Canada Privacy — PIPEDA & Law 25

Who this applies to

This page applies to customers and users located in Canada. It explains how DashboardFox handles personal data under Canada's federal privacy law — the Personal Information Protection and Electronic Documents Act (PIPEDA) — and, for Quebec residents, the additional requirements of Quebec Law 25 (Act respecting the protection of personal information in the private sector, as amended by Bill 64).

This page supplements our main Privacy Policy, which describes what personal data we collect, how we use it, and how to exercise your rights. Read this page alongside the Privacy Policy for the complete picture.

Accountability

5000fish, Inc. is accountable for the personal information under its control and has designated a privacy contact responsible for compliance with PIPEDA. All privacy inquiries and data access requests from Canadian customers should be directed to:

Consent

We collect, use, and disclose personal information only with your knowledge and consent, except where the law permits otherwise. When you register for DashboardFox, create an account, or accept our Terms of Service, you consent to the collection, use, and disclosure of personal information as described in our Privacy Policy.

You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting us at team@dashboardfox.com. Note that withdrawing consent may mean we are unable to continue providing some or all of the Service to you.

Limiting collection, use, and disclosure

We collect only the personal information necessary for the identified purposes — operating DashboardFox, processing payments, providing support, and communicating with you. We do not collect personal information indiscriminately. We do not sell personal information or share it with third parties for advertising purposes.

Personal information is disclosed only to the sub-processors required to deliver the Service, each bound by contractual data protection obligations. Our full sub-processor list is available at Sub-processor Registry.

Transfers outside Canada

DashboardFox is operated by 5000fish, Inc., a US corporation, meaning personal data collected from Canadian customers is transferred to and processed in the United States. We take reasonable steps to protect personal information during transfers and require sub-processors to maintain equivalent protections.

One of our sub-processors, BetterMode (community forum), is headquartered in Canada. Canada has received an adequacy finding from the EU Commission for PIPEDA-covered transfers, which reflects the strength of Canada's privacy framework.

By using the Service, Canadian customers acknowledge that their personal information will be processed in the United States and other jurisdictions where our sub-processors operate, and that it may be subject to access by law enforcement or regulatory authorities in those jurisdictions.

Quebec Law 25 — additional requirements

Quebec residents have additional rights and protections under Law 25, which came into full effect in September 2023. The following provisions apply specifically to Quebec residents:

Privacy impact assessments

Before any new cross-border transfer of personal information or implementation of technology with significant privacy implications, we conduct a privacy impact assessment (PIA) to ensure adequate protection is in place.

Right to data portability

Quebec residents have the right to request a copy of their personal information in a structured, commonly used, technological format, and to have it communicated to any person or body authorized by law to collect such information. To submit a portability request, contact team@dashboardfox.com.

Right to de-indexation

Where personal information is made publicly accessible through our platform (for example, in a public-facing report or dashboard), Quebec residents may request that such information be de-indexed or that hyperlinks providing access to it be removed, where the dissemination of the information contravenes the law or a court order.

Breach notification — Quebec

In the event of a confidentiality incident (data breach) that presents a risk of serious injury to a Quebec resident, we are required to notify the Commission d'accès à l'information (CAI) within 72 hours of becoming aware of the incident. Affected Quebec residents will also be notified in accordance with our Breach Notification Policy.

Your rights under PIPEDA

Under PIPEDA, you have the right to:

• Access — request access to your personal information held by us, and information about how it has been used and to whom it has been disclosed
• Correction — request correction of inaccurate or incomplete personal information
• Withdraw consent — withdraw consent to the collection, use, or disclosure of your personal information, subject to legal and contractual restrictions
• Challenge compliance — challenge our compliance with PIPEDA by contacting our privacy contact, and if not satisfied, by filing a complaint with the Office of the Privacy Commissioner of Canada

We will respond to access requests within 30 days. If we require more time, we will notify you within the initial 30-day period and explain the reason for the extension.

Supervisory authority

If you are not satisfied with our response to a privacy concern, you may file a complaint with:

Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, Quebec K1A 1H3
priv.gc.ca — 1-800-282-1376

Quebec residents may also contact the Commission d'accès à l'information (CAI):
cai.gouv.qc.ca