Privacy Policy

Anchor Compliance is a confined space compliance platform operated by CCL Health and Safety ("CCL", "we", "us", "our"). This policy explains what personal information we handle when you use Anchor Compliance at www.anchorcompliance.ca, why we handle it, and who else it reaches.

It covers the Anchor Compliance product only. CCL's consulting website at ontariohealthandsafety.com publishes its own privacy policy, and that document governs your use of that site.

Information you give us directly

When you create an account we collect your name, email address, and the details you provide about your work: job title, role, company name, industry, approximate number of employees, city, province, and what you told us you are looking for. We use this to set up your account, to understand whether Anchor Compliance fits your situation, and to follow up with you about it.

While you use the product we store the facility, team, and compliance records you create, including facility name and address, the names and email addresses of team members you invite, your confined space registry, hazard assessments, entry records, comments, and any photographs you upload.

Information about other people that you enter

This is worth reading closely, because it is the part of Anchor Compliance that concerns people who may never use the product themselves.

Confined space records identify the people involved in an entry. Depending on what you record, an assessment or entry may contain the names of entrants, attendants, supervisors, rescuers, and the competent person who signed it, along with typed signatures, the dates and times each person entered and exited, and the name and phone number of a site liaison contact.

You control that information. CCL stores and processes it on your behalf so you can produce and retain the records your legal obligations require. You are responsible for having an appropriate basis to enter it and for making sure the people named are aware their information is recorded, as your workplace privacy obligations require. We do not use worker information entered into your records for marketing, and we do not sell personal information.

Documents that are readable by link

When a hazard assessment is approved, or an entry record is completed, Anchor Compliance publishes it at a long, unguessable web address so it can be shared with an inspector, a contractor, or anyone else who needs to see the signed record.

Anyone who has that address can open the document without signing in, and the document includes the personal information described above. The addresses are not listed in the product, are not included in search engine indexes, and are not published anywhere by us, but they are not protected by a password. Treat a document link the same way you would treat the signed paper record: share it with the people who need it, and understand that whoever receives it can pass it on.

Draft and unapproved records are not published this way and remain visible only to your facility and the competent person assigned to it.

Why we handle this information

• To provide, operate, and support the Anchor Compliance service
• To create and maintain your account and authenticate you when you sign in
• To produce the compliance documents, exports, and audit records the product exists to create
• To send transactional messages such as sign-in links, sign-off notifications, and document status updates
• To respond to your enquiries and provide customer and consulting support
• To secure the service and investigate misuse
• To meet our own legal and regulatory obligations

We may also contact you about Anchor Compliance itself. You can ask us to stop sending non-essential messages at any time using the contact details below. Messages that are part of the service, such as a sign-in link or a notification that a document needs your sign-off, are not marketing and cannot be turned off separately from the account.

Service providers

We use a small number of third-party providers to run Anchor Compliance. Each one receives only what it needs to perform its function, and each is bound to handle it confidentially and use it only to provide services to us.

• Supabase, our database, authentication, and file storage provider. It holds your account details, all facility and compliance records, and any photographs you upload.
• Vercel, our application hosting provider. It processes web requests to the service and provides aggregate usage analytics about how pages are used. Our analytics do not use cookies and do not build a profile of you across other websites.
• Resend, our email delivery provider. It receives the name and email address of each recipient in order to deliver sign-in links, team invitations, and notifications, and it holds the contact list we use to follow up with new sign-ups.

We may also disclose information where we are required to do so by law, or where it is necessary to establish, exercise, or defend a legal claim.

Where information is stored

CCL Health and Safety operates from Ontario, Canada. Our service providers operate infrastructure in Canada and the United States, and your information may be stored or processed in either country. Information held in another country may be accessible to the courts, law enforcement, and national security authorities of that country under its laws. If you need to know the specific region your facility's records are stored in, contact us and we will tell you.

Cookies and session storage

Anchor Compliance sets cookies that are necessary for the service to work. These keep you signed in as you move between pages and protect the sign-in process. Without them you could not use an account, so they cannot be turned off while you are signed in. You can clear them through your browser, which signs you out.

We do not use advertising cookies, and we do not use cookies to track you across other websites.

Retention

We keep personal information for as long as necessary to provide the service, and afterwards for as long as necessary to meet our legal, regulatory, and record-keeping obligations or to resolve disputes.

Compliance records are intended to be durable. Signed assessments and completed entry records, and the audit trail of who submitted, approved, or rejected them, are kept as evidence of what was in effect at a given time, and superseding a document does not erase the version it replaced. Your own obligation to retain confined space records for a period set by law may be longer than your use of Anchor Compliance, and you are responsible for keeping your own copies. The product provides PDF exports for that purpose.

If you want information deleted, contact us using the details below and we will explain what can be removed and what we are required to keep.

Security

We use technical and organisational measures appropriate to the service, including encrypted connections, authentication through single-use sign-in links rather than stored passwords, and access controls that restrict records to your facility and the competent person assigned to it. Every sign-off action is written to an append-only audit log.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Keep your email account secure, since access to it means access to your Anchor Compliance sign-in links, and share document links only with people who should see them.

Your rights

Under Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to ask for access to the personal information we hold about you, to ask us to correct it if it is inaccurate, to withdraw consent to non-essential communications, and to complain to the Office of the Privacy Commissioner of Canada.

To exercise any of these, contact us using the details below. We will respond within a reasonable time and may need to verify your identity first. Where information forms part of a compliance record or an audit trail, we may not be able to alter or delete it, and we will explain why if that is the case.

If your personal information appears in a customer's records because an employer entered it, that customer decides how those records are used. Contact them first. We will help where we can, and we will pass your request on where we cannot act on it ourselves.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the date at the top of this page, and we will tell account holders directly if a change materially affects them. Continuing to use Anchor Compliance after a change means you accept the updated policy.

Contact us

For any question about this policy, about what we hold, or to make a privacy request, contact CCL Health and Safety:

CCL Health and Safety
Waterloo, Ontario, Canada
Email: info@ontariohealthandsafety.com
Phone: (519) 998-2584