Privacy Policy - Instant Record Check

This English version follows the French text filed with Québec's Commission d'accès à l'information. Where a rule applies only in Québec, this version says so. In Québec, the French text governs.

Effective date: [DATE]

Last updated: October 21, 2026

1. Who we are #

Instant Record Check is the name under which 1244527 B.C. Ltd. operates an online name-based criminal record check service. The check is performed by partner municipal police services in Canada, using the Canadian Police Information Centre (CPIC).

2. Privacy officer #

The Chief Executive Officer of Instant Record Check, the company's highest authority, acts as the privacy officer. You can reach the officer:

• by email: confidentialite@instantrecordcheck.ca
• by mail: Instant Record Check, to the attention of the privacy officer, 2031 Store St., Unit 11, Victoria, British Columbia V8T 5L9

3. Who this policy applies to #

This policy applies to:

• people who order a criminal record check concerning themselves (individuals stream);
• people who consent to a check requested by an organization, such as an employer or volunteer organization (organizations stream);
• people who visit our website;
• people who contact us by email or telephone;
• people acting as representatives of a client organization, for their business contact information.

It does not apply to information that partner police services hold for their own purposes. That information is subject to the laws that apply to those police services.

4. When we collect your information #

We collect your information in the following ways:

• during your written or oral interactions with us;
• when you complete forms;
• when you visit our website;
• from third parties, with your consent or when the law authorizes us to do so.

We do not collect the same information in every situation. For each situation, the following explains what we collect, from whom, why, by what means, and what you may refuse.

4.1 You visit our website

• Information: IP address, connection date and time, pages viewed, browser and device type, device and session identifiers, and the province inferred by our own servers from your IP address.

4.2 You order a check concerning yourself (individuals stream)

• Information collected from you: first and last name, other names used where applicable, date and place of birth, sex, current and previous addresses, email address, telephone number, and type and date of previous convictions.

4.3 An organization requests a check concerning you (organizations stream)

In this situation, we collect your information on behalf of the organization that requested the check. The organization sends us your first name, last name, and email address so that we can invite you. The name of that organization is shown on the first page after you log in, together with the request for consent to disclose the result. If you refuse, we do not disclose any result to the organization, it is refunded, and we do not tell it why, because several reasons may explain why an invitation is not completed. You may then continue the order at your own expense for your own use. If you accept, the organization may view the result in its account.

• Information: the same information collected in the individuals stream, the name of the requesting organization, and the first name, last name, and email address that it sends us.

4.4 We verify your identity

In Québec, we verify your identity, with your consent collected when you place the order, using questions generated by TransUnion from information it holds about you. Elsewhere in Canada, we may verify your identity using a government-issued identity document and a selfie through Stripe Identity, or using questions generated by TransUnion from information it holds about you.

• Information collected from TransUnion: the questions asked, your answers, and the verification result (pass or fail).
• Biometrics: Elsewhere in Canada, we may use a government-issued identity document and a selfie through Stripe Identity to verify your identity. We do not collect biometric characteristics from people located in Québec.

You pay for your order

• Payment: processed by Stripe. Your card data is sent directly to Stripe. We do not receive or retain it.
• Information: the amount, date, and status of the transaction and a transaction identifier.

We receive and transmit the report

The result is determined by an agent of the partner police service from CPIC and entered in our portal. Our system produces the document from that entry, and we do not modify the result.

Information: the outcome of the check (no record found, declared record confirmed, or check incomplete), the date on which the check was completed, and the document serial number.

4.7 You contact us

• Information: the content of your message, your contact details, and, where applicable, the relevant order number.

5. Why we process your information #

We collect and process your personal information only for the following purposes:

• verify your identity before processing your order;
• send your request to the partner police service and obtain the check result;
• send the result to you or, with your express consent, send it to the requesting organization;
• allow partner police services to audit completed checks and authenticate issued documents;
• collect payment and produce required accounting records;
• answer your questions and handle your access, correction, and complaint requests;
• operate and secure our website and prevent fraud;
• measure use of our website and improve our services: for visitors located in Québec and visitors whose location cannot be determined, only if they accept the consent banner; for visitors elsewhere in Canada, analytics load as described in section 14, and this policy is the notice of that use;
• measure the effectiveness of our advertisements. After a paid order that came from an ad click, our server reports the sale to the ad platform with the ad click identifier, the order number, and the amount; this happens for every such order and does not depend on the consent banner. Hashed email, name, address, and phone fields are sent to Google only after a Québec visitor accepts the banner; they are never sent for visitors outside Québec;
• comply with obligations imposed on us by law.

We do not use your information for other purposes without your consent, except where permitted by law.

6. Your consent #

When we collect, use, and disclose your personal information, we always do so for specific purposes. Your consent is valid for the time needed to achieve those purposes. We may then retain your personal information for the time needed to meet our retention obligations described in the law and in our retention schedule. We always respect the purposes for which we collected your personal information. If we want to use or disclose your personal information for other purposes, we will ask for your consent, except where permitted by law.

Consent requested separately

A criminal record check result is sensitive information. Your consent to its disclosure is therefore requested expressly and separately from the rest of the form, using a box that is not checked in advance.

Withdrawing your consent

You may withdraw your consent at any time by writing to our privacy officer (see section 2). Withdrawal does not affect disclosures already made or processing already completed. If you withdraw your consent before the result is disclosed to the organization, we do not disclose it to the organization. If disclosure has already occurred, withdrawal applies going forward: we no longer disclose anything, but anything already sent must be addressed through a request to the organization. If withdrawing your consent prevents us from providing the service, we will tell you.

7. Who has access to your information within our organization #

Only staff members who need to process your personal information to perform their duties may access it. They have access only to the information necessary to perform their tasks.

We have established staff roles and responsibilities throughout the processing lifecycle, from collection to destruction. These roles and responsibilities are described in our Access Governance Policy.

8. To whom we disclose your information #

We may disclose information when the law provides for or requires it. Each provider acting on our behalf is bound by a written contract setting out the applicable protection measures.

9. Disclosure outside Québec #

Your personal information may be disclosed outside Québec in the following cases:

• our operations are located in British Columbia (Canada);
• police services are located throughout Canada;
• Stripe processes payments in the United States;
• PostHog processes browsing data in the European Union;
• Klaviyo (order-related emails), Intercom (support), Sentry (error tracking), Netlify (site delivery), and Google and Microsoft (advertising conversion measurement) process information in the United States. After a paid order that came from an ad click, our server reports the sale to the ad platform with the ad click identifier, the order number, and the amount; this happens for every such order and does not depend on the consent banner. Hashed email, name, address, and phone fields are sent to Google only after a Québec visitor accepts the banner; they are never sent for visitors outside Québec.

10. How long we retain your information #

We retain your information for the time needed to achieve the purposes for which it was collected. When those purposes have been achieved, we destroy or anonymize it, unless a law requires us to retain it longer.

As part of our activities as an agent of personal information, we do not retain personal information about you for more than seven years after collecting it. The law requires us to destroy it at that point. This limit is a maximum: information that is not part of the check file (correspondence, browsing data, and so on) is destroyed sooner. The check file (information provided, result, identity-verification information, and proof of consent) is retained for seven years from collection, to allow checks required by partner police services and authentication of issued documents.

Once the retention limit is reached, our destruction policy describes the methods we use to destroy information securely.

11. How we ensure information is accurate #

We apply operating procedures designed to ensure that the information we disclose is current and accurate when disclosed, and that the disclosure complies with the law.

• The result is determined by the partner police service from CPIC. We do not modify it.
• Any inaccuracy reported to us is corrected without delay. When the inaccurate information has already been disclosed, we notify the recipient.
• If the inaccuracy concerns the content of the criminal record itself, the correction must be requested from the police service or the Royal Canadian Mounted Police. We tell you what steps to take.

12. How we protect your information #

Physical measures

Locked premises, alarm, video surveillance, and controlled access to facilities.

Technological measures

Encrypted communications (TLS); encrypted backups (AES-256) locked against modification or deletion until they expire; server access by cryptographic key only; multifactor authentication on our providers' administrator accounts; individual identifiers; and system updates to address known vulnerabilities.

Organizational measures

Access limited according to job functions, an information-security policy, staff training and awareness, confidentiality commitments signed by staff, and written contracts with providers setting out the applicable protection measures.

13. Privacy incidents #

We maintain a privacy-incident register. When an incident presents a risk that you will suffer serious harm, we notify the competent authorities and notify you diligently, as the law requires. In all cases, we take reasonable measures to reduce the risks and prevent a similar incident from happening again.

14. Cookies and logs #

What a cookie is

A cookie is a small file placed on your device when you visit a website. It allows the website to function properly and, in some cases, to measure how it is used.

Cookies necessary for the website to operate

These cookies are essential to the website's operation and security (session, fraud protection, and remembering your language). They are set everywhere without your consent because the website cannot function without them. Our payment provider (Stripe) and our error-monitoring tool (Sentry, which does not use a cookie) operate as necessary functions. Our own servers infer your province from your IP address to adapt our messages and determine whether the consent banner should be shown.

Audience-measurement and behaviour-analysis cookies

This technology includes functions that can identify you, locate you, or perform profiling, meaning evaluate certain characteristics, including your preferences, interests, or behaviour.

For visitors located in Québec and visitors whose location cannot be determined, these functions are disabled by default and may be activated using the consent banner shown on the first visit. Visitors elsewhere in Canada do not see a banner: analytics, support chat, advertising, and email tags load on those visits, and this policy is the notice of that use.

Refusing these cookies does not prevent you from using the website or ordering a check.

15. Automated decisions #

Identity verification is based on automated processing of your answers to authentication questions. If this processing alone leads to your order being refused, we inform you no later than when we communicate that refusal.

You have the right to have this information corrected.

You may present your observations to a staff member able to review this decision by writing to our privacy officer (section 2).

16. Your rights and how to exercise them #

You have the right to:

• access, consult, and obtain a copy of the personal information we hold about you;
• have inaccurate, incomplete, or ambiguous information corrected, and have information collected without authorization deleted;
• receive, in a structured and commonly used technological format, computerized information you provided to us;
• withdraw your consent;
• request, in cases provided by law, that dissemination of information about you stop or that any hyperlink providing access to it be de-indexed;
• file a complaint.

How to make your request

Send your request in writing to the privacy officer (section 2), by email or by mail.

We must ensure that the request truly comes from you and may ask you for identification, from which you may mask information that is not necessary for verification. The copy is destroyed as soon as verification is complete.

Time and fees

We respond in writing within 30 days after receiving your request. Access to your information is free. Reasonable fees may be charged for transcribing, reproducing, or transmitting information. We tell you the approximate amount before doing so.

If we refuse your request

We give reasons for any refusal, identify the legal provision on which it is based, and state the remedies available to you and the time limit for exercising them. If you ask, we assist you in understanding the refusal.

If you are a person with a disability

On request, we take the reasonable accommodation measures needed to allow you to exercise your access right.

Recourse to a privacy regulator

If you are in Québec and disagree with our response, want to complain about our personal-information practices, or we have not responded within 30 days, you may submit an application for review of a disagreement to the Commission d'accès à l'information du Québec. The application must be submitted within 30 days after the refusal or expiry of the response period. If you are elsewhere in Canada, you may file a complaint with the Office of the Privacy Commissioner of Canada.

Commission d'accès à l'information du Québec: cai.gouv.qc.ca, 1 888 528-7741.

17. Changes to this policy #

We may change this policy. Each change is the subject of a notice published in the same section of our website and sent by any means suitable to reach you. The notice states the publication date, the subject of the changes, and their effective date.

18. Contact us #

For any question about this policy or the protection of your personal information:

• Instant Record Check, to the attention of the privacy officer
• 2031 Store St., Unit 11, Victoria, British Columbia V8T 5L9
• confidentialite@instantrecordcheck.ca