1. Who We Are
Impact Coop (“we”, “us”, “our”) is a cooperative based in Moncton, New Brunswick, Canada. This Privacy Policy applies to the Impact Coop Client Portal, accessible at portal.impactcoop.ca.
For privacy-related questions or concerns, contact us at:
Marc Henrie
[email protected]
(506) 227-4655
40 Marquette Ave, Moncton, NB E1A 5L9
2. What Information We Collect
When you use the Client Portal, we collect and store the following personal information:
- Account credentials: Your email address and a securely hashed version of your password. We never store your plain-text password.
- Authentication data: Session tokens, login attempt records, and multi-factor authentication codes (temporary, expiring within 10 minutes).
- Usage data: Login timestamps, IP addresses associated with login attempts, and portal access logs.
- Financial data: Invoice records, payment history, and related financial documents associated with your account.
- Profile information: Name, phone number, division, and contact details associated with your account.
3. Why We Collect This Information
- Authentication and security: To verify your identity, manage your session, and protect your account from unauthorized access.
- Service delivery: To display your invoices, payment records, and financial information within the portal.
- Security monitoring: To detect and prevent unauthorized access, brute-force attempts, and fraudulent activity.
- Audit and accountability: To maintain records of data access as required for financial compliance.
- Communication: To send you multi-factor authentication codes and security alerts.
4. Legal Basis and Consent
By checking the consent box on the login page and using this portal, you acknowledge and agree to this Privacy Policy. Your use of the portal constitutes informed consent under the Personal Information Protection and Electronic Documents Act (PIPEDA).
You may withdraw consent at any time by contacting us at [email protected]. Withdrawal of consent may result in the termination of your portal access.
5. How We Protect Your Information
- Encrypted transmission: All data is transmitted over HTTPS (TLS encryption).
- Password hashing: Your password is hashed using SHA-256 before storage. We never store or transmit your plain-text password.
- Multi-factor authentication: A one-time code is required at every login in addition to your password.
- Account lockout: After 3 failed login attempts, your account is temporarily locked for 15 minutes.
- Session expiry: Portal sessions automatically expire after 60 minutes of inactivity.
- Access logging: All login attempts and data access events are logged with timestamps and IP addresses.
6. Third-Party Processing and Data Transfers Outside Canada
| Processor | Purpose | Location |
|---|---|---|
| Make.com (Celonis SE) | Authentication middleware, OTP delivery coordination, session token generation | United States / EU |
| CRM Platform | Contact data storage, invoice records, audit logging | United States |
These providers are bound by contractual obligations to maintain protections for your personal information that are substantially equivalent to those required under Canadian privacy law. We do not sell your information to third parties.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Session tokens | Deleted upon logout or after 60 minutes of inactivity |
| OTP codes | Deleted within 10 minutes of generation |
| Login attempt logs | 12 months |
| Audit access logs | 24 months |
| Invoice and financial records | 7 years (Canadian tax regulations) |
| Account credentials (hashed) | Duration of active account |
8. Your Rights Under PIPEDA
As a Canadian resident, you have the right to:
- Access: Request a copy of the personal information we hold about you.
- Correction: Request that inaccurate or incomplete information be corrected.
- Withdrawal of consent: Withdraw consent to the collection, use, or disclosure of your information.
- Complaint: File a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.
To exercise any of these rights, contact us at [email protected].
9. Cookies and Local Storage
The Client Portal uses browser sessionStorage (not cookies) to maintain your login session. SessionStorage is cleared automatically when you close your browser tab. We do not use advertising cookies, tracking pixels, or third-party analytics on this portal.
10. Security Incident Response
In the event of a privacy breach that poses a real risk of significant harm, we will:
- Notify the Office of the Privacy Commissioner of Canada as required under PIPEDA.
- Notify affected individuals directly.
- Take immediate steps to contain and remediate the breach.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of the portal after changes constitutes acceptance of the updated policy.
12. Contact Us
Impact Coop
Attn: Privacy Officer
40 Marquette Ave, Moncton, NB E1A 5L9
[email protected]
(506) 227-4655