Privacy Governance Policy

This page describes how 1000595837 Ontario Inc. o/a Inlabs governs personal information in practice. It complements the Privacy Policy and is published to meet the governance-transparency requirements of Quebec's private-sector privacy law.

The person in charge of the protection of personal information is the President of 1000595837 Ontario Inc. o/a Inlabs. Privacy matters are handled through privacy@runpayroll.ca.

New systems and material changes that involve personal information are assessed for privacy impact before launch, covering necessity, sensitivity, access, retention, and vendor involvement. The payroll system and the worker portal are assessed under this practice.

We collect only what the identified purposes require. Payroll data is collected because payroll administration and statutory documents require it; website and account data are limited to operating, securing, and billing the Service.

Access to personal information is role-based and limited to what a role requires. Administrative access requires multi-factor authentication, and access and changes are recorded in an append-only audit log.

We maintain an incident-response process and a register of confidentiality incidents. Incidents presenting a real risk of significant harm are reported and affected individuals notified as the law requires.

Requests and complaints go to privacy@runpayroll.ca. We acknowledge promptly, respond within the timelines the applicable law sets, and explain the outcome. If you are unsatisfied, you may escalate to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

• Payroll records: retained for the statutory periods that apply to payroll and tax records in Canada.
• Account, billing, and support records: retained while the account is active and as needed for legal and audit purposes afterward.
• When retention ends, records are deleted or anonymized on our destruction schedule, subject to backup cycles.

Providers that handle personal information are bound by written agreements and listed at /subprocessors. Provider changes and processing locations are reviewed under the project-review practice above.

This policy and the practices behind it are reviewed at least annually and when the Service changes materially.