Privacy & Schools

A designated Privacy Officer (Andrew Kiedyk, admin@elevation650.com) is accountable for compliance. Our privacy policies, including our use of service providers outside Canada, are published and available to anyone on request.

Public customers consent at booking, purchase, or account creation, and we state the purposes of collection at that point. School-seat student information is collected under the authority of the contracting school board (see POPA row below).

We disclose every provider and its country (see table below), and name a contact who can answer questions about foreign handling of personal information: admin@elevation650.com.

All traffic encrypted in transit (TLS). Passwords stored as salted bcrypt hashes only. Role-based access (admin / teacher / student). Administrative actions on sensitive data are audit-logged. Database is access-controlled and not publicly reachable.

Documented incident response: contain, assess for real risk of significant harm, notify the OIPC without unreasonable delay where required, notify affected individuals, and notify any affected school board — target within 72 hours of discovery.

Published retention schedule: learning data deleted within 60 days of a verified request or contract end; bookings/messages up to 2 years; waivers kept for legal limitation periods; financial records 7 years (CRA).

Individuals may request a copy of their personal information or corrections by emailing admin@elevation650.com. We respond within 45 days as the Act requires.

For school boards we operate as a service provider: student data is used only to deliver the purchased training — never for advertising, profiling, resale, or AI training. We sign board data-sharing / service agreements, notify boards of privacy incidents within 72 hours, limit access to authorized staff, use no subcontractors beyond the disclosed providers below, and return or securely destroy student data at contract end or on request. We support board Privacy Impact Assessments with our downloadable privacy package.

Alberta's PIPA is declared substantially similar to PIPEDA, so PIPA governs our handling of personal information within Alberta. PIPEDA continues to apply when personal information crosses provincial or national borders — e.g., our disclosed U.S. service providers below. Those flows carry the same safeguards, contractual limits, and disclosure (PIPA s. 13.1; PIPEDA accountability and safeguards principles).

Promotional texts (e.g., discount codes) are sent only to existing customers or people who requested them, with consent recorded at the time of sending. Every message identifies us and supports STOP to opt out. Transactional messages (bookings, receipts, course access) are sent as part of the service.