Privacy Policy

This Privacy Policy explains how Commute Union (“Commute Union,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information when you visit our website or communicate with us.

1. Scope and applicable law

This policy applies only to personal information under our control in connection with the Commute Union public website and related inquiries. It does not govern the Commute Union mobile application. The mobile application will have a separate privacy policy before it collects personal information or becomes publicly available. We handle personal information covered by this policy in accordance with the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and other applicable Canadian laws.

“Personal information” means information about an identifiable individual. It does not generally include business contact information used solely to communicate with someone about their employment, business, or profession.

2. Personal information we collect

We limit collection through this website to:

• Information you provide: your name, email address, and the contents of inquiries, feedback, or other communications you send to us.
• Technical and usage information: IP address, browser and device type, operating system, referring page, pages accessed, access times, and similar server-log information that may be received automatically by us or our hosting provider.

The website does not collect app account information, commute routes, precise location data, chat messages, payment information, or contact lists. We do not use website information for profiling or automated decision-making.

Please do not send sensitive information through the website contact form or by email unless we specifically request it and provide an appropriate way to transmit it.

3. Why we collect and use personal information

We collect and use personal information only for purposes that a reasonable person would consider appropriate, including to:

• respond to inquiries, feedback, and requests;
• operate, maintain, troubleshoot, and secure the website;
• prevent fraud, misuse, security incidents, and other harmful activity;
• establish, exercise, or defend legal rights; and
• comply with applicable legal and regulatory obligations.

If we want to use personal information for a new purpose that is not reasonably connected to a purpose described above, we will identify that purpose and obtain consent where required.

We do not currently use personal information to send promotional or marketing emails. Before sending commercial electronic messages, we will obtain any consent required by Canada's anti-spam legislation and provide an unsubscribe mechanism.

4. Consent and your choices

We obtain consent before or at the time we collect, use, or disclose personal information, except where permitted or required by law. The form of consent will depend on the sensitivity of the information and the reasonable expectations of the individual. Providing information through our contact channels constitutes consent for us to use that information to review and respond to the communication.

You may decline to provide optional information. You may also withdraw consent to future use or disclosure, subject to legal restrictions and reasonable notice. Withdrawal will not affect processing that already occurred lawfully, and it may limit our ability to respond to your inquiry.

5. Cookies and third-party resources

Our website does not currently use advertising cookies or behavioural advertising tools. It loads fonts from Google Fonts, which may cause your browser to send technical information, including your IP address, to Google. Our hosting provider may also use essential technologies or server logs to deliver and secure the website.

If we introduce analytics, advertising, or other non-essential tracking technologies, we will update this policy and provide any notice or consent mechanism required by applicable law.

6. When we disclose personal information

We do not sell or rent personal information. We may disclose personal information:

• to service providers that support website hosting, security, email, communications, and related operations, under appropriate contractual or other safeguards;
• with your consent or at your direction;
• to comply with a subpoena, warrant, court order, or other lawful requirement;
• when permitted by law to investigate fraud, security threats, unlawful activity, or violations of our rights; or
• in connection with a proposed or completed business transaction, subject to applicable legal safeguards.

7. Processing outside Canada

Some service providers may process or store personal information outside Ontario or Canada. When information is processed in another jurisdiction, it may be accessible to courts, law-enforcement agencies, or regulators under that jurisdiction’s laws. We remain accountable for personal information transferred to service providers for processing and use contractual or other measures appropriate to the circumstances.

8. Retention and disposal

We generally delete contact inquiries and associated personal information within 12 months after the inquiry is resolved, unless a longer period is reasonably necessary for an ongoing matter or required by law. Copies may remain temporarily in routine backups until those backups are overwritten through their normal cycle. Technical logs are retained according to our hosting provider's applicable retention settings. When information is no longer required, we securely delete, destroy, or anonymize it.

9. Safeguards and privacy breaches

We use administrative, technical, and physical safeguards appropriate to the sensitivity and amount of personal information under our control. These measures are intended to protect against loss, theft, unauthorized access, disclosure, copying, use, or modification. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

We assess suspected privacy breaches and, where required by PIPEDA, report breaches that create a real risk of significant harm to the Office of the Privacy Commissioner of Canada, notify affected individuals, and maintain required breach records.

10. Access and correction

You may request access to personal information we hold about you and ask how it has been used or disclosed. You may also request correction of information that is inaccurate or incomplete.

Send a written request using the contact information below. We may need to verify your identity before responding. We will normally respond within 30 days, subject to any extension or exception permitted by law. If we cannot provide access, we will explain the reason, subject to legal restrictions.

11. Age Requirements

Our website and services are designed for individuals who are at least 18 years old. We do not intentionally collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can promptly delete it.

12. Questions and complaints

Questions, access or correction requests, withdrawals of consent, and privacy complaints may be sent to:

Commute Union
15 Vicora Linkway
Toronto, Ontario M3C 1A7
Canada
hello@commuteunion.com

We will investigate complaints and explain the outcome and any steps taken.

13. Changes to this policy

We may update this policy as our practices or legal obligations change. We will post the revised policy on this page and update the “Last updated” date. If a change materially affects how we handle information already collected, we will provide additional notice or obtain consent where required.