Privacy Policy

1. Our two roles

When you visit our websites or hold an account with us, we decide how your information is used. We are its controller, and this policy applies directly.

When an organization uses the Services for its own work, the information it adds belongs to that organization: its staff, employees, guests, clients and customers. Examples are employees in Payroll, guests in Booking and contacts in the CRM. The organization decides how that information is used, and we process it on its behalf under our Data Processing Agreement. If you are an employee, guest or client of one of our customers, contact that organization first. We will help it answer your request.

2. Information we collect

Account and sign-in

• Name, email address, username, password (stored only as a salted hash), and the organizations, groups and roles you belong to.
• If you sign in with Google, Microsoft or Facebook, we receive your name, email address and an account identifier from that provider. We do not receive your password there.
• Security records: sign-in times, IP address, browser type, and the actions you take in the Services (audit logs).

Information organizations put into the Services

This depends on the product. Each one is described in section 3.

People who fill in an organization’s forms

Organizations can send forms and documents to sign to people who have no account with us. What we receive is described under “Forms and electronic signatures” in section 3.

Website visitors and contact forms

• What you send us through contact or careers forms, such as name, email, phone, message and resume.
• Basic technical logs needed to run and secure the websites.

3. What each product handles

Shree Krupa Enterprise Inc. platform

Organizations manage their operations here. Depending on the modules they use, this can include:

• staff profiles, departments, attendance and availability (HR);
• tasks and projects, and chat messages;
• customer and lead contact details and activities (CRM);
• invoices, payments and ledger records (finance);
• documents and files (document management), inventory and supply chain records;
• dispatch and delivery: rides, local deliveries, parcels and carriers, described below;
• online forms and documents signed electronically, described next.

Forms and electronic signatures

When you fill in or sign a form an organization sends you, the organization controls the information and we process it for it. We receive:

• your answers, the files you attach, and an identity document if the organization asks for one;
• your typed name and, if you draw one, your handwritten signature, and the boxes you fill on a PDF;
• your email address, and the one-time codes we email you to confirm it is yours;
• the time, your IP address and your browser and device details, the language you chose, and that you agreed to sign electronically;
• if you pass a request to someone else, their name, email address and your reason;
• if the form takes a payment, what you chose, which the organization’s finance records use to create and email your invoice.

When you submit, these details are sealed: they are fingerprinted, digitally signed and stored as a locked record, so they cannot be altered afterwards. A correction or an edit is sealed as a new version, and earlier versions stay on record. To prove when a record was sealed, only its fingerprint (a SHA-256 hash, which reveals nothing about its content) is sent to independent time-stamping services, FreeTSA and OpenTimestamps; OpenTimestamps records it permanently in the public Bitcoin blockchain. Anyone with a record’s seal or sealed PDF can check that it is authentic on its verification page, which never shows the answers.

Saved, unfinished answers are kept for 30 days, then deleted. Ask the organization that sent you the form about its own use of your information; the form links to its privacy notice when it has given one.

Dispatch, rides, deliveries and parcels

Organizations use dispatch to run their own couriers and drivers and to send parcels with carriers. Depending on how they use it, we process for them:

• Riders, customers and parcel receivers: name, phone number, email address, pickup and dropoff addresses and their map position, times, fares, tips and charges, ratings and comments, messages exchanged with the courier through the Services, the delivery PIN, and proof of delivery (who received it, a photo and a signature, when the organization asks for them).
• Couriers and drivers (the organization’s staff or contractors): their position while they are online and the routes they drive, shifts, the jobs offered to and done by them, vehicles, cash they collect and hand in, and earnings and payouts.
• Parcels: sender and receiver details, contents, weights and sizes, declared values, labels, tracking events and carrier invoices. For parcels crossing a border, the customs declaration: what is inside, its origin and value, and the exporter’s and importer’s tax numbers.
• Public tracking pages: anyone with a job’s tracking link sees its status, its stops and their addresses, the courier’s first name, vehicle and plate, the courier’s position while on the way, the estimated arrival, and the carrier’s tracking link. The link is the only key to the page, so it should be shared only with the people concerned.

An organization that collects payments by card connects its own payment gateway. Riders and customers pay on the gateway’s page; we receive the result and the amount, never the card number.

Booking

Guests and clients of our customers: name, email, phone, booking dates and times, the service or room booked, notes and special requests, and booking history. When an organization connects an online travel agency (Booking.com, Expedia, Agoda, Trip.com or Google Hotels), reservations and the guest details they contain are exchanged with that agency at the organization’s direction. We send booking confirmations and other booking notices by email on the organization’s behalf.

Payroll

Employees of our customers: identity and contact details, Social Insurance Number, date of birth, address, province of employment, tax credit forms (TD1), pay rates, hours, earnings, deductions and benefits, garnishments, bank account details for direct deposit, pay statements, and year-end slips and records (T4, T4A, RL-1, ROE). Social Insurance Numbers and banking details are encrypted when stored. Payroll prepares filings and payment files for the employer; the employer is responsible for filing with the Canada Revenue Agency, Revenu Québec and Service Canada and for paying its employees.

Bookkeeping

Bank and card transactions of our customers and their clients: dates, amounts, descriptions, counterparties, categories, notes and supporting documents. When a bookkeeper asks a client about a transaction, we email that client a single-use link to a short form.

Meridian Media Hub

Connected social media accounts, encrypted access tokens, posts and media, and the comments and reviews people leave on published posts, with the commenter’s public name and username. MMH has its own detailed notice, including what each social network shares with it, at meridianmediahub.com/privacy.

4. How we use information

• To provide the Services: sign you in, run the features your organization uses, and send the emails those features need.
• To keep the Services secure and reliable: authentication, access control, audit logs, fraud and abuse prevention, backups and troubleshooting.
• To support you and to communicate about your account, changes to the Services and these policies.
• To meet legal obligations, such as tax and record-keeping rules.

We do not sell personal information. We do not use customer data for advertising, and we do not use it to train artificial intelligence models.

5. Who we share it with

• Service providers who host and operate the Services for us (see the list of subprocessors). They act only on our instructions and under confidentiality and security obligations.
• Services an organization connects, at its direction: online travel agencies (Booking), social networks (MMH), sign-in providers, its payment gateway, and the carriers it ships with.
• Carriers an organization connects (such as UPS, FedEx, DHL, Canada Post, Purolator, GLS, DPD, and carriers in Asia, the Middle East and Africa, Latin America and Oceania). To price, book, collect, track and invoice a shipment, we send them the sender’s and receiver’s names, addresses, phone numbers and email address, the parcel details and, across a border, the customs declaration. Each carrier handles them under its own terms and privacy policy, in its own country and the countries the parcel passes through.
• Map, address and route services: the maps in dispatch load map images from OpenStreetMap and CARTO, which receive your IP address and the area shown. When an organization sets up address lookup or route planning services, the addresses and positions of its stops are sent to them.
• Time-stamping services (FreeTSA and OpenTimestamps) receive only the fingerprints of sealed form records, never their content.
• People within your organization, according to the roles its administrators assign.
• Authorities, when the law requires it. We tell the affected organization when the law allows.
• A buyer or successor in a merger or acquisition, subject to this policy.

6. How we protect it

Traffic to the Services uses TLS, and connections between our servers are encrypted. Stored files use server-side encryption. Sensitive values are additionally encrypted in the application with AES-256-GCM: Social Insurance Numbers, banking details, sign-in sessions and connected-account tokens. Access is controlled by role-based permissions and recorded in audit logs. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify the affected organizations, individuals and regulators as the law requires.

7. How long we keep it

• Customer data is kept while the organization uses the Services. After its account ends, we delete it within 90 days, unless the organization asks us to export it first or the law requires us to keep it longer.
• Payroll and bookkeeping records are kept for at least six years from the end of the tax year they relate to, as Canadian tax law requires the employer to keep them, unless the organization takes them over.
• Sealed form records are kept as the organization decides, while its account is active, and are deleted with its other data when the account ends. While kept they cannot be changed; a correction is added as a new version. Fingerprints already recorded by time-stamping services cannot be removed, but reveal nothing.
• Saved, unfinished form answers are deleted after 30 days.
• Your acceptance of these policies (which version, when, and from which IP address) is kept while your account exists, as proof of what you agreed to.
• Couriers’ positions are kept for the period the organization sets (at least 7 days). After that, only the route each finished job travelled is kept with that job.
• Jobs, proof of delivery, customs declarations and labels are customer data, kept while the organization uses the Services.
• Connected-account tokens and credentials (MMH, travel agencies, carriers, payment gateways) are deleted as soon as the connection is removed.
• Security and audit logs are kept for up to one year. Server logs are kept for up to 90 days.

8. Where it is stored

Our application and database servers are in Canada. Some service providers, such as website hosting and email delivery, may process information in the United States or other countries. We protect it there with contracts and the safeguards described here. Carriers and other services an organization connects process what it sends them in their own countries, which for parcels includes the countries a parcel is sent from, through and to.

9. Cookies and similar technologies

We only use what the Services need to work:

We do not use advertising or cross-site tracking cookies.

10. Your rights

You can ask to access or correct your personal information, ask us to delete it, or withdraw consent where we rely on it. Depending on where you live, you may have further rights: under Canada’s PIPEDA, Québec’s Law 25 (including data portability and information about automated decisions), the EU or UK GDPR, or US state privacy laws. Email privacy@shreekrupa.net. We answer within 30 days and may need to confirm your identity. For information an organization controls, we pass your request to that organization. A sealed form record cannot be edited, so a correction is added to it as a new version instead. You can also complain to the Office of the Privacy Commissioner of Canada, or to your local regulator.

11. Children

The Services are for businesses and are not directed to children under 16. Organizations may hold limited information about minors, such as young employees or guests, and are responsible for having a lawful basis for it.

12. Changes

We will post updates here and change the date at the top of this page. We will tell account holders about material changes before they take effect, and ask them to accept the new version the next time they sign in.

13. Contact

Our Privacy Officer is accountable for this policy: privacy@shreekrupa.net, Shree Krupa Enterprise Inc., Unit 6, 2763 Danforth Avenue, Toronto, ON.