PoomAt

1. Introduction

Welcome to PoomAt's Privacy Policy. We respect your privacy and are committed to protecting your personal data. This privacy policy will inform you about how we look after your personal data when you visit our website and tell you about your privacy rights and how the law protects you.

This policy applies to all personal information we collect through our website, mobile applications, and related services. Please read this policy carefully to understand our practices regarding your personal data.

2. Data We Collect

We collect and process the following types of personal data:

Identity: Name, date of birth (for helpers, verification status)
Contact: Email, phone, mailing address
Account: Role, preferences, saved settings
Business Info: Company name, business registration number, and tax ID (for company helpers)
Usage: Pages visited, interactions, device and browser information, IP address
Location: Approximate location for service matching; Precise location (with consent) for real-time tracking
Payments: Tokenized payment method details (brand, last4, expiry); no full card numbers stored
Verification: Results from identity and safety screening providers (statuses and metadata, not full documents)

We also collect, use and share Aggregated Data such as statistical or demographic data. Aggregated Data may be derived from your personal data but is not considered personal data as it does not directly or indirectly reveal your identity.

3. How We Use Your Data

We use your personal data for the following purposes:

To register you as a new user and create your account
To provide and maintain our service, including matching clients with helpers
To process and complete transactions, and send related information including confirmations
To manage our relationship with you, including notifications about changes to our terms or privacy policy
To provide customer support and respond to your requests
To personalize your experience and deliver content relevant to your interests
To improve our website, products, and services
To protect the security and integrity of our platform
To verify helper identity and perform safety screening as applicable
To comply with legal obligations and resolve disputes

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason compatible with the original purpose.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

Contract: To provide the platform and facilitate bookings
Legitimate Interests: Platform safety, fraud prevention, product improvement
Legal Obligation: Compliance with applicable laws and regulations
Consent: Where required (e.g., certain marketing, location services)

5. Data Security

We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, accessed, altered, or disclosed in an unauthorized way. These measures include:

Encryption in transit and at rest for sensitive data
Secure authentication and session management
Least-privilege access controls
Regular security testing and monitoring
Third-party assessments where applicable

We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

6. Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process your personal data, and whether we can achieve those purposes through other means.

7. Your Rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data, including the right to:

Access: Request access to your personal data
Correction: Request correction of your personal data
Erasure: Request erasure of your personal data
Restriction: Request restriction of processing your personal data
Portability: Request transfer of your personal data
Objection: Object to processing of your personal data
Withdraw Consent: Withdraw consent where we rely on consent to process your personal data

You can exercise these rights by contacting us using the details provided in the "Contact Us" section below. These rights may be limited in some circumstances by local law requirements.

We aim to respond to requests within 30 days as required by Canadian privacy laws. Where permitted, we may extend this period with notice if a request is complex or numerous.

8. Third-Party Data Sharing

To provide our services effectively, we may share your personal data with trusted third-party service providers and partners. This includes:

Payments: Payment processors to store tokenized methods and process transactions
Verification: Identity and safety screening providers (status only, no full documents shared)
Communications: Email/SMS providers for notifications and support
Analytics: Providers that help improve performance and user experience
Tax Authorities: To comply with tax reporting obligations (e.g., CRA, Revenu Québec)
Legal: Authorities or advisors when required by law

Important: We only share data that is necessary for service provision and ensure all third parties maintain appropriate security measures and comply with applicable privacy laws. We never sell your personal data to third parties for marketing purposes.

9. International Transfers

We may transfer your personal data to countries outside your country of residence, including to countries that may not provide the same level of data protection as your home country. We ensure appropriate safeguards are in place to protect your personal data in these cases.

Where required, we use standard contractual clauses or other approved transfer mechanisms. Our service providers may process data in the United States and other jurisdictions. Details are available upon request.

10. Third-Party Links

Our website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.

11. Contact Us

If you have any questions about this Privacy Policy, you can contact us:

By email: support@poomat.com
By visiting our contact page

12. Changes to This Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this page. You are advised to review this Privacy Policy periodically for any changes.

13. Canada-wide (PIPEDA) and Quebec (Law 25)

13.1 PIPEDA (Canada)

We follow the principles of the Personal Information Protection and Electronic Documents Act (PIPEDA), including accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance.
You may request access to, correction of, or deletion of your personal information, subject to legal limitations. We will respond within timelines required by law.
We maintain safeguards appropriate to the sensitivity of the information and notify you of breaches as required by law.

13.2 Quebec Law 25 (Act to modernize legislative provisions as regards the protection of personal information)

For Quebec residents and processing subject to Quebec law, we comply with Law 25 requirements, including privacy impact assessments for high-risk projects, maintaining a person in charge of personal information, and enhanced transparency.
We honor Quebec-specific rights such as the right to be informed, to access, to correction, and to request cessation of dissemination (de-indexing) where applicable under law.
Cross-border transfers involving Quebec residents are conducted with appropriate safeguards and disclosures, including information on the jurisdictions where data may be communicated.
If a French version of this policy is provided, it will prevail for Quebec consumers in case of discrepancy.
For minors under 14 years of age, consent must be given by the holder of parental authority or by a guardian.

14. Marketing Communications (CASL)

We send marketing communications only with your consent, as required by Canada's Anti-Spam Legislation (CASL). You can withdraw consent at any time by using the unsubscribe link in our emails or by contacting us.

Transactional or service-related emails (e.g., receipts, booking updates) may still be sent as they are necessary to provide our services.
You can update your marketing preferences in your account settings or by contacting support.
Our physical mailing address is: [Insert Physical Address, City, Province, Postal Code]

15. Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. If this changes, we will provide clear notice and you will have the right to request human review and to present observations, consistent with applicable laws (including Quebec Law 25).

16. Supervisory Authorities and Complaints

If you are not satisfied with our response to a privacy request, you may contact the relevant privacy authority:

Office of the Privacy Commissioner of Canada (OPC): priv.gc.ca
Quebec — Commission d'accès à l'information (CAI): cai.gouv.qc.ca

17. Person in Charge of Personal Information (Privacy Officer)

We designate a person in charge of personal information (Privacy Officer). You can reach our Privacy Officer at support@poomat.com.