Privacy Policy

VeriGuest Enterprise — Visitor Management System

1. Who We Are

VeriGuest Systems ("VeriGuest," "we," "our," or "us") is a Canadian enterprise software company headquartered in Hamilton, Ontario. We develop and operate a visitor management platform that includes a Windows desktop application, an Android tablet kiosk application, and a cloud-hosted administrative dashboard. Inquiries regarding this policy may be directed to:

• Privacy Officer Contact: parthpf52@gmail.com
• Mailing Address: Hamilton, Ontario, Canada

2. Scope of This Policy

A. Marketing Website (veriguest.ca)

When you visit our website or submit an inquiry form, we may collect the following personal information:

• First name, last name, and professional email address
• Company or organization name
• Phone number (optional, where provided)
• Inquiry description / message content

This information is used exclusively for the purpose of responding to your inquiry, scheduling demonstrations, and delivering the services you have requested. We do not sell, rent, or share website-derived personal data with third-party advertisers.

B. VeriGuest Visitor Management System (VMS Software)

Our deployed enterprise software collects the following categories of personal data on behalf of our client organizations (the "Clients"):

• Visitor names, contact details, and company affiliation
• Visit purpose, host employee, and visit timestamps
• Digital signatures on Non-Disclosure Agreements (NDAs) and safety policy documents
• Biometric identifiers: Facial recognition encodings (stored as encrypted mathematical vectors, not photographs) for the purpose of identity verification at facility entry points
• Visitor categorization (employee, contractor, VIP, etc.) and contractor compliance level

3. Legal Basis for Processing

VeriGuest operates under, and is compliant with, the following Canadian and applicable international privacy frameworks:

• PIPEDA – Personal Information Protection and Electronic Documents Act (Canada, Federal): Governs all collection and processing of personal data.
• PHIPA – Personal Health Information Protection Act (Ontario): Applicable to clients deploying VeriGuest in healthcare, hospital, long-term care, and clinical environments.
• GDPR – General Data Protection Regulation (European Union): We apply GDPR-equivalent standards for any client with operations in the EU.

We collect personal information only where there is a lawful basis: express consent, fulfillment of a contract, compliance with a legal obligation, or a legitimate business interest that is clearly outweighed by no countervailing privacy risk.

4. Data Retention

• Website Inquiry Data: Retained for up to 36 months from the date of last contact, unless you request earlier deletion.
• Visit Logs (VMS Clients): Client-configurable retention period. Default is 365 days. Clients may configure extended retention for audit and compliance purposes.
• Biometric Encodings: Retained only as long as the visitor profile remains active in the client's system. Deleted automatically upon profile deactivation or upon visitor request.

5. Data Security

We implement industry-standard security measures to protect all personal information under our control, including:

• End-to-end encryption in transit using TLS 1.3
• Data-at-rest encryption using AES-256
• Access control, role-based permissions, and audit logging within the VMS administrative dashboard
• Regular security assessments and software dependency patching

6. Your Privacy Rights

Under PIPEDA and applicable provincial legislation, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Withdraw consent and request deletion of your data (subject to legal or contractual retention requirements)
• Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC)

To exercise any of these rights, contact our Privacy Officer at parthpf52@gmail.com. We will respond to all requests within 30 days as required by PIPEDA.

7. Third-Party Services

Our website and software interact with the following third-party processors:

• Stripe, Inc. – Payment processing for subscriptions. Stripe is PCI-DSS Level 1 certified. Cardholder data is never processed or stored by VeriGuest directly.
• Twilio, Inc. – SMS notification delivery for host alerts and emergency broadcasts. Phone numbers are transmitted to Twilio solely for the purpose of delivering the requested notification and are not stored by Twilio beyond message delivery.
• Google Fonts / CDNJS – UI typography and icon libraries loaded from external CDNs. These do not involve the transmission of personal data.

8. Cookies

Our marketing website uses only essential technical cookies required for session management and security token handling. We do not deploy advertising trackers, cross-site tracking pixels, or third-party analytics beacons. You may disable cookies in your browser settings without functional degradation to the public site.

9. Changes to This Policy

We may update this policy periodically to reflect changes in our practices, technology, or applicable law. Material changes will be communicated via email notification to active clients and/or a prominent notice on this page. Continued use of our services after the stated effective date constitutes acceptance of the revised terms.

10. Contact

All privacy-related inquiries, data access requests, and complaints should be directed to:

• Email: parthpf52@gmail.com
• Subject Line: Privacy Inquiry – VeriGuest

You also have the right to escalate unresolved concerns to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

---

© 2024 VeriGuest Systems. All rights reserved. This document constitutes a legally binding privacy notice under applicable Canadian legislation.