About this policy
The Visual Thinking Company Inc. ("VTCo", "we", "us", or "our") builds civic intelligence infrastructure. Most of what we work with describes places, institutions, programs, services, and populations rather than identifiable people. Some of it is personal information, and this policy explains how we handle it.
This policy covers our websites, public applications, professional and institutional products, and related services (collectively, the "Services").
1. Privacy laws that apply to VTCo
VTCo is a private-sector organization based in British Columbia. Our handling of personal information is governed principally by British Columbia's Personal Information Protection Act, known as PIPA.
The federal Personal Information Protection and Electronic Documents Act, known as PIPEDA, may also apply to commercial activities involving personal information that crosses a provincial or national border, and in other circumstances where federal privacy law applies.
Where VTCo provides services to a public body, or to an organization subject to additional privacy, security, or data residency obligations, we may also be bound by those requirements under contract or by law.
2. Information we collect
Public websites and applications
When you use a public VTCo website or application, we collect limited technical and usage information needed to operate, secure, and improve the Service. This may include pages viewed, referring source, feature and search activity, timestamps, and device or regional information at an aggregate level.
If you send us an inquiry through our contact form, we collect the information you provide, which includes your name, work email address, organization, the products or topics you indicate an interest in, and the description of the decision you are working on. If you contact us by email or through another channel, we collect what you send us.
Professional, institutional, and commercial users
If you hold an account, purchase a Service, or enter an institutional engagement, we collect information reasonably required to provide and administer that relationship. This may include your name and contact details, organization and professional role, account and authentication information, subscription or territory information, billing and transaction records, and correspondence with us about support or account administration.
Payment information may be handled by payment service providers acting on our behalf. We collect or retain payment information only to the extent required for billing, accounting, and administration.
Civic and public source data
VTCo also collects and integrates civic information from government, institutional, and other authoritative public sources. Most of that information concerns places, infrastructure, institutions, programs, services, or aggregate populations rather than identifiable individuals. Where public source information does contain personal information, we handle it in accordance with applicable law and this policy.
3. How we use information
We may use personal information to:
- provide, operate, maintain, and improve the Services;
- administer and authenticate accounts;
- process subscriptions, licences, and payments;
- respond to inquiries and provide support;
- send service, account, and security communications;
- maintain the reliability and security of our systems;
- understand how the Services are used;
- maintain business, accounting, and legal records; and
- meet legal and regulatory obligations.
We limit collection, use, and disclosure to purposes that are reasonable in the circumstances and permitted by law.
4. Consent
We identify the purposes for which personal information is collected at or before the time of collection. Where consent is required, we obtain it in a form appropriate to the circumstances and to the sensitivity of the information.
You may withdraw consent where the law permits, on reasonable notice, subject to any legal or contractual consequence of doing so. Some information must be retained or handled without consent where a statutory exception applies.
5. Where information is held
We use service providers to support functions such as communications, security, billing, and system administration. Where a service provider processes personal information on our behalf, we limit what we provide to what the service reasonably requires, and we require appropriate safeguards. Where a service provider may access or process personal information outside Canada, that information may be subject to the laws of the jurisdiction in which it is processed.
Where VTCo has given a specific contractual commitment that information will remain exclusively within Canada, that commitment governs the Service or engagement to which it applies.
6. Disclosure of personal information
VTCo does not sell personal information.
We may disclose personal information only where reasonably necessary and permitted by law, including:
- to service providers acting on our behalf;
- to professional advisers where necessary for legal, accounting, or security purposes;
- where required or authorized by law, court order, or lawful government process;
- where reasonably necessary to protect the security, rights, or property of VTCo or others;
- in connection with a proposed or completed corporate transaction, where permitted by law and subject to appropriate safeguards; or
- with your consent, or at your direction.
Service providers that receive personal information from VTCo are required to use it only for the purposes for which it was provided, and to protect it appropriately.
7. Security
We make security arrangements appropriate to the sensitivity of the information under our control. These include access controls, authentication controls, encryption of information in transit, restricted administrative access, and logging.
No system can be guaranteed completely secure. We review our safeguards as our Services and infrastructure change. Where a privacy or security incident occurs, we investigate it, take appropriate remedial action, and give notice where required by law.
8. Retention
We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, and to meet legal, regulatory, accounting, security, and business requirements.
When identifiable personal information is no longer required, we destroy it or remove the means by which it can be linked to an identifiable individual, subject to any applicable retention requirement.
9. Access and correction
You may ask for access to personal information about you that is under our control, and you may ask us to correct information you believe is inaccurate or incomplete.
Requests are subject to the rights, exceptions, and time limits set by applicable privacy law. We may need to verify your identity before responding. Send requests to our Privacy Officer using the contact details in section 11.
10. First Nations, Métis, and Inuit data governance
VTCo distinguishes between publicly released aggregate information about Indigenous populations and information entrusted to VTCo by an Indigenous government, organization, or community under a specific data governance relationship.
Where VTCo is entrusted with data governed by a First Nation, we follow the requirements established by that First Nation and respect the First Nations Principles of OCAP®, being Ownership, Control, Access, and Possession, as that Nation applies them.
Where VTCo is entrusted with data governed by a Métis or Inuit government, organization, or community, we follow the governance protocols established for that information.
Use of publicly released aggregate information from sources such as Statistics Canada does not imply that VTCo owns any underlying Indigenous knowledge, or that any Indigenous community has reviewed or endorsed our use of that information.
OCAP® is a registered trademark of the First Nations Information Governance Centre.
11. Accountability, questions, and complaints
VTCo designates a Privacy Officer responsible for overseeing compliance with applicable privacy requirements and with this policy.
Questions about this policy, requests for access or correction, withdrawals of consent, and privacy complaints can be sent to:
Privacy Officer
The Visual Thinking Company Inc.
Vancouver, British Columbia, Canada
privacy@thevisualthinkingcompany.com
We review privacy complaints and respond in accordance with applicable law.
You may also contact the Office of the Information and Privacy Commissioner for British Columbia about matters governed by British Columbia privacy law, or the Office of the Privacy Commissioner of Canada about matters within federal jurisdiction.
12. Changes to this policy
We may update this policy as our Services, infrastructure, and legal obligations change. When we make a material change, we update the effective date at the top of this page and, where appropriate, give additional notice through the affected Service. The version published here is the current version.