Privacy Policy

Valistream Solutions Ltd. ("Valistream", "we", "us", or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and the choices you have. It applies to the website at valistream.ca, the stakeholder portal, and any related services we provide (together, the "Services").

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, British Columbia's Personal Information Protection Act (PIPA). Where we serve clients or visitors in other regions, we also work to meet the privacy expectations that apply there.

By using our Services, you agree to the practices described in this policy. If you do not agree with it, please do not use the Services.

1. Who we are

Valistream Solutions Ltd. is a company incorporated in British Columbia, Canada (Business Number 796733731). We provide delivery planning, scheduling, documentation, and project controls software and services to medium and large organizations. For the purposes of applicable privacy law, Valistream is the organization responsible for the personal information described in this policy. Our contact details are in Section 15.

2. Information we collect

We collect personal information in three ways: information you give us directly, information we collect automatically when you use the Services, and information we receive through your organization's use of the portal.

Information you give us

• Demo and contact requests. When you fill in a form on our website, we collect your name, your work email address, your company name if you provide it, and the contents of your message.
• Account information. If you are given access to the portal, we collect your name, email address, login credentials, the role and access level assigned to you, and the projects you are permitted to view or edit.
• Project and operational data. When you or your organization use the Services, we process the data entered into or uploaded to the platform. This can include scheduling and progress records, attendance and timesheet entries, activity and tag logs, requisitions, documents, and files that your team chooses to upload.
• Correspondence. If you email us or otherwise get in touch, we keep a record of that correspondence and any information you include in it.

Information we collect automatically

• Technical and log data. Our servers automatically record information such as your IP address, browser type and version, device and operating system, the pages you visit, the date and time of your visit, and referring pages. We use this to keep the Services secure and working properly.
• Session cookies. When you sign in to the portal, we use a cookie to keep you logged in during your session and to protect your account. See Section 5 for more about cookies.

Information we receive from your organization

If your employer or client engages Valistream, they may create an account for you and provide your name, work email, role, and project assignments. In that situation, your organization decides who has access and at what level, and they act as the owner of the project data they put into the platform. We process that data on their behalf and under their instructions.

3. How we use information

We use personal information only for purposes a reasonable person would consider appropriate in the circumstances, including to:

• respond to demo requests, questions, and other enquiries;
• set up, operate, and secure portal accounts and access levels;
• deliver, maintain, and support the Services your organization uses;
• store, sync, and present scheduling, progress, attendance, timesheet, and document data;
• generate reports and exports, including value and earned value reporting for your systems;
• monitor and improve the performance, reliability, and security of the platform;
• communicate with you about your account, service updates, and changes that affect you;
• detect, prevent, and address fraud, abuse, security incidents, and technical issues; and
• meet our legal, regulatory, and contractual obligations.

We do not sell your personal information, and we do not rent or trade it. We do not use the project data your organization uploads for advertising.

4. Our legal basis

Under Canadian law, we rely on your consent to collect, use, and disclose personal information, except where the law allows or requires us to act without it. Depending on the situation, our handling of your information may also be necessary to perform a contract with you or your organization, to pursue our legitimate business interests in running and securing the Services, or to comply with the law. Where we rely on consent, you may withdraw it as described in Section 10, subject to legal and contractual limits.

5. Cookies and analytics

A cookie is a small text file stored on your device by your browser. We use a small number of cookies that are necessary for the Services to work. The main one is a session cookie that keeps you signed in to the portal and helps protect your account against unauthorized use. These cookies do not track you across other websites.

You can set your browser to refuse cookies or to alert you when a cookie is being set. If you block the session cookie, the portal sign in will not work. We do not currently use third party advertising cookies. If we add website analytics in the future, we will update this policy and, where required, ask for your consent first.

6. When we share information

We treat your information as confidential. We share it only in the limited circumstances below.

• Service providers. We use trusted third parties to host and run the platform, including our web and database hosting provider. These providers process information on our behalf, only for the purpose of providing their service to us, and under obligations to keep it secure and confidential.
• Within your organization. Project data and portal activity are visible to others in your organization according to the roles and access levels your organization assigns.
• Legal and safety reasons. We may disclose information if we are required to by law, regulation, court order, or a lawful request from a public authority, or where we reasonably believe disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud or a security issue.
• Business transfers. If Valistream is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will require the recipient to honour the commitments in this policy.

We do not disclose your personal information to third parties for their own marketing purposes.

7. Where information is stored

Our platform is hosted with a third party hosting provider, and your information is stored on servers that provider operates. Depending on the provider's infrastructure, your information may be stored or processed outside your province or country, including in jurisdictions whose privacy laws differ from those where you live. Where information is handled outside Canada, it may be accessible to courts, law enforcement, and authorities in those jurisdictions under their laws. We take reasonable steps to make sure any provider that handles personal information for us provides a comparable level of protection. If you have questions about where your information is held, contact us using the details in Section 15.

8. How we protect information

We use technical and organizational safeguards designed to protect personal information against loss, theft, and unauthorized access, use, or disclosure. These include encrypted connections (HTTPS) for data in transit, role based and project scoped access controls, separate handling of credentials and secrets on the server side, restricted access to uploaded files, and storing access tokens rather than database credentials in any tools we distribute. No method of transmission or storage is completely secure, so while we work hard to protect your information, we cannot guarantee absolute security. You also play a part by keeping your login details confidential and notifying us if you suspect any unauthorized use of your account.

9. How long we keep information

We keep personal information only for as long as it is needed for the purposes described in this policy, or for as long as required to meet legal, accounting, contractual, or reporting obligations. Contact and demo enquiries are kept for as long as needed to follow up and for our reasonable business records. Account and project data are kept for the duration of the service relationship with your organization and for a reasonable period afterward, after which we delete it or make it anonymous, unless a longer period is required by law or agreed in a contract. On request, and in good standing, we can provide a reasonable export of your organization's own data.

10. Your rights and choices

Subject to applicable law, you have the right to:

• Access the personal information we hold about you and ask how it has been used and to whom it has been disclosed;
• Correct information that is inaccurate, incomplete, or out of date;
• Withdraw consent to our use of your information, subject to legal and contractual limits, by contacting us;
• Ask us to delete personal information where there is no legal or business reason for us to keep it; and
• Opt out of non essential communications at any time.

To make a request, contact us using the details in Section 15. We may need to confirm your identity before we act. We will respond within the time required by law. There is normally no charge, and if any cost applies we will tell you in advance. If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner of Canada or to your provincial privacy regulator. If your organization owns the project data in question, we may direct your request to them and assist them in responding.

11. Electronic messages

When we send commercial electronic messages, we follow Canada's Anti Spam Legislation (CASL). That means we send them with your consent or where the law otherwise allows, we identify ourselves clearly, and we give you a simple way to unsubscribe. Service messages that relate to your account or to a service your organization uses are not promotional and may still be sent so we can support you.

12. Children

Our Services are intended for businesses and the professionals who work for them. They are not directed to children, and we do not knowingly collect personal information from anyone under the age of majority in their province or territory. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

13. Third party links

Our website and portal may contain links to third party sites or services that we do not control. This policy does not apply to those sites. We encourage you to read the privacy policy of any third party site you visit, because we are not responsible for their content or practices.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes, we will revise the "Last updated" date at the top of this page and post the new version here. If the changes are significant, we will take reasonable steps to let you know. We encourage you to review this page periodically. Your continued use of the Services after an update means you accept the revised policy.

15. How to contact us

If you have questions about this policy, want to exercise your rights, or wish to make a complaint about how we handle personal information, please contact our privacy contact:

We will acknowledge your message and respond as soon as we reasonably can, and within the time frames set by applicable law.