Privacy Policy

The short version

• Union IQ is a platform that unions and associations use to run their own operations. The organization you belong to decides what goes into it and who can see it. We process that information on the organization's instructions, as its service provider.
• Your organization's data is stored and processed in Canada. Two things pass outside Canada: email, because notifications we send you go through an email provider in the United States, and the automated check on our organization signup page, which runs on Cloudflare's network. The details are in Where your information is stored and processed.
• We do not sell personal information, we do not use it for advertising, and we do not place advertising or analytics trackers on the platform.
• We do not currently send any of your organization's data to third-party artificial intelligence or machine-learning providers.
• Questions and requests go to privacy@union-iq.com.

Who we are and the role we play

Union IQ ("Union IQ", "we", "us") is operated from Alberta, Canada. This policy covers the Union IQ platform at union-iq.com and its subdomains, the public website, the waitlist, creating an organization (by invitation or through the signup page), and the demo environment (together, the "Services").

Two roles apply, and it matters which one you are dealing with:

• For an organization's workspace, the organization is responsible for the personal information it and its users put into Union IQ: for having the right to collect it, for the consents and notices it requires, and for who it gives access to. We collect, use, store and disclose that information only to provide the Services to the organization and as its administrators instruct. If you are a staff member or member of an organization that uses Union IQ, that organization's own privacy policy governs how it uses your information, and requests about your information should go to it first.
• For the public website, the waitlist, creating an organization and the demo, we are responsible for the information we collect, and this policy is the complete description of how we handle it.

What we collect

Information your organization or you provide

• Account and profile information. Name, work email address, role, department, position, job title, manager, phone numbers, profile photo, and any additional profile fields your organization has enabled. When your organization signs you in with Microsoft Entra ID (single sign-on), we receive the identity attributes your organization's directory releases, such as your name, email address, job title, department and manager.
• Content of the modules your organization uses. For example, expense claims and receipts, collective agreements and the notes and bookmarks you make in them, documents, calendar events, poll and survey responses, data files an administrator uploads for reporting, and the settings, roles and navigation an administrator configures. What is collected depends entirely on which modules your organization has turned on and how it uses them.
• Support requests and feedback you send through the help menu, including any text you write and the page you sent it from.
• Waitlist requests from the public website: your name, email address and organization, the IP address and browser identification (user agent) of the request, and any notes we add while following up with you.
• Creating an organization. When you create an organization, by invitation or through the signup page, we collect your email address, your name, and the organization's name and short name. When you accept the Terms of Service for your organization, we record your email address, the version of the Terms, the time, and the IP address and browser identification (user agent) of the request, as the record of that agreement. A signup request also records the IP address and browser identification of the request that sent it.
• Name checks. Some organization names, such as those of established unions, must be confirmed before an organization can use them. When one is, we record the name, the email domain of the person who asked for it, and how it was confirmed (their email domain, a DNS record they added to it, or a review by our team).

Information collected automatically

• Audit and access logs. To protect the platform and give your organization an accountable record, we log sign-ins and sign-outs, failed sign-in attempts, what was viewed or changed and by whom, and administrative actions. These records include the IP address and browser identification (user agent) of the request.
• Technical and usage information needed to serve a request: your browser type, device type, and the pages and features you use. We do not use third-party analytics services to profile visitors.
• Notification delivery records, such as whether an email notification was sent, delivered, or bounced.
• The automated check on the signup page. The organization signup page uses Cloudflare Turnstile to tell people apart from automated abuse. It runs only on that page. Your browser loads the check from Cloudflare, which receives your IP address, your browser identification (user agent), technical characteristics of your connection, and which website the check is on; when you send the form, we send Cloudflare the check's result and your IP address to confirm it. Cloudflare uses this to detect bots for us, and also, as the party responsible for it, to improve its bot detection, as its Turnstile privacy addendum describes. It does not use it to identify, profile or target you.

Cookies and local storage

Union IQ uses only the cookies it needs to work. None are advertising or third-party tracking cookies.

You can clear cookies and local storage in your browser at any time. Doing so signs you out and removes offline copies.

How we use information

We use personal information to:

• provide, operate, secure and support the Services for your organization;
• authenticate you and enforce the permissions your organization's administrators have set;
• send notifications you or your organization have asked for, such as expense approvals, support replies, survey invitations and reminders, together with the email digest and quiet-hours preferences you set;
• keep the audit records described above;
• respond to support requests and waitlist enquiries;
• prevent abuse of organization signup: we use the IP address of a signup request, and the email address and its domain, to limit how many organizations can be created in a day, and to recognize an address that already has an account however it is written;
• improve the platform, using aggregated or de-identified information wherever that is sufficient;
• meet our legal obligations.

We do not sell personal information. We do not use it for advertising. We do not use your organization's data to train artificial-intelligence models, and we do not currently send it to any third-party AI or machine-learning provider. If a future feature needs to, we will describe it here and in that feature's settings before it can be enabled for an organization, and it will be the organization's choice.

Where your information is stored and processed

We are specific about this because it is the question organizations most often need answered, and because Canadian privacy law expects organizations to know where their service providers keep personal information.

In plain terms: your organization's information is stored in Canada, and the servers that read and write it when you use the platform are in Canada too. Three things happen outside: the connection from your browser is terminated at the edge location nearest to you, which is where you are; email we send you passes through a provider in the United States; and if you use the organization signup page, its automated check runs on Cloudflare's network, which may process it outside Canada. Information in transit between all of these locations is encrypted.

Because email is delivered from outside Canada, the content of a notification email may be subject to the laws of the country it passes through, including lawful access by authorities there. Notification emails carry only what is needed to tell you something happened; the records themselves stay in Canada. We choose providers that publish their security practices and whose terms commit them to protect the information they handle for us.

What this means under Canadian privacy law. Canada's federal law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and the substantially similar provincial laws in Alberta, British Columbia and Québec allow personal information to be processed by a service provider outside Canada, provided the organization remains accountable for it and uses contractual and other means to protect it. Some provinces add a duty to tell people about it. In particular:

• Alberta's Personal Information Protection Act requires an organization that uses a service provider outside Canada to tell individuals how to obtain information about the organization's policies and practices for that service provider. This policy is written so an organization can point to it for that purpose. Alberta's Act applies to trade unions expressly.
• Québec's private-sector privacy law (as amended by Law 25) requires an organization to assess the privacy impact before communicating personal information outside Québec. The stored data and the request processing described above are both in Québec; email delivery, and the automated check on the organization signup page, are outside it. We will provide the information an organization needs to complete that assessment.

Union IQ currently serves organizations in Canada. If we begin serving organizations in other countries, we will update this section to describe any change in where information is stored and the laws that apply.

Who can see your information

Within your organization

Your organization's administrators control who can see what, through roles and permissions. Colleagues see your information only to the extent those permissions allow (for example, an approver sees the expense claims routed to them). Your organization's administrators can see the audit log for their own workspace.

Service providers

We share information with the providers in the table above only so they can perform their part of the Services for us. We do not permit them to use it for their own purposes, with one exception: Cloudflare also uses the signals from the signup page's check to improve its bot detection, as described below. In addition:

We will update this list when a provider is added or replaced. Organizations with a current agreement receive notice of material changes.

Microsoft 365

If your organization signs in with Microsoft Entra ID, Microsoft acts as the identity provider under your organization's own Microsoft agreement. If your organization also connects Microsoft 365 features, Union IQ reads (and, where the feature calls for it, writes) the corresponding information through Microsoft's Graph API on behalf of each user who connects: for example calendar events, tasks, and file listings from OneDrive. Union IQ keeps a cache of that information so pages load quickly and so the platform can send reminders.

Each feature is a separate permission that your organization grants and can turn off on its own. When a permission is turned off, the information Union IQ cached for that feature is deleted. Your organization's Microsoft 365 data otherwise stays in Microsoft's service under Microsoft's terms and privacy statement.

Platform operator access

Union IQ's platform operators can open an organization's workspace to investigate a problem or provide support. Every such session is recorded in the audit log with a start and end, and is used only for support and operations.

Sharing your organization chooses to do

Some features let an authorized user create a link that shows information to people outside the platform, for example a read-only analytics view or an agreement excerpt. Those links exist only when someone in your organization creates them, and your organization can set an expiry, require a passcode, and revoke them.

Legal requirements

We may disclose personal information where the law requires it, for example in response to a court order or a lawful demand from a public authority with jurisdiction. Where we are permitted to, we will tell the affected organization before we respond.

Business changes

If Union IQ is acquired or merges with another organization, personal information may be transferred as part of that transaction, subject to this policy. Organizations with a current agreement will be notified.

How we protect information

• Isolation between organizations. Every organization's data is separated by row-level security in the database, enforced by the database itself and not only by application code.
• Encryption. Connections use TLS. Stored data and files are encrypted at rest by our hosting providers. Credentials for connected services are stored in an encrypted vault.
• Authentication. Passwords are stored only as salted hashes, never in a readable form. Organizations can use single sign-on with their own identity provider. Sessions time out after inactivity, on a schedule the organization sets.
• Least privilege. Access inside the platform is governed by roles and permissions that an organization's administrators control. Access by Union IQ's operators is limited and audited.
• Audit trail. Sign-ins, access to records and changes to them are logged and available to the organization's administrators.
• Application security. Standard browser protections are enforced, including a content security policy, strict transport security and protection against clickjacking.

No system is perfectly secure. If we learn of a breach of security safeguards involving an organization's personal information, we will notify that organization without undue delay after we confirm it, with the information we have that the organization needs to meet its own reporting obligations. Deciding whether a breach creates a real risk of significant harm, and reporting it to the Office of the Privacy Commissioner of Canada or a provincial commissioner and to affected individuals, is the organization's responsibility as the party accountable for the information.

How long we keep information

• While your organization uses the Services, information is kept for as long as it is needed for the purpose it was collected. Several modules have retention settings that the organization's administrators control, such as how long deleted expense claims can be restored before they are purged, how long removed agreements are kept, and how long audit records and notifications are retained.
• When your organization stops using the Services, we will, on written request, provide an export of its data in standard formats and delete the organization's data within a reasonable period afterwards, except where we are required by law to keep it or where it remains in routine backups for a limited time.
• Waitlist information is kept until you ask us to remove it or until it is no longer needed to follow up with you.
• Organization signup. A signup request that is never confirmed is deleted by the daily cleanup once it is 48 hours old, so within three days. A confirmed request is deleted the same way 45 days after it created the organization. An organization created by invitation or through the signup page that never finishes setup is normally closed after about 30 days, after notice by email, and removed with its data about two weeks later (one we cannot reach, or one waiting on a name check, can take longer). The record that someone accepted the Terms for an organization is kept after the organization is removed, as the record of that agreement.
• Demo environment. The demo is reset to its starting state on a schedule, and demo accounts are cleaned when a visit ends. Do not put real personal information into the demo.

Your rights and choices

Under PIPEDA and the provincial laws that apply to your organization, you have the right to ask what personal information an organization holds about you, to have it corrected if it is inaccurate, and to withdraw consent to its use subject to legal or contractual restrictions. Québec residents also have a right to receive computerized personal information they provided in a structured, commonly used format.

• If you use Union IQ through your organization, please direct requests to your organization. Its administrators can view, correct and export your information, and can delete your account. We will support your organization in responding. If you are not able to reach your organization, contact us and we will help route the request.
• If you contacted us through the website or the waitlist, contact us directly and we will respond within 30 days, which is the period Canadian privacy law generally allows.
• Notifications. You can change which notifications you receive, and whether they arrive by email immediately or in a daily digest, in your notification preferences. Email notifications carry an unsubscribe link. Messages that are necessary to operate your account or that your organization has marked as required may continue.
• Complaints. If you believe we have not handled your information properly, contact us first at privacy@union-iq.com. You also have the right to complain to the privacy regulator with jurisdiction: the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, the Office of the Information and Privacy Commissioner for British Columbia, or the Commission d'accès à l'information du Québec.

Children

The Services are for organizations and their adult staff and members. We do not knowingly collect personal information from anyone under 14 years of age. If you believe a child has provided us information, contact us and we will delete it.

Electronic messages

Emails that Union IQ sends about your account and your organization's activity are transactional: they are part of operating the Services you or your organization have asked for. If we send commercial electronic messages, for example about new modules, we will do so only with consent that meets Canada's anti-spam legislation, and every such message will identify us and carry a working unsubscribe mechanism.

The laws this policy is written to

Union IQ is designed to help organizations meet their obligations under:

• the Personal Information Protection and Electronic Documents Act (Canada);
• the Personal Information Protection Act (Alberta);
• the Personal Information Protection Act (British Columbia);
• the Act respecting the protection of personal information in the private sector (Québec), as modernized by Law 25;
• Canada's Anti-Spam Legislation (CASL).

Where an organization is subject to a different law, we will work with it to understand what that requires of the Services.

Changes to this policy

When we change this policy, we will update the date at the top of the page. For changes that materially reduce your rights or expand how we use information, we will give organizations with a current agreement advance written notice before the change takes effect.

Contact

Email privacy@union-iq.com. Union IQ is operated from Alberta, Canada, and this address reaches the person responsible for privacy at Union IQ.