1. Who we are
RSPO operates the RSPO business progression platform at rspo.ca from Canada. This policy explains how we handle personal information when you browse the website, contact us, create an account, submit business evidence or use support services. For privacy requests, contact the RSPO privacy team at support@rspo.ca.
2. Information we collect
We collect the information you provide, such as your name, business name, email address, telephone number and country; account and business profile details; questions and support messages; and documents you choose to submit for verification. Evidence may contain information about directors, owners, staff or other individuals. Submit only relevant information that you are authorized to share, and redact unrelated personal details. Do not send passwords, payment card details or identity documents through the public contact form.
3. How we use information
We use information to answer enquiries, operate accounts and workspaces, assess submitted requirements, maintain evidence and review histories, arrange requested specialist support, administer orders and subscriptions, issue service communications, prevent misuse and meet applicable obligations. Contact enquiries are saved in a restricted admin inbox. Active, verified administrators may receive separate email notifications linking to that inbox. A contact submission does not enrol you in marketing.
4. Consent and your choices
The contact form asks you to acknowledge this policy before sending your details. We record the acknowledgement time and policy version. Providing information for an enquiry allows us to use it to respond; it does not authorize unrelated promotion. Where we rely on consent, you may ask to withdraw it by emailing support@rspo.ca, subject to legal or contractual restrictions that we will explain. Withdrawal may prevent us from providing a requested function. Optional integrations and public registry publication require their own applicable authorization.
5. Business verification and public listings
Information submitted for assessment is available to authorized personnel according to their roles and assignments. Verification decisions, revisions and supporting history may be retained to explain outcomes and maintain the integrity of the framework. A public registry listing is separate from a private account: publication depends on business consent, administrative approval and the platform’s eligibility rules. Only approved public fields are intended for publication. Private evidence documents and internal review messages are not public registry content. Contact us to request correction or withdrawal of public information.
6. Service providers and disclosures
We use service providers to host and secure the platform, manage authentication and storage, process payments and, when configured, deliver notifications. These currently include Vercel and Supabase for platform infrastructure and Stripe for payment processing; an email delivery provider may process notification recipients and delivery records. Card information entered into Stripe-hosted payment flows is processed by Stripe; we retain relevant payment references and transaction status rather than full card numbers. Authorized consultants access information needed for their assigned work. We may disclose information where required by law, to address security incidents, enforce lawful rights, or as part of a business transfer with appropriate protections. We do not sell personal information.
7. Where information is processed
Infrastructure and service providers may process or store information outside Canada, including in the United States. Information processed abroad may be subject to the laws and lawful access requirements of those jurisdictions. We remain responsible for information under our control and use contractual and technical measures appropriate to the service. Contact us for questions about service providers or cross-border handling.
8. Security, cookies and abuse prevention
We use access controls, authenticated workspaces, encrypted connections and other safeguards appropriate to the information and the service. Optional authenticator-based protection is available for accounts. No online service can guarantee absolute security. Essential cookies and similar technologies support sign-in and session security. Hosting services may record technical request information. To limit contact-form abuse, the platform uses validation, a hidden spam field and submission limits based on protected hashes of an email address and network address. These hashes are not shown in the admin inbox. We will explain and obtain any required choices before introducing optional tracking that requires consent.
9. Retention and deletion
We keep information for as long as reasonably needed for the purposes described here, including responding to enquiries, supplying services, maintaining review and transaction records, resolving disputes and meeting legal requirements. Different records have different needs: a contact enquiry does not require the same retention as a payment or verification history. We review information for deletion or anonymization when it is no longer needed. Backups and records subject to legal holds may remain for a further limited period. Closing an account does not automatically erase every audit, payment or review record. Contact us for a deletion request or details about a particular record.
10. Access, correction and concerns
You may ask what personal information we hold about you, request access or correction, and raise concerns about its use. We may need to verify your identity without collecting unnecessary information. We will respond within the time required by applicable law and explain any lawful limitation or refusal, including protection of another person’s information. Canadian federal or provincial privacy laws may apply depending on the activity and location. You may also contact the Office of the Privacy Commissioner of Canada or the relevant provincial authority. Start by emailing support@rspo.ca with “Privacy request” in the subject line.
11. Updates and scope
This platform is intended for business use, not for children. Do not create an account unless you can lawfully act for yourself or your business. External websites and connected providers have their own policies. We may update this policy as the platform changes, show the revised date and provide further notice or seek consent where required. A new policy does not automatically authorize an incompatible use of previously collected information.