Privacy policy

1. Scope and accountability

This policy applies to personal information controlled by Working Order (“Working Order,” “we,” “us,” or “our”) in connection with workingorder.ca, project inquiries, customer and staff accounts, the customer portal, support communications, invoices, hosted payment requests, and our direct business relationships.

Working Order is based in the Niagara Region, Ontario, Canada. The Working Order Privacy Lead is accountable for our privacy practices and can be reached using the contact information at the end of this policy.

When Working Order builds or supports software that processes information on behalf of a client, that client may control the information in its system. The applicable project agreement and the client’s own privacy policy may then govern that processing.

2. Information we collect

Project inquiries and communications

We may collect your name, email address, organization, phone number, preferred contact method, the kind of help you are looking for, your preferred engagement model, and the message or files you choose to provide. We also retain related emails, support messages, meeting notes, and communication history.

Customer, portal, and support information

For customers and authorized users, we may collect account names, business contact details, sign-in credentials stored as secure password hashes, account roles, support tickets, replies, project details, service history, and records needed to administer the relationship.

Billing and payment information

We may keep invoice numbers, descriptions, amounts, currency, due dates, payment status, payment method, date paid, receipt details, hosted-checkout references, and related accounting records. Card details entered on a hosted payment page are handled by the payment provider; Working Order does not receive or store full card numbers or card security codes.

Technical and security information

Our website and hosting systems may process IP addresses, request times, requested pages, browser or device information, error and security logs, and essential cookie identifiers. This information supports delivery, troubleshooting, fraud prevention, rate limiting, account security, and service reliability.

3. How information is collected

We collect information directly from you when you submit a form, communicate with us, create or use an invited account, open or reply to a support request, enter into an agreement, or use a hosted payment link. We may also receive business contact or project information from an authorized colleague, client, integration, payment provider, or service provider involved in delivering the requested work.

4. Why we use personal information

We use personal information for reasonable business purposes, including to:

• review and respond to inquiries;
• assess, plan, quote, deliver, document, and support technology work;
• create and administer customer, staff, and portal accounts;
• communicate about projects, support requests, invoices, payments, security, and service changes;
• process and reconcile hosted payments and maintain accounting records;
• protect accounts, investigate errors, prevent abuse, and maintain reliable systems;
• meet contractual, tax, accounting, insurance, security, and legal obligations; and
• establish, exercise, or defend legal claims.

We do not sell or rent personal information.

5. Consent and communications

We seek meaningful consent when required and limit collection, use, and disclosure to purposes a reasonable person would consider appropriate. You may withdraw consent to an optional use by contacting us, subject to legal, contractual, security, and record-keeping requirements. Withdrawing consent may limit our ability to provide a requested service.

Messages responding to an inquiry, delivering contracted work, supporting an account, or administering a payment are service communications. If Working Order sends optional commercial or promotional messages, we will do so with the consent or other authority required by Canada’s Anti-Spam Legislation and will provide a working way to unsubscribe.

6. When information may be shared

We share personal information only as reasonably necessary for the purposes described in this policy. Recipients may include:

• hosting, database, backup, email, security, identity, communication, and technical-service providers;
• hosted payment providers, such as Stripe, when a payment option is enabled;
• professional advisers such as accountants, insurers, legal counsel, or auditors;
• another organization involved in a proposed financing, sale, merger, reorganization, or transfer of all or part of the business, subject to appropriate confidentiality protections; and
• government, regulatory, law-enforcement, court, or other parties when disclosure is required or permitted by law, needed to protect rights or safety, or necessary to investigate fraud or security concerns.

Service providers are expected to handle information for the services they provide and to use safeguards appropriate to the sensitivity of the information.

7. Processing outside Canada

Some service providers may process or store information in Canada, the United States, or other jurisdictions. Information handled outside your province or Canada may be subject to the laws and lawful-access processes of that jurisdiction. Working Order remains accountable for personal information under its control and considers privacy and security when selecting service providers.

8. Cookies and website tracking

The site uses cookies and similar mechanisms that are necessary for secure sign-in, session continuity, form protection, and account security. A “remember me” cookie is used only when a user chooses that option.

Working Order does not currently use third-party advertising cookies or website analytics. If that changes, this policy and any required consent choices will be updated before the new tracking is enabled.

9. Retention and disposal

We retain information only as long as reasonably needed for the purposes described above and for applicable legal, accounting, tax, insurance, security, warranty, dispute, and backup requirements. Retention depends on the relationship and the type of record. For example, an unanswered inquiry may be kept for a shorter period than an active customer file, accounting record, or support history.

When information is no longer required, it is deleted, anonymized, or securely disposed of where reasonably possible. Residual copies may remain temporarily in protected backups until they are overwritten through the normal backup cycle.

10. Safeguards

Working Order uses administrative, technical, and physical safeguards appropriate to the sensitivity of the information. These may include role-based access, secure password hashing, multi-layer authentication controls where available, encryption in transit, protected configuration, rate limiting, audit records, backups, vendor controls, and restricted administrative access.

No internet transmission or storage system can be guaranteed completely secure. Please do not send passwords, payment-card details, health information, government identifiers, or other sensitive credentials through the public project-inquiry form.

11. Privacy incidents

Working Order investigates suspected loss, unauthorized access, use, or disclosure of personal information. Where required by applicable law, we will keep breach records, notify affected individuals and relevant organizations, and report a breach to the Office of the Privacy Commissioner of Canada when it creates a real risk of significant harm.

12. Access, correction, and privacy questions

You may ask whether Working Order holds personal information about you and request access to or correction of that information, subject to lawful exceptions. We may need to verify your identity before acting on a request. We will explain if we cannot fulfill all or part of a request.

You may also ask about our service providers, withdraw consent to an optional use, or raise a concern about how information has been handled. We will review and respond to privacy concerns in a reasonable time.

13. Children’s information

Working Order’s website and services are intended for businesses and authorized business users, not children. We do not knowingly collect personal information from children through the public website. If you believe a child has provided information, please contact us so we can review and address it.

14. Changes to this policy

We may update this policy when our services, providers, practices, or legal obligations change. The current version will be posted here with its effective date. Material changes will be communicated in an appropriate way when required.

15. Contact the Privacy Lead

Privacy Lead, Working Order
Niagara Region, Ontario, Canada
sales@workingorder.ca
workingorder.ca

If a privacy concern is not resolved to your satisfaction, you may contact the Office of the Privacy Commissioner of Canada.