Privacy Policy

We process data in two capacities: (a) as a controller, for our own business operations (account registration, billing, marketing); and (b) as a processor, on behalf of our customers, when handling worker personal data, call recordings, and transcripts provided by customers during service delivery.

Canadian privacy law does not work from a list of legal bases the way European law does. Under PIPEDA the question is consent, plus whether a reasonable person would consider the purpose appropriate. So here is the plain version of why we hold each thing.

• To run the service you signed up for: filling shifts, screening applicants, sending confirmations, preparing hours for your payroll provider. This is the purpose you consented to when you created the account, and it covers most of what we do.
• Because the law requires the record to exist: employment standards records, payroll and tax records, and the credential evidence a client or a provincial inspector can ask to see. We could not delete these on request even if you asked, and Section 8 sets out how long each is kept.
• To keep the service working and secure: logs, error reports, and fraud prevention. Kept short, named in Section 8.
• With your consent, separately given: marketing to you as a customer. Withdraw it at any time and nothing about your service changes.

For your workers' information, the accountable organization under PIPEDA is your agency, not Kordis. You decide what is collected and why; we process it on your instructions and hold it under the terms of this policy. That division is worth understanding, because it decides who answers when a worker asks a question about her own data. See Section 6.

Kordis places outbound calls and sends texts to your workers and applicants on your behalf. Canadian rules govern that, and they are not the same as the American ones. Two apply here: CASL, Canada's Anti-Spam Legislation, which covers commercial electronic messages including text; and the CRTC's Unsolicited Telecommunications Rules, which set calling hours, identification requirements, and the National Do Not Call List.

Most of what Kordis sends is not a marketing message at all. A shift confirmation to a worker you already employ is an operational message about work she has agreed to do. That distinction matters under CASL, and it is why Kordis separates the two kinds of message rather than treating every text the same way.

You are responsible for:

• Having consent, express or implied, before Kordis contacts a worker or applicant. An existing employment relationship generally supplies implied consent for operational messages about shifts.
• Not using Kordis to send commercial electronic messages to people who have not consented to receive them.
• Keeping your own record of how consent was obtained. Kordis keeps the audit trail of what it sent and what came back, which supports your record but does not replace it.

Kordis handles the parts that can be built in. Calls are placed inside the calling hours of the worker's province, never outside them. Every call identifies Kordis and the agency on whose behalf it is calling. Recording consent follows the rules of the province the worker is in. Every call and text, and its consent status, is logged. If a worker withdraws consent, tell us and we will act on it, and Kordis stops contacting that worker.

Kordis is a Canadian federal corporation and Canadian privacy law governs what we do with personal information. The federal statute is PIPEDA, the Personal Information Protection and Electronic Documents Act. Quebec, British Columbia and Alberta have their own provincial privacy statutes, and where one of those applies to your workers it applies alongside this policy.

Under PIPEDA, a person whose personal information we hold has these rights. Workers and applicants can exercise them, and so can you. Write to us using the contact in Section 13:

• Access: Ask what personal information we hold about you, how we are using it, and who we have disclosed it to, and receive a copy.
• Correction: Have information that is inaccurate or incomplete corrected.
• Withdraw consent: Withdraw consent at any time, subject to legal or contractual restrictions and on reasonable notice. We will tell you what withdrawing means for the service.
• Deletion: Ask us to delete personal information, subject to the records an employer must keep by law. Employment standards and payroll records have minimum retention periods we cannot override; where that applies we will say so and name the reason.
• Challenge our handling: Challenge how we are handling your information, and receive an answer.
• Ask about automated processing: Ask whether a decision about you involved automated processing, and how. Kordis screens and scores applicants; the hiring decision is always made by a person at the agency, never by Kordis.

We respond within 30 days, which is the PIPEDA limit. If we need longer, or if we cannot fulfil a request, we will tell you and explain why in writing. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or to your provincial privacy commissioner in Quebec, British Columbia or Alberta.

One practical note about who answers a worker's request. For your workers' information, the agency is the organization accountable under PIPEDA and Kordis processes that information on your instructions. If a worker asks us directly, we will point them to you and tell you they asked, so nothing gets lost between us.

PIPEDA is the federal baseline. Four provinces have their own private-sector privacy statutes, and where one governs your workers it applies instead of or alongside PIPEDA. Nothing in this policy reduces a right a provincial statute gives you.

• Ontario: no separate private-sector privacy statute, so PIPEDA governs. Ontario's employment rules still apply to the records themselves, including what a temporary help agency must keep and for how long.
• Quebec: the Act respecting the protection of personal information in the private sector, as amended by Law 25. It is the strictest regime in the country: it requires a named privacy officer, a privacy impact assessment before information leaves Quebec, and it gives people a right to data portability.
• British Columbia and Alberta: each has a Personal Information Protection Act (PIPA). Both cover employee personal information directly, which PIPEDA does not do for provincially regulated employers, so if you staff in either province that is the statute your worker records sit under. Alberta's PIPA also requires notifying the provincial commissioner of a breach that creates a real risk of significant harm.

To exercise a right under any of these, or to ask which one applies to you, write to info@kordisai.com. We verify who you are before we release anything, then respond within 30 days.

If your agency places workers outside Canada, or you have workers covered by a foreign privacy law, tell us. This policy is written for Canadian agencies staffing in Canada, which is who Kordis is built for, and we would rather say that plainly than imply a coverage we have not written.

We retain data only for as long as needed to provide the service and to meet our legal, tax, and contractual obligations:

• Operational data (active placements, timekeeping, payroll): kept while your account is active and for the period your service agreement requires
• Compliance and audit records: employment, wage-and-hour, and tax law (for example, Record of Employment (ROE), payroll records, and provincial employment records)require certain records to be kept for several years; we retain those for the period the applicable law requires
• Call recordings and transcripts: kept per your service agreement. When you request deletion, we remove our copies and instruct our telephony and transcription providers to delete theirs; deletion at those providers completes on their schedule and may take a short time to finish.
• Account data (your name, email, billing): kept while your account is active and as needed for tax, legal, and audit purposes

You can request export or deletion of your data at any time, subject to the legal and contractual obligations above, and we honor it through our data-subject request flow.

We use the following third-party services to provide Kordis. You agree to our use of these processors:

• Microsoft Azure: Cloud hosting, compute, and storage
• Azure OpenAI Service (Microsoft): AI processing for product features: drafting, screening, summaries, and staging work for approval
• Clerk: Sign-in and account management
• Twilio: Voice calling and SMS delivery
• Deepgram: Speech-to-text transcription of calls
• ElevenLabs: Text-to-speech voice synthesis
• Inngest: Background job orchestration
• Stripe: Payment processing and billing
• Checkr: Background check ordering and results
• Intercom: In-app and website support chat
• Sentry: Error monitoring and application performance

We have Data Processing Agreements in place with all subprocessors. These processors are bound to protect data to the same standard we do. We will notify you of any material changes to our processor list at least 30 days in advance. If you require details about any processor or wish to object to a new processor, contact us at info@kordisai.com.

The full register, including the data categories each processor handles and where it runs, is on our subprocessors page.

We implement industry-standard security measures to protect your data:

• Encryption at rest: Sensitive worker data is sealed with AES-256-GCM envelope encryption, with the keys held in Azure Key Vault
• Encryption in transit: All data transmitted to and from Kordis is encrypted using secure encryption protocols
• Data isolation: Your data is isolated from other customers: you only see your own workers and orders
• Access controls: Team members only see what they need to manage their work, with full audit logging
• Compliance: We name a security certification only once it's earned, never before

While we use industry-standard security, no system is completely secure. If you become aware of a security breach, contact us immediately.

Kordis is hosted on Microsoft Azure in the United States (eastus2 region). If you are a controller in the EU, UK, or other jurisdiction, any transfer of personal data to the US is governed by:

• Standard Contractual Clauses (SCCs) with our hosting provider and third-party processors
• Our commitment to implement appropriate safeguards

If you do not consent to US data storage, please notify us before using Kordis.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by updating the "Last updated" date on this page. Your continued use of Kordis after such changes constitutes your acceptance of the updated policy.

If you have questions about this Privacy Policy or wish to exercise your data subject rights, contact: