Privacy Policy

1. Introduction

Indicia HR ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our background screening platform and related services. Indicia HR is a product owned and operated by Confidion Consulting & Technologies Inc., a company established in Nova Scotia, Canada.

Our privacy practices are designed to comply with the data-protection and consumer-reporting laws that apply in the jurisdictions we serve, including the frameworks described in Section 4 below.

2. Information We Collect

We may collect the following types of information:

• Account Information: Name, email address, phone number, company name, and login credentials
• Candidate Information: Personal details submitted for screening purposes, including name, date of birth, Social Security Number, address history, employment history, and education records
• Usage Data: Information about how you interact with our platform, including IP address, browser type, pages visited, and access times
• Payment Information: Billing details processed through our secure payment provider

3. How We Use Your Information

We use your information to:

• Provide and maintain our screening services
• Process and complete background checks and verifications
• Communicate with you about your account and our services
• Process payments and manage billing
• Improve and optimize our platform
• Comply with legal obligations, including FCRA requirements
• Protect against fraud and unauthorized access

4. Privacy Frameworks We Comply With

Depending on the location of the candidate and the employer, your personal information is handled in accordance with one or more of the following frameworks:

• PIPEDA (Canada) — the federal Personal Information Protection and Electronic Documents Act
• Provincial privacy legislation — including substantially similar provincial private-sector privacy laws and provincial consumer-reporting statutes where applicable
• Québec Law 25 — the Act to modernize legislative provisions as regards the protection of personal information
• GDPR (EEA) and UK GDPR — the EU General Data Protection Regulation and its UK equivalent, together with the UK Data Protection Act 2018
• FCRA (United States) — the Fair Credit Reporting Act, for screening involving US candidates or employers

5. Information Sharing and Sub-processors

We do not sell your personal information. We share information only as needed to deliver our services and as permitted by law, including with:

• Authorized Parties: Employers or organizations who have lawfully requested screening reports, in compliance with applicable consumer-reporting and privacy law
• Legal Authorities: When required by law, subpoena, or legal process

We engage a limited number of sub-processors to help operate the platform. Each is bound by contractual obligations to protect personal information under terms equivalent to those in this policy. Our current categories of sub-processors and the regions in which they process data are:

• Hosting & infrastructure security — Amazon Web Services (AWS), Canada
• Data-verification & screening sources — Canada, the United States, and other jurisdictions as required by the scope of the specific check
• Identity verification & AI/analysis providers — Canada and the United States
• Payment processing — Canada and the United States

We maintain a current list of named sub-processors and will make it available on request through our Contact Support page.

6. Data Hosting and Residency

The Indicia platform and its primary data stores are hosted on Amazon Web Services (AWS) infrastructure located in Canada. Personal information you provide is stored on this Canadian-resident infrastructure, subject to the limited cross-border transfers described in Section 7.

7. International Data Transfers

While your data is hosted in Canada, some personal information may be transferred to sub-processors located outside Canada — for example, to complete verifications that require checks in another country. Where this occurs:

• Transfers are limited to what is necessary for the specific screening purpose;
• Recipients are bound by contractual terms providing an equivalent level of protection;
• For personal data within the scope of the GDPR/UK GDPR, transfers rely on Standard Contractual Clauses (SCCs) or another lawful transfer mechanism; and
• For personal information subject to Québec Law 25, we conduct a privacy-impact assessment before transferring the information outside Québec.

Where an employer sends us personal data originating in the EEA or UK, that employer acts as the data controller for the initial transfer to us.

8. Data Security

We implement industry-standard security measures to protect your information, including encryption in transit and at rest, access controls, regular security audits, and secure data centers. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security. For more detail, see our Security page.

9. Data Breach Notification

We maintain procedures to detect, investigate, and respond to security incidents involving personal information. In the event of a breach of security safeguards that creates a real risk of significant harm, we will notify affected individuals and the appropriate authorities without undue delay and, where required, within the timelines set by applicable law. This includes assisting with reporting obligations under PIPEDA, Québec Law 25 (including notification to the Commission d'accès à l'information), and the GDPR/UK GDPR (which require notification to the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a qualifying breach). We maintain records of breaches as required by law.

10. Data Retention

We retain personal information for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Screening records are retained in accordance with applicable consumer-reporting and privacy laws (including FCRA and applicable state and provincial requirements), and operational logs are kept on short retention cycles.

11. Automated Decision-Making and Profiling

Our platform may use artificial intelligence and automated analysis to help screen and rank candidates. These tools support — but do not replace — human judgment: an authorized person is responsible for reviewing results and making final employment and eligibility decisions. Where the law grants it (including under Québec Law 25 and the GDPR/UK GDPR), you may request information about automated processing that affects you, request human review, and contest a decision based solely on automated processing.

Where our identity-verification process uses document authentication and biometric facial matching, we obtain express consent before collecting or using biometric information, in accordance with applicable law including Québec Law 25.

12. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction or rectification of inaccurate information
• Request deletion or de-indexing of your personal information
• Receive a portable copy of certain information
• Withdraw consent or opt out of certain data processing activities
• Request human review of, or contest, a decision based solely on automated processing
• Dispute information contained in a screening report (FCRA and equivalent rights)

13. Cookies and Tracking

We use cookies and similar technologies to enhance your experience, analyze usage patterns, and maintain security. You can control cookie preferences through your browser settings.

14. Children's Privacy

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date.

16. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at Contact Support.