Privacy Policy
This policy explains what personal information csr eco solutions collects when you use recovery, why, where it is kept, how long we keep it, and what you can ask us to do with it. recovery is our reporting portal for office decommissioning projects, at recovery.csrecosolutions.com.
We have written one policy for everyone who uses recovery, in Canada and in the United States.
In short
- We collect what we need to give you an account, keep it secure, and show your organisation its project results. We do not sell personal information, and we do not use it for advertising.
- recovery uses only cookies it needs to work: one keeps you signed in, and short-lived ones carry a sign-up, invitation, password-reset or email-change link. There are no advertising or analytics cookies.
- Your organisation decides what goes into its projects. We handle that information for your organisation, on its instructions.
- Our main systems are in Toronto, Canada. Some of our service providers are in the United States.
- You can ask to see or correct your information, or raise a concern, at dpo@csrecosolutions.com. We answer within 30 days.
1. Who we are and how to reach us
recovery is operated by CSR ECO SOLUTIONS INC., which does business as csr eco solutions, at 2 Island 130, Port Severn, Ontario L0K 1S0, Canada ("csr eco solutions", "we", "us").
The person in charge of the protection of personal information at csr eco solutions is Blake Leal, Managing Partner. You can reach him for any privacy question, request or concern:
- by email: dpo@csrecosolutions.com
- by mail: CSR ECO SOLUTIONS INC., Attention: Privacy, 545 King St W, Suite 338, Toronto, Ontario M5V 1K4
2. Who this policy covers
- People with a recovery account ("Authorised Users"): the people an organisation that uses recovery (the "Customer") has allowed to sign in.
- People who contact us or ask for access through a form in recovery or by email.
- People named in a Customer's project records ("Client Data"), for example a name written on a scale ticket. Section 9 explains who is responsible for that information.
This policy covers recovery. It does not cover the csr eco solutions corporate website.
3. What we collect
Account details. Your name as you want it displayed, a username, your work email address, your organisation, and your role in it (owner, admin, contributor or viewer). We keep your password only as a one-way hash; we cannot read it.
Two-step sign-in. If you set up two-step sign-in, we keep the secret that links your authenticator app to your account, and your backup codes in hashed form. Neither is ever shown back to you or to our staff. If you give us a phone number, we use it only to call you back to confirm it is you when you ask us to reset your two-step sign-in.
Sign-in and security records. Each time someone signs in or tries to, we record the email address used, whether it worked, the date and time, the network address (IP address) and the browser type your browser reports. We record the IP address when you change your account details or password, or ask to reset your password. We use IP addresses to slow down repeated wrong sign-in attempts.
Records of what you do in recovery. We record who created, changed or deleted a project record and when, and the figures before and after the change. We record invitations: who invited whom, with which role, and when. We record that you accepted a notice or terms, with the date and the version you accepted. We record when an in-app suggestion was shown to you, and whether you opened it or dismissed it.
What you send us. When you use the Contact Us form or the access request form, or email us, we keep what you wrote, your name, your email address, your company name, and the date. For the access request form we also record the IP address the request came from, to stop abuse of the form.
Contact Us form (signed-in members). When a signed-in member sends a request through the Contact Us form in recovery, we keep: your name; your email address (filled in from your account, and you can change it); a topic you pick from a list (a paid plan, more projects, past reporting, verification, running a project with csr eco solutions, enterprise, or other); your message, up to 2,000 characters; the page you sent it from; optionally, a band for how many projects your organisation expects each year; optionally, the partner that referred you (none, one of a short list of csr eco solutions' channel partners, or other); and the plan your organisation was on at that moment, which we read from our own records, not from you. We email the request to csr eco solutions support with your address as the reply address. That email also states your organisation's name, its plan, how many projects it has and your role in it. We record whether the email went out.
Projects we ran for you. When csr eco solutions staff publish into your organisation a project we ran for you, we copy into recovery the figures and details of that project: weights, quantities, values and recovery percentages, the project reference and title, the site address, the date, the name of the csr eco solutions project manager who ran it, and the program it belongs to. We also use your organisation's name from our client records to link your recovery organisation to our record of you (a name only, no contact details). We do not copy invoices, what we paid our logistics partners, your contacts, our notes, files, quote prices, or map coordinates. The personal information in a published project is the project manager's name (one of our staff) and the site address, which can identify a person where the site is a home or a sole proprietor's premises.
The invitation to your organisation's owner. When we set up your recovery organisation for you, we send the owner's invitation to the email address we hold for your primary contact in our client records. We use the name and address from that record for that invitation and for nothing else in recovery.
Project locations. When a project is created with a site address, we keep the address and work out its map position once, using our mapping provider (section 8).
Personal information inside Client Data. Project records are about materials, weights and destinations, not about people. They can still contain personal information: a name on a scale ticket, a site contact, a driver's name, the name of a person who received a donation, or a name typed into a note. The same is true of historical records a Customer gives us to load. See section 9.
What we do not collect. We do not collect payment card numbers. We do not use advertising trackers, analytics services run by other companies, or session recording. We do not run a device-fingerprinting script.
4. Why we use it
We use personal information only for these purposes:
- To provide recovery: to create your account, sign you in, show you and your organisation your projects and reports, and send the email the service needs (section 12).
- For security and to prevent fraud and abuse: to protect accounts, investigate incidents, and keep one organisation's information separate from another's.
- For support: to answer you when you ask for help or for access.
- For billing: to invoice the Customer and keep the financial records the law requires.
- To meet legal obligations, and to establish or defend legal claims.
For the features in section 3 specifically: we use a Contact Us request to answer you, to decide who at csr eco solutions should answer it, and to prepare a quote or a plan change you have asked about; we use the details of a published project to show your organisation its own report; and we use your primary contact's name and email address only to send the owner invitation.
We do not use personal information for advertising. We do not sell it. We do not use Client Data to market our services to a Customer's own customers. We do not use Client Data to introduce, recommend, rank or route work to any supplier unless the Customer asks us to for a named project. We send marketing email only to people who have asked for it (section 12).
We rely on your consent, given when you or your organisation chose to use recovery after being shown this policy, and on the exceptions the law allows for security, fraud prevention and legal obligations.
5. Preventing abuse of sign-up
To stop automated and repeat sign-ups, when you sign up we use: your email address and its domain; your network address (IP address); and a check by Cloudflare Turnstile, which reads details about your browser and device in your browser (section 8). We refuse sign-ups from known disposable email services, and our server refuses connections from network ranges listed by Spamhaus as used for abuse. We limit how many sign-up emails one address can receive in a day. Our server logs the IP address of each sign-up step, for the period in section 7. We do not use any of this for marketing.
6. Automated decisions
One decision is made automatically: a sign-up with an email address at a known disposable email service is refused. If you think this is wrong, write to dpo@csrecosolutions.com and a person will review it. On request we will tell you what information was used and the main reason for the decision, and you may submit your comments.
7. How long we keep it
We keep personal information only as long as we need it for the purposes in section 4, then we destroy it or make it anonymous. The Data Retention and Deletion Schedule gives the full list, and we will send it to you on request. The main periods are:
| Information | How long we keep it |
|---|---|
| Your account details | While your account is open. After it is closed, your name and email address are kept for as long as the records that refer to you (such as the history of project changes) are kept |
| Two-step sign-in secrets, backup codes and call-back phone number | Until you remove them or your account is closed |
| IP address and browser details in server access logs | Deleted automatically as newer logs replace them, normally within about 90 days, and may be kept longer when traffic is low |
| Record that you accepted the terms (the version, the time and the email address used) | Kept as the record of the contract for as long as we hold the account, and not deleted on request while we may need it to prove the contract |
| Client Data after a subscription is cancelled | Read-only for 30 days, then deleted. Copies in backups are deleted as the backups age out. |
| Invoices, and promo, referral and pilot code redemptions | 6 years |
| Enquiries you send us by email that do not lead to a subscription | As long as we need them to answer and follow up, and no longer than 24 months after the last contact |
| Contact Us requests sent from inside recovery | Kept while your organisation is open, whatever its plan, then deleted when a closed organisation is purged. |
| Projects we ran for you, published in recovery | Kept in recovery while your organisation is open. Not deleted when a paid plan ends. A project we withdraw is hidden from you at once and kept until your organisation is closed and purged. Deleted from recovery when a closed organisation is purged. Our own source record of the project stays in our internal project system. |
| An Enterprise arrangement that ends | Your organisation becomes read-only at once, your reports stay viewable for 30 days, then the data you entered is deleted. We email the owners when read-only begins, 7 days and 1 day before the deletion, and after it. |
| Record of your consent to marketing email | For as long as we rely on the consent, plus 3 years |
8. Where it is kept and who receives it
Where. recovery and its database run at Vultr in Toronto, Canada. Records of projects that csr eco solutions carried out for a Customer are kept in our own operations system. When our staff publish one of those projects into your organisation, a copy is sent to recovery over a private network between two csr eco solutions systems, never over the public internet, and the copy is kept in recovery's database.
Service providers. We use the companies below to run recovery. Each receives only what it needs for its task and is bound by contract to protect it. The Subprocessors page at https://recovery.csrecosolutions.com/legal/subprocessors holds the current list, and we update this section when the list changes.
| Provider | What it does for us | What it receives | Where |
|---|---|---|---|
| Vultr (The Constant Company, LLC) | Hosts recovery, its database and the provider's own backups | Everything held in recovery | Canada (Toronto) for the primary database |
| Twilio SendGrid (Twilio Inc.) | Delivers recovery's email, including Contact Us requests sent to our support team | The recipient's email address and the content of the message | United States |
| Mapbox (Mapbox, Inc.) | Suggests addresses as you type, and draws the map of project sites | The address text you type into the address search; project site addresses and map positions; and, when your browser contacts Mapbox directly (section 11), your IP address and browser details | United States |
| Microsoft (Microsoft Corporation) | Sign-in and mailboxes for csr eco solutions staff, including the mailbox that receives Contact Us requests; holds the source documents a Customer gives us so that we can load its historical projects | Staff account details; messages you send to our team; those documents, which may name people | Microsoft 365, a Microsoft service; data location per Microsoft's published regions |
| Stripe (Stripe Payments Canada, Ltd.; Stripe, LLC for personal data) | Takes card payments for paid plans, and sends the receipts and invoices for them | The billing contact's name and email address, the organisation's billing address and any tax number it gives, and card details, which go straight to Stripe; we receive a reference and the last four digits and never see the card number | Canada and the United States |
| Cloudflare (Cloudflare, Inc.) | Checks, on the sign-up page, that a sign-up comes from a person and not a script | Your IP address and details about your browser and device that the check reads in your browser | United States |
Outside your province or country. Some of these providers are outside Canada, and all of them may be outside your province or state. While information is in another jurisdiction it is subject to the law there, and courts, law enforcement and national security authorities of that jurisdiction may be able to obtain it. We require each provider by contract to protect it to a standard comparable to ours.
Other people who see your information.
- Your organisation. Its owners and admins see members' names, email addresses, roles and activity in recovery.
- Our staff, when they need to in order to run the service or help you.
- Organisations your organisation chooses to share with. Client Data is shared with a channel partner, a supplier or anyone else outside your organisation only when your organisation links to them or sends it to them, and your organisation can end a link at any time.
- Authorities, where the law requires it or allows it, for example under a court order.
- A successor business. If csr eco solutions is sold or merged, the information passes to the new owner, which must keep to this policy.
We do not give personal information to anyone else.
9. Client Data: who is responsible for what
A Customer decides what goes into its projects in recovery, including any personal information in its records and notes, and decides who in its organisation can see it. The Customer is responsible for having the right to put that information into recovery.
csr eco solutions handles Client Data on the Customer's behalf, to provide the service the Customer has asked for, under the Terms of Service and the Data Processing Addendum. We do not use it for our own purposes beyond what those documents allow.
To detect the same scale ticket being used in more than one account, we may compare a one-way coded value made from record identifiers (for example the receiving facility and ticket number) across accounts. Only we make this comparison, and no Customer's data is shown to another.
If your name or other personal information is in a Customer's project records and you want to see it, correct it or have it removed, please ask that Customer first. If you ask us, we will pass your request to the Customer and help it respond.
For account details, sign-in and security records, and what you send us directly, csr eco solutions is responsible, and you can ask us directly.
Projects that csr eco solutions ran for a Customer are different, because we made those records ourselves in running the project, and we keep our own source record. A published copy is read-only for the Customer. If your name (for example as the csr eco solutions project manager) or your address is in one, you can ask us directly.
10. Sharing with other organisations
Your organisation can share chosen projects with another organisation by sending an invitation by email. People in the other organisation need a recovery account to see them, and see only the projects shared with them. The organisation that shared can end access at any time; when it does, we tell the other organisation by email.
11. Cookies and similar technologies
The cookies we set. recovery sets only cookies it needs to work. None holds personal information in readable form, none can be read by scripts on the page, and each is sent only over an encrypted connection and only to recovery.csrecosolutions.com:
| Cookie | What it does | How long it lasts |
|---|---|---|
__Host-recovery_session | Keeps you signed in | Until you sign out, after 30 minutes without activity, or 12 hours at most |
recovery_signup | Carries the link from your sign-up email to the last sign-up step | 24 hours, or until the step is done |
recovery_invite | Carries the link from an invitation email to the invitation page | 15 minutes |
recover_code | Carries the link from a password-reset email to the reset page | 1 hour |
email_change_code | Carries the link from an email-change confirmation to the confirmation step | 1 hour |
These cookies are strictly necessary: recovery cannot sign you in, or act on a link we emailed you, without them. We set no advertising, analytics or preference cookies. Because there is nothing optional to accept or refuse, recovery shows no cookie banner.
Your browser's local storage. recovery keeps two things in your browser's own storage, on your device only: the last few searches you typed into project search, so it can suggest them again, and the time of your last activity, so that every open tab signs you out together. Neither is sent to us. Clearing your browser's site data removes them. The sign-up page also runs Cloudflare's Turnstile check (section 8).
Maps and address search. Two features contact our mapping provider, Mapbox, directly from your browser:
- Address search. When you type in "Find the address" while adding a project, what you type is sent to Mapbox so that it can suggest matching addresses. You can skip the search and type the address fields yourself.
- Interactive map. The projects page shows a map as a still image that our servers fetch, so your browser does not contact Mapbox. If you press "View interactive map", your browser loads Mapbox's map software from Mapbox. That software stores a randomly generated identifier in your browser's local storage and sends Mapbox usage information, such as the fact that a map was loaded. Mapbox states that it does not use this to track or profile individual people.
In both cases Mapbox receives your IP address and browser details, as any website you contact does.
12. Email
recovery sends email only about your account and your organisation's use of the service: sign-in and security messages, invitations, and service notices. It is sent from noreply@csrecosolutions.com, as "recovery by csr eco solutions". We do not add tracking to the links in these messages.
If someone in an organisation invites you to join it, we use the email address they give us to send you the invitation. If you do not accept, the invitation expires after 7 days.
We send marketing email, such as product news, only if you have asked for it by ticking a box that is never ticked for you. Every marketing message says who sent it and how to unsubscribe, and we act on an unsubscribe request within 10 business days. Unsubscribing from marketing does not stop the account and security messages above.
When you use the Contact Us form, we use the details you send to reply to your enquiry and to prepare a quote. We do not share them with channel partners unless you tell us you were referred by one.
13. How we protect it
We protect personal information with safeguards suited to how sensitive it is: access limited to the people who need it, each organisation's information kept separate from every other's, encrypted connections, and records of security events. The Security and Data Storage Overview, which we send on request, describes these measures and says which are in place today. No system is perfectly secure. If a breach of our safeguards creates a real risk of significant harm to you, we will tell you and the regulators the law requires us to tell.
14. Your rights and how to use them
You can ask us:
- to see the personal information we hold about you, and how we have used it and to whom we have given it;
- to correct it if it is wrong or incomplete;
- to withdraw your consent to our using it. If we need the information to give you an account, withdrawing consent means closing the account, and we will tell you so before we act;
- for a copy of the information you gave us, in a structured, commonly used format, where the law gives you that right;
- about an automated decision (section 6): what information was used and the main reasons, and to have a person review it.
How. Write to dpo@csrecosolutions.com. You can change your display name, username and password yourself in Settings. To protect you, we may ask for enough to confirm who you are before we act. There is no charge.
When. We answer within 30 days of receiving your request. If we need more time, or cannot do what you ask, we will tell you why in writing within those 30 days, and tell you how to complain.
Complaints. If you are not satisfied with our answer, you can complain to:
- the Office of the Privacy Commissioner of Canada, priv.gc.ca;
- if you live in Quebec, the Commission d'accès à l'information du Québec, cai.gouv.qc.ca.
15. If you are in the United States
recovery is run from Canada, and your information is kept in Canada and with the providers in section 8. We do not sell personal information. We do not share it for advertising based on your activity across other websites, and we do not use it for targeted advertising.
Some US states give their residents privacy rights by law. Whatever state you live in, you can make any of the requests in section 14 in the same way, and we will not treat you differently for making one.
16. Children
recovery is a tool for businesses. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, write to dpo@csrecosolutions.com and we will delete it.
17. Changes to this policy
The version number and date are at the top. When we make a change that matters to how we handle your information, we will tell Authorised Users inside recovery and by email at least 30 days before it takes effect, and we will keep earlier versions available at https://recovery.csrecosolutions.com/legal/privacy. Minor changes, such as a new address or clearer wording, take effect when we publish them.
A French version of this policy is available at https://recovery.csrecosolutions.com/legal/fr/privacy.