Introduction

The CSA Group of companies, being all the subsidiary and affiliated entities worldwide under the Canadian Standards Association and CSA Group Testing & Certification Inc., organizations, (collectively “CSA Group “or “we” or “our”) is committed to respecting your privacy. Our privacy notices set out the Personal Information (PI) collected by CSA Group, the purposes for which PI is collected and processed, who it may be disclosed to as well as your rights. For further information please select the notice that is relevant to your relationship with CSA Group. In addition, our Cookie Notice applies to any person visiting any of our websites.

1. Introduction

The CSA Group of companies, being all the subsidiary and affiliated entities worldwide under the Canadian Standards Association and CSA Group Testing & Certification Inc., organizations, (collectively “CSA Group “or “we” or “our”) is committed to respecting your privacy. This Privacy Notice applies to all products and services offered by and all interactions with CSA Group by any means or format. CSA Group has other specific privacy policies for cookies, job applicants, CSA Group’s employees and for members of the standards development organisation. Please refer to the policy that is relevant to you.

2. Accountability and how to reach us

CSA Group is responsible for the management, protection, and confidentiality of the Personal Information that we process on your behalf. Our Chief Legal, Ethics & Compliance Officer and Corporate Secretary is the organization’s Chief Privacy Officer. If you have any questions or privacy concerns, please contact us here.

3. Definitions

Automated decision-making: When an electronic system uses Personal Information to make a decision without human intervention.

Data controller: An organisation/body that decides how and why data is being processed.  A data controller can be a business, a public authority, an agency, or another body.

Data processor: An organisation/body that processes Personal Information only on behalf of the data controller. The data processor is often a third-party external to the data controller.

Legitimate interests: Refers to the processing of Personal Information to carry out tasks directly related to business activities. The processing of Personal Information in this context may not necessarily be justified by a legal obligation or carried out to execute the terms of a contract with an individual.

Personal Information: Information about an identified or identifiable individual, including name, address, email address, signature, opinion regarding the data subject, and other information relating to an individual, including sensitive Personal Information. It does not include data where the identity has been removed (anonymous or aggregate data). Please note both “Information” and “Data” terms are used interchangeably in this Notice.

Sensitive Personal Information: A sub-category of Personal Information that refers to Personal Information that relates to race, ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about health, and genetic and biometric data. Not all countries define sensitive Personal Information in their privacy and data protection laws.

4. Who is collecting your Personal Information

CSA Group is the “Data Controller”. This means that we are responsible for deciding how we hold and use your Personal Information.

5. Personal Information we collect

The information we collect may include the following:

  • Identifying information: including but not limited to your name, image, voice or face recording, date of birth, passport number, country of citizenship;
  • Contact information:  phone numbers, mailing or email address;
  • Transaction and Payment information such as credit card or bank account information;
  • Professional and education information such as resume, job title, name of employer;
  • Interaction information: such as details of enquiries;
  • Opinions: responses to surveys, case studies, beta testing, usability testing, or any feedback you provide to us; or
  • Technical information: such as use of our digital services including, authentication and profile information (such as username and password), IP address, browser type and version, browser plug in types, and operating system.

6. Contexts in which we collect your Personal Information

Most of the information we collect is provided directly by you. This may include when you:

  • Interact with our websites, mobile, or web applications;
  • Communicate with CSA Group via phone calls, chat, emails, web forms, social media, and other methods of communication;
  • Register, attend or participate in any of our events, webinars, conferences, marketing campaigns, case studies, beta testing, usability tests, surveys, or other related initiatives;
  • Set-up an account to one of our websites to make a purchase or request access to any of our products and/or services, to subscribe to our newsletter and stay up to date with our latest news and initiatives;
  • Express an interest in participating with or joining our organization;
  • Apply for a CSA Group scholarship;
  • Have been invited to visit a CSA Group location;
  • Subscribe to receive marketing and promotional content; or
  • Provide services to CSA Group.

If you choose not to provide us with any Personal Information that has been requested, it may limit the products and services that we are able to provide to you.

7. Purpose and legal basis for processing your Personal Information

CSA Group processes your Personal Information where it is necessary for the purposes of the legitimate interests of CSA Group and CSA Group employees.

We will only use your Personal Information for the purposes for which we collected it unless we reasonably consider that we need to use it for another legitimate purpose compatible with the original purpose. If we need to use your Personal Information for a new or unrelated purpose, we will notify you and we will explain the legal basis that allows us to do so or obtain your consent.

For example:

  • To provide you with products, services, or programs;
  • To correspond and interact with you or provide technical support;
  • To solicit your feedback in relation to our products, services, or programs;
  • To personalize our offerings to you;
  • To assess your suitability for CSA Group scholarships and/or awards;
  • For fraud prevention;
  • For marketing and promotional purposes;
  • To complete commercial transactions through our online store;
  • To assist in making arrangements to visit CSA Group, which may include supporting a visa application;
  • To reimburse you for any expenses that CSA Group offers to cover;
  • To manage risk;
  • To ensure adherence to CSA Group’s policies and procedures; or
  • To meet legal and regulatory requirements.

CSA Group may get in touch with you by any means of communication for which you have provided to us and authorized, including e-mail, telephone, and mail.

8. How Personal Information is processed

Personal Information is processed both manually and electronically in accordance with the above-mentioned purposes and in compliance with relevant regulations. Within the CSA Group of companies, your Personal Information will be shared with only a limited number of CSA Group employees to the extent they need access to your Personal Information in connection with their job responsibilities. Access will be provided on a need-to-know basis.

9. Disclosures of Personal Information to third parties and international transfers

Your Personal Information will only be disclosed or shared with a third party with your consent for purposes consistent with this Privacy Notice or based on our legitimate interest.  On a limited basis we will share your Personal Information:

  • On a need-to-know basis with third parties such as vendors, contractors, and other service providers who we engage to perform tasks on our behalf or business affiliates who engage us to deliver services on their behalf;
  • Where required by law enforcement, government institutions, or judicial or regulatory authorities;
  • To investigate a suspected breach of contract, a violation of CSA Group’s policies or procedures (if applicable), or a contravention of the law; or
  • In the context of a data security breach or a legal proceeding.

Your information may be shared with our subsidiaries and/or corporate affiliates to fulfill the purposes of collecting your Personal Information or for other lawful grounds such as our legitimate interests. Such interests would include the provision of services, sales, marketing and support. We take commercially reasonable steps to ensure that all CSA Group subsidiaries and/or affiliates conform to this Privacy Notice and applicable local laws. CSA Group does not sell, rent, or trade your Personal Information to other to third parties for their independent use, unless you request or authorize it.

To facilitate our global operations, CSA Group may transfer Personal Information from your home country to other CSA Group locations across the world. To protect your Personal Information, we will only transfer Personal Information to countries that have ‘adequate’ data protection as determined by the European Commission, or if strong data protection commitments and measures are made by the recipient via contractual arrangements such as data processing agreements.

CSA may transfer personal data collected from individuals residing in the European Union or the United Kingdom to third party processors located in countries outside the European Economic Area (EEA) or the United Kingdom. CSA will comply with the GDPR and UK GDPR in respect to such transfers by ensuing proper transfer mechanisms and contractual measures are in place and, where mandated, transfer impact assessments have been conducted.

10. Safeguards for Personal Information

CSA Group uses commercially reasonable efforts to protect the security of your Personal Information. We use industry standard encryption algorithms and other technical controls to keep Personal Information secure and reduce risk. Nevertheless, such measures cannot prevent all loss, misuse, or alteration of Personal Information. In the case of a data breach that may impact you, we will make reasonable efforts to notify you and relevant regulatory bodies without undue delay.

All third-party services providers and business affiliates that work with us are expected to maintain privacy and security protections that are consistent with CSA Group’s privacy and information security policies. Read more about our security measures.

11. Retention of Personal Information

Depending on the type of Personal Information and the nature of our relationship with you, we keep your Personal Information for different lengths of time. We decide how long we need Personal Information on a case-by-case basis, but our aim is to keep your Personal Information for as long as necessary to fulfill the purpose for which your Personal Information is collected. We use the following criteria to make decisions on how long we will store your Personal Information:

  • The type and category of Personal Information.
  • Whether the Personal Information is required to offer our services.
  • How long we have to store the Personal Information to meet our legal obligations.
  • Our legitimate interests or legal purposes, such as enforcing our agreements, resolving disputes, preventing fraud, record-keeping, or protecting our legal rights.

12. Your Rights

Under data protection laws, you are provided with rights related to your Personal Information depending on the jurisdiction in which you reside. You have the right to know or access: the Personal Information that we hold about you, the categories of data concerned, how we use and share it, and how long we store it.

Depending on the jurisdictions in which you reside, you may request correction, updating, portability, restrictions on processing, or deletion of your Personal Information. You may also have the right to object to or withdraw consent to the processing of your Personal Information. CSA Group will not discriminate against you for exercising any of these rights.

If CSA Group has disclosed your Personal Information to third parties as per this Notice, and you make a request to have your information corrected, where reasonable, we will notify those third parties of any changes or additions made to your Personal Information.

To exercise any of your rights to your Personal Information as outlined above please contact us here and provide sufficient details to enable us to fulfill your request. We may also need to verify your identity to protect your privacy. If there is a reason that we can’t fulfill your request, you will be informed of those reasons.

If you are not satisfied with CSA Group’s response to your privacy concerns or our response to data subject rights you have exercised, you have a right to contact your local data protection regulator. To determine the appropriate regulatory body please contact us here.

13. Your Choice

You are in control of your Personal Information and providing your information to CSA Group is your choice. You can withdraw your consent to the processing of your Personal Information at any time. We will respect any such request, but it may limit the services that we are able to offer you. To withdraw your consent, please contact us [email protected]. You can also unsubscribe at any time to electronic messages from CSA Group via the unsubscribe link at the bottom of our e-mails.

14. Children & Privacy

CSA Group websites are not intended for use by children under the age of 16. CSA Group does not knowingly collect Personal Information from children under the age of 16. If we learn that we have collected Personal Information from a child under the age of 16, we will delete that data from our systems.

15. Cookie Notice

Please see our Cookie Notice for information on how we use cookies on our website.

16. Use of AI and Automated Decision Making

In the event that CSA Group uses artificial intelligence technologies to process Personal Information or uses Personal Information to facilitate machine learning, such activities will be made transparent, be based on an ethical AI governance framework, and be executed in compliance with applicable laws and regulations.

Automated decisions are defined as decisions about individuals that are based solely on the automated processing of Personal Information and that produce legal effects that significantly affect the individuals involved. If automated decisions are made by CSA Group, we will inform you; and affected persons will be given an opportunity to express their views on the automated decision in question and object to it.

17. Changes to this Privacy Notice

We are constantly trying to improve our websites and services, so we may need to change this Privacy Notice from time to time. We will alert you about material changes by, for example, placing a notice on our website and/or sending you an e-mail (if you have registered your e-mail with us) when we are required to do so by applicable law. You can see when this Notice was last updated by checking the date at the top of this page. You are responsible for periodically reviewing this Notice.

1. Introduction

The CSA Group of companies, being all the subsidiary and affiliated entities under Canadian Standards Association (collectively “CSA Group “or “we” or “our”) is committed to respecting your privacy. This Notice specifically describes how we collect and use the Personal Information of our standards development organization members. 

2. Accountability and how to reach us

CSA Group is responsible for the management, protection, and confidentiality of the Personal Information that we process on your behalf. Our Chief Legal, Ethics & Compliance Officer and Corporate Secretary is the organization’s Chief Privacy Officer. If you have any questions or privacy concerns, contact us here.

3. Definitions 

Automated decision-making: When an electronic system uses Personal Information to make a decision without human intervention. 

Data controller: An organisation/body that decides how and why data is being processed. A data controller can be a business, a public authority, an agency, or another body.

Data processor: An organisation/body that processes Personal Information only on behalf of the data controller. The data processor is usually a third-party external to the company. 

Legitimate interests: Refers to the processing of Personal Information to carry out tasks directly related to business activities. The processing of Personal Information in this context may not necessarily be justified by a legal obligation or carried out to execute the terms of a contract with an individual.  

Members: Refers to volunteer members of CSA Group’s standards development organization and other participants of CSA Group’s standards activities. 

Personal Information: Information about an identified or identifiable individual, including name, address, email address, signature, opinion regarding the data subject, and other information relating to an individual, including sensitive Personal Information. It does not include data where the identity has been removed (anonymous or aggregate data). Please note both terms “Information” and “Data” are used interchangeably in this Notice. 

Sensitive Personal Information: A sub-category of Personal Information that refers to Personal Information that relates to race, ethnicity, disability, religious or philosophical beliefs, gender, sexual orientation, political opinions, trade union membership, information about health, and genetic and biometric data. Not all countries define sensitive Personal Information in their privacy and data protection laws. 

4. Who is collecting your Personal Information

CSA Group is the “Data Controller”. This means that we are responsible for deciding how we hold and use your Personal Information.  

5. Personal Information we collect

Most of the information we collect about you is provided directly by you. When we collect information about you from someone else, that trusted source is expected to have obtained your permission before providing your data to CSA Group. The information we collect may include the following:

  • Identifying information, such as your name, image, date of birth, gender;
  • Contact information, such as phone numbers, mailing and email address;
  • Your opinions, testimonies, views, or topics of interest;
  • Financial information; 
  • Resume, job title, name of employer;
  • Interaction information: such as details of an application for membership; or
  • Technical information: such as the use of our digital services and platforms including authentication and profile information (such as username and password), IP address, browser type and version, and browser plug in types and operating system.

6. Purpose and legal basis for processing your Personal Information 

We will only use your Personal Information for the purposes disclosed to you at the time of collection and/or in accordance with this Privacy Notice. We may use it for another legitimate purpose compatible with the original purpose it was collected for, or for CSA Group’s legitimate business interest. 

For example:

  • To assess your application for membership, which includes assessing your relevant experience and location; 
  • To on-board you as a Member;
  • To better understand our membership with the objective of attracting diverse members and ensuring an inclusive and equitable environment for members;
  • To correspond and interact with you;
  • To identify you as an author in CSA Group’s publications such as our standards; 
  • To provide you with standards-related products, services, or programs;
  • To help you subscribe to our newsletter and stay up to date with our latest news and initiatives;
  • To provide you with technical support; 
  • To set-up an account to one of our websites, to provide access to any of our products and/or services, and to participate in CSA’s products beta testing or usability tests;
  • To facilitate the attendance or participation in any of our events, webinars, conferences, programs, trainings, or forums;
  • To facilitate for events sponsored by you;
  • To reimburse you for expenses covered by CSA Group;
  • To assist you with accommodation or flights bookings;
  • To solicit participation in marketing campaigns, case studies, member spotlights, surveys, or other related initiatives; 
  • To recognize you for your service and contributions;
  • To conduct membership demographic reviews and census;
  • For fraud prevention;
  • To assist in making arrangements to visit CSA Group facilities;
  • To reimburse you for any expenses incurred on our behalf (if applicable); 
  • To manage risk;
  • To ensure adherence to CSA Group’s policies and procedures including but not limited to CSA Policy Governing Standardization and CSA Directives & Guidelines Governing Standardization parts 1-4; or
  • To meet legal, regulatory, and/or accreditation requirements.

If we need to use or disclose your Personal Information for a new or an unrelated purpose, we will notify you and we will explain the legal basis that allows us to do so or obtain your consent. CSA Group may get in touch with you by any means of communication for which you have provided to us and authorized, including e-mail, telephone, and mail. 

7. How Personal Information is processed

Personal Information is processed both manually and electronically in accordance with the above-mentioned purposes and in compliance with relevant regulations. Within the CSA Group of companies, your Personal Information will be disclosed only to a limited number of CSA Group employees to the extent they need access to your Personal Information in connection with their job responsibilities. Access will be provided on a need-to-know basis.

8. Disclosures of Personal Information to third parties and international transfers

Your Personal Information will only be disclosed or shared with a third party for purposes consistent with this Privacy Notice or based on our legitimate interest. On a limited basis we will share only the Personal Information necessary with the following parties: 

  • Standards committee members at CSA Group or other standards development organisations;
  • On a need-to-know basis with third parties such as vendors, contractors, and other service providers whom we engage to perform tasks on our behalf or business affiliates who engage us to deliver services on their behalf;
  • Accreditation bodies such as Standards Council of Canada (SCC) or American National Standards Institute (ANSI) for accreditation purposes; 
  • Other Standards Development Organizations for collaboration or joint development of standards and/or standards harmonization.
  • Where required by law with law enforcement, government institutions, or judicial or regulatory authorities;
  • To third parties contracted by CSA Group to investigate a suspected breach of contract, a violation of CSA Group’s policies or procedures, or a contravention of the law; or
  • To third parties contracted by CSA Group to help with a data security breach or legal proceedings. 

Your information may be shared with our subsidiaries and/or corporate affiliates to fulfill the purposes of collecting your Personal Information or for other lawful grounds such as our legitimate interests. Such interests would include the provision of services, sales, marketing, and support. We take commercially reasonable steps to ensure that all CSA Group subsidiaries and/or affiliates conform to this Privacy Notice and applicable local laws. CSA Group does not sell, rent, or trade your Personal Information to other to third parties for their independent use. 

To facilitate our global operations, CSA Group may transfer Personal Information from your home country to other CSA Group locations across the world. To protect your Personal Information, we will only transfer Personal Information to countries that have ‘adequate’ data protection as determined by the European Commission, or if strong data protection commitments are made by the recipient in data processing agreements. 

CSA may transfer data collected from individuals residing in the European Union or the United Kingdom to third party processors located in countries outside the European Economic Area (EEA) or the United Kingdom. CSA will comply with the GDPR and UK GDPR in respect to such transfers by ensuing proper transfer mechanisms and/or contractual measures are in place and, where mandated, transfer impact assessments have been conducted.

9. Safeguards for Personal Information

CSA group uses commercially reasonable efforts to protect the security of your Personal Information. We use industry standard encryption algorithms and other technical controls to keep Personal Information secure and reduce risk. Nevertheless, such measures cannot prevent all loss, misuse, or alteration of Personal Information. In the case of a data breach that may impact you, we will make our best efforts to notify you without delay and where required by law, we will notify relevant regulatory bodies. 

All third-party service providers and business affiliates that work with us are expected to maintain privacy and security protections that are consistent with CSA Group’s privacy and information security policies. Read more about our security measures. 

10. Retention of Personal Information

Except as otherwise permitted by law or regulation, we will retain your Personal Information for long as necessary to fulfill the purpose for which it was processed or as reasonably necessary to comply with our accreditations, legal obligations, resolve disputes, and enforce our agreements. We may also retain cached or achieved copies of your Personal Information for a reasonable period of time.

11. Your Rights 

Under data protection laws, you are provided with rights related to your Personal Information depending on the jurisdiction in which you reside. You have the right to know or access: the Personal Information that we hold about you, the categories of Personal data concerned, how we use and share it. 

Depending on the jurisdictions in which you reside, you may request correction, updating, portability, restrictions on processing, or deletion of your Personal Information. You may also have the right to object to or withdraw consent to the processing of your Personal Information. CSA Group will not discriminate against you for exercising any of these rights. 

If CSA Group has disclosed your Personal Information to third parties as per this Notice, and you make a request to have your information corrected, where reasonable, we will notify those third parties of any changes or additions made to your Personal Information. 

To exercise any of your rights to your Personal Information as outlined above please contact us here and provide sufficient detail to enable us to fulfill your request. We may also need to verify your identity to protect your privacy. If there is a reason that we can’t fulfill your request, you will be informed of those reasons. 

If you are not satisfied with CSA Group’s response to your privacy concerns or our response to data subject rights you have exercised, you have a right to contact your local data protection regulator. To determine the appropriate regulatory body please contact us here.

12. Your Choice

You are in control of your Personal Information and providing your information to CSA Group is your choice. You can withdraw your consent to the processing of your Personal Information at any time. We will respect any such request, but it may limit the services that we are able to offer you. To withdraw your consent, please contact us here. You can also unsubscribe at any time to electronic messages from CSA Group via the unsubscribe link at the bottom of our e-mails.

13. Cookie Notice 

Please see our Cookie Notice for information on how we use cookies on our website. 

15. Use of AI and Automated Decision Making 

In the event that CSA Group uses artificial intelligence technologies to process Personal Information or uses Personal Information to facilitate machine learning, such activities will be made transparent, be based on an ethical AI governance framework, and be executed in compliance with applicable laws and regulations. 

Automated decisions are defined as decisions about individuals that are based solely on the automated processing of Personal Information and that produce legal effects that significantly affect the individuals involved. If automated decisions are made by CSA Group, we will inform you; and affected persons will be given an opportunity to express their views on the automated decision in question and object to it. 

16. Changes to this Privacy Notice

This Notice may be updated as required to reflect changes to our practices with respect to the handling of Personal Information or to address changes in applicable laws. You will always find our latest Notice here, and in certain circumstances where changes are significant and may affect you, we may notify you of such changes via e-mail. 

1. Purpose

The CSA Group of companies, being all the subsidiary and affiliated entities under the Standards Development and Testing, Inspection, & Certification umbrella organizations, (collectively “CSA Group “or “we” or “our”) is committed to protecting the privacy and security of your Personal Information. We use data in a variety of ways to build and maintain a team of exceptional talent. It is important to us to be transparent and explain how and why we process your Personal Information. This Privacy Notice describes how we collect and use Personal Information during and after your candidate application process with us. 

2. Accountability and how to reach us

CSA Group is responsible for the management, protection, and confidentiality of the Personal Information that we process on your behalf. Our Chief Legal, Ethics & Compliance Officer, and Corporate Secretary is the organization’s Chief Privacy Officer. If you have any questions or privacy concerns, please contact us here.

3. Definitions

Automated decision-making: When an electronic system uses Personal Information to make a decision without human intervention. 

Data controller: An organization/body that decides how and why data is being processed. A data controller can be a business, a public authority, an agency, or another body.    

Data processor: An organization/body that processes Personal Information only on behalf of the data controller. The data processor is often a third-party external to the data controller. 

Legitimate interests: Refers to the processing of Personal Information to carry out tasks directly related to business activities. The processing of Personal Information in this context may not necessarily be justified by a legal obligation or carried out to execute the terms of a contract with an individual.  

Personal Information: Information about an identified or identifiable individual, including name, address, email address, signature, opinion regarding the data subject, and other information relating to an individual, including sensitive Personal Information. It does not include data where the identity has been removed (anonymous or aggregate data). Please note both terms “Information” and “Data” are used interchangeably in this Notice. 

Sensitive Personal Information: A sub-category of Personal Information that refers to Personal Information that relates to race, ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about health, and genetic and biometric data. Not all countries define sensitive Personal Information in their privacy and data protection laws. 

4. Who is collecting your Personal Information

CSA Group is the “Data Controller”. This means that we are responsible for deciding how we hold and use your Personal Information.  

5. Personal Information we collect about you

When you apply for a role with us, we will collect and process the following categories of your Personal Information:

Contact details:

  • Personal address, telephone number, email address, URL of social media profile.

Professional Information data:

  • Resume, academic background and qualifications, positions held/job titles, work addresses.

Technical data:

  • Your use of and interaction with our online platforms and services; your IP address, browser type and version, browser plug-in types and versions, operating system.

Identification data:

  • Full name, title, marital status, date of birth, passport number, driving license number, nationality, national identification number, immigration status and work permits held, photographic images and languages spoken.

Profile data:

  • Username and password for our online recruitment portals, positions applied for.

Compensation Information data:

  • Salary, bonus, and benefits received and expected.

Electronic Monitoring data:

  • To the extent permitted by law, we may record and monitor your electronic communications with us. 
  • If you attend a physical location for the interview process, we will capture your image on CCTV.

Sensitive Personal Information:

  • Psychometric data is collected for any jobs where personality screening is conducted.
  • In limited circumstances, where relevant to the recruitment process and where allowed or required by law, we may collect information about: criminal convictions and offenses; gender, race, and ethnicity voluntarily and to ensure we are an inclusive employer; dietary requirements if we are arranging catering; disability so that we can make reasonable accommodations for you in our buildings; health-related information; sexual orientation if you provide details of your spouse or partner; political affiliations for us to determine whether you are a politically exposed person.

6. How we collect your Personal Information

Most of the Personal Information we receive is information that you directly submit to CSA Group as part of your application and interview process. We may also receive information from third parties such as online job networks, recruiters, social media sites, or from another employee if the application was submitted through our referral program.

If you have submitted your application through a third-party recruitment website, the Personal Information that you share is processed according to that third party’s privacy policies and procedures.

7. Purpose and legal basis for processing your Personal Information

Any Personal Information you provide to CSA Group during the application and recruitment journey will be processed for (i) the specific position you have applied for, and (ii) other current and future open positions within CSA Group that may be suitable to you if you choose to be considered for other opportunities.

We will only use your Personal Information for the purposes for which we collected it unless we reasonably consider that we must use it for another legitimate purpose compatible with the original purpose. If we need to use your Personal Information for a new or an unrelated purpose, we will notify you and we will explain the legal basis that allows us to do so.

CSA Group processes your Personal Information when:

  • It is necessary to process your application for potential employment.
  • You consent to the processing.
  • The processing is required by applicable law (e.g., for compliance with tax, court, or executive orders).
  • We, or a third party, have an overriding legitimate interest in using your Personal Information, such as to provide a safe work environment, or to protect CSA Group against theft or fraud.

More specifically, the below table sets out the purposes and basis for which we process an applicant’s Personal Information:

Processing Purpose Category of Personal Information Basis of Processing
To ensure CSA Group has complete and accurate information within your profile.
  • Contact data
  • Professional information data
  • Profile data
  • Technical data
Legitimate interests: to ensure the completeness of your profile data.
To allow CSA Group employees to refer candidates and enable them to track the status of submitted referrals.
  • Contact data
  • Professional information data
Legitimate interests: to allow CSA Group employees to refer candidates and enable them to track the status of submitted referrals.
To evaluate whether you have the necessary skills and qualities to perform in a potentially relevant future role, and to recommend you as a member of our Talent Community for possible open positions.
  • Contact data
  • Professional information data
  • Profile data
  • Technical data
  • Consent
If you are a member of our Talent Community, to send you messages about career opportunities
  • Contact data
  • Consent
To process your application including to identify you as a candidate and contacting you; to communicate with you to schedule interviews, make travel arrangements, etc.; to evaluate applications, and review assessment test results; to ascertain your fitness to work; to assess whether you have the professional skills, expertise, and experience required for the position applied for and to make recruitment decisions.
  • Identification data
  • Contact data
  • Professional information data
  • Profile data
  • Sensitive Personal Information
  • Performance of a contract
  • Legal or regulatory obligation
  • Legitimate interests: to communicate with you; to schedule interviews and make travel arrangements if required; to evaluate whether you have the necessary skills and qualities to perform the relevant role
To check if you are legally entitled to work in the area in which you are applying to work.
  • Identification data
  • Contact data
  • Legal obligation
  • Legitimate interests: to ensure you have the right to work in the area you are applying to work
If you are offered and accept a position, to conduct background screening (as allowed or required by law), including verification of all information provided i.e., prior work and education verification, and criminal background checks.
  • Identification data
  • Contact data
  • Professional information data
  • Profile data
  • Sensitive Personal Information
  • Legal or regulatory obligation
  • Legitimate interests: to protect CSA Group assets and employees; fraud and other financial crime prevention
Administrative tasks in preparation for joining once the background screening is completed i.e., determining the terms on which you work with us, administering the contract for your offer if you are successful, making decisions about compensation and performance requirements
  • Identification data
  • Contact data
  • Professional information data
  • Profile data
  • Sensitive Personal Information
  • Performance of a contract
  • Legal or regulatory obligation
  • Legitimate interests: managing our workforce to ensure the efficient and secure running of our business
To fulfill reporting requirements for applicable health and safety obligations, employment equity laws and regulations.
  • Identification data
  • Profile data
  • Sensitive Personal Information
  • Legal or regulatory obligation
To prevent fraud or other detection of crimes; to ensure network and information security, including preventing unauthorized access to our computer and electronic communications systems and preventing malicious software distribution.
  • Identification data
  • Electronic Monitoring data
  • Technical data
  • Legitimate interest: to prevent fraud or other detection of crimes as well as to ensure network and information security
Contact third parties such as your emergency contact, medical services etc. in the event of an emergency.  
  • Identification data
  • Consent
  • Legitimate interests: to protect your vital interests
To conduct data analytics studies to review and better understand employee hiring rates and equal opportunity monitoring.
  • Professional data
  • Technical data
  • Compensation data
  • Legitimate interests: to analyze and improve our recruitment process and workforce

If you fail to provide certain information when requested, we may not be able to complete the recruitment process, or we may be prevented from complying with our legal obligations.

 

8. Disclosures of Personal Information to third parties and international transfers 

Your Personal Information will only be disclosed or shared with third parties for purposes consistent with this Privacy Notice or based on our legitimate interest. On a limited basis, we will share your Personal Information:

  • On a need-to-know basis with third parties such as vendors, contractors, and other service providers who we engage to perform tasks on our behalf or business affiliates who engage us to deliver services on their behalf;
  • Where required by law enforcement, government institutions, or judicial or regulatory authorities;
  • To investigate a suspected breach of contract, a violation of CSA Group’s policies or procedures, or a contravention of the law; or
  • In the context of a data security breach or legal proceedings.  

Your information may be shared with our subsidiaries and/or corporate affiliates to fulfill the purposes of collecting your Personal Information or for other lawful grounds such as our legitimate interests. Such interests would include the provision of services, sales, marketing and support. We take commercially reasonable steps to ensure that all CSA Group subsidiaries and/or affiliates conform to this Privacy Notice and applicable local laws. CSA Group does not sell, rent, or trade your Personal Information to other to third parties for their independent use, unless you request or authorize it. 

To facilitate our global operations, CSA Group may transfer Personal Information from your home country to other CSA Group locations across the world. To protect your Personal Information, we will only transfer Personal Information to countries that have ‘adequate’ data protection as determined by the European Commission, or if strong data protection commitments are made by the recipient in data processing agreements. 

CSA may transfer Personal Information collected from individuals residing in one jurisdiction to a third party located in another jurisdiction. CSA will conduct data transfer impact assessments, ensure proper data transfer mechanisms are in place, and make best efforts to comply with applicable data transfer rules depending on the privacy or similar data protection laws of a given jurisdiction. 

9. Safeguards for Personal Information

CSA Group uses commercially reasonable efforts to protect the security of your Personal Information. We use industry standard encryption algorithms and other technical controls to keep Personal Information secure and reduce risk. Nevertheless, such measures cannot prevent all loss, misuse, or alteration of Personal Information. In the case of a data breach that may impact you, we will make best efforts to notify you without delay and where required by law, we will notify relevant regulatory bodies. 

All third-party services providers and business affiliates that work with us are expected to maintain privacy and security protections that are consistent with CSA Group’s privacy and information security policies. Read more about our security measures. 

10. Retention of Personal Information

If your application is unsuccessful, CSA Group will keep your profile data for 12 months after the end of the relevant recruitment process (this period may differ, depending on the region you have applied from). In addition to this and with your consent, your details may be kept on file for 3 years for consideration for future employment opportunities. At the end of that period, or if you withdraw your consent, your data will be deleted or destroyed.

If you are successful in your application for a position, we retain the Personal Information you provide during the application process, and information about your application process, as part of your employee records.

In some circumstances, we may anonymize your Personal Information so that it can no longer be associated with you, in which case we may use such information for a longer period for aggregate or statistical purposes.

11. Updating your Personal Information

If there is a change in your Personal Information, you can update or make changes by accessing your online candidate profile on our career site.

12. Your Rights 

Under data protection laws, you are provided with rights related to your Personal Information depending on the jurisdiction in which you reside. You have the right to know or access: the Personal Information that we hold about you, the categories of data concerned, how we use and share it, and how long we store it. 

Depending on the jurisdictions in which you reside, you may request correction, updating, portability, restrictions on processing, or deletion of your Personal Information. You may also have the right to object to or withdraw consent to the processing of your Personal Information. CSA Group will not discriminate against you for exercising any of these rights. 

If CSA Group has disclosed your Personal Information to third parties as per this policy, and you make a request to have your information corrected, where reasonable, we will notify those third parties of any changes or additions made to your Personal Information. 

To exercise any of your rights to your Personal Information as outlined above please contact us here and provide sufficient detail to enable us to fulfill your request. We may also need to verify your identity to protect your privacy. If there is a reason that we can’t fulfill your request, you will be informed of those reasons. 

If you are not satisfied with a response from CSA Group with respect to your privacy concerns or our response to data subject rights you have exercised, you have a right to contact your local data protection regulator. To determine the appropriate regulatory body please contact us here.

13. Use of AI and Automated Decision Making

In the event that CSA Group uses artificial intelligence technologies to process Personal Information or uses Personal Information to facilitate machine learning, such activities will be made transparent, be based on an ethical AI governance framework, and be executed in compliance with applicable laws and regulations. 

Automated decisions are defined as decisions about individuals that are based solely on the automated processing of Personal Information and that produce legal effects that significantly affect the individuals involved. If automated decisions are made by CSA Group, we will inform you; and affected persons will be given an opportunity to express their views on the automated decision in question and object to it. 

14. Changes to this Applicant Privacy Notice

This Policy may be updated as required to reflect changes to our practices with respect to the handling of applicants’ Personal Information or to address changes in applicable laws. You will always find our latest Policy here, and in certain circumstances where the changes are significant and may affect you, we may notify you of such changes via e-mail. 

CSA Group Testing & Certification Inc. and its subsidiaries and affiliates (collectively “CSA Group” or “we” or “our”) are committed to respecting and protecting the privacy of our online and mobile visitors who use or visit our websites, mobile applications, or online services, or interact with our digital campaigns (“websites”). This notice, to be read in conjunction with the CSA Group Privacy Policy, describes how we use cookies and other technology to personalize the experience of visitors when using our websites.

1. Online tracking and cookies

What cookies and tracking tools do we use? We may use cookies, web beacons, and pixels on our websites. A cookie is a small piece of data that is sent from a website server and saved on your computer or mobile device when you access a website to, for example, help facilitate the use of a website and to help understand how a website is being used. Different types of cookies are used for different types of activities. Examples of cookies we may use are:

  • First-party cookies set by the site you are visiting. Our cookies have distinct functions and are necessary for the delivery of our services, to help us improve our performance or to help us serve you relevant and targeted content.
    • Session cookies: These cookies are stored in your device’s temporary memory and are automatically removed when you close the browser. These cookies are essential, as they connect information between CSA Group’s web server and yours, or enable you to navigate through our secure websites after authentication. When you close the browser, the cookies expire and are no longer active or used.
    • Persistent cookies: Another type of cookie is known as a persistent cookie, which remains on your device usually for 30 to 90 days. They are used to help us understand your interactions with our website, which enables CSA Group to identify specific challenges users may have with areas of our site (i.e. navigation, form completion, etc.) and make improvements to the experience. These cookies may also be used to provide enhanced functionality and personalization by allowing our site to remember the choices you have made, but are non-essential.
  • Third-party non-essential cookies set by service providers whose technologies we may leverage to help us deliver and assess the effectiveness of our content.
    • Analytics cookies: Also known as performance cookies, these cookies help us improve site navigation and enhance our website visitors’ experience. For example, we use Google Analytics for web statistical analysis. We make no effort to personally identify you based on your visit to our site. If you wish, you may opt out of being tracked by Google Analytics by disabling or refusing the cookies; by disabling JavaScript within your browser; or by using the Google Analytics Opt-Out Browser Add-On.
    • Advertising cookies: These cookies record your visit to our websites, the pages you have visited and the links you have followed. We may use this information to make our website content more relevant to your interests and to measure the effectiveness of our marketing initiatives. They remember the other websites you visit and are optional cookies. If you restrict such cookies through your browser settings, you will experience less targeted advertising. Our websites or email communications may also use technology such as “pixels” or “web beacons”. This technology allows us to understand which areas of our emails you click and your behaviour on our websites, such as which pages you visit. These tags are used to help us optimize and tailor our sites for you and other future visitors and to help provide you with content tailored to your interests.

2. What information is collected

When you visit our website, the site asks your browser to store a cookie on your device to remember details, such as information that you may provide, information about you, information about or in your device, geolocation data, and statistical information about website usage.

  • Information you provide, such as your name and e-mail address;
  • Information about you – This will include information such as your language preference, country, time zone, and your CSA’s Online Store login information (if applicable);
  • Information about or in your device – CSA Group may collect or access information about your device, such as device model, unique device number, operating system type and version, browser type and version, current language, plug-ins, screen resolution, Internet Protocol (IP) address, and your Internet Service Provider (ISP), and the region from which you are connecting to our website or applications;
  • Geolocation data such as the built-in GPS in devices that generates latitudinal and longitudinal geographic coordinates; and
  • Statistical information – We also collect statistical information on how you access or use our websites or mobile applications to help improve your website experience.

 

3. How we use information collected by cookies

We use the information in several ways to deliver products and services to you. This includes:

  • Recognizing you when you return to our websites or use our mobile apps (and remembering your user ID to make it easier for you to login);
  • To help verify your identity;
  • To collect statistical information about your on-site behaviour so that we can identify which areas of our website may need to be enhanced to improve the design, navigation, content, and overall user experience;
  • To customize content to your interests and to advertise and promote relevant products and services to you and others like you that conduct business with us digitally;
  • To optimize our websites and the content we make available; and
  • To help secure your connection to our websites and for fraud prevention and investigation purposes.

 

4. How we share information collected by cookies

Non-essential cookies identify when you visit specific CSA Group websites and may be shared with third parties involved in customizing advertising or third-party digital channels. CSA Group does not sell your information to third parties, nor do we track your interaction with a third-party website. For purposes described in this notice or in the particular online or digital channel, CSA Group may share information with employees, agents, and service providers, who are required to maintain the confidentiality of the information. We may also share information with government agencies, public bodies, regulators, or other entities where permitted or required by law.

 

5. How to manage your cookies

The browsers of most computers, smartphones, and other web-enabled devices are typically set up to accept first party cookies. If you do not want your information collected or used for advertising or marketing purposes via cookies, you can change how cookies will be placed on your device when you visit our website by changing the settings on your browser. These settings are usually found in the ‘options’ or ‘preferences’ menu of your browser.

Most browsers can be set to detect cookies and give you an opportunity to reject them, but refusing cookies may, in some cases, result in a suboptimal or generic digital experience that does not adapt to your online behaviour.

You do not have to accept non-essential cookies. Your choice not to accept these cookies will not prohibit your use of CSA Group websites. However, please remember that cookies improve certain functions and provide a more tailored browsing experience. If you choose to switch certain cookies off, you should be aware that certain features of our websites may not function properly without cookies.

If you have any concerns about the cookie practices of CSA Group websites, please contact us here.

The Chief Legal, Ethics & Compliance Officer is accountable for compliance with privacy and personal information protection obligations at CSA Group. If you have any questions concerning privacy at CSA Group, please contact us at [email protected].  

If you wish to exercise any of your rights by submitting a Privacy Access Request (a.k.a Data Subject Access Request), please do so by using one of the following links:  

Canada Privacy Access Request  

US Privacy Access Request

EEA_UK Data Subject Access Request  

China Privacy Access Request 

If none of the above apply to you, please use the Global Privacy Access Request