Privacy Policy

Version: 2026-06-10

Privacy Policy

This Privacy Policy describes how fairhub.ca ("PUQ Software", "PUQ", "we", "us") processes personal data in connection with our websites, Client Portal, and the products and services we provide (the "Services"), including cloud services, software products, Custom Software Development, and outsourced IT services.

We are PUQ Software, a business registered in Manitoba, Canada (Business Number 785655176, Manitoba Registry Number 10266096), with its registered address at 4-397 St Anne's Rd, Winnipeg, MB R2M 3C1, Canada. In this Policy, "PUQ", "we", "us", and "our" refer to PUQ Software.

We comply with:

  • The Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada — our primary privacy regime;
  • The EU/EEA General Data Protection Regulation (GDPR) for individuals in the EU/EEA;
  • The UK GDPR and Data Protection Act 2018 for individuals in the UK;
  • The Swiss Federal Act on Data Protection (FADP) for individuals in Switzerland;
  • The California Consumer Privacy Act (CCPA/CPRA) for residents of California; and
  • Canada's Anti-Spam Legislation (CASL) for commercial electronic messages.

For any privacy question or to exercise your rights, contact [email protected].

§1 General Provisions

  1. This Policy is part of the Client Portal regulations and forms part of every agreement we conclude with you. By using the Services, you accept this Policy.

  2. We process personal data using the operations defined in PIPEDA and the GDPR, including: collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, and destruction — by automated and non-automated means.

  3. Terms used in this Policy have the meanings given in our Terms of Service or, where not defined, the meanings assigned by applicable data protection law.

§2 Personal Data We Collect

  1. We collect personal data in the following categories:

    1. Information you provide. Account name, email address, password (stored hashed), and the additional fields you complete (first and last name, position, telephone, company name, tax/registration identifiers (VAT, GST, BN, or equivalent), invoicing address, postal address, and bank account details for refunds where applicable). PUQ creates a unique internal user identifier (user_id).

    2. Order, billing, and tax records. Products purchased, invoice amounts, currency, tax classification, payment status, and proforma documents.

    3. Communications. Tickets, chat, and email correspondence with us.

    4. Technical data. IP address, browser type and version, operating system, language preference, referrer, device identifiers, and request metadata.

    5. Usage and log data. Logged activity in the Client Portal and our Services (login events, configuration changes, product downloads, API calls, security events). Logged actions are tied to your user_id.

    6. Customer Content. Data you upload to or process through our Services, including configurations and files you submit during Custom Software Development engagements.

  2. Mandatory fields are indicated at the point of collection. Other information you provide is voluntary; refusal to provide voluntary information will not affect your ability to use the core Services.

  3. We do not independently verify the accuracy of personal data you provide and rely on you to keep it current.

  4. We use Google Analytics to understand aggregate usage of our websites (page visits, traffic sources, basic device information) and to improve the Services. Analytics cookies are activated only with your consent through the cookie banner; you can decline at the banner or change your choice at any time via "Cookie settings" in the website footer. We do not use Facebook Pixel, Google AdSense, Criteo, or other third-party advertising or cross-site tracking trackers. See our Cookie Policy for the full cookie inventory.

§3 Legal Basis for Processing

  1. Where the GDPR or UK GDPR applies, we rely on the following legal bases:

    1. Contract (Art. 6(1)(b)) — to take steps before entering into and to perform our agreement with you, including delivering the Services and providing support.
    2. Legal obligation (Art. 6(1)(c)) — to comply with applicable law, including tax, accounting, and anti-fraud requirements.
    3. Legitimate interests (Art. 6(1)(f)) — to operate, secure, and improve the Services, prevent abuse, and pursue or defend legal claims, where these interests are not overridden by your fundamental rights.
    4. Consent (Art. 6(1)(a)) — for marketing communications and any optional cookies or analytics, where consent is required.

  2. Where PIPEDA applies, we process personal data based on your express or implied consent and the limited statutory exceptions where consent is not required (e.g., investigation of breaches of agreement, debt recovery, legal compliance).

§4 Children's Privacy

  1. The Services are not intended for and are not directed to children under 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without the consent required by applicable law, we will delete it promptly. If you believe a child has provided personal data to us, please contact [email protected].

§5 Purposes of Processing

  1. We process personal data to:

    1. Create and maintain your account and Client Portal profile;
    2. Conclude agreements with you electronically (via login–password or email-based simple electronic signature) for the use of the Client Portal and Services;
    3. Deliver the Services and provide support, including responding to applications submitted through the Client Portal or by email;
    4. Identify you and authenticate access to your account and any associated services;
    5. Communicate with you about account activity, security, billing, and changes to the Services or our policies (these messages are transactional and you cannot unsubscribe from them while you have an active account);
    6. Send marketing communications about our Products and Services, where you have given express consent under CASL/GDPR (you may withdraw consent at any time);
    7. Perform statistical analysis on aggregated and anonymised data to understand how the Services are used and to improve them;
    8. Keep records of received, transmitted, delivered, or processed electronic messages, files, images, audio, video, and similar materials for the periods required by law;
    9. Detect, investigate, and prevent fraud, abuse, and security incidents;
    10. Establish, exercise, and defend legal claims, and comply with legal obligations and lawful requests from public authorities.

§6 Your Rights

  1. Subject to the limitations of applicable law, you have the right to:

    1. Be informed about the personal data we collect about you and how it is used;
    2. Access your personal data and obtain a copy;
    3. Rectify inaccurate or incomplete personal data;
    4. Object to or restrict processing in the situations recognised by GDPR Art. 18 and 21 (including direct marketing);
    5. Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
    6. Erase your personal data ("right to be forgotten") where:
      • the data are no longer necessary for the purposes of collection or processing;
      • you withdraw consent and there is no other legal basis for processing;
      • you object to processing based on legitimate interests and there are no overriding grounds;
      • the processing was unlawful;
    7. Not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, except as permitted by law;
    8. Data portability — receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller, where automated processing is based on consent or contract.

  2. Under PIPEDA (Canada), you may request access to and correction of your personal information held by us, and you may withdraw consent subject to legal or contractual restrictions. You may also lodge a complaint with the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/.

  3. Under the CCPA/CPRA (California), you may request to know, delete, and correct your personal information. You may also opt out of "sale" or "sharing" of personal information — PUQ does not sell or share personal information for cross-context behavioural advertising. You may designate an authorised agent to act on your behalf.

  4. How to exercise your rights. Submit your request from the email address on your account to [email protected] or through the Client Portal. We may need to verify your identity before fulfilling a request. We respond within the timeframes required by applicable law: 30 days under GDPR (extendable by two months for complex requests), 30 days under PIPEDA (extendable up to 30 additional days), and 45 days under CCPA (extendable by 45 days). If we cannot fulfil a request, we will explain why.

  5. Right to complain to a supervisory authority. If you believe our processing infringes your rights, you may complain to your local data protection authority. In the EU, the lead authority depends on your country of residence; in the UK, the Information Commissioner's Office (ICO); in Canada, the OPC.

§7 Retention

  1. We retain personal data only for as long as necessary for the purposes set out in this Policy and to satisfy applicable legal, accounting, or reporting obligations. Typical retention periods:

    Category Retention
    Active account and Customer Content For the duration of your account and as set out in your service agreement
    Closed account records (basic identifiers and ledger of services used) Up to 7 years after account closure for tax and accounting compliance
    Invoices and tax records At least 6 years (Canadian tax requirement); longer where other laws require
    Server, security, and Client Portal log files 12 months from creation, longer if needed to investigate an incident
    Marketing consent records While consent is valid plus a reasonable period to evidence consent
    Support tickets Up to 3 years after closure

  2. When personal data are no longer required, we delete or irreversibly anonymise them.

§8 Security

  1. We apply administrative, technical, and physical safeguards designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include TLS encryption in transit, encryption at rest for sensitive data where supported, role-based access controls, principle of least privilege, audit logging, and periodic review of vendors and security practices.

  2. Personal data are kept confidential, except information that is publicly available by your choice (for example, a public profile field) or that the Service technology necessarily exposes to other Users.

  3. Breach notification. If we become aware of a personal data breach affecting you, we will notify you and the relevant authorities as required by applicable law — including the 72-hour authority notification under GDPR Art. 33 and the mandatory record-keeping and notification obligations under PIPEDA's Breach of Security Safeguards Regulations.

  4. Report security issues to [email protected].

§9 Disclosure of Personal Data — Sub-processors and Third Parties

  1. We do not sell personal data and we do not share personal data with third parties for cross-context behavioural advertising.

  2. We share personal data only with:

    1. Service providers (sub-processors) that process personal data on our behalf to deliver the Services. These currently include, among others:

      • Hetzner Online GmbH (Germany / Finland) — server and cloud infrastructure hosting our websites and the Client Portal;
      • Cloudflare, Inc. (global edge) — DDoS protection, CDN, bot mitigation, and DNS;
      • Stripe, LLC (United States) — to the extent Stripe acts as our Data Processor for core card payment processing carried out on our instruction.

      Transactional and opt-in marketing email is sent from PUQ-operated mail servers running on Hetzner infrastructure — no third-party email-delivery provider is involved. The Client Portal is built on WHMCS (commercial billing-platform software self-hosted by PUQ); WHMCS Inc. is a software vendor, not a sub-processor — customer personal data are processed exclusively on PUQ-controlled infrastructure. Sub-processors are bound by written agreements that restrict their use of personal data and require appropriate security measures.

      AES-256 encrypted backups of operational systems are stored on PUQ-owned servers located in Winnipeg, Manitoba, Canada — not with a third-party backup provider. The exact facility is not disclosed publicly for operational-security reasons.

    1a. Independent controllers — payment processors. When you pay for our Services, payment-service providers also process payment data as independent data controllers for their own purposes (such as fraud prevention, AML/KYC compliance, regulatory obligations, and product analytics). PUQ shares with them only the personal data necessary to complete the payment and any related fraud-prevention checks. They process this data under their own privacy terms: - Stripe, LLC (United States) — Stripe acts in a dual role: as our Processor for core card payment processing (see §1 above) and as independent Controller for fraud detection, AML/KYC compliance, and product analytics. Both roles are governed by the Stripe DPA (current version: 18 November 2025). Privacy: https://stripe.com/privacy - PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) for EU/EEA/UK customers and PayPal, Inc. (United States) for other regions — payment processing and related fraud prevention; PayPal acts as independent controller in respect of all customer payment data per the PayPal Data Protection Addendum. Privacy: https://www.paypal.com/privacy These providers may transfer data internationally under their own approved transfer mechanisms (Binding Corporate Rules, Standard Contractual Clauses, or equivalent). For their full terms, see the linked privacy notices.

    1. Authorities and legal proceedings — where required by law, court order, or other lawful process, or to establish, exercise, or defend legal claims.

    2. Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality and continued protection consistent with this Policy.

    3. With your consent — for any other disclosure, including disclosures you initiate from your Client Portal.

§10 International Data Transfers

  1. We are based in Canada and may transfer personal data to service providers in other jurisdictions.

  2. From the EU/EEA, the UK, and Switzerland to PUQ Software in Canada. Canada has been recognised as providing an adequate level of personal data protection by the European Commission (Commission Decision 2002/2/EC of 20 December 2001) for transfers to organisations subject to PIPEDA, by the UK government, and by Switzerland. PUQ Software is subject to PIPEDA. Accordingly, transfers from the EEA, UK, or Switzerland to PUQ Software in Canada do not require Standard Contractual Clauses or other supplementary transfer mechanisms.

  3. Onward transfers. Where our sub-processors are located outside Canada, the EEA, the UK, or Switzerland, and the destination country is not subject to an adequacy decision, we rely on Standard Contractual Clauses or equivalent UK/Swiss addenda, together with appropriate technical and organisational measures.

  4. A copy of the safeguards used for any specific transfer is available on request to [email protected].

§11 Modification, Erasure, and Account Deletion

  1. You may correct or update most personal data directly in your Client Portal at any time.

  2. To delete your account or withdraw your consent to processing, send a request from the email on your account to [email protected]. Please note that some information must be retained to satisfy legal or contractual obligations (for example, invoices for tax purposes); we will explain any such limitation in our response.

§12 Cookies

  1. Our use of cookies and similar technologies is described in our Cookie Policy. We use only essential cookies by default; analytics or advertising cookies, if introduced, will require your consent where applicable.

§13 Marketing and CASL

  1. We send marketing email only with your express opt-in consent as required by Canada's Anti-Spam Legislation (CASL) and, where applicable, GDPR. Every marketing email includes the sender's identity (PUQ Software), our physical mailing address, and a one-click unsubscribe mechanism that takes effect within 10 business days. Withdrawing marketing consent does not affect transactional or service messages necessary to operate your account.

§14 Changes to This Policy

  1. We may update this Policy from time to time. Material changes will be communicated by email to your account address or through the Client Portal at least 30 days before they take effect, where reasonably practicable. The "Last Updated" date at the top of the Policy reflects the latest revision. The previous versions of this Policy are available on request.

  2. The unilateral right to change this Policy without notice that appeared in the prior version is no longer in effect. From May 31, 2026, changes follow the notification process described above.

§15 Contact

PUQ Software Attn: Privacy 4-397 St Anne's Rd Winnipeg, MB R2M 3C1 Canada

Contact: [email protected]