TokenNo Privacy Policy (Canada)Draft

DRAFT — this document is waiting for review by qualified legal counsel in Canada. It is not yet in force and must not be relied on.

Version
0.1-draft
Last updated
Effective date
Not set yet

DRAFT. NOT YET IN FORCE. This Privacy Policy is a draft. Qualified legal counsel in Canada has not yet reviewed it, and it is not in force. It is not legal advice. Text in [square brackets] is a placeholder or a point still open for counsel. The final version will replace this draft before any customer or business uses TokenNo in Canada.

1. Who we are and what this policy covers

TokenNo ("TokenNo", "we", "us") is a queue and token platform. In Canada it is provided by [TokenNo North America entity legal name], [registered address] (contact: info@tokenno.com). This entity is the organisation accountable for your personal information under PIPEDA and provincial privacy laws, and the merchant of record for advance payments. It includes:

  • the TokenNo customer app, which you use to book and track tokens;
  • the TokenNo Business app for businesses, including the web front desk and the TV "Now Serving" board;
  • the TokenNo admin console, which our own staff use;
  • our public website at tokenno.com; and
  • the TokenNo Integration API, which lets businesses connect their own systems.

This policy explains what personal information we collect in Canada, why we collect it, who we share it with, where it is stored, how long we keep it, and the choices and rights you have. It applies to customers (people who book tokens, including hosts and their guests) and to people who work for businesses that use TokenNo ("vendors"), such as owners, receptionists and doctors.

Vendors include clinics, hospitals, restaurants, salons, offices and event organisers. Each vendor decides what services it offers and how it runs its own queue, and has its own privacy obligations and practices. TokenNo provides the platform. Once a vendor moves information out of TokenNo, for example into its own clinic software or point-of-sale system through the Integration API, the vendor is responsible for it, and the vendor's privacy policy applies (see section 7). How responsibilities are split between TokenNo and vendors is set out in the Vendor Data Processing Addendum that vendors accept (Terms of Service, section 27).

Group companies. Staff of other TokenNo group companies, including [TokenNo India entity legal name] in India, may access personal information to operate, support and secure the service, under intra-group agreements and the safeguards in section 10 [counsel to confirm the group structure and which group companies have access, and where].

2. The laws we follow

We handle personal information in line with the Canadian privacy laws that apply to us:

  • the Personal Information Protection and Electronic Documents Act (PIPEDA), including the ten fair information principles set out in its Schedule 1 (see section 3);
  • in Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25 (An Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25);
  • in Alberta, the Personal Information Protection Act (Alberta PIPA);
  • in British Columbia, the Personal Information Protection Act (BC PIPA); and
  • Canada's Anti-Spam Legislation (CASL) for commercial electronic messages (see section 6).

[Counsel to confirm: which of these laws applies to which activity. In particular, whether PIPEDA or the Alberta or BC PIPA governs information collected within those provinces, how Quebec's private sector act applies to an operator based outside Quebec, and whether any provincial health information law (for example Ontario's Personal Health Information Protection Act) applies when TokenNo is used by clinics or hospitals (see section 4).]

3. Our commitments under PIPEDA's fair information principles

In plain language, this is how we apply the ten principles:

  1. Accountability. We are responsible for personal information under our control, including information we pass to our service providers. We have named a Privacy Officer (section 15).
  2. Identifying purposes. We tell you why we collect information (section 6) at or before the time we collect it.
  3. Consent. We collect, use and disclose personal information with your knowledge and consent, except where the law allows otherwise. We ask for express consent for anything sensitive, such as live location.
  4. Limiting collection. We collect only what we need. In Phase 1 that is mainly your name and mobile number (section 4).
  5. Limiting use, disclosure and retention. We use and share information only for the purposes we identified, unless you agree or the law requires otherwise, and we keep it only as long as needed (section 11).
  6. Accuracy. We keep information as accurate and up to date as needed for its purpose. You can update your details in the app.
  7. Safeguards. We protect information with security measures suited to its sensitivity (section 10).
  8. Openness. We publish this policy and answer questions about our practices.
  9. Individual access. You can ask to see the personal information we hold about you and ask us to correct it (section 13).
  10. Challenging compliance. You can complain to our Privacy Officer, and to a privacy regulator (section 14).

4. What we do NOT collect

We have deliberately kept the information we collect to a minimum in this first phase of TokenNo ("Phase 1").

  • No medical records or health details. Even when you book with a clinic, hospital or doctor, we collect only your name and mobile number together with the booking itself. We do not ask for symptoms, diagnoses, health card numbers, insurance details or any other health information. Please do not type health information into any free-text field.
  • No card or bank account numbers. Our payment gateway handles card and bank details. TokenNo never receives or stores your full card number or security code.
  • No background location. We never track your location in the background, or at any time when you have not turned sharing on for an active token. Location sharing is off by default.
  • No Social Insurance Numbers from customers.

Even without health details, the fact that you booked a token with a clinic could show that you sought health care. We treat booking history with health care vendors as sensitive. We disclose it only to you, your guests, the vendor, and the service providers and vendor systems described in section 7 that need it to deliver the service. [Product to consider keeping room or specialty names out of SMS and WhatsApp text for health care vendors.] [Counsel to confirm: whether a clinic booking (name, mobile number and the clinic or doctor) is "personal health information" under a provincial health information law such as Ontario's Personal Health Information Protection Act or Alberta's Health Information Act when a health care vendor uses TokenNo, and if so, TokenNo's role (for example as an agent or electronic service provider of the clinic) and any resulting obligations.]

5. Information we collect

5.1 Information you give us

  • Account information: your mobile number, which is your TokenNo identity (you sign in with a one-time code sent by SMS), your name and your language preference. One mobile number is one identity across TokenNo. The same number can be used both as a customer and as vendor staff.
  • Bookings and tokens: the vendor, location, service point (for example a doctor or a counter), session, token number, party size, booking status (booked, called, served, cancelled, no-show, renumbered) and your booking history.
  • Guest information: if you are a host and invite guests to share your token, the guests' mobile numbers that you enter. Please invite only people who know you and expect to hear about the visit (see section 6.3).
  • "Notify me" requests: the vendors or sessions for which you asked to be told when booking opens.
  • Messages to us: what you send when you contact support.

5.2 Information collected automatically

  • Live location, only when you turn it on: if you choose to share your location for an active token, we collect your device's precise location while sharing is on. We use it to show your distance and estimated arrival time (ETA) to you, your host or guests and the vendor, to send a "leave now" alert, and to mark you as "arrived" automatically when you come within about 100 m of the location (geofence arrival). Sharing stops automatically (for example when the token is served or cancelled) and you can stop it at any time. We delete location data soon after the visit (see section 11).
  • Device and app information: push notification tokens (via Firebase Cloud Messaging), device type, operating system, app version and language setting.
  • Security and usage logs: sign-in events, IP address, timestamps and actions taken in the apps and the admin console (audit logs). We use these to keep the platform secure and to resolve disputes.
  • Website cookies: our website uses cookies and similar technologies that it needs to work. [Placeholder: list any analytics cookies before launch. If analytics or advertising cookies are added, this policy and our consent approach must be reviewed, including Quebec's rules on technologies that can identify, locate or profile a person.]

5.3 Information from vendors and others

  • Bookings made for you by a vendor: a vendor may book a token for you, for example when you phone the front desk, walk in, or use its QR code or kiosk, or through its own system connected to the Integration API. The vendor then gives us your mobile number, and sometimes your name. The vendor confirms that you agreed to service messages about that visit, and our first message identifies TokenNo and the vendor and tells you how to stop messages.
  • Payment information from our payment gateway: whether the payment succeeded, the amount, a masked card reference (for example the last four digits), transaction identifiers and refund status.
  • Messaging providers: message delivery status, and replies such as STOP.

5.4 Information about vendor staff and businesses

  • staff names, mobile numbers, roles and the locations they can access;
  • business details (legal name, address, contacts, business type, locations and service points);
  • KYC (know-your-customer) documents, such as government ID of the owner or an authorised person, the CRA Business Number, bank verification (for example a void cheque or bank letter), and the results of verification checks;
  • payout and banking details, held mainly by our payment gateway; we may keep a masked reference; and
  • API keys (we store only a secure hash of each key), webhook settings and API call logs.

6. Why we use information, and your consent

We use personal information to:

  1. Provide the service: create your account, issue tokens, show the live queue, call your token, handle renumbering ("push back") and cancellations, and let hosts and guests share one token.
  2. Send service messages: booking confirmations, "your token is being called" alerts, changes (including new token numbers), cancellations (including when a vendor or a location holiday cancels a session) and "notify me when booking opens" alerts, by push notification, SMS and WhatsApp.
  3. Use your location: only while you share it for an active token, to show distance and ETA, send "leave now" alerts and mark you as arrived by geofence.
  4. Take payments and make refunds: when a vendor requires advance payment, we collect it as merchant of record, apply the vendor's refund rule and pay vendors out.
  5. Verify businesses: review vendor KYC documents before approving a vendor.
  6. Keep TokenNo safe: prevent fraud and misuse, secure accounts and keep audit logs.
  7. Translate vendor content: show business names, descriptions and room names in your chosen language. Vendor content, not your personal information, is what gets translated.
  8. Improve the service: for example, estimate service times per service point using booking timing data, in aggregated or de-identified form where possible.
  9. Comply with law: meet legal, tax, accounting and law-enforcement obligations, and enforce our Terms of Service.

Consent. We ask for consent in separate steps:

  • Necessary uses. By creating an account or booking a token, you consent to the uses in points 1, 2, 4, 5, 6, 7 and 9, because we cannot provide the service without them.
  • Service improvement (point 8) is described to you separately at sign-up, and you can object to it in Profile without affecting the service [counsel to confirm whether opt-out consent is enough, or whether de-identified data is outside consent].
  • Live location (point 3) needs your separate, express consent each time you turn sharing on, and you can withdraw it at any time by turning sharing off.
  • Bookings with health care vendors. Because a clinic booking is sensitive, we ask for your express consent, separately from other matters, when you book with a health care vendor, at least for Quebec residents [counsel to confirm whether this is needed outside Quebec, or whether a clinic booking is not "sensitive" for Quebec purposes]. You may withdraw other consents too, subject to legal or contractual limits, but if you do we may not be able to provide the service. We do not make decisions about you based only on automated processing of your personal information. [Counsel to confirm: whether learned service-time estimates or automated KYC checks could be "decisions based exclusively on automated processing" under Quebec's private sector act that require notice.]

6.1 Commercial electronic messages (CASL)

We follow Canada's Anti-Spam Legislation (CASL):

  • We send marketing or promotional messages (commercial electronic messages) by email, SMS or WhatsApp only if you have given consent that CASL recognises. Agreeing to marketing is never a condition of using TokenNo.
  • Every commercial electronic message we send identifies TokenNo, gives our contact details and includes a free, easy way to unsubscribe.
  • We act on an unsubscribe request without delay, and in any case within 10 business days.

Service messages that confirm a booking you asked for, or give you facts about a token you hold (calls, renumbering, changes, cancellations, sign-in codes and "notify me" alerts you requested), are about a transaction or service you are already using. CASL treats these differently from marketing. [Counsel to confirm: the exact CASL treatment of each type of TokenNo service message, including "notify me when booking opens" alerts and messages to guests.] We still identify TokenNo in them and give you a way to stop them.

6.2 SMS, WhatsApp and push

  • Reply STOP to any TokenNo SMS to stop receiving texts, or email info@tokenno.com.
  • If you reply STOP, texts from us stop, including sign-in codes. Reply START to receive them again, or sign in with [WhatsApp / another method]. You may still receive push notifications in the app. Without SMS you may miss "your token is being called" alerts. [Product to confirm this wording against the SMS provider's opt-out behaviour.]
  • WhatsApp messages are sent through the Meta WhatsApp Business platform and follow Meta's opt-in and opt-out rules. You can block or opt out in WhatsApp at any time.
  • You can turn off push notifications in your device settings.
  • Your mobile carrier's message and data rates may apply.

6.3 Guests' mobile numbers

When a host invites a guest, we use the guest's mobile number only to tell them about the shared token (the token number, changes, calls and cancellations). A host must invite only people who know them and expect these messages, and must have the guest's permission to share their number. A guest can reply STOP or contact us to stop messages, or ask us to delete their number. [Counsel to confirm: consent position under PIPEDA and CASL for messages to guest numbers supplied by a host.]

7. How we share information

We do not sell personal information, and we do not share it for advertising. We share it only as follows:

  • With the vendor you book with: your name, mobile number, token, party size, booking status, payment and refund status and, while you share location, your distance and ETA. The vendor uses this to serve you. Each vendor is responsible for its own use of this information. [Product to confirm that vendors never see raw coordinates; if an option to show them is added, it will be disclosed here and need your opt-in.]
  • With your host or guests: the token details and status, and, while sharing is on, the distance and ETA you chose to share.
  • With a vendor's own systems (Integration API): if a vendor connects its own systems (for example clinic software or a POS) to TokenNo, the customer's name, mobile number and booking, token and payment event data for that vendor (for example token number, status, session and payment succeeded events) are sent to those systems on the vendor's instruction. Health details are never sent. Once it arrives, the vendor is responsible for it.
  • With service providers (sub-processors) that work on our behalf under contracts that limit their use of your information and require them to protect it:
    • Amazon Web Services (AWS): hosting and storage;
    • payment gateways: Stripe in Canada; Razorpay, Tap Payments and Moyasar serve other TokenNo markets;
    • SMS and WhatsApp providers: Twilio in Canada; MSG91, Unifonic and Meta WhatsApp Business (the provider depends on the country);
    • Google Firebase Cloud Messaging: push notifications;
    • translation providers: vendor content only; and
    • maps and routing providers: we send location coordinates to them to calculate distance and ETA.

    A current list of sub-processors, and the countries where they process information, is available from info@tokenno.com [placeholder: or at a sub-processor page URL].

  • For legal reasons: where the law requires or permits it, for example to comply with a court order, warrant or other valid legal request, to protect the rights, safety and property of users, vendors, TokenNo or the public, or to enforce our terms.
  • In a business transaction: as part of a merger, acquisition, financing or sale of assets, under the conditions Canadian privacy law sets for such transactions.
  • With your consent or at your direction.

8. Where your information is stored (outside Canada)

TokenNo is hosted on AWS, and our servers are currently in the AWS Mumbai region, India. If you use TokenNo in Canada, your personal information will be transferred to, stored in and processed in India. Some of our service providers may also process it in the United States or other countries. [Placeholder: list the countries for each sub-processor.]

While your information is outside Canada, it is subject to the laws of those countries, and courts, law enforcement and national security authorities there may be able to access it.

We protect information that leaves Canada by:

  • choosing providers carefully and putting written contracts in place that require a level of protection comparable to Canadian law;
  • using the safeguards in section 10, wherever the information is processed; and
  • for information about Quebec residents, carrying out the privacy impact assessment that Quebec law requires before communicating personal information outside Quebec, taking into account the sensitivity of the information, why it is used, the protection measures and the legal framework in the destination country, and having a written agreement with the recipient.

You can ask our Privacy Officer (section 15) for more information about our service providers outside Canada and how they handle your information. This notice is also given for the purposes of Alberta PIPA's rules on service providers outside Canada. [Counsel to confirm: the content of the Quebec cross-border privacy impact assessment for hosting in India and the result, whether the Alberta PIPA service-provider notice needs more detail at the point of collection, and whether Canadian hosting should be offered for any category of data, for example health care vendors.]

9. Information about Quebec residents

If you live in Quebec, the following also applies:

  • Person in charge of the protection of personal information: [name and title], reachable at info@tokenno.com (see section 15).
  • Privacy by default. Settings that could identify, locate or profile you, such as live location sharing, are off until you turn them on.
  • Portability. You may ask for personal information you gave us in a structured, commonly used technological format, and ask us to send it to another organisation you choose, where Quebec law gives this right.
  • Stopping dissemination and de-indexing. In the cases Quebec law allows, you may ask us to stop disseminating your personal information or to de-index a link to it.
  • Minors. Personal information of a child under 14 is collected only with the consent of the person with parental authority, or a tutor (see section 12).
  • Confidentiality incidents. We keep a register of confidentiality incidents and notify the Commission d'accès à l'information and affected people of any incident that presents a risk of serious injury.
  • Language. TokenNo is not yet offered in Quebec. We will offer it to customers and businesses in Quebec only once French versions of this policy, our Terms of Service and the apps are available. [Launch decision for the founder: add ca/privacy.fr.md, ca/terms.fr.md and a French app and website UI before launching in Quebec, or keep Quebec users and vendors geo-restricted. Counsel to confirm the requirements of the Charter of the French Language, ss. 52 and 55.]

10. How we protect information

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:

  • encryption in transit, and encryption at rest where available;
  • role-based access, with audit logs of actions in the vendor apps and the admin console;
  • one-time-code sign-in;
  • API keys that are shown only once and stored only as a secure hash, with scopes, IP allowlists and revocation;
  • webhooks signed so they can be verified;
  • staff training and confidentiality obligations; and
  • data minimisation: the only personal details we ask customers for are name and mobile number; we also process the booking, device, log, payment and (optional) location data described in section 5.

No system is perfectly secure. If a breach of security safeguards involving your personal information creates a real risk of significant harm to you, we will notify you and report it to the Office of the Privacy Commissioner of Canada, as PIPEDA requires, and notify any organisation or government body that could reduce the harm. We also report to the Information and Privacy Commissioner of Alberta and the Quebec Commission d'accès à l'information where their laws require. We keep a record of every breach, as PIPEDA's breach regulations require. [Counsel to confirm: breach record retention period and whether notice to the BC regulator is required at launch.]

11. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires. When we no longer need it, we securely destroy it or anonymise it.

  • Live location: deleted within [X hours] after the token is served, cancelled or expires. Sharing stops automatically before that.
  • Account information: while your account is active, and for [X months] after you delete it or after [X months] of inactivity.
  • Bookings and token history: [X months/years], so you can see past bookings and use "Book again", and so disputes can be resolved.
  • Guest mobile numbers: [X days] after the shared booking ends, unless the guest has their own TokenNo account.
  • Payment and refund records: as long as tax and accounting law and payment-network rules require [placeholder: for example 6 years under federal tax record-keeping rules; counsel to confirm].
  • Vendor KYC documents: for the length of the vendor relationship plus [X years], or longer if the law requires it.
  • Audit and security logs: [X months/years].
  • Push tokens: until you sign out, uninstall the app or the token expires.
  • Information used to make a decision about you: kept long enough for you to have a reasonable opportunity to access it, as Canadian privacy law requires, and while any access request or complaint is open.

12. Children

TokenNo is meant for adults. You must be at least the age of majority in your province or territory (18 or 19, depending on where you live) to create a TokenNo account. [Counsel to confirm the minimum age.] We do not knowingly collect personal information from children through their own accounts. A parent or guardian may book a token for a visit that includes a child, using the parent's own account, and should not enter the child's details.

In Quebec, we do not collect personal information about a child under 14 without the consent of the person with parental authority or a tutor. If you believe a child has given us personal information, contact info@tokenno.com and we will delete it.

13. Your privacy rights

Subject to limited exceptions in the law, you have the right to:

  • Access: ask whether we hold personal information about you, see it, and learn how it has been used and to whom it has been disclosed;
  • Correction: ask us to correct information that is inaccurate or incomplete. Where it is appropriate, we will tell others who received the information about the correction;
  • Withdraw consent: withdraw consent at any time, subject to legal or contractual limits. Turning off location sharing, replying STOP to SMS and unsubscribing from marketing are examples;
  • Deletion: ask us to delete your account and associated personal information, unless we must keep some of it by law (for example payment records);
  • Quebec residents: the additional rights in section 9; and
  • Complain: challenge our compliance, first with our Privacy Officer and then with a regulator (section 14).

13.1 How to exercise your rights

  • In the app: Profile, then Privacy (access, correction, deletion), or Profile, then Delete account.
  • By email: info@tokenno.com, with the subject "Privacy request", from or mentioning the mobile number on your account.

Verification. To protect you, we verify requests, usually by sending a one-time code to your mobile number. We use the information you give for verification only for that purpose.

Timing and cost. We will respond within 30 days of receiving your request. Requests from Quebec residents are answered within 30 days, with no extension. Elsewhere, if the law allows us to extend that time and we do, we will tell you why and when to expect our answer. Access requests are free; if the law allows a minimal fee for an unusual request, we will tell you the estimated cost first. [Counsel to confirm: response periods under Alberta PIPA, BC PIPA and Quebec law, and any fee rules.]

If we refuse. If we cannot give you access or make a correction, we will tell you why in writing, as far as the law allows, and tell you how to complain.

13.2 Information about you held by vendors

If you want to exercise rights over information a vendor holds in its own systems, or decides how to use, please also contact that vendor directly. Where we hold information on a vendor's behalf, we may pass your request to the vendor and help it respond.

14. Complaints

Please contact our Privacy Officer first (section 15). We will investigate every complaint, and if it is justified, we will take appropriate steps, including changing our practices.

If you are not satisfied, you may complain to:

  • the Office of the Privacy Commissioner of Canada (priv.gc.ca);
  • in Quebec, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca);
  • in Alberta, the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca); or
  • in British Columbia, the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca).

15. Privacy Officer and contact

  • Privacy Officer (for Quebec, the person in charge of the protection of personal information): [Privacy Officer name and title], [TokenNo North America entity legal name]
  • Email: info@tokenno.com
  • Postal address: [registered address]
  • [Placeholder: Canadian contact address or representative, if required. Counsel to confirm.]

16. Changes to this policy

We may update this policy, for example when we launch Phase 2 features. If we make material changes, we will tell you in the app or by message before they take effect. If a change means we would use your personal information for a new purpose, we will ask for your consent first. The "Last updated" date at the top shows when the policy last changed.