Legal
Privacy Notice
This Privacy Statement (“Notice”) explains how Toogood Financial Systems Inc. and Convexus Managed Services Inc., both operating as Chronicle Financial Technologies (collectively, “Chronicle,” “we,” “us”), collect, use, disclose, retain, and protect personal information, and how individuals (“Data Subjects”) can contact us or exercise their privacy rights.
Scope
- This Notice applies to personal information processed by Chronicle in the course of providing our products and services, operating our business, and managing our website.
- Where Chronicle processes personal information on behalf of a client (as a service provider/processor), the client’s own privacy notice may also apply.
- This Notice describes our handling of personal information under all applicable Canadian federal and provincial private-sector privacy laws, to the extent applicable to Chronicle’s activities described in this Notice.
Entities and activities covered
This Notice covers:
- Toogood Financial Systems Inc. and Convexus Managed Services Inc., both operating as Chronicle Financial Technologies, and their respective workforces (employees and contractors) when performing business operations and delivering services.
- Our clients (and their authorized representatives) when Chronicle processes personal information on a client’s behalf to provide contracted services.
- Service providers / subprocessors that support Chronicle’s operations (e.g., hosting, security, etc.) where they may process personal information under contract and appropriate safeguards.
The activities covered include: providing and supporting our products and services, operating and securing our systems, administering billing/accounting, managing client relationships, recruiting/employment administration, and operating/optimizing our website.
Purpose for collecting personal information
We collect and use personal information for purposes including:
- providing and performing our products and services
- improving our products and services
- initiating, maintaining, and developing client relationships (including communicating product and service information)
- administering billing, accounting, and security measures in relation to our business
- delivering and operating our website, monitoring its security, troubleshooting issues, and analysing website traffic
Types of personal information we may collect
Chronicle collects only the personal information reasonably necessary to support the purposes described in this Notice, deliver contracted services, and operate our business.
Depending on the relationship and service being provided, we may collect or receive personal information such as:
- contact and identification information
- account, authentication, and access information (e.g., usernames, access logs)
- recruitment/employment-related information (when individuals apply for roles)
- information submitted through Jotform-hosted demo request forms linked from our website, including your name, email address, telephone number, company name, and selections describing your organization’s business activities and the Chronicle solutions you are interested in
- technical information received by Jotform, such as your IP address when you open a demo request form through a link or button on our website, as described under “Cookies and similar technologies”
- technical information recorded through Cloudflare when you visit our website, including access time, IP address, country, and whether you use a desktop or mobile device
How we collect personal information (methods of collection)
We collect personal information through:
- direct interactions (e.g., communications, forms, contractual onboarding)
- our clients or their authorized representatives, when they provide personal information to us for processing in connection with services
- our website and related technologies (see “Cookies and similar technologies” below)
Personal information may be handled through Chronicle’s software applications, business communication systems, and support/ticketing systems, depending on the relationship and service being provided.
Sources of personal information (when not collected directly)
In addition to information collected directly from individuals, we may receive personal information from:
- our clients and or their vendors, when they provide data to us for processing or support
- service providers that support our operations (e.g., cloud hosting, security tooling), subject to contractual and security safeguards
- public or professional sources where appropriate for business operations and legal compliance
Choice and consent
- Where required, we obtain consent for the collection, use, and disclosure of personal information.
- Consent may be express or implied, and may be obtained in written or oral form as appropriate.
- Individuals may withdraw consent where applicable, subject to legal and contractual restrictions, and with the understanding that withdrawal may affect our ability to provide requested services.
Disclosure to third parties
We may disclose personal information:
- to third-party service providers that support our operations, under written agreements and appropriate privacy and security safeguards;
- as directed by our clients or as necessary to provide the contracted services on their behalf;
- where required or authorized by applicable law.
Where website information is processed
Chronicle is based in Ontario, Canada. Third-party services used on or linked from our public website, including Jotform-hosted demo request forms, may process website visitor information outside Canada, including in the United States. This may include information submitted through a demo request form and technical information received by these providers when their services load, as described under “Cookies and similar technologies.”
Website information processed outside Canada is subject to the laws of the jurisdiction where it is processed and may be accessible to courts, law enforcement, national security, or regulatory authorities in that jurisdiction. For service providers processing personal information on our behalf, we use contractual and other safeguards intended to provide a comparable level of protection. These safeguards cannot override applicable foreign laws or lawful orders.
Personal information processed on behalf of clients in connection with our software applications and contracted services is governed by the applicable client agreement and applicable privacy law, including any requirements concerning where that information may be stored or processed. The website processing described in this section does not change those requirements.
Retention and disposal
- We retain personal information for as long as necessary to fulfil the purposes for which it was collected, including responding to enquiries and managing prospective or ongoing business relationships, and to meet applicable legal, regulatory, and contractual requirements.
- Demo request records stored in Jotform are deleted one year after submission.
- Website access information recorded through Cloudflare is retained for 30 days.
- Personal information processed on behalf of clients through our software applications or contracted services is retained and disposed of in accordance with the applicable client agreement, client instructions, and applicable legal requirements.
- When personal information is no longer required for these purposes, we securely dispose of it using procedures appropriate to the medium, including paper records, electronic records, and physical storage or transfer media.
Security for privacy
We protect personal information using reasonable physical, technological, and administrative safeguards, including:
- access controls based on a need-to-know basis
- secure storage and transmission practices
- monitoring and incident response processes
- confidentiality obligations and privacy/security training
- controls for contractors/consultants under written agreements and supervised access
If a breach of security safeguards involving personal information under Chronicle’s control meets the notification threshold under applicable privacy law, we will notify affected individuals and report it to the appropriate privacy regulator within the legally required timeframe. We maintain records of breaches and confidentiality incidents as required by applicable law.
Where a confirmed data breach involves personal information we process on behalf of a client through our software applications or contracted services, we will notify the client without undue delay following confirmation and within any timeframe required by applicable law or our agreement. We will assist the client with its investigation and any required notifications, while fulfilling any legal obligations that apply directly to Chronicle. Where applicable law or our agreement requires earlier notification of a suspected incident, we will notify the client accordingly.
Quality and accuracy
- We aim to keep personal information we maintain for our own purposes accurate, complete, and up to date as reasonably required.
- When we process personal information on behalf of a client, the client is responsible for the accuracy and completeness of that information.
Access and individual rights
- Individuals may request access to personal information that Chronicle holds for its own purposes and request correction where they believe it is inaccurate or incomplete.
- Where a correction is warranted, we will amend the information and, where appropriate, notify third parties to whom it has been disclosed. If a challenge remains unresolved, we will record it and, where appropriate, communicate it to relevant third parties.
- For personal information we process on behalf of a client through our software applications or contracted services, access and correction requests should be directed to that client. Chronicle will assist the client as appropriate.
- Individuals may withdraw consent as described under “Choice and consent.”
- Individuals may request deletion of personal information submitted through Jotform-hosted demo request forms linked from our website. We will assess and respond to the request in accordance with applicable privacy requirements. We may retain information where necessary for an ongoing business relationship or to meet legal, regulatory, or contractual requirements, and will explain any limits on our ability to fulfil the request.
- Requests may be submitted using the contact details below. We respond within the time limits required by applicable privacy law.
- Some requests may be refused where permitted or required by law; if so, we will provide reasons.
Monitoring and enforcement
- We maintain procedures to receive, investigate, and respond to complaints and inquiries about our handling of personal information.
- We respond to privacy inquiries, complaints, and disputes within applicable legal time limits and any additional response requirements under the applicable client agreement. Where neither specifies a timeframe, we respond within a reasonable timeframe.
- We may take appropriate corrective measures, including updating policies and practices.
- We may apply disciplinary measures to enforce employee privacy responsibilities.
- If you are not satisfied with our response to a privacy concern, or have not received a response within the applicable legal timeframe, you may contact the appropriate privacy regulator. This may include the Office of the Privacy Commissioner of Canada (opens in a new tab) or, where Quebec privacy law applies, the Commission d’accès à l’information du Québec (opens in a new tab). Their websites explain the applicable complaint and review procedures.
Contact us
To ask questions, submit requests, or raise concerns about privacy:
- Email: [email protected] (Attn: Privacy Officer)
- Mail: 169 Enterprise Blvd, Suite 401, Markham, ON L6G 0E7 (Attn: Privacy Officer)
Communicating changes to this Notice
We communicate changes to this Notice as follows:
- All changes: We update the publicly available Notice.
- Retention of prior versions: Prior versions of this Notice are retained and are available on request.
- Material changes: Where a change materially affects how personal information is collected, used, disclosed or retained, we will provide appropriate notice in accordance with applicable law and our client agreements.
Effective date and updates
We may update this Notice from time to time. The current version is published at chroniclefintech.com/privacy, and the effective date above identifies when that version takes effect.