Privacy Policy

Qorum is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how Qorum (“Qorum,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information in connection with our association management platform, available at qorum.ca.

This policy is written to comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Schedule 1 of which establishes ten fair information principles that form the legal foundation of this document. Where our platform serves individuals located in Quebec, we also comply with Quebec’s Act respecting the protection of personal information in the private sector, as modernized by Law 25 (formerly Bill 64), which is fully in force as of September 22, 2024. Where our platform serves individuals in Alberta or British Columbia, we comply with those provinces’ respective Personal Information Protection Acts (PIPA), which are substantially similar to PIPEDA.

We encourage you to read this policy in full. If you have questions about any part of it, please contact us using the information in Section 14.

1. Who We Are and Who This Policy Covers

Qorum operates a software-as-a-service (SaaS) platform that enables professional associations, clubs, and similar organizations (each, an “Organization”) to manage their memberships, events, communications, and related administrative functions. Qorum provides this platform to Organizations as a service, and processes personal information both on behalf of Organizations (as a data processor) and in connection with its own operations (as a data controller).

This policy applies to:

• Organization administrators — individuals who subscribe to, configure, and manage the Qorum platform on behalf of their Organization
• Members — individuals who create member accounts within an Organization’s portal, register for events, or otherwise interact with the platform
• Guests — individuals who register for events without creating a member account
• Visitors — individuals who visit any Qorum-powered website

Qorum’s role vs. the Organization’s role:

When you interact with an Organization’s portal (for example, as a member of a professional association using Qorum), that Organization is independently responsible for its own privacy practices, including how it handles the personal information it collects from you, how it communicates with you, and how long it retains your information. Qorum processes your information on that Organization’s behalf, in accordance with this policy and our agreements with the Organization.

If you have questions about how a specific Organization handles your personal information, please contact that Organization directly.

2. PIPEDA Principle 1 — Accountability

Qorum is accountable for all personal information under our control, including personal information that we transfer to third-party service providers for processing.

Designated Privacy Contact:

Qorum has designated an individual responsible for our organization’s privacy compliance. This person is the point of contact for all privacy-related inquiries, access requests, correction requests, and complaints. Contact information is provided in Section 14.

Third-Party Accountability:

When we transfer personal information to third-party service providers (see Section 7), we do so under contractual arrangements that require those parties to maintain privacy protections comparable to our own. We take responsibility for ensuring that our service providers handle personal information in a manner consistent with this policy and applicable Canadian privacy law.

Privacy Management:

We maintain internal policies and procedures to give effect to this Privacy Policy, including policies for data access, employee training, breach response, and retention and destruction of personal information.

3. PIPEDA Principle 2 — Identifying Purposes

We identify the purposes for which we collect personal information at or before the time of collection. We do not use personal information for purposes other than those identified in this policy without first obtaining your consent, except as required or permitted by law.

The purposes for which we collect personal information are described in detail in Sections 5 and 6 of this policy.

4. PIPEDA Principle 3 — Consent

4.1 How We Obtain Consent

We obtain your consent before or at the time we collect personal information, except where the law permits or requires collection without consent. Depending on the sensitivity of the information and the context of collection, consent may be:

• Express consent — actively provided by you through account registration, event registration, or explicit opt-in actions (used for all standard data collection on this platform)
• Implied consent — inferred from your actions in the context of an existing relationship (for example, an existing member providing updated contact information)

When you create an account, register for an event, or subscribe to an Organization’s communications, you are consenting to the collection, use, and disclosure of your personal information as described in this policy.

4.2 Withdrawing Consent

You may withdraw your consent to our use of your personal information at any time, subject to legal and contractual restrictions and reasonable notice. To withdraw consent, contact us using the information in Section 14 or, where applicable, use the privacy controls available in your member profile.

Please be aware that withdrawing consent may limit our ability to provide certain services to you. For example, withdrawing consent to the use of your email address will prevent us from delivering event registration confirmations, password reset emails, and Organization communications.

4.3 Consent and Minors

We do not knowingly collect personal information from individuals under the age of 14 without the consent of a parent or guardian. In accordance with Quebec’s Law 25, for users under 14 who are located in Quebec, we require verified parental or guardian consent before collecting personal information.

If you believe we have inadvertently collected personal information from a minor without appropriate consent, please contact us immediately using the information in Section 14.

5. PIPEDA Principle 4 — Limiting Collection

We limit our collection of personal information to what is reasonably necessary to fulfill the identified purposes. We collect personal information by fair and lawful means only.

5.1 Information You Provide Directly

Account and profile information:

When you create an account on the Qorum platform, we collect your first name, last name, and email address. These are required to authenticate your identity and provide access to the platform. Optional profile fields that you may choose to complete include your job title, company or organization name, province, phone number, and a short biographical statement.

Event registration information:

When you register for an event as a member, we use the name and email address already associated with your account. When you register as a guest (without an account), we collect your first name, last name, and email address. You may also be asked to provide your company or organization name. If an event includes optional registration questions, your responses to those questions are collected only if you choose to provide them.

Subscription and billing information:

When an Organization administrator subscribes to Qorum’s platform services, we collect the billing contact name and email address for subscription management purposes. Payment card information is not collected or stored by Qorum — it is entered directly into and handled by Stripe, Inc. We receive and retain transactional records from Stripe, including subscription status, payment amounts, and transaction dates.

For event ticket sales and membership fee processing (where applicable), payment card information is similarly handled directly by Stripe. We retain records of transaction amounts and outcomes for accounting and reporting purposes.

Communications and support:

When you contact us with a support request, question, or complaint, we retain the content of your message and your contact information in order to respond and to improve our services.

Event question responses:

Where an event includes optional or required registration questions configured by the Organization, your answers are collected and stored on behalf of that Organization for event management purposes.

5.2 Information Collected Automatically

Usage and technical log data:

When you access and use the Qorum platform, our hosting infrastructure automatically records standard technical data including your IP address, browser type and version, operating system, pages or features accessed, timestamps of access, and error logs. This data is used to maintain the security and performance of the platform.

Session and authentication data:

We use session cookies to maintain your authenticated login state while you are using the platform. These are functional cookies that are strictly necessary for the platform to operate. Without them, features such as maintaining your login across pages would not function.

We do not use tracking cookies, behavioural profiling cookies, or third-party advertising cookies.

5.3 Information We Do Not Collect

We do not collect:

• Government-issued identification numbers (such as Social Insurance Numbers)
• Health or medical information
• Biometric data
• Financial account numbers or payment card numbers (these go directly to Stripe)
• Sensitive personal information beyond what is described above

6. How We Use Your Information

We use personal information solely for the purposes identified at the time of collection, or for purposes that are consistent with those identified. Our uses of personal information include:

Platform operation and service delivery:

We use your account information to authenticate your identity, provide access to platform features, manage your member profile, and enable the features and services available through the Qorum platform.

Event registration and management:

We use registration information to confirm your place at an event, send you confirmation and reminder communications, enable the Organization to manage attendance, and deliver post-event materials or communications where the Organization has configured them.

Transactional email communications:

We send emails that are necessary to deliver our services, including: event registration confirmations (including meeting links for virtual events where applicable), event reminders, password reset instructions, invitation emails, welcome emails to new administrators, and platform billing notifications. These communications are not optional for core service delivery.

Organization-configured email communications:

Where an Organization uses Qorum’s email campaign tools to send newsletters, announcements, or other communications to their members or subscribers, we process member contact information as a data processor on behalf of that Organization.

Payment processing:

We use billing contact information to manage subscription payments, process applicable platform fees for event ticket and membership transactions, and communicate with administrators about subscription status and renewal.

Platform security and fraud prevention:

We use technical log data and session information to detect, investigate, and respond to unauthorized access, abuse, or other security incidents affecting the platform.

Platform improvement and product development:

We may use aggregated, de-identified data about how the platform is used to understand usage patterns, identify areas for improvement, and inform the development of new features. This aggregated data cannot be used to identify individual users.

Legal compliance and record-keeping:

We retain certain records as required by applicable law, including financial records required by Canadian tax legislation and transaction records required for regulatory purposes.

We do not:

• Sell your personal information to any third party
• Use your personal information for behavioural advertising
• Share your personal information between Organizations on the platform
• Use your personal information for automated decision-making that produces legal or similarly significant effects

7. Third-Party Service Providers and Disclosures

7.1 Service Providers

We engage the following third-party service providers to operate and deliver the Qorum platform. Each provider processes personal information on our behalf and is subject to contractual obligations requiring privacy protections comparable to those described in this policy:

7.2 Cross-Border Data Transfers

As shown in the table above, some of our service providers are located in and process data in the United States. When personal information is transferred outside Canada, it may be subject to the laws of that foreign jurisdiction, including laws that may permit government authorities to access personal information. We have taken steps to ensure that each of our foreign-based service providers maintains data protection practices that provide a level of protection comparable to that required under Canadian privacy law, including through our contractual arrangements with those providers.

For users in Quebec, we note that personal information transferred to providers operating outside Quebec is subject to a privacy impact assessment as required by Law 25. We conduct such assessments and maintain documentation of our cross-border transfer arrangements.

7.3 Within Organizations

Personal information belonging to members of an Organization is accessible to the administrators of that specific Organization, for the purpose of managing membership records, event attendance, and communications. Qorum does not share member information between different Organizations on the platform.

7.4 Law Enforcement and Legal Requirements

We may disclose personal information without your consent where required or authorized by law, including:

• In response to a valid court order, subpoena, or other legal process
• To comply with a request from a government authority or regulatory body with jurisdiction
• Where we have reasonable grounds to believe disclosure is necessary to prevent or investigate fraud, a threat to safety, or another illegal activity
• To protect the rights, property, or safety of Qorum, our users, or the public

Where permitted by law, we will notify you before disclosing your personal information in response to a legal demand.

7.5 Business Transfers

In the event of a merger, acquisition, sale of substantially all assets, or other business combination involving Qorum, personal information may be transferred as part of that transaction. Prior to any such transfer where personal information would become subject to a materially different privacy policy, we will provide reasonable notice to affected users and, where required by law, obtain consent.

7.6 With Your Consent

We may disclose personal information to third parties not described above with your express consent.

8. Data Retention

We retain personal information only for as long as is necessary to fulfill the purposes for which it was collected, or as required or permitted by applicable law. When personal information is no longer required, it is destroyed, erased, or rendered anonymous.

• Active member and administrator accounts: Personal information associated with an active account is retained for the duration of the account’s existence on the platform.
• Deleted accounts: Core profile information is permanently deleted from our systems within 30 days. Certain records may be retained beyond this period as described below.
• Event registration records: Retained for a minimum of one year following the event date.
• Financial and payment records: Retained for a minimum of seven years in accordance with the requirements of the Income Tax Act (Canada) and applicable accounting standards.
• Email communications: Records of email campaigns and delivery status are retained for a minimum of two years.
• Security and breach records: Maintained for a minimum of 24 months following the date of discovery, as required by PIPEDA’s breach of security safeguards regulations.
• Technical log data: Retained for a period not to exceed 12 months, after which they are deleted or anonymized.

9. Accuracy

We take reasonable steps to ensure that the personal information we hold about you is accurate, complete, and up to date for the purposes for which it is used.

You can review and update your personal profile information at any time by logging into your account and accessing your profile settings. If you believe that personal information we hold about you is inaccurate, incomplete, or out of date, you may contact us directly using the information in Section 14 and request that the information be corrected. We will respond to such requests within 30 days.

If we disagree that a correction is warranted, we will note your request in our records and explain our reasons for not making the correction.

10. Safeguards

We implement physical, organizational, and technological safeguards designed to protect personal information against loss, theft, unauthorized access, use, disclosure, copying, or modification. Our safeguards include:

Technological safeguards:

• Encrypted data transmission using TLS/HTTPS for all data in transit
• Row-level security (RLS) policies in our database, ensuring that each Organization’s data is isolated from that of other Organizations
• Hashed and salted password storage through Supabase Auth — we never store passwords in plain text
• Session tokens with expiry, requiring re-authentication after periods of inactivity
• Access controls restricting access to production systems to authorized personnel only
• Supabase Storage used for uploaded files, with access policies enforcing tenant isolation

Organizational safeguards:

• Internal access policies limiting access to personal information on a need-to-know basis
• Contractual requirements placed on third-party service providers
• Designated privacy accountability (see Section 2)
• Processes for identifying, assessing, and responding to privacy risks and incidents

Physical safeguards:

Physical security of our data infrastructure is maintained by our hosting providers (Supabase and Vercel), who maintain their own physical security controls for the data centres in which our data is stored.

No method of electronic transmission or digital storage is completely secure. While we take the safeguards described above seriously and review them on an ongoing basis, we cannot guarantee absolute security.

11. Data Breach Notification

We maintain a breach response program that includes procedures for identifying, assessing, containing, and notifying affected parties of privacy breaches.

A privacy breach is the loss of, unauthorized access to, or unauthorized disclosure of personal information resulting from a failure of our security safeguards or a failure to establish adequate safeguards.

Mandatory reporting under PIPEDA:

As required by PIPEDA’s breach of security safeguards provisions (in force since November 1, 2018), if a privacy breach creates a real risk of significant harm to one or more individuals, we will:

• Report the breach to the Office of the Privacy Commissioner of Canada (OPC) as soon as feasible after determining that the breach meets the reporting threshold
• Notify affected individuals directly, providing sufficient information to allow them to understand the nature of the breach and to take steps to reduce the risk of harm
• Notify any other organization or government institution that may be able to help reduce the risk of harm to affected individuals

Quebec-specific obligations:

For breaches involving personal information of individuals located in Quebec, we also comply with Law 25’s confidentiality incident reporting requirements, including reporting to the Commission d’accès à l’information du Québec (CAI).

Record-keeping:

We maintain a log of all privacy breaches, including those that do not meet the threshold for mandatory reporting. This log is retained for a minimum of 24 months and is available to the OPC upon request.

12. Openness

We make information about our privacy policies and practices publicly available. This Privacy Policy is available on our website at qorum.ca and can be accessed at any time.

If you have questions about our privacy practices that are not addressed in this policy, you may contact us using the information in Section 14.

13. Your Privacy Rights and Challenging Compliance

13.1 Your Privacy Rights

Under PIPEDA, and under Quebec’s Law 25 where applicable, you have the following rights:

Right of access:

You have the right to request access to the personal information we hold about you, including information about the purposes for which it is used and to whom it has been disclosed. We will respond to access requests within 30 days of receipt of a written request. Access is provided free of charge.

Right to correction:

You have the right to request correction of personal information that is inaccurate or incomplete. See Section 9 for more detail.

Right to withdraw consent:

You may withdraw your consent to certain uses of your personal information at any time, subject to legal and contractual limitations. See Section 4.2 for more detail.

Right to erasure (deletion):

You may request deletion of your personal information. We will honor such requests where we are not required by law to retain the information and where doing so does not conflict with our legitimate operational requirements.

Right to de-indexation (Quebec residents):

If you are a resident of Quebec, you may request the de-indexation of information associated with your name where its continued indexation causes harm to you or violates the law. We will assess such requests in accordance with Law 25.

Right to data portability (Quebec residents):

As of September 22, 2024, individuals in Quebec have the right to request that personal information collected from them be communicated in a structured, commonly used technological format. We will respond within 30 days.

Right to challenge compliance:

You have the right to challenge our compliance with this Privacy Policy and with applicable privacy legislation. See Section 13.2 below.

13.2 How to Submit a Request or Complaint

To exercise any of the rights described above, or to submit a complaint, please contact our designated privacy contact using the information in Section 14. We will acknowledge your request and respond within 30 days.

If we are unable to resolve your complaint to your satisfaction, you have the right to contact the applicable privacy regulator:

• Office of the Privacy Commissioner of Canada (OPC) — 1-800-282-1376 (Federal matters and all provinces except Quebec, Alberta, and BC)
• Commission d’accès à l’information du Québec (CAI) — (Quebec residents)
• Office of the Information and Privacy Commissioner of Alberta — (Alberta residents)
• Office of the Information and Privacy Commissioner for British Columbia — (British Columbia residents)

14. Contact Us

For all privacy-related inquiries, access requests, correction requests, deletion requests, complaints, or questions about this Privacy Policy, please contact our designated privacy contact:

Email: privacy@qorum.ca
Website: qorum.ca

We respond to all privacy inquiries within 30 days.

15. Provincial Privacy Laws

Quebec: Law 25 — fully in force as of September 22, 2024. Provides rights including data portability, de-indexation, and stricter consent requirements. Enforced by the CAI. Fines of up to C$25 million or 4% of worldwide turnover for serious violations.

Alberta: Personal Information Protection Act (PIPA Alberta) — substantially similar to PIPEDA for intra-provincial commercial activity. Mandatory breach notification to the Alberta OIPC without unreasonable delay.

British Columbia: Personal Information Protection Act (PIPA BC) — substantially similar to PIPEDA for intra-provincial commercial activity.

For intra-provincial commercial activity in these provinces, the applicable provincial law generally applies in place of PIPEDA. PIPEDA continues to apply to interprovincial and international data transfers.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or the features of our platform. When we make changes, we will update the “Last Updated” date at the top of this policy.

For material changes, we will provide advance notice to Organization administrators by email at least 14 days prior to the changes taking effect.

Your continued use of the Qorum platform after the effective date of a revised Privacy Policy constitutes your acceptance of the revised terms, to the extent permitted by applicable law.

17. Interpretation and Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Canada, including PIPEDA and applicable provincial privacy legislation. Where there is any conflict between this Privacy Policy and applicable law, the applicable law shall prevail.

This Privacy Policy is intended to comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair information principles, Quebec’s Law 25, and the substantially similar provincial privacy laws of Alberta and British Columbia. It reflects Qorum’s actual data collection and processing practices as of the effective date stated above.

Qorum is not a law firm and this document does not constitute legal advice. Organizations using the Qorum platform to manage their own members remain independently responsible for their own privacy compliance obligations under applicable law.