Privacy Policy

Introduction

This Privacy Policy together with the relevant Terms and Conditions and any other documents referred to sets out the basis on which any personal information or personal data as defined by applicable data protection laws we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how we will treat it. If you would prefer your personal data is not used in the manner described in this policy, you should not use our websites or services. Our websites and services include our BIS Safety Software system and the associated BIS Safety mobile app (collectively the “Web Platforms”).  By using our Web Platforms, you may be corporate user or a public user or both. “Corporate Users” are users who are required to have an account by a company, entity, or organization in a portal managed by that company, entity, or organization. “Public Users” are users who independently create and access an account under BIS’ portal, BIS Safety Software.  

BIS Safety Software Inc., 261 Seneca Road, Sherwood Park, Alberta, Canada, T8A 4G6 is the data processor for Corporate Users and the data controller for Public Users. This Privacy Policy applies to this company and its affiliates and subsidiaries who will be referred to as “we”, “us” or “our” in this policy.  

Summary

This Privacy Policy informs you how we protect your privacy. The Privacy Policy applies to our company, affiliates and subsidiaries who will be referred to as “we”, “us” or “our” in this policy. It describes how we collect and use personal information in our business, on our Web Platforms, in electronic communications, and in the social media services used to direct you to our Web Platforms. 

We comply with Canadian, United States of America (USA), European and other international privacy law including: the Alberta Personal Information Protection Act (PIPA), the British Columbia Personal Information Protection Act, the Ontario Freedom of Information and Protection of Privacy Act, the Quebec Private Sector Privacy Act, the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s Anti-Spam Legislation (CASL), the California Consumer Privacy Act (CCPA), the United States of America Children’s Online Privacy Protection Act (COPPA), the Australian Privacy Act 1988, the European Union General Data Protection Regulation (EU GDPR), and the European Union Directive on Privacy and Electronic Communications (EU e-privacy Directive), the United Kingdom Data Protection Act 2018, the New Zealand Privacy Act 2020, and other applicable privacy law as amended from time to time all of which are referred to as “privacy law”. 

There may be links from our Web Platforms to other websites. However, this Privacy Policy applies only to our Web Platforms; it does not apply to any third-party websites which may be linked to our Web Platforms. We do not endorse and are not responsible for linked third-party websites. Please check on those linked websites for their privacy policies and make any inquiries with them. 

Your continued use of our services and Web Platforms signifies your acknowledgement and consent to our Privacy Policy now and in the future. Our Privacy Policy is periodically updated; we will include dates of changes in the policy, so you know when changes have been made. For a change which significantly alters the meaning of anything in the policy, we may notify you of the changes on your next login or may ask you to reaccept the policy before continuing. 

Collecting Information for Our Services

We collect your personal information to provide services to you. The types of information we collect are: 

• Information you give us: We collect information so we may contact you, assist you, provide you with information about our services, and provide services to you. 

• Automatic information: We may automatically collect certain types of information when you electronically interact with us. 

• Information from other sources: We might collect information about you from other sources, including third-party service providers, and publicly available sources. 

Personal information that you provide may include the following: your name, email address, physical location, postal address, phone number, birthdate, driver’s licence, social insurance number, social security number, Internet Protocol address, banking or credit information, employment history and information, health information, and educational and training history. 

We may collect personal information: 

• Voluntarily provided to us by you through our Web Platforms, direct communications (for example, meetings or trade shows), and electronic communications including social media, surveys, webinars, search functions, questionnaires, feedback, and various forms, including contact, information, and requests for demonstration forms; 

• When you have entered our Web Platforms while performing online searches or seeking health and safety training; 

• When we have received a business referral to you, or you may be a member of an organization that is an existing business associate of ours; 

• When you or your organization provide us with personal information in order to purchase our services, resell our services, provide courses and products to include in our services, create accounts, or become registered users of our services; and 

• When we ask you to provide identifying information if you want a demonstration or to use our services, to assist you with a registered user account, or to resolve complaints or concerns. 

If you become a registered user on your own behalf, you will create a password for your account. If your organization creates an account for you, you or your organization may create a password for your account. We encrypt all passwords. You or your organization, as applicable, will be responsible for protecting the password. Through our software, we may provide your organization with options to block, encrypt or otherwise secure certain sensitive information (for example, your social insurance number or social security number). You or your organization, as applicable, are responsible for using these options. Passwords will be automatically encrypted with no access to anyone other than the password creator. 

We usually will not change your personal information, and usually only delete information with your consent or the consent of your organization, unless required to do so by law or to prevent illegal activity. 

Client Added Personal Information

Our system collects and stores limited personal information that is required to create a user account, consisting of first and last name, province/state, country, language, and password. Clients may choose to additionally collect any other type of personal information from their users, including highly sensitive personal information. Clients are solely responsible for making sure that data they collect and transmit using our system, including personal information, is protected for privacy and complies with any applicable privacy law using the available security tools within the BIS Safety Software system and their own information security policies, processes, and standards. BIS expressly disclaims any responsibility or liability for any personal information that a client or user adds to or collects though our system except for the limited personal information required to create a user account. Any further personal information collected or shared in our system is done so at the client and users’ own risk. 

How We Use Personal Information

We use your personal information to operate, and to provide and improve our business and services. Our purposes for using personal information are as follows: 

Provide services: We use your personal information to provide and deliver our services and third-party courses and products; and to process transactions related to those services, courses and products including registering you as a user, receiving payments, providing training, and verifying your certificates. 

Measure, support, and improve services: We use your personal information to analyze performance, fix errors, measure your usage, provide support, and improve and develop our services. 

Recommendations and personalization: We use your personal information to recommend services that might be of interest to you, identify your preferences, and personalize your experience. 

Comply with legal obligations: In certain cases, we may have a legal obligation to collect, use, retain, or delete your personal information. 

Communicate with you: We use your personal information to communicate with you in relation to our services and to respond to your requests, including by mail or electronically (for example by phone, text, video, email, VOIP, internet messaging, social media, or webinars). 

Marketing: We use your personal information to market and promote our services, which may now or in the future use interest-based or personalized targeted ads. We may use interest-based ads to display features, courses, products, and services that might be of interest to you. We may use cookies and other similar technologies which enable us to understand the effectiveness of the interest-based ads by measuring what ads are clicked or viewed, and to provide you with more useful and relevant ads. 

Fraud, abuse prevention and credit risks: We may use your personal information to detect and prevent fraud and abuse in order to protect you and the security of our services. We may use algorithms and scoring methods to assess and manage security, and financial and credit risks. 

Cookies

To enable our systems to recognize and provide you with services, we may use cookies and other similar technologies to recognize your browser or device, learn more about your interests, and provide you with important features and services including: 

• Recognizing you when you sign in, which allows us to provide you with recommendations, display personalized content, and provide customized services; 

• Keeping track of your specified preferences, such as language and configuration preferences; 

• Conducting research and diagnostics to improve our offerings; 

• Measuring and analyzing the performance of our services; 

• Preventing fraudulent activity and improve security; and 

• Delivering content relevant to your interests. 

Some cookies may be deleted at the end of your browsing session, while other cookies may persist between sessions. 

Examples of the information we may collect through cookies include: 

• Network and connection information, such as the Internet Protocol address used to connect your computer or other device to the internet, and information about your internet service provider; 

• Computer and device information, such as device, application, or browser type and version, browser plug-in type and version, operating system and time zone setting; 

• The location of your computer or device; 

• Authentication and security credential information; 

• Content interaction information, such as content and course downloads, streams, and playback details, including duration and number of simultaneous streams and downloads; and 

• The full Uniform Resource Locator (URL) clickstream to, through, and from our Web Platforms and services, content, and courses you viewed or searched for, page response times, download errors, and page interaction information. 

Our cookies may allow you to take advantage of some essential and useful features; blocking some types of cookies may impact your experience of our Web Platforms. You can manage browser cookies through your browser settings. The ‘Help’ feature on most browsers will tell you how to remove cookies from your device, prevent your browser from accepting new cookies, how to have the browser notify you when you receive a new cookie, how to disable cookies, and when cookies will expire. Check the support site for your browser to understand privacy settings available to you. If you block or reject some of our cookies through your browser’s settings, you might not be able to use certain offerings that require you to sign into an account and some features and services may not work. You might also have to manually adjust your preferences or settings every time you visit our Web Platforms. If your browser includes Intelligent Tracking Prevention (ITP), preferences specific to our Web Platforms may reset on an ongoing basis. These resets are managed by your browser, not by us. 

How We Share Personal Information

Personal Information about our customers and registered users is an important part of our business. We do not sell this personal information to others. We may share personal information with third-party service providers, such as credit card processors, managed hosting providers, and sub-processors, who follow policies and practices at least as protective as described here for the purposes of providing our Web Platform and services to you. We inform our clients of changes to our sub-processors through our Sub-processor Notice. We recommend clients and users to review the privacy policy of our sub-processors. For Corporate Users, we may also share personal information with registered users within your portal. Public Users may opt out of having their personal information shared with third-party service providers, however, opting out will prevent access to our Web Platforms. “Portals” refer to logically separated, personalized environments within our Web Platforms that provide registered users and customers with a single point of access and ensure personal information is restricted to users within the same environment based on their user accounts. We will not give a third party with whom we share your information an independent right to share or disclose your information with any other person, group, or company outside of their own professional advisors and affiliates.  

We have contractual relationships with third parties who provide content, courses, and products which you may access through our software. These third-party providers are subject to our Privacy Policy. If you wish to access the content, courses, and products, you may need to share your personal information with these third parties. 

We may share the information and documents we have collected from you with third-party service providers, third-party suppliers, third-party course purchasers, governing bodies, and record validators to perform certain functions on your behalf which may include: delivering, supporting and upgrading technology, software and hardware; sending communications; processing credit card and other payments; assessing compliance risks; analyzing and processing data; providing marketing and sales assistance; providing customer relationship management; providing content, courses, and products; tracking, validating and administering your course records; maintaining our software and systems; performing security and audit functions, and data processing, storage and security. 

We host, record, and publicly share educational electronic meetings, such as webinars, that collect and display personal information limited to names, email addresses, names of employers, images, voices, and any information participants disclose. 

As we continue to develop our businesses, we might sell our businesses or services. In such transactions, personal information may be one of the transferred assets but remains subject to this Privacy Policy. We may release account and other personal information when that release is required to comply with the law, to apply or enforce our terms and agreements, or to protect the rights, property and security of our customers and others. This may include exchanging information with other companies and organizations for security, fraud prevention and detection, and credit risk reduction. 

Cross-Border Data Transfer

Our business and databases, which store the vast majority of our data, is located within Canada. Our trusted service providers and sub-processors are located around the world, including the United States of America, Ireland, Australia, and India. Any information that we collect, including personal information, may be stored and processed in Canada, the United States of America, Ireland, Australia, and India. When information is stored or processed outside of Canada, it may be subject to the laws of and be accessible by legal authorities in such other jurisdictions. We carefully assess our service providers and sub-processors prior to transferring your data to them to ensure the provide an adequate level of protection of your data. 

Examples of Information Collected

Information You Provide 

You provide information to us when you: 

• Search for, subscribe, purchase, register or use our software and services; 

• Use services purchased for you by another individual or organization, which may allow the purchaser to access information related to the purchase such as your name, the course, the course status, the mark, and certificates of completion; 

• Communicate with us (for example, by mail, or electronically, such as by phone, text, video, email, VOIP, internet messaging, social media or webinars); 

• Complete an information request or request for demonstration form; 

• Post on our Web Platforms or participate in community features or webinars; 

• Register and administer user accounts, or participate in a course or training; 

• Configure your settings, provide access permissions, or interact with our services; 

• Activate an account under an organization, which may provide the organization with administrative access to your account information and the ability to register you for courses; track and validate your course marks, certificates of completion, and training history; and update your records and information; 

• Sell, purchase or use third-party content and courses through our software and services; 

• Access third-party content and courses, which may require sharing with a third-party provider information such as your name, purchase information, photo or video identification, training records, course marks and certificates of completion; 

• Access third-party content and courses, which may require sharing with a certification body information such as your name, purchase information, photo or video identification, training records, course marks and certificates of completion; 

• Access third-party content and courses, which may include authorizing a third-party individual or organization to verify the existence and status of your certificates and training and communicate with you via our Web Platforms; 

• Use the BIS Safety mobile app, which may collect location data and allows third parties to access your name, registration, course marks, or certificates of completion when presented with a QR code or your identification information; or 

• Authorize us to verify to third parties the validity and status of your certificates when they enter your last name and certificate number into the public certificate verification process on our Web Platforms. 

Depending on how you use our services, third-party content, and courses or interact with us, you might provide such information as: 

• Your name, email address, physical location, device location, postal address, phone number, and contact information; 

• Payment information, including credit card or banking information; 

• Information about your location or organization; 

• Your username and authentication and security credential information; 

• Your training records, course marks, and certificates of completion; 

• Your image, and video and voice recordings; 

• Identity information, including government-issued identification; 

• Corporate and financial information and tax identifiers; and 

• Feedback, inquiries, customer service requests, phone conversations, chat sessions and emails. 

Automatic Information 

We collect information automatically when you: 

• Visit our Web Platforms, or interact with or use our software, app, or services; 

• Open content and courses in our software or download content and courses; 

• Open emails or click on links in emails from us; 

• Attend our webinars; or 

• Electronically communicate with us. 

Examples of the information we may automatically collect include: 

• Network and connection information, such as the Internet Protocol address used to connect your computer or other device to the internet and information about your internet service provider; 

• Computer and device information, such as device, application, browser type and version, browser plug-in type and version, operating system, and time zone setting; 

• Location of your computer or device; 

• Authentication and security credential information; 

• Content interaction information, such as content and course downloads, streams and playback details; 

• Metrics, such as offering usage, occurrences of technical errors, diagnostic reports, your settings preferences, backup information, API calls, Single Sign On (SSO) activity, and other logs; 

• Full Uniform Resource Locator (URL) clickstream to, through, and from our website (including date and time), content and courses you viewed or searched for, page response times, download errors, and page interaction information (such as scrolling, clicks, and mouse-overs); 

• Email addresses and phone numbers used to contact us; and 

• Identifiers and information contained in cookies. 

Information from Other Sources 

Examples of information we may receive from other sources include: 

• Marketing lead and sales generation information, including your name, email address, postal address, physical location, phone number, and other contact information; 

• Subscription, purchase, support, or other information about your interactions with other products and services; 

• Search results and links, including paid listings; and 

• Banking, credit history and payment information. 

Information You Can Access

Examples of information you may be able to access through our services include: 

• Your name, email address, physical location, postal address, phone number, and other contact information; 

• Username, aliases, roles, and other authentication and security credential information; 

• Your subscription, purchase, usage, billing, and payment history; 

• Payment settings, such as payment instrument information and billing preferences; 

• Third-party course completion information, including training records, course marks and certificates of completion; 

• Education, training, and employment information; and 

• Email communication and notification settings. 

Location of Personal Information

Your personal information is stored in Canada on third-party data servers (for example, AWS Canada). Limited personal information collected and publicly shared from recorded webinars may be stored in third-party data servers located in USA or Canada. Conversations and any information you provide to our Support Team by phoning 1-780-410-1660, (French) 1-780-410-1659, (toll-free Canada) 1-866-416-1660, (USA) 1-713-424-0660, and (toll-free USA) 1-866-575-5670 is stored in the USA. BIS shares personal information with sub-processors who may also store this data in locations outside of Canada. Please refer to our Sub-Processor Notice for information on our sub-processors and where they store personal information.  

Securing Information

We design our systems with your security and privacy in mind, including providing you with options to secure your personal information. We maintain compliance programs that support and validate our security controls. We use software, security, and encryption protocols to protect the security of your information. These protocols may be used during electronic communications, during transmission with our Web Platforms, or for our services. We maintain physical, electronic, and procedural safeguards for the collection, storage, disclosure, and deletion of personal information. Our security procedures mean that we may require proof of identity before we disclose personal information or provide certain services to you. 

Access and Choice

Subject to your organization’s restrictions, you may be able to view, update, and delete your account information and control how you interact with and use our services. Your services may include settings that provide you with options for how your information may be viewed, used, or secured. If you want to add, update, or delete information related to your account, we usually don’t keep a copy of the prior version. The Help feature on most browsers and devices will tell you how to prevent your browser or device from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether. 

Retention of Personal Information

We keep your personal information to communicate with you to enable your continued use of our services for the purposes described in this Privacy Policy or as may be required by law. Your personal information is retained if your account remains active. After your account is deactivated, our retention of your personal information will be consistent with applicable laws. 

Our Data Security and Compliance Program

Both BIS and our clients acknowledge the crucial importance of safeguarding personal and confidential information. Our data security and compliance program helps customers understand the robust controls we have in place to maintain data security and compliance on our servers and with any third-party service providers. We meet Payment Card Industry requirements and use reputable third-party payment processors (for example, Moneris) to process payments in our ecommerce store. We meet data and security requirements including those of the Payment Card Industry and the System and Organization Controls (SOC) 2 Trust Services Criteria. Our data security and compliance certifications and attestations are assessed by independent auditors, and result in certifications, audit reports, or attestations of compliance. Our data security program includes a risk management program that aims to identify and mitigate threats and vulnerabilities with controls appropriate to the level of risk. Our risk management controls include regular, comprehensive vulnerability scans, external testing, and internal audits. In the event we become aware of a security incident that has affected our customers or users, we will notify affected parties following applicable laws.  

Our customers and users are also responsible for the following:  

• Safeguarding the security of their portal and accounts to the same extent to which they protect the confidentiality, integrity, and security their own systems and data.  

• Reporting relevant security findings or security incidents which affect their accounts.  

• Complying with applicable data security laws and regulations.  

We have functionality (such as encryption and security features) and legal agreements that support customer and user compliance. We strive to continuously improve our data security program and will communicate changes to our customers and users in a timely manner.  

Your Rights

You have a number of rights under privacy law which, in certain circumstances, you may be able to exercise in relation to the personal information we process about you. These include:

• the right to ask whether we hold personal information about you and request copies of such personal information and information about how it is processed;
• the right to request correction of inaccurate personal information we hold about you;
• the right to restrict our use of your personal information;
• the right to request deletion of personal information:
  • that is no longer necessary for the purposes underlying the processing,
  • where consent for the information being processing has been withdrawn, or
  • when processing is not in compliance with applicable legal requirements;
• the right, in certain cases, to receive a machine-readable copy of your personal information;
• the right to request portability of personal information that you have provided to us where the processing of such personal information is based on consent and is carried out by automated means;
• the right not to be subject to a decision based solely on automated processing, including profiling, which has legal effects for you or affects you in any other significant way; and
• the right to object to our use and processing of your personal information.

Where we rely on consent as the legal basis on which we process your personal information, you may also withdraw that consent at any time.

If you are seeking to exercise any of these rights, please contact us using the details in the Contacts, Notices and Revisions section below. We will handle any request to exercise your rights in accordance with applicable privacy law and any relevant legal exemptions.

You may also have the right to complain to a local authority if you think we have processed your personal data in a manner which is unlawful or breaches your rights. If you have such concerns, we kindly request that you contact us first (using the contact details in the Contacts, Notices and Revisions section below) so that we can investigate and do our best to resolve your concerns.

Children’s Privacy and Age Limits

We do not knowingly collect, use, or disclose personal information from any individual under the age of 13 or individuals under the age of 14 who reside in Quebec, Canada. Individuals under these age limits must not access or use our Web platforms or submit any personal information to us. 

If we become aware that personal information has been collected from a child under these age limits, we will promptly delete such information from our records. 

Individuals aged 13 to 17 may access and use the Web Platforms only with the verifiable consent and ongoing supervision of a parent or legal guardian. Parents or guardians who believe that we may have collected personal information from a minor are invited to contact our Privacy Management Program at privacy@bistraining.ca  to request review and deletion of the information. 

Artificial Intelligence 

Introduction 

Our Web Platforms may contain integrated services that use artificial intelligence (“AI”) or machine-generated learning (collectively, “AI Services”).  Our AI Services enhance the user experience and help our users perform actions and achieve objectives more efficiently in our Web Platforms. BIS may also implement AI Services in its business operations, so that it may provide services efficiently and effectively.  

About Our AI Services 

Our AI Services are each designed and intended to perform specific functions. The AI Services use information provided by users, such as text, images, videos, and content in files of any format, to generate and output content from our Web Platforms. The AI Services may also use information we collect from users to monitor functionality of our Web Platforms, such as but not limited to usage and performance metrics. The AI Services that are integrated into our Web Platforms or incorporated into business operations may be wholly or partially developed by third parties. 

We review the terms and conditions or have written agreements with all third parties whose AI Services we use. We apply and maintain a risk management program, which includes impact assessments and practices for human oversight, to manage which third party or internally developed AI Services we integrate into our Web Platforms and business operations. BIS employees and contractors agree to follow applicable privacy laws when using AI Services.  BIS has internal practices in place to ensure compliance with privacy legislation, including defined roles and responsibilities, establishing clear expectations with respect to compliance with privacy obligations, a mechanism to receive and respond to privacy-related questions and complaints, and a commitment to regularly reviewing our practices based on technological and regulatory developments. These practices also prohibit BIS’ employees and contractors from entering personal information and confidential information into AI Services integrated within our Web Platforms or incorporated into our business operations. 

Data Privacy of AI Services 

AI Services may store and retain data that they process. This data may be stored in datacentres located in the United States of America or other countries and thus will be subject to their laws. These third parties do not have access to any personal information stored in our Web Platforms, and our Web Platforms do not transmit personal data to these third parties unless users provide it directly to AI Services. 

Our Web Platforms do not contain any public AI systems. This means that data entered by users into our AI Services through our Web Platforms are not shared with and used in any AI model that generates outputs in any other external website, database, or digital system that is not owned and provided by BIS. 

Our Web Platforms will use private, segmented AI systems where appropriate. This means that data entered by users into our AI Services through our Web Platforms may be shared with or accessible to other users within the same Portal when appropriate. Data entered by users into AI Services on our Web Platforms and outputs generated by AI Services may be added to future training data used by our private AI systems or used by BIS to provide and improve our services to you and to help us better understand how you use our Web Platforms. Only BIS may modify training data and data within private AI systems. 

Our Web Platforms store the data users input into our AI Services, so that we can monitor and improve how the AI Services are responding. We also store input data to monitor for violations of the Terms and Conditions here associated with using AI Services. 

We use appropriate safeguards to protect personal information collected or used throughout the AI Services from risks of security breaches or inappropriate use.  Such safeguards are commensurate to the sensitivity of the personal information and take into account risks specific to the AI Services and AI systems, such as jailbreaking. 

BIS undertakes privacy impact and/or algorithmic impact assessments to identify and mitigate potential or known impacts of AI Services (or their use) on privacy and other fundamental rights. We do not use AI Services that are deemed unacceptable by applicable legislation (such as for discriminatory profiling or generating content that otherwise infringes on fundamental rights). We use anonymized, synthetic or de-identified information, rather than personal information, in the AI Services whenever possible. 

Consent to AI Services 

BIS makes transparent on our Web Platforms where AI Services are used by marking tools as “BIS AI” and generated content with a statement to indicate partial or whole content generation by AI. Where possible, we provide users with the option to opt out of AI Services. Some features of our Web Platforms may only function with AI Services. 

AI Services are an integrated part of our Web Platforms, and therefore, providing consent to AI Services may be a requirement to access and maintain an account. If you do not wish to provide consent where consent is a requirement, you may be required to delete your account or avoid creating an account, as applicable. If you have questions about consent related to our AI Services, please contact us at our Privacy Management Program below. 

If you wish to withdraw your consent to allowing our system to collect and use your inputs into AI Services and outputs generated by AI Services in our AI training data, please contact us at our Privacy Management Program below. 

Personal Information 

BIS may collect, update, and output personal information belonging to users to other users with administrative access from within the same Portal through AI Services integrated within our Web Platforms.   

The AI Services integrated into our Web Platforms may process personal information stored on our Web Platforms. AI Services will process personal information based on the prompts made by users who are logged into our Web Platforms and who have the administrative level of access needed to access that personal information. Personal information is only collected and processed by AI Services strictly for the purposes of providing you with enhanced software solutions. 

Specific Privacy Disclosures

California Consumer Privacy Act 

These disclosures are pursuant to the California Consumer Privacy Act.  

Categories of personal information collected or disclosed for a business purpose: The personal information that we may collect, or may have collected from you or disclosed in the preceding twelve months, fall into the following categories depending on how we may have engaged with you: 

• Direct identifiers, such as your real name, alias, postal address, social security number, driver’s licence and passport information, and signature; 
• Indirect identifiers such as cookies and other similar technologies, phone numbers, Internet Protocol addresses, and account names; 
• Biometric data, such as images, and audio and video recordings; 
• Geolocation data, such as physical location information from computers, smart phones and other devices; 
• Internet activity such as browsing history, search history, data on interaction with a webpage, application or advertisement; 
• Sensitive information such as personal characteristics, behaviour, employment, and education information; and 
• Professional or employment related information; education information, including enrollment status, fields of study, degrees, training, honors, awards, course marks and certificates of completion. 

Depending on how you may engage with our services, further categories of personal information disclosed for a business purpose include: 

• Commercial information, such as the details of a product or service, if a third-party service provider is assisting to provide that product or service to you; 
• Internet or other electronic network activity information, for example if a third-party service provider gathers security reports; 
• Biometric information, such as your image, voice or video recording, for example if you participate in identity verification by a third-party service provider; 
• Electronic communications if a third-party service provider reviews recordings of customer interactions for quality assurance purposes; and 
• Professional or employment-related information, for example if we provide information to a third-party service provider for registration or verification of marks or certificates received. 

Your rights: You have the right under the California Consumer Privacy Act to request information about the collection of your personal information by us and access your personal information. As a Public User, you have the right to request deletion of your personal information or opt-out of sharing your personal information with our third-party service providers, including our sub-processors, by deleting your account.  

No sale of personal information: We have not sold personal information of consumers, as those terms are defined under the California Consumer Privacy Act. 

No discrimination: We will not discriminate against any consumer for exercising their rights under the California Consumer Privacy Act. 

European Union 

Controller of Personal Information: We may be the data controller or data processor of personal information collected or processed through our business, Web Platforms, and services. 

Processing: We process your personal information on one or more of the following legal basis:  

• As necessary to enter into a contract with you or a legal entity you represent, to perform our contractual obligations, to provide our services, to respond to requests from you, or to provide customer support; 
• We have a legitimate interest where the processing is necessary for us to conduct our business, but not where our interests are overridden by your interests, as further described in this Privacy Policy; 
• Where we process personal information which you have already made public or where it is considered public information; 
• As necessary to comply with relevant law and legal obligations, including responding to lawful requests and orders; or 
• With your consent. 

Your Rights: Subject to applicable laws, you may exercise rights pertaining to your personal information as described above.  

Transfers outside of the European Economic Area or EEA: When we transfer your personal information outside of the EEA, we do so in accordance with the terms of this Privacy Policy and applicable data protection law. 

Children’s Online Privacy Protection Act (COPPA) 

The Children’s Online Privacy Protection Act (COPPA) of 1998 enacted by the United States Congress prohibits unfair or deceptive acts or practices in connection with the collection, use, or disclosure of personal information on the internet from and about children 12 years or under. BIS does not usually offer its services to children 12 years or under. In very limited circumstances a person may buy certain services for children 12 years or under. If you believe that a child 12 years or under has provided us personal information without parental consent, please contact us, and we will delete that information. 

Canada’s Anti-Spam Legislation (CASL)  

Consistent with the Privacy Policy described here, you have authorized us to communicate with you in writing, or electronically, such as by email, social media, text, phone, or any form of electronic and internet-based methods using computers, smart phones, mobile or handheld devices, phone, or any future devices. You may unsubscribe anytime by either clicking an unsubscribe button; directly contacting us by phone, mail, or email; or providing reasonable notice by any other means. 

Canada’s Quebec Law 25 

Law 25 enhances the privacy laws in Quebec, Canada. In compliance in Law 25, BIS performs privacy impact assessments, provides breach notification in circumstances where unauthorized access is likely to cause real risk of significant harm to individuals as described under guidelines established by PIPEDA, and requests explicit consent for the collection of sensitive personal information for organizations and users in Quebec. BIS maintains a privacy management program to respect the data subject rights of Public Users in Quebec as follows:   

• Right to be informed 
• Right to access 
• Right to rectification 
• Right to erasure 
• Right to withdraw consent 
• Right to restrict processing 
• Right to data portability 

Quebec prohibits the collection, use, processing, and disclosure of personal information on the internet from and about children 13 years and under without parental or guardian consent. If you believe that a child residing in Quebec who is 13 years or under has provided us personal information without parental consent, please contact us, and we will delete that information. 

Contacts, Notices and Revisions

If you have any concern about your privacy or want to contact one of our third-party data processors, please contact us at our Privacy Management Program. 

Privacy Management Program  

BIS Safety Software 

261 Seneca Road 

Sherwood Park AB Canada T8A 4G6 

Phone: 780-410-1660 

Toll Free: 1-866-416-1660 

Email: privacy@bistraining.ca  

If you interact with our services on behalf of or through your organization, then your personal information may also be subject to your organization’s privacy practices, and you should direct privacy inquiries to your organization. 

Privacy Policy Change

If we alter our Privacy Policy, any changes will be posted on this page of our website with the date of the latest revision so that you are always informed of the information we collect about you, how we use it and the circumstances under which we may disclose it.  

Last Updated: September 15, 2025

Terms and Conditions

Carefully read all the Terms and Conditions including our Privacy Policy before accessing or using our websites, including www.bissafety.ca, www.bissafety.com, www.trainanddevelop.ca, and www.bissafety.uk, and web services, including our BIS Safety Software system and the associated BIS Safety mobile app (collectively the “Web Platforms”). By accessing or using the Web Platforms, you agree to be legally bound by the Terms and Conditions. If you do not agree with the Terms and Conditions, which referentially incorporates our Privacy Policy, you must not use, access, or open an account for or through the Web Platforms. 

The Terms and Conditions describe how you use the Web Platforms of BIS Safety Software Inc., which includes our companies, affiliates, and subsidiaries (“BIS”). The Terms and Conditions may be changed from time to time by BIS unilaterally and at its sole discretion. Any changes will be posted on the Web Platforms, and your continued use of the Web Platforms indicates your acceptance of the modified Terms and Conditions. 

Without BIS’s prior written permission, you shall not copy, create derivative works, transmit, display, or distribute the Web Platforms, which includes the following: text, images, videos, photographs, audio files, graphics, documents, courses, forms, exams, surveys, policies, procedures, assessments, and materials used for the purpose of providing or testing knowledge and gathering information (collectively referred to as “Resources”). Your use of the Web Platforms, which in all situations includes Resources, is limited to your sole use only. At no time shall you provide, allow, or permit anyone else to use your account to gain access to the Web Platforms. 

You may make purchases or pay an invoice through our Web Platform. Payments made by credit card are processed by our payment processors, Moneris Solutions Corporation and CardConnect, LLC, who act solely as a payment processor and do not provide any other services within our Web Platform. By making any payments by credit card, you authorize our payment processors to charge your credit card and store your credit card information following their policies. We are not responsible for and you release and hold us harmless for any actions, errors, or omissions of these payment processors.  

Artificial Intelligence

We are constantly using, developing, and deploying new technologies to enhance the services we provide to you. Our Web Platforms may provide to you services that use artificial intelligence or machine-generated learning (“AI Services”) to generate and output content in response to input that you provide (“Input”). Examples of Input are text, images, videos, and content in files of any format. These AI Services that are integrated into our Web Platforms may be wholly or partially developed by third parties. 

In using our AI Services through our Web Platforms, you agree to the following: 

• You represent and warrant that you have the right to upload and use the Input. You are responsible for the Input you provide. 

• The Input must be your own content, or authorized by the third-party owner of that content, and must not infringe on or violate any third party’s rights. Provided that the Input is wholly owned by you, and that your actions are not in violation of these Terms and Conditions, then you retain such ownership of the Input, and you have the right to use, distribute, and modify such output within our Web Platforms for internal business use only or commercial purposes. We reserve the right to remove output generated by AI Services temporarily or permanently to investigate and resolve reports of copyright infringement and violation of these Terms and Conditions. By providing Input, you agree to waive and release all moral rights that may exist in that Input or the subsequent output, and you grant us the non-exclusive, worldwide, irrevocable, royalty-free, sub-licensable right to use, host, reproduce, adapt, publish, translate, and distribute it in any and all media for the purposes of providing services to you. 

• You will abide by any third-party terms applicable to the AI Services, including OpenAI’s usage policies, accessible here. 

• As our AI Services are intended for individuals over the age of 18, you confirm you are at least 18 years old and will not use AI Services to collect personal information of children under 14 without parental/guardian consent.  

You agree not to use the AI Services or any part thereof (including with respect to any Input or output): 

• in violation of any applicable municipal, provincial, territorial, federal or international law, or in violation of any person’s legal rights; 

• in a way that could harm, damage, or disrupt the Web Platforms, or any of our goods, services, or business; 

• in a way that would adversely impact use of the Web Platforms by other users; 

to submit, upload, request, deliver, provide, or transmit any text, graphics, images, messages, information, or other material that:
(i) infringes, misappropriates, or violates a third party’s patent, copyright, trademark, trade secret, moral rights, or other proprietary or intellectual property rights, or rights of privacy;

(ii) violates or constitutes any conduct that would violate, any applicable law or regulation, or would give rise to civil liability;

(iii) is unlawful, abusive, tortious, pornographic, libelous, defamatory, obscene, pornographic, hateful, vulgar, offensive, or racially or ethnically objectionable;

(iv) promotes discrimination, exploitation, bigotry, racism, hatred, harassment, or harm against any individual or group;

(v) is violent, abusive, or threatening, or promotes violence, harassment, or actions that are threatening to any living thing; or

(vi) promotes illegal or harmful activities or substances;

• to collect, use, disclose, or store personal information about any other individuals without their consent; 
• to abuse, harm, interfere with, or disrupt our AI Services; 

• in any manner not permitted by these Terms and Conditions. 

You understand that these AI Services may generate output similar to or the same as output generated for other users in other portals. You acknowledge that the AI Services is a self learning tool that generates evolving output and may generate content with inaccuracies. Use of the AI Services is at your sole risk. You agree to use discretion before relying on, publishing, or otherwise using output generated by the AI Services. You agree that without notice, BIS may in its sole and unfettered discretion temporarily or permanently deactivate the AI Services in one or more of its Web Platforms at any time for any reason including preventing abuse, responding to legal requirements, or resolving security and performance issues. 

Our AI Services are each designed and intended to perform specific functions. BIS does not guarantee that the AI Services and any output it generates is suitable or appropriate for your purposes and requirements. 

Warranties and Liability

BIS is not responsible for any errors or omissions appearing in the Web Platforms, including generated output from the AI Services and actions, errors, or omissions of our payment processors. To the fullest extent permitted by law, BIS does not warrant and disclaims any warranty, expressed, or otherwise implied as to the accuracy, correctness, completeness, reliability, timeliness, fitness for any particular purpose or satisfactory quality of the Web Platforms and the AI Services included. The Web Platforms are provided without warranties of any kind, and you are using them at your own risk. Furthermore, BIS disclaims all responsibility and liability of any description including, without limitation, liability for negligence, injury, incidental, special, indirect, punitive, or consequential damages, expense or loss (including loss of profits, loss of revenue, loss of savings, loss of information, business interruption, loss of privacy, personal injury or other pecuniary loss) of any kind, direct or indirect, suffered by any person as a result of or in connection with the Web Platforms and the AI Services to include any reliance placed by such person on the Web Platforms, or the viewing, use or performance of the Web Platforms, whether with the required authority or otherwise. BIS suggests that you follow any applicable professional standards, government and industry regulations, and company polices and procedures, and that you act and ensure the safety of your users without reliance on the Web Platforms, including the Lone Worker feature. 

BIS reserves the right to revise, amend, alter or delete any aspect of the Web Platforms in whole or in part, but shall not be responsible for or liable in respect of any such revisions, amendments, alterations or deletions. 

BIS does not warrant and disclaims any warranty that the Web Platforms and the AI Services, in whole or in part, or any associated functions will be uninterrupted or error-free, or that defects will be corrected. Furthermore, BIS disclaims all responsibility and liability of any description including without limitation liability for negligence, injury, incidental, special, indirect, punitive, or consequential damages, expense or loss (including loss of profits, loss of revenue, loss of savings, loss of information, business interruption, loss of privacy, personal injury or other pecuniary loss) of any kind, direct or indirect, suffered by any person as a result of or in connection with the Web Platforms to include any reliance placed by such person on the Web Platforms, or the viewing, use or performance of the Web Platforms, whether with the required authority or otherwise. 

The following additional terms and conditions further apply to the use of the BIS Safety mobile application and any modules or features accessed within it, including but not limited to the Lone Worker module and the Site Access module: 

Due to the number of external factors and service providers required to ensure full functionality of the technology, including internet providers, text message service providers, and server hosting providers, BIS Safety Software Inc. cannot accept any responsibility or liability for the use or dependence on these features and expressly disclaims all liability for their use. We recommend that all users follow applicable professional standards, government and industry regulations, and company policies and procedures, and that you act and ensure the safety of your users without reliance on the BIS Safety mobile application and its features. Use the BIS Safety mobile app and its features at your own risk. 

Age Requirement

You must be at least 13 years old to use our services or 14 years old if you reside in Quebec, Canada. If you are between 13 and 17, you may only use the services with permission and supervision from a parent or legal guardian. By accessing or using the services, including AI services, you represent and warrant that you meet these age requirements.  

Indemnification

You agree to indemnify and hold harmless BIS and all of their directors, officers, shareholders, employees, agents, insurers, and contractors from any claim or demand, including reasonable legal fees, made by any third party in connection with or arising out of your use of the Web Platforms and the AI Services, your violation of the Terms and Conditions, and your violation of applicable laws. 

Access and Links

As a Public User, you may deactivate your account at any time. If you have not accessed your account at least once within two years, your account may be auto deactivated. As a Corporate User, your account may be deactivated by the company, entity, or third party managing the portal from where your account belongs.  

BIS reserves the right to deny or restrict access to the Web Platforms to any particular person, group or organization, or to block access from a particular Internet Protocol address to the Web Platforms at any time. BIS reserves the right to deactivate and permanently delete accounts without activity for 2 years or more, including login activity, and accounts that violate the Terms and Conditions or the Privacy Policy.   

The Web Platforms may contain hyperlinks to websites which are not controlled by BIS. Hyperlinks to other websites are provided solely for your convenience. If you use these hyperlinks and websites, you do so at your own risk, and it is your responsibility to take all protective measures to guard against viruses and other destructive elements. 

BIS is not responsible for the availability, accuracy, or reliability of the output generated by AI Services nor the content of websites not controlled by BIS. BIS shall not be liable for any injury, damages, loss, or expense howsoever arising from the use of AI Services or access to those websites. In no circumstance shall BIS be considered to be associated or affiliated with any trade or service marks, logos, insignia or other devices used or appearing on websites which are not controlled by BIS. 

BIS disclaims any responsibility for the content available on any other website reached by links to or from the Web Platforms that are not controlled by BIS. 

BIS may in its sole discretion disable any links to any websites, including defamatory, infringing, or obscene websites; or websites that contain topics, names, or information that violates any law, or any intellectual property, privacy, or publicity rights. 

Copyright

The Web Platforms are protected by copyright that is held by BIS. Your use of the Web Platforms and the AI Services does not grant you any rights in respect to the copyright.  

Law and Jurisdiction

The Terms and Conditions are deemed to have been made and performed exclusively in the Province of Alberta, Canada, and will be governed by and construed under the laws of that jurisdiction. You irrevocably attorn to the exclusive jurisdiction of the courts of the Province of Alberta for any claim related to the Terms and Conditions or the Web Platforms and agree not to bring any action, claim, suit or proceeding against BIS in any jurisdiction other than the Province of Alberta. 

Severability  

To the extent that any provision of the Terms and Conditions is declared by a court or lawful authority of competent jurisdiction to be invalid, illegal, or unenforceable, such provision shall be severed and deleted or limited so the remainder of the Terms and Conditions shall continue in full force and effect with respect to all other provisions.  

Acceptance on Someone Else’s Behalf

In the event you create an account on the Web Platforms on behalf of someone else, you represent and warrant that you have notified them of the Terms and Conditions, obtained their consent, and have the legal authority to agree to the Terms and Conditions on their behalf.

Last Updated: September 15, 2025

Anti-Corruption Anti-Bribery Commitment

Anti-corruption and anti-bribery laws strictly prohibit acts of bribery and corruption and require companies to develop comprehensive and robust prevention processes and procedures. Aligned with our core value of integrity, BIS Safety Software Inc. (“BIS”) is committed to conducting business in an ethical and fair manner, which includes complying with all anti-corruption and anti-bribery laws. This is accomplished and reinforced through our Commitment.

Our Commitment:

1. BIS has zero-tolerance for acts of bribery and corruption. Accordingly, BIS will not engage in bribes or corrupt practices of any kind and prohibits all team members and contractors from engaging in these activities.
2. Team members and contractors will avoid any activities that might lead to or suggest bribery or corrupt practices will be made or accepted. Bribery is giving money or something of value, often illegally, to influence actions and decisions. Bribery includes giving kickbacks and grease payments. Corrupt practices mean unethical or unlawful misuse or interactions with authorities, which includes bribery.
3. Team members and contractors will report all situations of bribery and corruption with business partners, team members, or third parties to the leadership team immediately, including where a demand for a bribe is expected to be received.
4. Team members and contractors must not offer or accept any gifts, entertainment, or hospitality from third parties that could affect impartiality, influence a business decision, or lead to the improper performance of a duty.
5. Gifts and entertainment (such as meals or sporting events) may be offered and accepted only when their value and frequency are deemed reasonable and proportionate.
6. BIS will provide anti-bribery anti-corruption training to all new and existing team members.
7. BIS expects all contractors, business partners, and third parties to comply with anti-bribery and anti-corruption laws and to raise any concerns about suspicions of bribery or corruption for BIS’ operations to our leadership team.
8. Concerns and questions related to bribery and corruption can be sent anonymously to the leadership team through the Anti-Corruption Anti-Bribery Commitment page on our public website. Team members and contractors have additional means to report concerns anonymously to the People & Culture team.
9. BIS takes breaches of this Commitment seriously and will take necessary disciplinary actions. Team members and contractors who violate these practices will be subject to disciplinary review, which may result in termination of contract or employment.
10. Any breach of this Commitment by our contractors and business partners will be investigated and could result in the termination of our business and contractual relationships based on the findings.
11. BIS maintains books, records, and accounts that accurately and fairly reflect the transactions of the company’s assets within reasonable detail. Team members and contractors are prohibited from making false or misleading entries in these books, records, and accounts.
12. As required by law, BIS will report acts of bribery and corruption to authorities.

Last Updated: August 18, 2025

Sub-Processor Notice

BIS Safety Software Inc. (“BIS”) uses sub-processors to help us provide our comprehensive and integrated learning management software. BIS engages with sub-processors (“Sub-processors”) who may receive or process client private data and who perform specific and various functions as part of the services we provide to you.

“Client Private Data” refers to all digital information, data, or files, which may include personal information, within a client’s portal.

“Personal Information” is defined consistent with privacy laws to include name, email address, physical location, postal address, birthdate, and other information that identifies a person.

This notice describes our process for engaging Sub-processors and lists the Sub-processors we use to provide services to you.

Our clients may sign up to receive notifications of any changes to this Sub-processor Notice through the System Updates module within their portal in our software. If you have any concerns about new Sub-processors, please contact our Support Team by phoning 1-866-416-1660 or emailing privacy@bistraining.ca within 14 days of notification.

Cookie Policy

BIS Safety Software Ltd. (“BIS”, “we”, “our”, “us”) uses cookies and other related technologies (collectively, “Cookies”) on www.bissafety.ca and any other website we own or operate (together, the “Websites”). This Cookie Policy explains what Cookies are, which ones we use, why we use them, how long they last, where data is processed, and the choices you have.

Please refer to the applicable Privacy Policy to understand how we collect, use, disclose, and protect personal information, and the rights available under Alberta’s Personal Information Protection Act (PIPA), the Canada’s federal Personal Information Protection and Electronic Documents Act (PIPEDA), and, where applicable, Quebec’s Act to Modernize the Protection of Personal Information (Law 25).

What are cookies?

Cookies are small text files that websites store on your device when you visit them. Different cookies have different purposes. Some cookies collect information that can reasonably identify or be associated with an individual and are considered “Personal Information” under Canadian privacy law. Other cookies remember your preferences, improving your browsing experience, and help us understand how our Websites and marketing campaigns are used.

We use both session cookies and persistent cookies. While persistent cookies are saved on your device until deleted, session cookies are deleted automatically when you close your web browser.

We use cookies based on your consent, our legitimate interests in providing Website functionality and improving our services, and when necessary, to fulfill our agreement with you.

Other Technologies

Our Websites may use other technologies to collect information.

· Scripts: This is a programmed set of instructions that run in your web browser to perform specific actions. For example, scripts may set cookies, fetch data, or enable interactive features.

Web Beacons/Pixel Tags: Invisible graphic files that allow us or our service providers to recognize when you have visited a page, opened an email, or otherwise interacted with our content. They help us measure performance and tailor content.

Third Parties

First-party cookies are placed by BIS. Third-party cookies are set by service providers, such as Google Analytics, Microsoft Clarity, Meta (Facebook and Instagram), LinkedIn, and YouTube on our Websites. These third parties may collect, use, disclose, and process your data in Canada or other jurisdictions and may recognize your device across different websites.

Types of Cookies

On the Websites, BIS may use the following types of Cookies below. You may opt out of all Cookies, except essential Cookies.

· Essential Cookies: These Cookies are necessary for you to use and navigate around our Websites.

· Technical or Functional Cookies: These Cookies improve the functionality of our Websites to provide you with a more personalized experience by remembering your preferences, such as session details.

· Statistics/Analytics Cookies: These Cookies collect aggregated and anonymous data about how visitors interact with our Websites, such as pages viewed and time spent on each webpage, to help us improve our content and navigation.

· Marketing or Tracking Cookies: These Cookies collect information about how you use our Websites over time by advertising companies, so they can show you advertisements on our Websites and potentially elsewhere that they believe may be relevant to you. These Cookies include cookies placed by Facebook, Instagram, LinkedIn, YouTube, and other social media platforms, who store data in the United States of America.

Your Consent

When you first visit our Websites, most browsers will request express consent to place non-essential Cookies. You can:

· Accept: Consent to all types of Cookies.

· View Preferences: Accept certain types of cookies only.

· Deny: Only essential Cookies will be used.

You can learn more about Cookies and how to update your Cookies in your browser settings here: (Google Chrome, Internet Explorer, Firefox, Safari, Opera)

Please note that if you opt-out of all non-essential Cookies, you may experience inconvenience when using our Websites or the Websites may not perform well.

Retention of Cookie Data

Cookie-derived data is retained only for as long as necessary to fulfil the purposes described above or as required by law. For example, Google Analytics data is retained for 14 months, after which it is automatically deleted or anonymized.

Access, Correction & Complaints

You may request access to, or correction of, personal information collected through Cookies by contacting us below. If you are not satisfied with our response, you may file a complaint with the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.

Contact Details

If you have any questions about our Cookie Policy, please contact our Privacy Management Program.

Privacy Management Program 261 Seneca Rd, Sherwood Park, AB T8A 4G6 Canada Email: privacy@bistraining.ca Phone number: 1 866-416-1660

We may update this Cookie Policy from time to time to reflect changes in our Websites and business practices. Any changes will be posted on this page with an updated revision date.

Last updated: 5/29/25

Changes to This Policy

We may update this Cookie Policy to reflect changes in our practices or legal requirements. We will post any changes on this page and, where appropriate, notify you by banner or email.

Last updated: May 29, 2025

Effective date: May 29, 2025