Privacy policy

Privacy Policy

CSO Services 4 U ("CSO Services 4 U," "we," "us," or "our") provides a WorkSafeBC compliance, safety, and HR management platform for businesses operating in British Columbia (the "Services"). Our storefront and billing are powered by Shopify. This Privacy Policy explains how we collect, use, and disclose personal information when you visit our website, purchase or use our Services, or interact with us directly.

Because of the nature of our platform, this policy covers two different relationships, described below: (1) our relationship with you, the business that subscribes to our Services, and (2) our relationship with your employees' data, which you submit to the platform for compliance management purposes.

By using our Services, you acknowledge that you have read and understood this Privacy Policy.

Two Types of Personal Information We Handle

1. Subscriber Information (you, as our customer)

This is information about you and your business as a CSO Services 4 U subscriber — your account, billing, and how you use our website and platform. We are the controller of this information, meaning we decide how and why it's collected and used.

2. Employee & Compliance Data (submitted on behalf of your workers)

This is information you or your authorized users input into the platform about your employees — for example, certifications, toolbox talk attendance, project assignments, and safety records — in order to manage WorkSafeBC compliance. We process this information on your behalf, as a service provider (processor), not as its owner. You remain responsible for ensuring you have the right to collect and share this data with us, and for responding to your employees' privacy requests about it. We will assist you with such requests where required.

Information We Collect

Subscriber account information: name, business name, billing address, phone number, email address, username, password, and account preferences.

Payment information: processed through Shopify and our payment processor. We do not directly store full credit card numbers.

Subscription & usage information: your plan tier, billing history, and how you interact with the dashboard and platform features.

Employee & compliance data (entered by you): employee names, contact details, certification records, training and toolbox talk history, project assignments, scope-of-work entries, and related file attachments (e.g. certificates, documents) that you or your authorized users upload.

Communications: information you share when contacting our support team.

Device & usage information: IP address, browser type, and general usage data collected automatically when you access our website or platform.

How We Use Personal Information

To provide the Services — creating and maintaining your account, processing subscription payments, enabling access to the compliance dashboard, and supporting the employee/certification records you manage on the platform.
To communicate with you — account notifications, support responses, and service updates.
For security and fraud prevention — authenticating accounts and protecting the platform and your data.
For legal compliance — responding to valid legal requests and enforcing our terms.
For marketing (subscriber information only) — with your consent where required, we may send you information about plan updates or relevant features. You can opt out at any time.

We do not use employee/compliance data you submit for marketing or advertising purposes, and we do not sell it.

How We Disclose Personal Information

We may share personal information with:

Shopify, which hosts our storefront and processes subscription payments.
Assembly, our workspace platform provider, which hosts your compliance dashboard and the employee/compliance data you submit.
Service providers who support hosting, IT, customer support, and analytics on our behalf, under confidentiality obligations.
Legal authorities, where required to comply with the law or valid legal process.
A successor business, in the event of a merger, acquisition, or sale of assets.

We do not sell personal information, and we do not share employee/compliance data with third parties for their own marketing purposes.

Where Your Information Is Stored

Our Services are operated from Canada, and your information is generally stored and processed within Canada through our hosting and platform providers. We do not currently offer our Services to customers in the European Union or United Kingdom, and this policy does not address EU/UK data transfer requirements.

Children's Data

Our Services are intended for business use and are not directed at children. We do not knowingly collect personal information from children. If you believe a child's information has been submitted to our platform, contact us and we will address it.

Data Security & Retention

We use reasonable technical and organizational measures to protect personal information, including access controls appropriate to the sensitivity of compliance and employee data. No system is completely secure, and we cannot guarantee absolute security.

We retain subscriber information for as long as your account is active and as needed to comply with legal and accounting obligations. We retain employee/compliance data for as long as your subscription is active, or as instructed by you; upon cancellation, you may request an export of your data, and we will delete it in accordance with our data retention practices unless a longer retention period is required by law.

Your Rights

Under Canadian privacy law — including the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA) — you have the right to:

Access the personal information we hold about you.
Correct inaccurate personal information.
Withdraw consent for optional uses, such as marketing communications, subject to legal or contractual restrictions.
Request deletion of your personal information, subject to our legal and business retention requirements.

If you are a subscriber submitting employee data on behalf of your business, requests from your employees about their own information should generally be directed to you as their employer; we will support you in responding to such requests as needed.

To exercise these rights, contact us using the details below. We may need to verify your identity before processing a request.

Complaints

If you have concerns about how we handle personal information, please contact us first so we can address it. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada or, for BC-specific matters, the Office of the Information and Privacy Commissioner for British Columbia.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the revised policy here and update the "Last updated" date.