Privacy Policy

Effective Date: October 27, 2025

MaipleStar Solutions Ltd. ("we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you visit our website at https://maiple.ca, use our services (including MaipleHCM Suite, MaipleShift, and MaipleTime), or interact with us in other ways. We operate in compliance with applicable privacy laws, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the California Consumer Privacy Act (CCPA) for California residents, and the General Data Protection Regulation (GDPR) for European Economic Area (EEA) residents.

By using our website or services, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use our services.

Information We Collect

We collect personal information to provide and improve our human capital management (HCM) software and related services. The types of information we collect include:

  • From our website: Name, email address, and phone number when you submit contact forms or sign up for newsletters.
  • From account registration or logins: Company details (e.g., name, address) and user roles (e.g., admin, employee).
  • Through our software/services: Employee data such as names, training records, date of birth, and performance metrics entered by authorized users in tools like MaipleHCM.

We do not collect personal information automatically beyond what is necessary for site functionality (e.g., IP addresses for security). Data collected outside of admin registration is used solely to provide the service.

How We Use Your Information

We use the personal information we collect for the following purposes:

  • To provide, maintain, and improve our services (e.g., processing employee data in MaipleHCM).
  • To communicate with you (e.g., service updates, support responses via email or text).
  • To enhance software functionality and performance based on usage patterns.
  • For legal compliance, such as record-keeping for audits or responding to lawful requests.

We do not use your information for marketing or solicitation without your explicit consent.

Sharing and Disclosure of Your Information

We do not sell personal information to third parties. We only share information as necessary and with your knowledge where applicable:

  • Service Providers: We share email addresses and phone numbers with trusted providers like AWS and Twilio for communication services (e.g., sending notifications). These providers are contractually obligated to protect your data and use it only for the services we provide. Providers may change over time, but we will update this policy accordingly.
  • User-Initiated Sharing: You control sharing data with third parties through our services (e.g., exporting reports). We do not automatically share on your behalf.
  • Legal Requirements: We may disclose information if required by law, such as to legal authorities in response to valid requests or to protect our rights, safety, or property.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We do not share data with advertisers or for any other commercial purposes.

Data Storage and Security

Your data is stored securely with measures appropriate to its sensitivity:

  • Location: Data for Canadian customers is stored in Canada, U.S. customers in the U.S., and EU customers in the EU to comply with local laws.
  • Retention: We retain data as long as your account is active and for a minimum of 7 years after termination for primary user contact and billing information (required for accounting purposes). Other service data can be deleted upon request.
  • Security: Sensitive information (e.g., Social Insurance Numbers) is encrypted. Names and email addresses are not encrypted but protected through access controls, firewalls, and regular security audits. Our team may access data from outside the storage country (e.g., a U.S.-based engineer accessing a Canadian server) for support purposes, but only with authorization.

While we strive to protect your data, no system is completely secure. We encourage you not to include sensitive health or personal details in optional comments (e.g., leave requests), as these are not encrypted.

Your Rights and Choices

The data you enter belongs to your organization. As the data controller, your organization controls access and decisions. We support the following rights where applicable under law:

  • Access and Portability: You can request a copy of your data in standard export formats at no cost. Custom formats may incur a reasonable fee.
  • Correction and Deletion: Request corrections or deletion of service-related data (excluding retained billing/contact info). Contact us to process requests.
  • Opt-Out: We do not sell data, so "Do Not Sell My Personal Information" requests under CCPA are not applicable. For GDPR, you can withdraw consent, object to processing, or request erasure (subject to legal retention).
  • Children's Privacy: Our services are not directed at children under the legal working age. We do not knowingly collect data from minors.

To exercise rights, contact us (details below). We respond within 30-45 days, depending on the law.

Cookies and Tracking

We use cookies and similar technologies solely for website and application functionality (e.g., session management) and performance monitoring (e.g., error tracking). No cookies are used for marketing, advertising, or third-party tracking. You can manage cookies via your browser settings, but disabling them may affect service usability.

For EU users, we implement consent mechanisms where required by GDPR.

International Data Transfers

Data is stored regionally, but authorized personnel may access it across borders for operational needs (e.g., support). We ensure transfers comply with laws like GDPR's Standard Contractual Clauses or PIPEDA's accountability principles.

Changes to This Privacy Policy

We may update this policy to reflect changes in our practices or laws. Significant changes will be notified via email to registered users or a prominent notice on our website at least 30 days in advance. Continued use after changes constitutes acceptance.

Contact Us

For privacy questions, rights requests, or concerns, contact our Privacy Officer via the contact form. Include "Privacy Inquiry" in the subject line.

Last Updated: October 27, 2025