Waves of Joy Consulting
Privacy Policy
Effective November 2, 2026 · Version 2026-11-02
Who is responsible
TradeRoots is operated by Waves of Joy Consulting. Our Privacy Officer can be reached at info@traderoots.ca or by mail at 25 Governors Lane, Stratford, PE C1B 1M2, Canada. This policy explains our handling of personal information for Canadian customers, businesses, workers and apprentices. It addresses applicable Canadian federal and provincial privacy requirements, including PIPEDA and the private-sector laws of Québec, Alberta and British Columbia.
Information and purposes
We collect account names, email addresses, password hashes, authentication factors and security events to provide secure access. Company records may include staff contact details, roles, credentials, training, skill evidence, hours, approvals, jobs, schedules, customer requests, messages, contracts, invoices, bank-account details and uploaded transactions. You choose what to enter; do not upload bank passwords, payment-card security codes, SINs or unrelated sensitive records. We use records to deliver the features you request, support you, prevent misuse, maintain accounts and meet legal obligations. Marketing uses a separate email subscription.
Company records and your passport
A company determines the purposes and authorized access for its workplace and customer records. Contact that company about those records; we assist it with requests and protect other people’s information. Your personal TradeRoots account and portable passport remain associated with you when employment ends. Ending a membership removes that company access, while the company retains its business records and you retain eligible personal training and hours evidence. A new employer does not automatically receive your previous employer’s confidential records.
Sharing and public information
Authorized coworkers, supervisors and customer-account holders receive only the access assigned to their role or relationship. Work enquiries and job applications are shared with the business you select. Opted-in directory listings, published vacancies, articles and reviews are public. Review publication requires an explicit choice and a public display name. Service providers process information for hosting, storage and email delivery. We do not sell personal information. We may disclose information when legally required or to investigate abuse and protect rights, subject to applicable law.
Storage, transfers and safeguards
Hosting and email services are supplied through Namecheap. Their infrastructure and support may involve processing outside your province, including outside Québec and Canada, where local authorities may have lawful access. See Service providers for current arrangements. We use access controls, encrypted private databases and uploaded files, protected credentials, encrypted backups and security monitoring. Access to encryption keys is restricted separately from data directories. Encryption does not eliminate every risk. We assess service-provider changes and transfers before introducing them, and complete privacy impact assessments where required.
Retention and deletion
We keep information for the purposes described, contractual requirements and applicable retention obligations. Company administrators determine appropriate workplace-record retention and legal holds. Account closure and deletion requests are reviewed before action so we do not delete another person’s records, evidence required by law or records subject to a dispute. Backups rotate on a thirty-day schedule; deletion may remain in isolated backups until rotation, and restoration must reapply outstanding deletion instructions. Security, consent and incident records may require longer retention. We maintain an incident register for at least five years.
Your choices and rights
You may request access, correction, withdrawal of optional consent, account closure, deletion where applicable and a structured copy of eligible personal information, including portability where required. Use Privacy requests or email the Privacy Officer. We verify identity proportionately and respond within the applicable legal period, generally thirty days, with any permitted extension explained. Withdrawal does not undo lawful processing already completed and may limit features that require the information. We explain any refusal and available review rights. You may complain to the Privacy Officer and to the applicable privacy regulator.
Young people, decisions and changes
TradeRoots is for people aged sixteen or older. A minor who cannot enter a binding contract must have the authorization required by their province and use an employer-managed relationship where appropriate. We do not knowingly collect information from children under fourteen. Skill and eligibility suggestions support human decisions; they are not a government certification, hiring decision or Red Seal approval. We publish dated policy updates and seek new consent when required for a materially different use of information.
25 Governors Lane, Stratford, PE C1B 1M2, Canada
info@traderoots.ca · Make a privacy request