PIPEDA Compliance

What is PIPEDA?

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal private-sector privacy law. It governs how organisations collect, use, and disclose personal information in the course of commercial activity. PIPEDA is based on ten Fair Information Principles established by the Canadian Standards Association.

PIPEDA applies to Talcura Technologies Inc. and to all personal information we process through the Talcura platform, including candidate data, employee records, and account holder information.

The Ten PIPEDA Principles — How Talcura Complies

Canadian Data Residency

All personal information processed through Talcura is stored exclusively on Microsoft Azure servers located in Canada. This means your data — including candidate records, employee information, and HR data — never leaves Canadian jurisdiction as part of our standard operations.

This is a default, non-negotiable feature of the Talcura platform, not a premium tier or contractual add-on. We provide a signed Data Processing Agreement confirming Canadian data residency to any customer who requires it for procurement or compliance purposes.

Breach Notification

Canada's breach notification requirements under PIPEDA (in force since November 2018) require organisations to notify the Office of the Privacy Commissioner of Canada (OPC) and affected individuals of privacy breaches that pose a "real risk of significant harm."

Talcura maintains a documented breach response plan that includes:

• Immediate containment and investigation upon detection of a suspected breach
• Risk assessment to determine whether the breach poses a real risk of significant harm
• Notification to the OPC and affected individuals within 72 hours where required
• Notification to affected customers (as data controllers) within 24 hours
• Maintenance of a breach record for a minimum of 24 months

Your Rights Under PIPEDA

As an individual whose personal information is held by Talcura Technologies or processed through Talcura, you have the right to:

• Know what personal information we hold about you
• Access your personal information and receive a copy
• Challenge the accuracy of your information and request corrections
• Know how your information is being used and to whom it has been disclosed
• Withdraw consent to the use of your personal information (subject to legal or contractual restrictions)
• Lodge a complaint with the Office of the Privacy Commissioner of Canada if you believe your rights have been violated

To make a request, contact our Privacy Officer at privacy@talcura.com. We will respond within 30 days.

Candidate Data & Employer Responsibilities

When your organisation uses Talcura to collect and manage candidate personal information, you (as the employer/operator) are the "organisation" responsible for that data under PIPEDA. Talcura acts as a service provider processing that data on your behalf.

Employers using Talcura are responsible for:

• Informing candidates that their personal information is being collected and the purpose for which it is collected
• Obtaining appropriate consent where required
• Retaining candidate information only for as long as necessary
• Complying with applicable provincial privacy legislation (PIPA in Alberta and BC, Act Respecting the Protection of Personal Information in Quebec)

Talcura provides tools to help you fulfil these obligations, including data export, deletion controls, and consent tracking features.

Filing a Complaint

If you believe Talcura Technologies has not handled your personal information in compliance with PIPEDA, you may:

• Contact our Privacy Officer first at privacy@talcura.com — we aim to resolve complaints within 30 days
• If not resolved to your satisfaction, file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca