Your privacy matters to us.

This Privacy Policy together with the relevant Terms and Conditions explains how BIS Safety Software Inc. (“BIS”, “we”, “us”, “our”) collects, uses, discloses, stores, secures, and deletes personal information as defined by applicable privacy laws. Our websites and services include our BIS Safety Software system and the associated BIS Safety mobile app (collectively the “Web Platforms”). By using our Web Platforms, you may be a corporate user or a public user or both. “Corporate Users” are individuals who have accounts created for them by an employer or organization in a managed portal. “Public Users” are individuals who create their own accounts independently and directly in our Web Platforms.

Where required, we will seek your consent within our Web Platforms. If you do not agree with this Policy, please do not use the Web Platforms.

Information Collected

From Whom We Collect Personal Information

Web Platform users. Public Users and Corporate Users, including administrators of user accounts.

Public website visitors. Individuals who visit our public websites (www.trainanddevelop.ca, www.bissafety.ca, www.bissafety.com, and www.bissafety.uk) who may provide contact information to receive information about our Web Platforms and participate in our events.

Event attendees. Individuals who register to attend any live or virtual events, conferences, or webinars hosted or sponsored by BIS.

Personal Information We Collect

If you are a Public User or a Corporate User, we collect your personal information through your use of our Web Platforms, when you interact with our customer support, or communicate with us in any way.

The types of information we collect include:

• Personal information, such as your name, contact details, date of birth, driver’s licence number, banking information, and login credentials, that you provide to us or that is provided by the employer or organization who provided you with an account.
• Employment information, such as your job title, supervisors, work training, and employment history.
• Education information, such as professional qualifications, as collected by the employer or organization who created your account.
• Health information as collected by the employer or organization who created your account.
• Biometric data, such as your image and video recordings of you, that is collected if you attend events or complete virtually proctored online courses.
• Billing information when you pay for BIS’ services or purchase any content from the e- commerce store. (Note we only retain and store the last 4-digits of your credit card number while all other data, such as the expiry date and authorization codes, are not stored.)
• Location information when you authorize our Web Platforms to detect and track your location, such as your address, city, and geographic area.
• Marketing information, such as your contact preferences.
• Usage information about how you use and interact our Web Platforms and public websites, such as your IP address, location, and log information of features you use.
• Troubleshooting and support information that you provide when you interact with our chatbots, complete feedback forms or other forms, or when you contact our customer support team or any personnel of BIS, such as the content of your chats and other communications.
• Other information we collect not listed here but that we will use and protect following this Privacy Policy or as otherwise disclosed at the time of collection.

Information From Our Websites and Events

When visitors to our public websites contact us or register for information, we collect personal information, such as contact information, so we can fulfill their request and keep in touch with them for sales and marketing purposes, ensuring we respect their marketing preferences.

When event attendees join and participate in our events, we collect personal information, such as your name, employment information, and dietary preferences (in some instances). If the event is recorded and posted on our social media channels, we may collect and share your image and voice depending on how you engage in the event.

Information From Third Parties and Referrals

Users, website visitors, event attendees, and our business partners may refer contacts to us, so we may receive your name, email, and address from these sources. You may submit referrals if you have the referral’s permission to provide their information to us, so we may contact them.

Information from Social Media

We share information about us and interact with the public on social media platforms, such as LinkedIn, YouTube, and other third-party platforms. When you visit and interact with us and others on those platforms, you and those platforms provide us with personal information, and you are subject to the platform provider’s privacy policy.

Information About Children

The Children’s Online Privacy Protection Act (COPPA) enacted by the United States Congress prohibits unfair or deceptive acts or practices in connection with the collection, use, or disclosure of personal information on the internet from and about children 12 years or under. Our public websites nor our Web Platforms are not directed to or intended for use by children under 13 or children residing in Quebec, Canada under 14. We do not knowingly collect, use, or disclose personal information from children as stated.

If we become aware that personal information has been collected from a child under these age limits, we will promptly delete or de-identify such information from our records, subject to any legal retention requirements.

Parents or guardians who believe that we may have collected personal information from a child should contact our Privacy Management Program at privacy@bistraining.ca to request review and deletion of the information.

How We Use Personal Information

We may use your personal information for the following purposes or as described at the time of collection:

Operate our business and provide services: We use your personal information to operate our business and provide, operate, and administer our Web Platforms, courses, and third-party courses and products, including:

• Troubleshooting issues, analyze performance, and fix issues to optimize our Web Platforms and websites;
• Understanding your needs to personalize your experience and expand our Web Platforms capabilities;
• Processing transactions related to those services, courses, and products;
• Sharing information about our services, such as new products and important updates;
• Providing you with customer support when requested;
• Responding to your questions and feedback;
• Protecting the security of our Web Platforms and systems;
• Communicating with you about events and webinars; and
• Other purposes for which we will notify you in advance and receive your consent.

Comply with legal obligations: In certain cases, we may have a legal obligation to collect, use, share, retain, or delete your personal information.

Fraud, abuse prevention and credit risks: We may use your personal information to detect and prevent fraud and abuse to protect you and the security of our services. We may use algorithms and scoring methods to assess and manage security, financial risks, and credit risks.

Marketing: We use your personal information to market and promote our services, which may now or in the future use interest-based or personalized targeted ads. We may use cookies and other similar technologies, which enable us to understand the effectiveness of the interest-based ads by measuring what ads are clicked or viewed and to provide you with more useful and relevant ads.

Cookies and Similar Technologies

We use cookies and similar technologies to recognize your browser or device, track your specified preference (such as language and configuration preferences), prevent fraudulent activity and improve security, learn more about your interests, and provide you with important features and services.

Please read our Cookie Policy to learn more.

You can withdraw consent or manage preferences for the use of non-essential cookies and similar technologies in our Web Platforms and public websites in your browser controls. Our cookies may allow you to take advantage of some essential and useful features. Blocking some types of cookies may impact your experience of our Web Platforms.

How We Share Personal Information

We do not sell your personal information to others. We may share personal information only as described in this Privacy Policy with these recipients:

Service providers. We work with service providers, such as payment processors, managed hosting providers, and sub-processors, who follow policies and practices at least as protective as described here for the purposes of providing our Web Platform and other services to you. We inform our clients of changes to our sub-processors through our Sub-Processor Notice. We recommend clients and users to review the privacy policy of our sub-processors.

Third party integrations. You may integrate certain third-party services with our Web Platforms. You are subject to the privacy policies and terms and conditions of third parties whose services you integrate in our Web Platforms.

Artificial intelligence services. Our Web Platforms may provide services that use artificial intelligence or machine-generated learning (“AI Services”), which may be wholly or partially developed by third parties. Our AI Services use information provided by users, such as text, images, videos, and content in files of any format, including facial images in virtually proctored online courses. For more information about our AI Services, please review our Artificial Intelligence Notice.

Business partners. We have contractual relationships with third parties who provide content, courses, and products, which you may access through our software. These third parties are subject to our Privacy Policy. If you wish to access third party content, courses, and products, you may need to share your personal information, including your registration, course marks, and certificates of completion, with these third parties. You may authorize us to verify to third parties the validity and status of your certificates when they enter your last name and certificate number into the public certificate verification page on our Web Platforms.

Third party marketers. We work with third parties to display and manage advertising and content on our websites who may use cookies or similar technologies to collect information about how you interact with our websites to provide you with a personalized experience, recommendations, and advertising based on your activities and interests.

Authorities and others. We may share your personal information with governing bodies, third parties needed for compliance, fraud prevention, and security purposes, legal counsel and auditors when needed. We may release account and other personal information when that release is required to comply with the law, to apply or enforce our terms and agreements, or to protect the rights, property and security of our customers and others. We may also share personal information with event co-sponsors.

Business transferees. If we sell our businesses or services, personal information may be shared with the acquiring entity in accordance with applicable privacy laws and subject to appropriate confidentiality safeguards. For Corporate Users, we may also share personal information with registered users within your portal based on their level of administrative access. Public Users may opt out of having their personal information shared with third-party service providers. However, opting out will prevent access to our Web Platforms.

We will not give a third party with whom we share your information an independent right to share or disclose your information with any other person, group, or company outside of their own professional advisors and affiliates.

Location of Personal Information

Your personal information is stored in Canada on third-party data servers (for example, AWS Canada). Additionally, personal information, including biometric data, collected during virtually proctored online courses is stored in Germany on third-party data servers. If you do not wish for your personal information to be stored in Germany, do not purchase or take virtually proctored online courses. Limited personal information collected and publicly shared from recorded webinars may be stored in third-party data servers located in USA or Canada. Conversations and any information you provide to our Support Team by phoning 1-780-410-1660, (French) 1-780-410-1659, (toll-free Canada) 1-866-416-1660, (USA) 1-713-424-0660, and (toll-free USA) 1-866-575-5670 is stored in the USA. BIS shares personal information with sub-processors who may also store this data in locations outside of Canada. Please refer to our Sub-Processor Notice for information on our sub-processors and where they store personal information.

Cross-Border Data Transfers

We primarily host our services and databases in Canada. However, we use trusted service providers and sub-processors in other countries, including the USA, Ireland, Germany, Australia, and India. As a result, your personal information may be stored, processed, or accessed in any of these jurisdictions for the purposes described in this Privacy Policy (for example, hosting, support, email delivery, analytics, payment processing, security, and fraud prevention). When information is stored or processed outside of Canada, it may be subject to the laws of the destination country and be accessible to court, law enforcement and national security authorities in those jurisdictions. We assess our service providers and sub-processors prior to transferring your data to them to ensure the provide an adequate level of protection of your data.

Security

BIS, our clients, and users acknowledge the crucial importance of safeguarding personal and confidential information. We maintain compliance and assurance programs that test, support, and validate our security controls. We use physical, administrative, and technical security controls, such as encryption protocols, which meet industry security standards to safeguard personal information we collect. Our data security program includes a risk management program that aims to identify and mitigate threats and vulnerabilities with controls appropriate to the level of risk. Our risk management controls include regular, comprehensive vulnerability scans, external testing, and internal audits. In the event we become aware of a security incident that has affected our customers or users, we will notify affected parties following applicable laws. Our security procedures mean that we verify your identity before we disclose personal information or provide certain services to you. We strive to continuously improve our data security program and will communicate important security updates to our customers and users in a timely manner.

While we strive to protect personal information, no method of transmission or storage is completely secure; if we become aware of a security incident, we will take appropriate steps and notify affected individuals as required by applicable law.

Retention

We keep your personal information to communicate with you and to enable your continued use of our services for the purposes described in this Privacy Policy or as may be required by law. We retain personal information only for as long as necessary to fulfill those purposes, comply with legal obligations, resolve disputes, and enforce our agreements. After those purposes are fulfilled, personal information is deleted or anonymized as per our documented retention schedules. Your personal information is retained if your account remains active. After your account is deactivated, our retention of your personal information will be consistent with applicable laws.

Your Rights

You have rights under privacy laws which, in certain circumstances, you can exercise in relation to the personal information we process about you. These include:

• The right to ask whether we hold personal information about you and request copies of such personal information and information about how it is processed;
• The right to ask what categories of personal information we have collected about you, the categories of sources from which the personal information was collected, the business and commercial purposes for collecting and disclosing personal information, the categories of third parties to whom we disclose personal information, and the categories of personal information disclosed for a business purpose;
• The right to request correction of inaccurate personal information we hold about you;
• The right to restrict our use and disclosure of your personal information for purposes permitted by law (to the extent applicable; we do not use sensitive personal information beyond permitted purposes);
• The right to request deletion (“erasure”) of personal information (the “right to be forgotten”):
  • that is no longer necessary for the purposes underlying the processing,
  • where consent for the information being processing has been withdrawn, or
  • when processing is not in compliance with applicable legal requirements;
• The right, in certain cases, to receive a machine-readable copy of your personal information;
• The right to request portability of personal information that you have provided to us where the processing of such personal information is based on consent and is carried out by automated means;
• The right not to be subject to a decision based solely on automated processing, including profiling, which has legal effects for you or affects you in any other significant way;
• The right to object to our use and processing of your personal information;
• The right to opt out of processing for targeted advertising, sale of personal data, or profiling in decisions that produce legal or similarly significant effects; and
• The right to direct us not to sell or share your personal information for cross-context behavioural advertising. (Note we do not engage in such practices.)
  
  

We will not waive or limit your rights, and we do not discriminate against those who exercise them.

Where we rely on consent as the legal basis on which we process your personal information, you may also withdraw that consent at any time.

How to Exercise Your Rights

If you want to exercise any of these rights, please contact us using the details in the Contacts section below. We will handle any request to exercise your rights in accordance with applicable privacy law and any relevant legal exemptions.

We will verify your request (which may include confirming control of your account, matching information, or requesting a signed declaration) and respond within 45 days (which may be extended as permitted by law). If your access is provided through an organization, we may redirect certain requests to your administrator where appropriate.

You may also have the right to complain to a local authority if you think we have processed your personal data in a manner which is unlawful or breaches your rights. If you have these concerns, we kindly request that you contact us first (using the contact details in the Contacts section below), so we can investigate and do our best to resolve your concerns.

For EU and UK residents, you also have the right to lodge a complaint with a supervisory authority:

• EU: your local Data Protection Authority in the EU or EEA.
• UK: the Information Commissioner’s Office.

Access and Choice

Personal information you may be able to access through our services include:

• Your name, email address, physical location, postal address, phone number, and other contact information;
• Username, aliases, roles, and other authentication and security credential information;
• Your subscription, purchase, usage, billing, and payment history;
• Payment settings, such as payment instrument information and billing preferences;
• Third-party course completion information, including training records, course marks and certificates of completion;
• Education, training, and employment information; and
• Email communication and notification settings.
  
  

Corporate Users: We have no control over what personal information is collected by entities and employers who create accounts for you and how they use your personal information. Subject to your organization’s restrictions, you may be able to view, update, and delete your account information and control how you interact with and use our services. Your services may include settings that provide you with options for how your information may be viewed, used, or secured. Entities and employers who pay for our services and manage user accounts are solely responsible for complying with all applicable laws with respect to Corporate Users.

We generally do not retain earlier versions of personal information once updated or revised. However, we may retain certain personal information where required to comply with legal obligations, to meet legitimate business or operational needs, or where it remains temporarily stores in system backups for a limited retention period.

Contact

If you have any concerns about your privacy or want to contact one of our third-party data processors, you may contact our Privacy Officer through our Privacy Management Program.

Privacy Management Program

BIS Safety Software
261 Seneca Road
Sherwood Park AB Canada T8A 4G6
Phone: 780-410-1660
Toll Free: 1-866-416-1660
Email: privacy@bistraining.ca

 Users in the European Union and EEA may contact BIS’ EU representative below.

DPO Europe GmbH

representative+bissafety@data-privacy-office.eu

 Users in the UK may contact BIS’ UK representative below.

Data Privacy Office Europe

ukrepservices@gmail.com

Specific Privacy Disclosures

Quebec Law 25

This section applies to individuals in Québec and describes how we comply with Law 25, which amends Québec’s private-sector privacy law.

Law 25 enhances the privacy laws in Québec, Canada. In compliance in Law 25, BIS performs privacy impact assessments, provides breach notification in circumstances where unauthorized access is likely to cause real risk of significant harm to individuals as described under guidelines established by PIPEDA, and requests explicit consent for the collection of sensitive personal information for organizations and users in Québec.

Governance and Accountability

We designate a Person in Charge of the Protection of Personal Information (our Privacy Officer) who you may contact through our Privacy Management Program. We maintain a privacy management program, including documented policies, staff training, role-based responsibilities, and regular reviews.

Privacy by Design

We implement measures so that, by default, only the minimum personal information necessary is collected, used, communicated, retained, and accessible.

Privacy Impact Assessments (PIAs)

We conduct PIAs for projects involving personal information. PIAs address sensitivity, purposes, proportionality, safeguards, and residual risks.

Confidentiality Incidents (Breaches)

We keep a register of incidents and notify the Commission d’accès à l’information (CAI) and affected individuals if the incident presents a risk of serious injury. Notifications describe the nature of the incident, information concerned, and steps taken or proposed to mitigate risk.

Consent

We obtain valid, informed, and specific consent where required by law. For sensitive personal information, we obtain express consent unless another legal basis applies.

Automated Decisions and Profiling

When we render a decision based exclusively on automated processing that produces legal or similarly significant effects, we inform the individual, provide the main factors and parameters that led to the decision, and offer a way to submit observations and, where applicable, request a review by a person.

Transfers outside of Québec

We primarily host and process personal information in Québec. We transfer personal information outside of Québec when needed to provide essential services in our Web Platforms or for business continuity purposes. Where we transfer personal information outside Québec, we do so in accordance with applicable law and implementing contractual, technical, and organizational safeguards to ensure that the information receives protection equivalent to that required under Québec’s privacy legislation.

We conduct transfer risk assessments and implement appropriate technical and organizational measures to protect personal information during and after transfer.

Canada’s Anti-Spam Legislation (CASL)

Consistent with the Privacy Policy described here, you have authorized us to communicate with you in writing, or electronically, such as by email, social media, text, phone, or any form of electronic and internet-based methods using computers, smart phones, mobile or handheld devices, phone, or any future devices. You may unsubscribe anytime by either clicking an unsubscribe button; directly contacting us by phone, mail, or email; or providing reasonable notice by any other means.

California

These disclosures apply to California residents and describe our practices under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA).

Categories of Personal Information We Collect

Categories of personal information collected or disclosed for a business purpose. The personal information that we may collect, or may have collected from you or disclosed in the preceding twelve months, fall into the following categories depending on how we may have engaged with you:

• Direct identifiers, such as your real name, alias, postal address, social security number, driver’s licence and passport information, and signature;
• Indirect identifiers, such as cookies and other similar technologies, phone numbers, Internet Protocol addresses, and account names;
• Biometric data, such as images, and audio and video recordings;
• Geolocation data, such as physical location information from computers, smart phones and other devices;
• Internet activity, such as browsing history, search history, data on interaction with a webpage, application, or advertisement;
• Sensitive information, such as personal characteristics, behaviour, employment, and education information; and
• Professional or employment related information, including education information, including enrollment status, fields of study, degrees, training, honors, awards, course marks and certificates of completion.
  
  

Depending on how you may engage with our services, further categories of personal information disclosed for a business purpose include:

• Commercial information, such as the details of a product or service, if a third-party service provider is assisting to provide that product or service to you; and
• Electronic communications if a third-party service provider reviews recordings of customer interactions for quality assurance purposes.

Your rights

Subject to applicable exceptions, California residents have rights related to their personal information as described in the Your Rights section.

If our practices change, we will update this Privacy Policy and provide the required “Do Not Sell or Share My Personal Information” mechanism.

Texas

This section applies to Texas residents and describes our practices under the Texas Data Privacy and Security Act (TDPSA).

Categories of Personal Information We Collect

Depending on how you interact with us (e.g., account creation, course delivery, support), we may collect and process:

• Identifiers and contact details (name, address, email, phone, online identifiers, IP address),
• Customer records/commercial information (purchases, transactions, service usage),
• Internet or network activity (log data, interactions with our sites/apps, cookies/SDKs),
• Geolocation data (approximate location if enabled),
• Professional/education information (employer/organization, role, enrollment, training records, marks, certificates),
• Biometric/recordings (image/voice/video where used for identity verification or proctoring),
• Inferences (preferences or configurations derived from the above), and
• Sensitive personal data (e.g., precise geolocation if enabled and government IDs and biometrics used for identification) processed only as permitted by law (consent where required).

Purposes for Processing

We process personal information to provide and manage services, support training and credentials, communicate with users, enhance security, prevent fraud, comply with laws, and enforce terms.

We may disclose personal information to service providers/processors (hosting, identity verification/proctoring, analytics, support, security, payments), your organization/administrator), certification bodies/content providers (to deliver/validate credentials), and government or law enforcement when required.

We do not sell personal information. If we engage in targeted advertising or other “sharing,” you may opt out.

European Union and United Kingdom

This section applies to individuals located in the European Economic Area (EEA) and the United Kingdom (UK). We apply equivalent protections to both, while noting that supervisory authorities, transfer mechanisms, and terminology may differ between the EU and the UK.

Depending on the activity we may act as:

• A data controller (for example, when we determine the purposes and means of processing personal information on our Web Platforms and in our business operations); or
• A data processor on behalf of our customers (for example, where an organization uses our services to manage its training and compliance data and instructs us how to process that data).
  
  

Where we act as a processor, our processing is governed by a data processing agreement with the relevant customer (the controller).

Lawful Bases for Processing

We process your personal information on one or more of the following legal bases as applicable under the EU GDPR and/or the UK GDPR:

• As necessary to enter into a contract with you or a legal entity you represent, to perform our contractual obligations, to provide our services, to respond to requests from you, or to provide customer support;
• We have a legitimate interest to operate, improve, and secure our services; to communicate with you about our services; to prevent fraud and misuse; and to assert or defend legal claims, except where such interests are overridden by your interests or fundamental rights and freedoms. We perform and document the required balancing test.;
• With your consent or where required by law (for example, certain marketing, cookies/analytics in some jurisdictions, or optional features). You may withdraw consent at any time, without affecting processing that occurred before withdrawal.
• Vital interests or public interests only where strictly applicable; or
• As necessary to comply with relevant law and legal obligations, including responding to lawful requests and orders.

Special Categories of Data

We do not seek to collect special categories of personal data (such as health, biometric identifiers used for identification, racial or ethnic origin) unless required for a specified purpose and permitted by law. Where such processing occurs, it is supported by an appropriate Article 9 condition (EU/UK), such as explicit consent or reasons of substantial public interest, and subject to additional safeguards.

Representatives

Because BIS is established in Canada, we appoint representatives for the EU and the UK in accordance with Article 27:

• EU Representative: Data Privacy Office Europe, whose contact information is provided in the Contacts section.
• UK Representative: Data Privacy Office Europe, whose contact information is provided in the Contacts section.
  
  

Individuals in the EEA/UK may contact the relevant representative on matters related to our processing of personal information, in addition to contacting BIS directly.

Transfers outside of the European Economic Area or EEA

We primarily host and process personal information in Canada. When we transfer personal information outside the EEA (for EU GDPR) or outside the UK (for UK GDPR), we do so in accordance with applicable law, using one or more of the following safeguards:

• Adequacy decisions (e.g., for Canada’s commercial sector and any other jurisdictions deemed adequate by the European Commission or the UK Government);
• Standard Contractual Clauses (SCCs) adopted by the European Commission, with supplementary measures as needed; and
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, as applicable.
  
  

We conduct transfer risk assessments and implement appropriate technical and organizational measures to protect personal information during and after transfer.

Privacy Policy Change

If we alter our Privacy Policy, any changes will be posted on this page of our website with the date of the latest revision so that you are always informed of the information we collect about you, how we use it, and the circumstances under which we may disclose it.

Last Updated: November 29, 2025