Privacy Policy

This Privacy Policy explains how Steer (the "Application"), operated by the organisation identified below (the "Operator", "we"), collects, uses, discloses and protects personal information about its users, its clients' contacts, drivers, and the contacts of partner carriers and suppliers who use the partner portal. It is written to comply with Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and applicable Canadian privacy legislation.

1. Who we are

RCP Transit
230 East Brighton Road,
Island Pond (Vermont) USA
05846
(819) 849-7878
guillaume@rcptransit.ca

2. Privacy officer

The privacy officer is responsible for this policy, for handling access, rectification and withdrawal requests, and for the confidentiality-incident register described in section 9.

3. Personal information we collect

• Account information – first and last name, email address, hashed password, role and warehouse assignment of every user of the Application, including partner-portal users.
• Business contact information – names, email addresses, phone numbers and postal addresses of client, carrier and supplier contacts, entered by our staff or by the partner through the portal.
• Operational information – orders, receptions, deliveries, bookings, carrier availabilities, notes, signatures, photos and documents (such as bills of lading) that may incidentally identify drivers or on-site contacts.
• Technical information – IP address, browser type, and timestamps recorded in security and activity logs, including the timestamp and IP address of your acceptance of the Terms of Service and this policy.

We do not collect payment card data. Accounting documents are synchronised with QuickBooks Online (see section 6).

4. Why we use it

• To operate the Application: manage inventory, orders, receptions, deliveries and carrier bookings.
• To communicate with users and partners about those operations (confirmations, booking proposals, notifications, reports).
• To invoice clients and pay carriers, including through our accounting software.
• To secure the Application, prevent fraud and misuse, and keep an audit trail of changes.
• To comply with our legal obligations.

We do not sell personal information and we do not use it for advertising or profiling.

5. Consent

Partner-portal users give explicit consent by accepting this policy and the Terms of Service when they first sign in and whenever these documents change. Contact information entered by our staff on behalf of a client, carrier or supplier is collected for the business relationship with that organisation; the organisation is responsible for informing its personnel. You may withdraw consent at any time by contacting the privacy officer, subject to our legal and contractual retention obligations.

6. Disclosure and service providers

We share personal information only with the service providers below, who process it on our behalf under contractual confidentiality obligations, and with the partners directly involved in an operation (for instance, the carrier booked on a delivery receives the delivery address).

Service providers (sub-processors)

7. Where your information is stored

Your personal information is stored and processed outside Québec. The Application is hosted on Heroku (Salesforce), United States (US region); its database runs on JawsDB (MySQL) and Heroku Key-Value Store (Redis), United States; documents and photos are stored on Amazon Web Services S3, us-east-2 (Ohio, United States). Before transferring information outside Québec we assessed the sensitivity of the information, the purposes of its use, the protection measures applied and the legal regime of the destination, and concluded the information receives adequate protection. Information may be subject to lawful access requests under the laws of the United States.

8. Retention

We keep personal information only as long as necessary for the purposes above and to meet legal, accounting and tax obligations. Operational records (orders, deliveries, invoices) are kept for the period required by Québec and Canadian tax law. Portal accounts that remain inactive are deactivated and their personal information anonymised in accordance with our retention schedule. Security and activity logs are pruned on a rolling basis.

9. Security and confidentiality incidents

We protect personal information with access controls based on roles and warehouses, encrypted transport (HTTPS), hashed passwords, audit logging and least-privilege access for our staff. Every incident involving personal information is recorded in our confidentiality-incident register. If an incident presents a risk of serious harm, we notify the Commission d'accès à l'information du Québec and the individuals concerned without delay.

10. Your rights

Subject to applicable law, you may ask to access the personal information we hold about you, to have it corrected, to withdraw consent, to have it de-indexed or deleted, and to receive it in a structured, commonly used technological format. Send your request to the privacy officer identified in section 2. We respond within 30 days. If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec.

11. Cookies

The Application uses only strictly necessary cookies: a session cookie that keeps you signed in and a security token that protects forms. We do not use analytics or advertising cookies.

12. Changes to this policy

We may update this policy. The effective date and version appear at the top of this page and every change is listed in the revision history below. Partner-portal users are asked to accept material changes at their next sign-in.

Revision history