Privacy policy
1. Data controller
WorkForce Tracker is operated by ColdTech Advanced Solutions LTD ("ColdTech"), based in Edmonton, Alberta, Canada. For any privacy matter, contact info@workforcetracker.ca.
2. Scope and roles
WorkForce Tracker is a B2B attendance platform contracted by companies (the "Customer"). With respect to the Customer's workers' data, the Customer acts as controller and ColdTech as a service provider processing data on the Customer's instructions. This policy also covers visitors of workforcetracker.ca and business contacts.
3. Data we process
- Worker identification: name, employee number and, if configured by the Customer, email and phone.
- Attendance records: check-in/check-out date and time, work site, and calculated hours (regular and overtime).
- Location: GPS coordinates captured at clock-in/out and site geofence verification. Location is not tracked outside the flows configured by the Customer.
- Clock-in verification photos, when the Customer enables that option.
- Tool and equipment custody: assignments, returns and digital signatures.
- Device technical data required for offline operation and synchronization.
- Customer (company) billing data: legal name, contact and subscription status.
4. Purposes
Data is processed exclusively to operate the service: recording verifiable attendance, computing hours and overtime under applicable labour law (for example Alberta's Employment Standards Code), managing on-site safety and custody, and billing the Customer's subscription. ColdTech does not sell or rent personal data, nor use it for advertising.
5. Legal framework
Processing complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA), on the basis of consent and what is reasonably required to manage the Customer's employment relationship with its workers.
6. Data residency
Production infrastructure is physically located in Edmonton, Alberta, Canada. Each Customer runs on a dedicated instance with its own database, isolated from other customers. Personal data is not transferred outside Canada to operate the service.
7. Blockchain
Integrity evidence is anchored on a private blockchain network using cryptographic fingerprints (hashes). No readable personal data is ever written on-chain: a hash cannot be reversed into the original information; it only proves, after the fact, that a record was not altered.
8. Service providers
- Stripe (billing of the Customer company's subscription; payment data is processed under Stripe's own PCI certifications).
- IONOS (email infrastructure for service notifications).
These providers only process the data necessary for their function.
9. Retention
Data is kept for the duration of the contract with the Customer and for the periods required by applicable labour and tax law. Upon termination, the Customer may request an export of its data; afterwards the instance and its database are permanently deleted.
10. Your rights
Workers may request access to or correction of their data, first through their employer (the Customer) or directly from ColdTech. You may also file a complaint with the Office of the Privacy Commissioner of Canada (OPC) or the Office of the Information and Privacy Commissioner of Alberta (OIPC).
11. Security
We apply TLS encryption in transit, per-customer physical isolation (dedicated database), role-based access control, securely hashed passwords and audit logs. Photos and documents are served only to authenticated users with the appropriate role.
12. Changes to this policy
Any material change will be published here with an updated date. Continued use of the service after a change constitutes acceptance.