal information is retained and destroyed securely and irreversibly as soon as the purposes for which it was collected or used have been achieved and the applicable legal retention periods have elapsed.
In addition, and without this deadline justifying retention longer than described above, any personal information collected in the course of personal information agent activities more than seven years ago is destroyed. This cap is calculated from collection, not from the last transaction in the file. It is a maximum.
3. Retention schedule #
The starting point for each period below is stated for each category. This retention schedule applies everywhere. No period may postpone destruction beyond the seven-year cap calculated from collection.
| Category | Period | Starting point | Basis |
|---|---|---|---|
| Customer identification information (name, other names, date of birth, sex, addresses, contact information) | As soon as the purposes are achieved; no later than 7 years | Collection | section 23; section 79.1 of LPRPSP |
| Verification result received from a police service | 7 years from collection (checks required by partner police services, authentication of issued documents, and the person's access to their account) | Collection | section 23; section 79.1 of LPRPSP; audit requirements of partner police services |
| Proof of consent | Retained with the order file and destroyed with it; no later than 7 years | Collection | section 23, section 92.2 of LPRPSP; section 2925 of the Civil Code of Québec |
| Information used to make a decision (including a refusal following identity verification), including identity-verification information (questions asked, answers selected, and result) | 7 years from collection (checks required by partner police services) | Collection | sections 11, second paragraph, 23, and 79.1 of LPRPSP; audit requirements of partner police services [référence du protocole] |
| Payment information held by us (amount, date, status, transaction identifier) | 7 years | End of financial year | section 35.1 of the Tax Administration Act; section 230 of the Income Tax Act |
| Customer correspondence | 3 years; deleted during the following cleanup | End of the exchange | section 23 of LPRPSP, section 2925 of the Civil Code of Québec |
| Identity documents submitted for an access or correction request | Immediate destruction | Verification completed | section 5; section 23 of LPRPSP |
| Register of access, correction, and complaint requests | 3 years | Request closed | section 23, section 92.2 of LPRPSP; section 2925 of the Civil Code of Québec |
| Confidentiality-incident register | 5 years | Date or period when the company became aware of the incident | section 8; Regulation respecting confidentiality incidents |
| Server logs (IP addresses, timestamps) | 6 months when there is no incident; 6 years when an incident is detected | Creation | section 23, section 92.2 of LPRPSP, section 2925 of the Civil Code of Québec |
| Usage measurement data (PostHog) | Automatic deletion of session recordings after 90 days. 7 years for site-usage events associated with random identifiers because the provider cannot delete them earlier. |
Collection | section 23 of LPRPSP; consent withdrawn or expired; provider plan limitation |
| Staff consultation log | 90 days for query content 7 years for the access list to allow auditing by police services |
Creation | sections 10 and 23 of LPRPSP |
| Unclaimed invitations (first name, last name, and email sent by the organization) | 90 days | Invitation sent | section 23 of LPRPSP |
| Encrypted backups | No more than 35 days | Backup created | Technical measure (see section 5) |
4. Holds #
Information is retained beyond the period set out in the schedule only in the following cases, each documented in the file with the reason and the new deadline:
- an access, correction, cessation of dissemination, or de-indexing request that we have not accepted: for the time required to allow the person to exhaust the remedies provided by law;
- an ongoing or reasonably anticipated dispute;
- a request from a competent authority;
- an expressly identified legal retention obligation.
An administrator records the hold in the file using an indicator respected by the purge process. It is lifted as soon as the reason disappears, and destruction is then carried out in the next purge.
These cases cannot postpone destruction beyond the seven-year cap. Any situation that could approach that cap is submitted to the Privacy Officer before the deadline.
5. Destruction methods #
- Production database. Permanent deletion of records, without mere marking, verified by a control query.
- Backup copies. Encrypted backups expire automatically no later than thirty-five (35) days after their creation. Information deleted from production therefore disappears from backups within a maximum of thirty-five (35) days. If a restoration occurs, before service is returned, the purge is run again and individual deletions recorded in the request register are reapplied under a written procedure.
- Providers. Deletion requests are sent to providers holding copies (identity verification, payment, email, and audience measurement) through the mechanisms provided in the written agreements with them.
- Paper documents. None in the normal course. If any exist, secure shredding is used.
6. Anonymization #
In Québec, section 23 of LPRPSP permits anonymization of information as an alternative to destruction, according to generally recognized best practices and criteria set by regulation. Instant Record Check does not anonymize any personal information and does not present information as anonymized unless it has been irreversibly anonymized.
7. Governance #
The Privacy Officer reviews this policy whenever there is a significant change to processing or systems.
In Québec, any change to this policy is communicated to the Commission d'accès à l'information no later than 30 days after the change.
8. Cessation of activities #
In Québec, the Commission d'accès à l'information is informed diligently if activities cease. Personal information is destroyed securely in accordance with this policy, under the Privacy Officer's supervision, unless there is a legal retention obligation. No file is sold or transferred without the consent required by law.