PRIVACY Policy
INTRODUCTION AND PURPOSE
At Skyactive Creative Inc. ("we", "our", "us" and, collectively, the “Organization”), we are committed to protecting your privacy and safeguarding your Personal Information.
The purpose of this Privacy Policy (the “Policy”) is to establish a framework for the collection, use, disclosure and retention of Personal Information by us. We comply with the requirements of applicable privacy legislation, including the British Columbia Personal Information Protection Act and the federal Personal Information Protection and Electronic Documents Act (PIPEDA) where the Organization engages in commercial activities that fall within federal jurisdiction, including certain cross-border or cross-provincial activities (collectively, “Applicable Privacy Legislation”).
The Organization will only collect, use or disclose Personal Information for purposes that a reasonable person would consider appropriate in the circumstances.
The handling, use, disclosure, and protection of confidential commercial, business, and proprietary information exchanged in connection with our services are governed by the applicable Master Services Agreement (MSA) or other written agreement between the applicable parties.
DEFINITIONS
In this Policy, the following terms have the following meanings:
“Business Contact Information” means information used to contact an individual at a place of business, such as a business title, address, telephone number or email address.
“Client” means any individual that accesses services provided by the Organization.
“Employee Personal Information” means Personal Information collected, used or disclosed solely for purposes reasonably required to establish, manage or terminate an employment or contractor relationship. It does not include information unrelated to employment or contractual engagement.
“Personal Information” refers to any information about an identifiable individual, including Employee Personal Information, but does not include Business Contact Information or work product information.
“Privacy Incident” means unauthorized or accidental access, collection, use, disclosure, loss, alteration, copying or disposal of Personal Information, or a failure of a safeguard.
“Privacy Officer” means the person designated by the Organization to oversee compliance with Applicable Privacy Legislation and this Policy.
“Staff” means current and prospective employees, volunteers and contractors of the Organization.
Other terms not specifically defined in this section will have the meanings given to them elsewhere in this Policy or as otherwise defined.
SCOPE
This Policy applies to the Personal Information of Staff and Clients that is in the Organization’s control. This Policy does not apply to Business Contact Information or work product information to the extent those categories are excluded from Applicable Privacy Legislation. Other Organization policies may impose additional confidentiality, records-management, cybersecurity, or information technology requirements.
PURPOSES OF COLLECTION
Staff
The Organization collects, uses, discloses, processes, and maintains Personal Information to:
• recruit and verify qualifications, and establish, manage or end employment or contractor relationships;
• administer payroll, benefits, pensions, leave, scheduling, training, performance, succession planning and workplace investigations;
• protect worker and public safety, manage accommodations and return-to-work processes, and administer claims;
• dispatch workers, provide and improve services, control access to sites and respond to emergencies;
• administer contracts, accounts, purchases, payments, collections, warranties, claims, insurance and audits;
• administer employee health, insurance, pension and benefit plans and confirm eligibility for coverage;
• meet reasonable customer, site-access and safeguarding requirements for work performed for third parties or in third-party facilities;
• verify education, training, qualifications, certification, competency and scope of work;
• improve and evaluate the Organization’s services, including by establishing training and development programs;
• evaluate and monitor performance;
• protect the Organization’s Staff, property, assets, business, systems, confidential information and legal rights, including investigating disputes, specific incidents, suspected misconduct, fraud or security events;
• monitor compliance with policies and address security and internal control issues;
• communicate with Staff, such as with respect to important upcoming dates, changes to benefits, health and safety-related alerts and new program rollout information;
• comply with the Organization’s legal, regulatory, tax, safety, licensing, court, recordkeeping and contractual requirements; and
• fulfill other purposes identified at or before collection or otherwise permitted by law.
Clients
The Organization collects, uses, discloses and maintains Personal Information about Clients for:
• accessing, improving and evaluating the Organization’s programs and services;
• maintaining and processing referrals;
• delivery of the Organization’s services;
• processing and collecting payments securely;
• the safety and security of Clients;
• investigating and responding to accidents, safety events, misconduct and similar incidents;
• responding to Client complaints and concerns;
• providing requested product, program or service information;
• evaluating usage of our website and related applications and improving our services, performance and user experiences, including through cookies and analytics;
• communicating about quotes, proposals, projects, updates, newsletters and similar information; and
• complying with the Organization’s legal, regulatory and contractual obligations.
TYPES OF INFORMATION COLLECTED ABOUT STAFF AND CLIENTS
Staff
The information that the Organization may collect about Staff for the purposes set out in this Policy includes information such as:
• an individual’s name, contact information, social insurance number (SIN), and emergency contact information;
• information about an individual’s employment history, education and qualifications;
• scheduling, attendance, leave, vacation, dispatch and assignment records;
• background check information, which may include criminal, credit, income, reference checks or proof of eligibility to work in Canada;
• payroll, banking, tax, pension, benefit, beneficiary and dependent information;
• provincial health insurance and employee-benefit information, including coverage status plan or member numbers and, only where reasonably necessary, a Personal Health Number;
• performance, training, discipline, investigation, grievance, accommodation and return-to-work records; and
• health or functional information required for safety, accommodation, benefits or legal obligations, with diagnosis information limited wherever practicable.
Clients
The information that the Organization may collect about Clients for the purposes set out in this Policy includes information such as:
• name, personal contact details and service-location information;
• account, contract, billing, payment, credit and transaction information;
• information needed for service delivery;
• service requests, dispatch records, access instructions, communications, complaints and incident details;
• social media handles, if applicable;
• information provided by Clients to our AI applications, including voice data (see section below); and
• website or portal submissions, technical logs, cookies or analytics where Clients interact with our website.
USE OF ARTIFICIAL INTELLIGENCE AND AUTOMATED COMMUNICATIONS
The Organization uses artificial intelligence (“AI”) and automated technologies such as chatbots, virtual receptionists, automated phone applications, and recording/transcription services to manage business communications. Most of the AI technologies that we utilize are provided by GoHighLevel.
When an individual interacts with these systems, we collect the sound of the individual’s voice, their name, their contact information, the reason for their communication, and any other details the individual voluntarily provides. Our systems may automatically update our records, or generate voicemails, written summaries, or transcripts from these interactions.
The Organization processes this data to respond to inquiries; answer, transfer or route calls; relay messages; schedule appointments; maintain records; provide customer service; monitor or improve our service quality; and perform related administrative functions. Collected information and generated records are shared with appropriate Staff for review and follow-up.
We implement reasonable measures to protect Personal Information against unauthorized access, disclosure, modification, or secondary use (such as third-party AI model training). However, individuals should avoid providing highly sensitive or confidential information through an automated system unless specifically advised that the system is appropriate for receiving such information.
CONSENT AND NOTICE
The Organization collects, uses and discloses Personal Information with the knowledge and consent of Staff and Clients where Applicable Privacy Legislation requires it. Consent may be express or implied, depending on sensitivity, reasonable expectations and the circumstances. The Organization will not require consent to unnecessary collection, use or disclosure as a condition of providing a product or service.
Applicable Privacy Legislation may permit the Organization to collect, use or disclose Employee Personal Information without consent when doing so is reasonable for establishing, managing or terminating an employment or contractor relationship. The Organization will give prior notice of the collection, use or disclosure and its purposes unless a statutory exception applies. This Policy largely supports that notice but does not replace a more specific notice when required.
An individual may withdraw consent on reasonable notice, subject to legal and contractual restrictions. The Organization will inform individuals of the implications of withdrawal of consent, including where certain services or benefits may become unavailable as a result of the withdrawal. Withdrawal does not apply where the law permits or requires the Organization to proceed without consent.
HOW AND WHEN THE ORGANIZATION SHARES PERSONAL INFORMATION
The Organization shares Personal Information internally only on a need-to-know basis and information shared between our staff must be limited only to that which is necessary for the purposes of fulfilling applicable job duties.
The Organization may also share Personal Information to service providers and other recipients who require it for an authorized purpose such as payroll and benefit administrators, insurers, banks, technology and cloud providers, customer relationship management software (such as GoHighLevel), payment processors, analytics, advisors, auditors, safety authorities, and government or law-enforcement bodies where authorized or required by law.
The Organization will limit disclosures to what is reasonably required and uses due diligence, contracts, confidentiality terms and other safety controls where appropriate. A service provider may process or store information outside British Columbia or Canada, including the United States. The information may then be subject to that foreign jurisdiction’s laws and lawful access requirements. The Organization takes reasonable steps to understand where service providers store information and to require appropriate contractual, technical and organizational safeguards. Questions about service-provider locations may be directed to the Privacy Officer.
The Organization does not sell Personal Information.
PROTECTION OF PERSONAL INFORMATION
The Organization implements security safeguards to protect Personal Information against risks such as loss or theft, as well as unauthorized access, disclosure, copying, use, storage or modification. These security safeguards will vary depending on the sensitivity of the information as well as the format in which the information is held and may include:
• Physical security measures such as locked filing cabinets and restricted access;
• Organizational measures such as security clearances, access only on a “need to know” basis, training, and imposing internal limits on data to restrict access and disclosure;
• Technological measures such as the use of passwords, multi-factor authentication, firewalls and regular backups; and
• Contractual measures such as taking reasonable steps to ensure that a comparable level of protection is implemented by service providers used by the Organization.
ACCOUNTABILITY
The Organization is responsible for the Personal Information under its control. The Organization has appointed a designated Privacy Officer who is accountable for the Organization’s compliance with this Policy and with Applicable Privacy Legislation. The Organization’s Privacy Officer can be contacted by writing to:
• privacy@skyactivecreative.ca
Staff must consult the Privacy Officer before introducing or materially changing technology or practices that collect, monitor, analyze or disclose Personal Information.
The Organization investigates non-compliance with this Policy and with Applicable Privacy Legislation where the Organization has reasonable grounds to believe that Personal Information is being inappropriately collected, modified, used, stored or disclosed. Staff who fail to properly maintain the safety and security of Personal Information or who engage in unauthorized collection, access, use, modification or disclosure of Personal Information may be subject to discipline up to and including termination of their employment or contractual engagement, as applicable.
PRIVACY BREACHES
The Organization views any Privacy Incident as a serious matter. In the event of a Privacy Incident, the Organization’s response will include the following steps:
The Organization will endeavor to contain the Privacy Incident as soon as possible and/or stop the unauthorized activities, as applicable;
The Organization will designate an appropriate individual to lead an initial investigation;
The Organization will notify individuals of any Privacy Incidents involving their Personal Information under the Organization’s control if such notification is required by Applicable Privacy Legislation or as the Organization otherwise determines is appropriate to do so; and
The Organization will keep a record of Privacy Incidents involving Personal Information under its control.
Staff are expected to provide their full cooperation with any Privacy Incident investigation.
Staff must immediately report actual or suspected Privacy Incidents to the Privacy Officer. If there is any question about whether a Privacy Incident has occurred or may occur, individuals are directed to immediately consult with the Privacy Officer.
ACCURACY AND CORRECTION OF PERSONAL INFORMATION
The Organization makes reasonable efforts to ensure that Personal Information is as accurate, complete and current as required for the purposes for which it was collected. In some cases, the Organization relies on Staff and Clients to ensure that certain information about them (such as contact information) is current, complete, and accurate. Individuals are expected to inform the Organization of any updates to their Personal Information as soon as reasonably possible.
Individuals may challenge the accuracy and completeness of their Personal Information by contacting the Privacy Officer. If the Organization is satisfied that an individual’s request for correction is reasonable, the Organization will amend the information as appropriate and take further action as required by Applicable Privacy Legislation. If the Organization is not satisfied that the request for correction is reasonable, the Organization will annotate the information, noting that a correction was requested but not made.
RETENTION
If the Organization uses Personal Information to make a decision that directly affects an individual, the Organization will retain it for at least one year after use so the individual has a reasonable opportunity to obtain access. Otherwise, the Organization will retain information only as long as reasonably required for the identified purpose or a legal, regulatory, contractual, insurance, audit, limitation-period or legitimate business requirement.
The Organization will maintain or apply a retention schedule by record category. A legal hold, investigation, claim, grievance or audit suspends normal destruction. When retention is no longer required, the Organization will securely destroy or delete the information.
RIGHT OF ACCESS
An individual may make a written request to the Privacy Officer for access to Personal Information under the Organization’s control, information about its use, and information about the persons or organizations to whom it has been disclosed, subject to exceptions found in Applicable Privacy Legislation. The request must identify the individual and records sought.
The Privacy Officer will assist the individual with the access request and will respond in a manner consistent with Applicable Privacy Legislation. The Organization may take reasonable steps to verify the individual’s identity and their right to access the requested information.
The Organization will respond within the time permitted by Applicable Privacy Legislation. The Organization will assist the requester and explain any refusal, applicable exception and review rights. A fee may be charged only as permitted by Applicable Privacy Legislation, with an estimate provided before the service is performed.
CHALLENGING COMPLIANCE
The Organization will investigate and respond to any complaints or inquiries relating to its compliance with Applicable Privacy Legislation or this Policy. Complaints or inquiries are to be in writing and forwarded to the Privacy Officer. The Privacy Officer will make efforts to investigate and respond to any complaints or inquiries within the timeframe required under Applicable Privacy Legislation.
Individuals who are not satisfied with the Privacy Officer’s response may file a complaint with the British Columbia provincial Privacy Commissioner if the BC PIPA is applicable at https://www.oipc.bc.ca/for-the-public/how-do-i-make-a-complaint/ or the Federal Privacy Commissioner if PIPEDA is applicable at https://www.priv.gc.ca/en/report-a-concern/.
CHANGES TO THIS POLICY
The Organization reserves the right to make changes to this Policy at any time. Such changes will be effective when posted. Please review this Policy from time to time to become aware of any changes that have been made. This Policy can be made available in an alternative format upon request.
Effective date: October 25, 2026