Your information, handled with care.

01 Who we are and what this policy covers

CCIS Interpretation & Translation Services ("CCIS", "we", "us") is a service of the Calgary Catholic Immigration Society, a registered non-profit based in Calgary, Alberta. We provide in-person, phone and virtual interpretation, and written translation, to individuals, businesses, health-care providers, legal professionals, government bodies and community organizations.

This policy covers personal information we collect through this website, our booking forms, email, phone calls, and in the course of delivering interpretation and translation services. It applies whether you book as a guest, hold an individual account, or belong to a business account.

02 The laws we follow

We handle personal information in accordance with:

• The Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private-sector privacy law, including its ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance.
• Alberta's Personal Information Protection Act (PIPA), which governs how organizations in Alberta collect, use and disclose personal information.
• Where a booking involves health information or a client that is itself a public body or custodian, the additional obligations those clients carry under Alberta's Health Information Act or Freedom of Information and Protection of Privacy Act flow down to us through our agreements with them.

We have appointed a Privacy Officer who is accountable for our compliance with these laws and for answering your questions. Their contact details are in the How to reach us section.

03 The personal information we collect

We collect only what we need to provide and bill for the service you ask for. Depending on how you use our services, this may include:

Contact and account details

• Your name, email address, phone number and, for business accounts, your organization, job title and access level within that account.
• Your account password, which is stored only in hashed form and which we cannot read.

Booking details

• The languages, service type, interpretation method, topic, date, time and location of an appointment, or the meeting link or phone number for virtual and phone appointments.
• Notes you add to a request, such as the purpose of the appointment, dialect preferences, or an interpreter gender preference.
• For translation requests, the documents you upload and any details about them, such as document type and whether a commissioner for oaths is required. Uploaded documents often contain personal information about you or others, for example on identity documents, medical records or court papers.

Billing and payment

• Invoice and payment records, billing address and, for business accounts, purchase-order or reference numbers. We do not store full credit-card numbers on our systems.

Communications and feedback

• Messages you send through the contact form or by email, including any attachments, and ratings or reviews you leave about an assignment.

Website data

• Technical information such as your IP address, browser type, the pages you visit and the time of your visit, collected through server logs and the cookies described in the Cookies section.

04 Why we collect it

We use personal information for the following purposes and no others, unless you consent or the law requires it:

• To deliver the service: match your request with a qualified interpreter or translator, confirm appointments, deliver completed translations, and send you the confirmation and status emails you would expect.
• To bill and collect payment: prepare quotes and invoices, including month-end consolidated invoices for business accounts, and keep the financial records the law requires.
• To run your account: let you sign in, see your bookings and invoices, and, for business owners, manage team members.
• To maintain quality and safety: track interpreter certifications and performance, resolve complaints, and investigate any concern about conduct or confidentiality.
• To respond to you: answer questions sent through the contact form, by phone or by email.
• To operate and secure the website: detect abuse, keep the service available, and understand which pages are used so we can improve them.
• To meet legal obligations: respond to lawful requests from courts, regulators or law enforcement, and keep records for the periods required by tax and non-profit reporting rules.

We do not sell personal information, and we do not use it for advertising.

05 Your consent

We collect, use and disclose personal information with your knowledge and consent. How we ask depends on how sensitive the information is:

• Express consent is asked for when you create an account, submit a booking or send us a message. Each of those forms includes a consent statement and a link to this policy, and we record the date and time you agreed.
• Implied consent applies where the purpose is obvious from the service itself, for example that we will share an appointment's details with the interpreter we assign to it.
• On behalf of someone else: if you book for a family member, client or patient, you confirm that you are entitled to give consent on their behalf, and that you have told them how their information will be used.

06 Who we share it with

We share personal information only as needed to provide the service and run our organization:

• Interpreters and translators. The freelancer or staff member assigned to your request receives the details needed to do the work: names, languages, date, time, location or meeting link, topic, and any documents to be translated. See the next section for the confidentiality obligations they carry.
• Your organization. If you are a member of a business account, the account owner and staff with the relevant access level can see the bookings and invoices made under that account.
• Service providers. Companies that host our website and database, deliver our email, and process payments, each of which may only use the information to provide that service to us. Some of these providers store data outside Canada; where they do, we use contracts that require protection comparable to Canadian law.
• Professional advisers such as auditors, accountants and lawyers, bound by confidentiality.
• Where the law requires it, for example in response to a court order or subpoena, or to a regulator with lawful authority.

07 Interpreters, translators and confidentiality

Every interpreter and translator who works with CCIS signs a confidentiality agreement and follows a professional code of ethics. In practical terms this means they:

• keep everything they hear, read or learn during an assignment confidential, including the fact that the assignment took place;
• do not keep copies of documents, recordings or notes after the work is delivered, except where a certified translation requires a record be retained;
• do not contact clients outside the assignment or use client information for any other purpose; and
• report any suspected loss or misuse of personal information to CCIS immediately.

Interpreters see only the bookings assigned to them. Access to your information within CCIS is limited to staff who need it for their role.

08 How long we keep it

We keep personal information only as long as necessary for the purposes it was collected, and then for as long as the law requires us to keep records:

• Booking and invoice records are kept for seven years after the end of the fiscal year they relate to, to meet Canada Revenue Agency and non-profit reporting requirements.
• Documents uploaded for translation and the translations we deliver are kept for one year after delivery so that re-issues and corrections can be handled, and then deleted. You may ask us to delete them sooner once the work is complete and paid for.
• Account details are kept while your account is active. If you close your account, or it stays inactive for three years, we delete or anonymize the personal information in it, apart from the records above.
• Contact-form messages are kept for one year.

When information is no longer needed, it is securely deleted or anonymized so that it can no longer be linked to you.

09 How we protect it

We protect personal information with safeguards appropriate to its sensitivity, including:

• encryption of all traffic between your browser and our website (HTTPS), and of data at rest with our hosting provider;
• hashed passwords, role-based access within the application, and separate sign-in for staff, interpreters and customers;
• uploaded documents stored outside the public web folder and served only through authenticated, time-limited links;
• staff and interpreter confidentiality training and agreements; and
• logging and regular review of access to administrative tools.

If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada, and where applicable the Office of the Information and Privacy Commissioner of Alberta, as the law requires.

10 Cookies and website data

This website uses a small number of cookies, all of which are necessary for it to work:

• a session cookie that keeps you signed in and remembers the form you are filling in;
• a security token that protects forms against forged submissions; and
• an optional "remember me" cookie if you choose that option when signing in.

We do not use advertising or cross-site tracking cookies. Our contact page can show a map from Google, which sets Google's own cookies when it loads; Google's use of that information is governed by Google's privacy policy. The map loads only if you choose Accept all in the cookie notice; if you choose Essential only, we show a link to directions instead.

Your choice is remembered in a cookie of its own for six months. You can change it at any time from the Cookie preferences link at the foot of every page, and you can block or delete cookies in your browser settings, though the site will not let you sign in or submit a booking without the session cookie.

11 Your rights and choices

Under PIPEDA and PIPA you have the right to:

• Access the personal information we hold about you, learn how it has been used and who it has been disclosed to. We will respond within 30 days, and may charge a minimal fee for copies where the law allows.
• Correct information that is inaccurate or incomplete. Account holders can update most contact details under Account Settings; for anything else, contact us.
• Withdraw consent to further collection, use or disclosure, as described in the Consent section.
• Ask for deletion of information we no longer need to keep.
• Complain. If you are not satisfied with how we have handled your information or your request, you may complain to our Privacy Officer, and then to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.

To protect your information we may ask you to verify your identity before acting on a request.

12 Children and people in care

Our services are booked by adults. Interpretation for a child, or for an adult who cannot give consent themselves, must be requested by a parent, guardian, or an organization with the authority to act on their behalf. We do not knowingly create accounts for anyone under 18.

13 Changes to this policy

We review this policy at least once a year and whenever our services or the law change. The effective date at the top of the page tells you when it was last revised. If a change materially affects how we use information you have already given us, we will tell account holders by email before it takes effect.

14 How to reach us

Questions, access requests, corrections and complaints go to our Privacy Officer:

Privacy Officer, CCIS Interpretation & Translation Services

1111 — 11 Avenue SW
Calgary, Alberta T2R 0G5

Phone: 403-606-6985

Email: translation@ccisab.ca