Privacy policy

Who is responsible

CanServe is the organization responsible for the personal information described here. Our privacy officer can be reached at the address and email at the bottom of this page, and answers privacy questions within 30 days.

When we carry out an order for a firm, we handle the information in that order on the firm's behalf as well as for our own record-keeping obligations.

What we collect

We collect only what the work needs:

• Account information: firm name, business address, billing email, business number, and each member's name, work email, phone, and role.
• Order information: the name and address of the person or business to be served, a map pin, the documents to be served, your matter reference, and anything you tell us about the party — including a photograph, where you give us one lawfully.
• Service records: the time, place, and outcome of every attempt, the GPS reading of the phone that recorded it, a description of the person served, and photographs taken at the address.
• Billing information: invoices, payments, receipts, and refunds. Card and bank details are held by our payment processor, not by CanServe.
• Delivery partner information: contact details, licence or bond details, coverage area, and — only while a partner is on duty — their last known location.
• Website and support information: what you send us through a form, and technical information such as the address your request came from, used to keep the service secure.

Why we use it, and on what basis

To review and open accounts; to carry out orders and record what happened; to produce proofs, invoices, and receipts; to support you; to keep the platform secure; and to meet legal and tax obligations.

For account and order information, our basis is the agreement with your firm. Information about a person being served is used because a legal proceeding requires documents to be delivered to them and the delivery to be proved — a purpose PIPEDA recognises without that person's consent, since seeking it would defeat the purpose.

We do not sell personal information, and we do not use it to advertise to you beyond our own services. Commercial email follows Canada's anti-spam legislation: it identifies us and every message has an unsubscribe link.

Who we share it with

We share only what each recipient needs:

• The process server, courier, or bailiff assigned to your order — the party, the address, the documents, and your instructions, while the job is theirs.
• Courts and their registries, where we file proof for you.
• Our service providers: hosting, email, mapping, and payment processing. Our subprocessors page lists them and what each one handles.
• Law enforcement or a regulator, where the law requires it. We ask for the legal basis, require a valid order where one is needed, and tell the affected customer unless we are prohibited from doing so.

Where it is held

CanServe's platform and its data are hosted in Canada. Our subprocessors page names any provider that could process information outside Canada, and what that means. While information is in another country, that country's courts and agencies may be able to require access to it.

How long we keep it

We keep records only as long as there is a reason to:

• Case records, attempts, and proofs: 7 years after the case closes. Affidavits are evidence, and limitation periods run for years.
• Invoices, payments, and receipts: 6 years after the tax year they belong to, as the Canada Revenue Agency requires.
• Field photographs: 2 years, unless they form part of a proof.
• A delivery partner's last known location: overwritten each time it updates; we never keep a trail.
• Website enquiries: 2 years. Activity and audit logs: 7 years. Backups: 14 days.

How we protect it

Each firm's data is separated from every other firm's, so a member only ever sees their own firm's records. Passwords are stored as one-way scrypt hashes; invitation and reset links are stored only as hashes, expire, and work once.

Access is by role: firm members see their firm, CanServe staff see what their role allows, and a delivery partner sees a case only while the job is theirs. Every staff action on a firm is written to that firm's own activity log.

Our security page describes the technical controls, and we keep an audit record of them.

Your rights

You can ask what personal information we hold about you, ask for a copy, ask us to correct it, and ask us to delete it. Write to the privacy officer below; we answer within 30 days and never charge for a first request.

Where we must keep a record by law — a proof of service in a concluded proceeding, for instance, or a tax record — we will tell you why we are keeping it rather than deleting it, and what we will do with it.

If a person who was served asks us about the information we hold about them, we answer that request as well, within the same limits.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or to your provincial privacy commissioner.

Cookies

We use only the cookies the service needs to work. Our cookie notice explains each one.

Breaches

If a breach creates a real risk of significant harm, we notify the Office of the Privacy Commissioner and the people affected as soon as feasible, and we keep a record of every breach for 24 months, as PIPEDA requires.

Changes

We post changes here with a new date, and tell account administrators before a material change takes effect.