Privacy Policy.

Scope of this policy

This policy applies to personal information under the control of 1 Asbestos Academy Ltd., operating as 1 Asbestos Academy, including information collected through:

• 1asbestosacademy.ca and the previous asbestosacademy.ca website;
• online scheduling, course registration, intake and contact forms;
• telephone calls, email, text messages and in-person communications;
• classroom, practical, remote and onsite training;
• examinations, practical assessments and recertification services;
• employer, sponsor, WorkBC or other third-party funded bookings;
• contractor consulting and Abatement HUB enquiries; and
• administrative, financial, safety, quality-assurance and compliance activities.

Our general private-sector activities are governed primarily by British Columbia’s Personal Information Protection Act. Where we provide services for or on behalf of WorkSafeBC, additional requirements under the Freedom of Information and Protection of Privacy Act, the Workers Compensation Act, applicable regulations and our agreement with WorkSafeBC may apply.

Accountability and privacy officer

1 Asbestos Academy is responsible for personal information under its control, including information processed by service providers on our behalf.

The position responsible for privacy compliance is:

The Privacy Officer oversees privacy policies, access and correction requests, complaints, service-provider controls, privacy training, incident response and required communications with WorkSafeBC or privacy regulators.

Personal information we may collect

The information collected depends on the service requested. It may include the following categories.

We seek to collect information directly from the person it concerns. Information may also be received from an employer, authorized representative, funding organization, training provider, WorkSafeBC or another person where the individual has authorized the collection or the collection is otherwise legally permitted.

Where identity verification is required, we seek to record only the information necessary for the verification. We do not retain a full copy of identification unless retention is required for an authorized purpose.

Why we collect and use information

We may collect and use personal information to:

• answer enquiries and recommend an appropriate training or certification pathway;
• create, confirm, modify or cancel bookings;
• verify identity, prerequisites and eligibility;
• deliver classroom, practical, remote and onsite training;
• administer examinations and practical assessments;
• register candidates and transmit required information to WorkSafeBC or an authorized examination system;
• document attendance, results, incidents, accommodations, interpreters and quality-assurance activities;
• issue Academy certificates for non-WorkSafeBC programs;
• process payments, invoices, refunds and funding arrangements;
• communicate with employers, sponsors or representatives where authorized;
• respond to complaints, access requests, audits or investigations;
• maintain website security and improve website performance;
• comply with legal, contractual, insurance, accounting, safety and recordkeeping obligations; and
• send promotional communications where consent or another lawful basis exists.

We will not use personal information for a new purpose unless that purpose is reasonably connected to the original purpose, the individual consents, or the use is otherwise authorized by law.

WorkSafeBC training, examinations and assessments

When personal information is collected expressly for WorkSafeBC-authorized asbestos training, examination or assessment services, it is collected to:

• verify candidate identity and eligibility;
• register and schedule candidates;
• administer authorized training, examinations and practical assessments;
• report attendance, results, irregularities and required administrative information;
• support WorkSafeBC certification decisions; and
• meet audit, quality-control, compliance and recordkeeping requirements.

The legal authority for this collection includes WorkSafeBC’s statutory responsibilities under the Workers Compensation Act, including section 59.01, applicable Occupational Health and Safety Regulation requirements, the Freedom of Information and Protection of Privacy Act and the training and assessment services agreement under which we provide the services.

Personal information held by us on behalf of WorkSafeBC remains under WorkSafeBC’s control for FIPPA purposes. Records supplied to WorkSafeBC may be subject to access-to-information requirements.

WorkSafeBC-specific safeguards

For information handled in connection with these services, we apply the following additional controls:

• collection is limited to information authorized and necessary for the service;
• access is restricted to people who require it to perform their duties;
• information is not used for advertising or unrelated commercial profiling;
• information is encrypted in transit and at rest using appropriate current security methods;
• information is stored, accessed and disclosed only within Canada unless WorkSafeBC provides written direction or the law expressly permits otherwise;
• unauthorized access, disclosure or suspected privacy incidents are immediately escalated under our breach procedure; and
• approved records are returned or securely destroyed when no longer required, subject to contractual and legal retention obligations.

Consent and choices

Consent may be express or implied, depending on the sensitivity of the information and the circumstances. By voluntarily providing information to request or receive a service, an individual generally consents to its reasonable collection, use and disclosure for that service.

Additional or express consent may be requested for matters such as promotional messages, testimonials, photographs, optional recordings or disclosure to another person.

Consent may be withdrawn by contacting our Privacy Officer, subject to legal, contractual and operational restrictions. Withdrawal may prevent us from delivering a requested service or completing an examination, certification or recordkeeping requirement.

When information may be disclosed

We do not sell or rent personal information. We may disclose it only as reasonably necessary and authorized, including to:

• WorkSafeBC and authorized systems or representatives supporting its training, examination, certification, audit or compliance functions;
• approved instructors, examiners, invigilators or interpreters who require the information to perform their duties;
• an employer, purchaser, funding agency or authorized representative where the individual has authorized the disclosure or the disclosure is otherwise legally permitted;
• service providers supporting booking, hosting, email, payment, accounting, document storage, security and administration;
• professional advisers, auditors, insurers or legal counsel subject to appropriate confidentiality obligations;
• law enforcement, regulators, courts or government bodies where disclosure is required or authorized by law; or
• another organization in connection with a lawful business transaction, subject to applicable privacy requirements.

We do not disclose WorkSafeBC confidential information or WorkSafeBC-controlled personal information to third parties except as authorized by the applicable agreement, WorkSafeBC or law.

Service providers and data location

We may use service providers for website hosting, scheduling, email, payment processing, accounting, analytics, security and document management. These providers receive only the information reasonably necessary to perform their services and are expected to protect it appropriately.

General website or business information may be processed in Canada or another jurisdiction, depending on the provider. When information is processed outside Canada, it may be subject to the laws of that jurisdiction.

We do not permit a subcontractor or subprocessor to access WorkSafeBC-controlled information unless the access is required, appropriately protected and approved where approval is required.

Website, cookies and analytics

Our websites may use cookies, pixels, server logs and related technologies to:

• keep website, booking and account functions working;
• remember preferences;
• detect fraud, misuse or security threats;
• measure website visits, engagement and conversions; and
• evaluate the effectiveness of advertising and outreach.

Browser settings may allow cookies to be blocked or deleted. Blocking essential cookies may prevent booking, payment or other website functions from working correctly.

We do not use examination answers, assessment results, government-identification information or WorkSafeBC candidate records for behavioural advertising.

Payments and financial information

Online payments are handled through third-party payment processors. Full payment-card information is generally entered directly into the processor’s secure system and is not stored by us.

We may retain transaction details such as purchaser name, billing contact, invoice number, amount, payment status, refund information, transaction identifier and limited card information supplied by the processor.

Payment and accounting records are retained for the periods required for business, tax, chargeback, audit and legal purposes.

Email, text and promotional communications

Operational messages about a booking, course, payment, exam, certificate, schedule change or service request are sent as necessary to provide the service.

Promotional emails or text messages are sent only where we have consent or another lawful basis. Commercial messages will identify us and provide a working unsubscribe method as required by Canada’s Anti-Spam Legislation.

An unsubscribe request applies to promotional messages. We may still send non-promotional messages required to administer an existing booking, examination, transaction, legal obligation or safety matter.

Security safeguards

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information. These may include:

• role-based access and least-privilege permissions;
• passwords, multi-factor authentication and account controls;
• encryption during transmission and storage;
• secure portals, systems and physical storage;
• software updates, malware protection, backups and security monitoring;
• confidentiality requirements and privacy training;
• secure examination and assessment procedures;
• incident response and breach-escalation procedures; and
• secure shredding or electronic destruction when records are no longer required.

No system can guarantee absolute security. Individuals should not send sensitive information through an unsecured channel unless instructed to do so.

Retention and secure disposal

Personal information is retained only for as long as reasonably necessary to fulfil the identified purposes and meet legal, contractual, safety, tax, insurance, audit and dispute-resolution requirements.

WorkSafeBC service records

Records concerning WorkSafeBC training and assessment services are maintained for the period required by our agreement, including the agreement term and generally seven years following completion or termination, unless WorkSafeBC directs otherwise or another legal requirement applies.

Other business records

Booking, financial, training, consulting, correspondence and complaint records are retained according to their purpose, sensitivity and applicable legal requirements. Marketing contact information may be retained until consent is withdrawn or the information is no longer required.

At the end of the applicable period, records are securely destroyed, anonymized or returned to the party entitled to control them. Backup copies may remain temporarily in protected, non-readable backup systems until overwritten under the normal backup-destruction cycle.

Access, correction and privacy requests

Subject to applicable exceptions, an individual may request:

• access to personal information under our control;
• information about how it has been used or disclosed;
• correction of inaccurate or incomplete information;
• withdrawal of consent where consent is the basis for the processing; or
• information about our privacy practices or complaint process.

Requests must be made in writing to the Privacy Officer and contain enough detail to identify the person and the information requested. We may ask for reasonable identity verification before releasing or changing records.

Access may be limited where disclosure would reveal another person’s information, confidential commercial information, legally privileged information, examination-security information or information that must not be disclosed under applicable law.

Privacy incidents, breaches and complaints

A suspected loss, unauthorized access, use, disclosure, alteration or disposal of personal information should be reported to our Privacy Officer immediately.

We will document and assess the incident, take reasonable steps to contain it, preserve evidence, reduce harm, correct vulnerabilities and notify affected parties or regulators where appropriate or required.

A suspected breach involving WorkSafeBC information is immediately reported to WorkSafeBC’s FIPPA Designate. WorkSafeBC will be consulted before notifications are issued regarding information under its control.

Complaints

Privacy complaints should first be sent in writing to our Privacy Officer. We will review the concern, gather relevant information, document the findings and communicate the outcome.

An individual who is not satisfied with our response may contact the Office of the Information and Privacy Commissioner for British Columbia. Complaints concerning WorkSafeBC-controlled information may also be directed to WorkSafeBC.

Third-party links and policy updates

Our websites may contain links to WorkSafeBC, funding agencies, training resources, social media or other third-party websites. Their privacy practices are governed by their own policies, not this policy.

We may update this policy when our services, systems, legal requirements or contractual obligations change. The current version will display its last updated date.

Material changes affecting an existing use of personal information may be communicated directly or accompanied by a new consent request where appropriate.