Privacy Policy

Maplebridge Group Inc. is an Ontario corporation operating as a professional chauffeur and ground transportation provider, with its head office at 100 King Street West, Suite 5600, Toronto, Ontario M5X 1C9. We are responsible for the personal information collected through our services.

Our Person Responsible for Personal Information (Privacy Officer), as required by section 8 of PIPEDA and section 3.1 of Law 25:

• • Title: Privacy Officer, Maplebridge Group Inc.
• • Email: privacy@maplepont.com
• • Phone: +1 (888) 627-5313
• • Mail: Privacy Officer, Maplebridge Group Inc., 100 King Street West, Suite 5600, Toronto, Ontario M5X 1C9

We use personal information to:

• arrange and deliver the service you booked;
• communicate with you about your booking (confirmations, changes, status updates);
• after a completed trip, ask you once, by email only, for a review on Google (every such email has a link to unsubscribe from review requests, and we do not send one if you have told us not to email you about anything beyond your trips);
• bill you and collect payment;
• maintain records as required by Canadian tax and corporate law;
• improve our service quality and operations;
• comply with legal obligations (HST remittance, CVOR records, AML/KYC where applicable);
• respond to your inquiries;
• send you service updates and (with your consent or as permitted by CASL) occasional communications about Maplebridge services.

We do not use personal information for purposes incompatible with the above without seeking your consent.

Automated decision-making, profiling, and AI. Maplebridge does not currently use automated decision-making within the meaning of section 12.1 of Law 25 to make decisions about you that produce legal effects or otherwise significantly affect you. For clarity, the following Maplebridge processes do not make decisions exclusively by automated processing within the meaning of section 12.1 of Law 25: (a) chauffeur-vehicle matching (assigned by a human dispatcher); (b) ETA calculation; (c) route selection (selected by the chauffeur using third-party map software); (d) fee calculation (rate-card and time-records based); and (e) card payment (processed by Stripe; the booking decision is made by a human). Where automated decision-making is used in the provision of our services, we will disclose at or before the decision (i) that the decision is being made by automated processing, (ii) the principal personal information used and the principal factors and parameters that led to the decision, and (iii) your right to request that a natural person review the decision and your right to make submissions to that person, in each case as required by section 12.1 of Law 25.

Profiling and AI. Maplebridge does not use artificial-intelligence-based profiling to make decisions about individual travellers and does not sell personal information to advertising or AI training providers. If we begin to use any technology of identification, location, or profiling within the meaning of section 8.1 of Law 25, we will provide notice and the right to deactivate any function that allows you to be identified, located, or profiled, in each case as required by that section.

Maplebridge operates in Canada, but most of the service providers we rely on store and process personal information in the United States. They are:

• Stripe Inc. — payment processing in the United States;
• Google LLC (Google Workspace) — email, document storage, and meetings, with primary processing in the United States and replication to other Google data centres globally;
• SMS and call-routing providers — processing primarily in the United States and Canada;
• dispatch and fleet management software providers — processing in the United States or Canada (we identify the provider on request);
• Google LLC (Firebase, Google Cloud, Google Analytics, Google Maps Platform and reCAPTCHA) — processing in the United States;
• Functional Software, Inc. (Sentry) — error reports, processing in the United States;
• Microsoft Corporation (Microsoft Clarity) — how pages are used, with form inputs masked, processing in the United States;
• Groq, Inc. — messages typed into the chat assistant, processing in the United States.

Where personal information is transferred outside Canada, it remains subject to the laws of the country where it is stored, which may permit access by foreign courts, regulators, and law enforcement on terms different from Canadian law. We use service providers who maintain reasonable standards of protection comparable to Canadian requirements, and we have written agreements in place that require these providers to protect personal information consistently with this Policy.

Quebec residents: Under section 17 of Law 25, before transferring personal information of Quebec residents outside Quebec, Maplebridge conducts a privacy impact assessment to confirm that the information will receive adequate protection. The factors we consider include the sensitivity of the information, the protection measures applied (technical, contractual, and organizational), the purposes for which the information is to be used, and the privacy and data-protection framework of the receiving jurisdiction. A summary of the most recent assessment is available on request to our Privacy Officer and will be provided within thirty (30) days of the request.

Our websites use cookies to:

• maintain your session, and keep a booking you have started as you move through it;
• understand how visitors use the site with Google Analytics 4, which is loaded only after you accept analytics cookies;
• see how a page is actually used with Microsoft Clarity — clicks, scrolling and a replay of the page, with everything you type into a form masked in your browser before it is sent — which is likewise loaded only after you accept analytics cookies;
• load those two tools, and nothing else, through Google Tag Manager, which itself runs only after you accept analytics cookies;
• measure which advertisements led to a booking or a phone call in Google Ads, which is given that by Google Analytics 4 as an import rather than by a separate tag on the site;
• remember your preferences, including your answer to the cookie banner itself.

Google reCAPTCHA also runs on pages where a request is made to our servers, to tell a real browser from an automated script. It is a security measure rather than an analytics or advertising one, so it runs whether or not analytics cookies are accepted; see 4.3a for what it collects.

Privacy by default. Consistent with section 9.1 of Law 25, our websites apply the highest level of privacy by default. On first visit, our websites display a cookie consent banner that allows you to accept or refuse non-essential cookies. Until you provide consent, only strictly necessary (functional) cookies are set. You can also configure your browser to refuse cookies. We do not currently use third-party advertising cookies or sell information to advertisers.

Privacy by default at the service level. The same principle applies to the chauffeur and ground transportation Service itself, not only to our websites. By default: (a) only the personal information necessary to perform a Service Order is disclosed to the assigned chauffeur (typically traveller name, pickup and drop-off location, time, and a contact phone for the day); (b) home addresses and unrelated travel patterns are not stored against the chauffeur’s record beyond the duty period; (c) corporate-client account managers see only the trips associated with the cost centres they manage; and (d) reporting dashboards show traveller information at the minimum level of identification consistent with the reporting purpose. Privacy impact assessments under section 8.1 / 17 of Law 25 are conducted for new processes that materially change how personal information is used or disclosed at the Service level. The factors we consider include the sensitivity of the information, the protection measures applied (technical, contractual, and organizational), the purposes for which the information is to be used, and the privacy and data-protection framework of any receiving jurisdiction.

We keep personal information only as long as necessary for the purposes for which it was collected, plus any retention required by law:

• booking and trip records: six (6) years from the end of the relevant tax year, archived through year-end of the seventh calendar year to align with year-end record archives, in accordance with section 230 of the Income Tax Act (Canada), section 286 of the Excise Tax Act (Canada), and the basic two-year limitation period under the Limitations Act, 2002 (Ontario);
• financial records (invoices, payments): six (6) years from the end of the relevant tax year, archived through year-end of the seventh calendar year on the same basis;
• communications (email, SMS): seven (7) years from the end of the relevant tax year, aligned with the retention basis for tax-relevant records; longer for records related to a complaint, dispute, or active insurance claim;
• website analytics: twenty-four (24) months;
• incident records: seven (7) years from the end of the calendar year of the incident, or longer where related to an active claim or regulatory investigation;
• CVOR-related records: retained at least six (6) months as required under Ontario CVOR rules, and longer where part of a tax or safety record;
• breach-of-security-safeguards records under PIPEDA section 10.3: twenty-four (24) months from the date the record is created (see clause 8 below);
• your account profile and consent records: until you close your account; the booking, financial and consent records it contains are then kept for the periods above.

After the retention period, we securely destroy or anonymise the information.

We protect personal information using safeguards proportionate to its sensitivity, including:

• restricted access — personal information is accessible only to personnel who need it for their role;
• encrypted transmission (TLS 1.2 or higher) for all personal information, with payment information also tokenised by our payment processor;
• secure storage with reputable cloud providers with access controls and audit logs;
• background checks and confidentiality obligations for chauffeurs and staff;
• regular review of our practices and annual privacy training for personnel.

No system is perfectly secure. If a privacy breach occurs that creates a real risk of significant harm to affected individuals, we will notify those individuals and the Office of the Privacy Commissioner of Canada in accordance with PIPEDA’s Breach of Security Safeguards Regulations (SOR/2018-64). Where Quebec residents are affected, we will also notify the Commission d’accès à l’information du Québec as required under Law 25.

Breach record-keeping (PIPEDA section 10.3). In accordance with section 10.3 of PIPEDA and the Breach of Security Safeguards Regulations, Maplebridge maintains a record of every breach of security safeguards involving personal information under its control, irrespective of whether the breach reaches the “real risk of significant harm” threshold. We retain those records for at least twenty-four (24) months from the date the record is created. The Office of the Privacy Commissioner of Canada may request access to those records at any time during that period.

Cyber Incident Response Plan. Maplebridge maintains an internal Cyber Incident Response Plan that describes how we triage and contain a security incident, who decides whether the “real risk of significant harm” threshold is met, who notifies the Office of the Privacy Commissioner of Canada and the Commission d’accès à l’information du Québec, and how the section 10.3 record is created. A summary of that Plan is available on request to our Privacy Officer.

Under PIPEDA, and where applicable Law 25, you have the right to:

• access the personal information we hold about you;
• correct inaccurate or incomplete personal information;
• withdraw consent for uses of your information that are based on consent (note that some uses are required for us to provide services or comply with the law and cannot be withdrawn while you continue to engage us);
• portability (Quebec residents under Law 25) — receive your personal information in a structured, commonly used technological format;
• de-indexing or erasure (Quebec residents under Law 25 in defined circumstances);
• information about automated decision-making if any decision affecting you is made on the basis of automated processing of personal information;
• complain to our Privacy Officer or, if unresolved, to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for Quebec residents, the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).

If you have an account, you can also download a copy of your data from your account (Profile → Download my data; it is emailed to you as a file straight away) and ask us to delete your account (Profile → Delete my account). Our team confirms a deletion by email; records we must keep are kept for the periods in clause 7.

To exercise any right, contact our Privacy Officer using the details in clause 1. We will respond within thirty (30) days, in accordance with PIPEDA section 8(3) (or as required by Law 25 for Quebec residents). Where a request is complex or the records are voluminous, we may extend the response period by up to thirty (30) additional days as permitted by section 8(4) of PIPEDA, in which case we will give you written notice of the extension, the new deadline, your right to complain to the Office of the Privacy Commissioner of Canada, and the reason for the extension, within the original thirty (30) day period.

Quebec-specific response times. For Quebec residents under Law 25:

• Access and correction — thirty (30) days from receipt of the request (s. 32);
• Portability — thirty (30) days, with the personal information delivered in a structured, commonly used technological format (s. 27);
• De-indexing or erasure — thirty (30) days; any refusal will be provided in writing with reasons and a description of your right to apply to the Commission d’accès à l’information du Québec (s. 28.1); and
• Right to be informed about an automated decision — provided at the time of the decision under section 12.1, with rectification or review available on request thereafter.

Our services are not directed at children. We do not knowingly collect personal information from minors except where a parent, guardian, or authorised adult books a service that includes a minor as a traveller, in which case the booking adult is responsible for providing any required consent on the minor’s behalf and warrants that they have authority to do so.

Consistent with PIPEDA’s meaningful-consent standard and the Office of the Privacy Commissioner’s guidance, we treat personal information about minors with heightened sensitivity. We do not engage in marketing or behavioural tracking directed at minors, and we collect only the personal information about minor travellers necessary to perform the service safely (including any accessibility, language, or special-needs information shared by the booking adult).

If you believe we have collected information from a minor without appropriate consent, please contact our Privacy Officer.

If you have given consent under Canadian Anti-Spam Legislation (CASL) — including through an existing business relationship within the meaning of section 10(9) of CASL — we may send you commercial emails about Maplebridge services. If you have an account, you give or withdraw consent in your account (Notifications), and we record the date, time, source and IP address of each choice. Every commercial email from us includes a clear one-click unsubscribe link that we process within ten (10) business days, as required by CASL. You can also unsubscribe by emailing support@maplepont.com with “Unsubscribe” in the subject line.

We may update this Policy from time to time. The “Last updated” date at the top reflects the most recent change. Material changes will be communicated through our websites and, where we have your email address, by email at least thirty (30) days before they take effect.

If you have any question about this Policy or about how we handle your personal information, contact our Privacy Officer: