Privacy Policy
What personal information BKY Technologies collects, why we collect it, who we share it with, and what you can ask us to do about it.
About this policy
Becker, Keating & Young Technologies Corp., operating as BKY Technologies, has built and run technology for Alberta organizations since 1999. Handling other people’s information carefully is most of what we do, so we would rather set out plainly how we treat it than leave you to guess.
This policy covers personal information that BKY collects and controls: what comes to us through bky.ca, through enquiries and sales conversations, through hiring, through our commercial relationships, and through the day-to-day work of managed IT and software delivery.
It does not cover:
- Personal information we handle on behalf of a client. When we host a client’s system, support their staff, or run an election on their behalf, the client decides what is collected and why. Their privacy policy governs, not ours. Section 3 explains the distinction and what to do if it applies to you.
- Other organizations’ websites and services. Links from bky.ca to a client’s site, a product site, or a vendor’s documentation take you somewhere with its own privacy practices.
- Business contact information used for business purposes — your work email address, title, and office phone number, used to contact you about your work. Alberta’s privacy legislation treats that differently from personal information.
We are not a federally regulated business, so our provincial statute is Alberta’s Personal Information Protection Act (PIPA). Where we handle personal information across provincial or national borders in the course of commercial activity, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies as well. Where we hold information about individuals in Quebec, Quebec’s Law 25 may also apply.
Who we are, and who to contact
We have designated a Privacy Officer, as PIPA requires. That person is accountable for this policy and for answering anything you ask about it. At BKY it is our President, so a privacy question does not get routed into a queue — it reaches the person answerable for the decision.
Troy Young, President — Privacy Officer
- Email privacy@bky.ca
- Phone (780) 464-5239
- Mail PO Box 62052, RPO Westmount, Edmonton, Alberta, T5M 4B5, Canada
- Region Edmonton, Alberta, Canada
If you would rather write than call, email reaches the Privacy Officer directly and we answer in writing.
The two roles we play with personal information
This is the part most privacy policies skip, and it is the part that decides whether the rest of this policy applies to you at all.
As a business, we control our own information. Website visitors, people who enquire, job applicants, our client and vendor contacts — we decide what to collect about those people and why. Everything else in this policy describes that role.
As a service provider, we handle information that belongs to our clients. A union local’s membership records in LabourConnex. Ballots and voter lists in Election Portal. The contents of a support ticket, a mailbox we administer, or a database we host. We hold that information because a client asked us to, we use it only to deliver what they engaged us for, and we do not decide what goes into it, mine it for our own purposes, sell it, or use it to train anything.
Under PIPA and PIPEDA, the client remains accountable for that information. What we may do with it is set by our agreement with them, which is more specific than this policy and takes precedence over it.
If you are a member, employee, voter, or customer of an organization that uses BKY
Your request belongs with that organization, not with us. If you ask us for access to your records, or to correct or delete them, we will refer you to them — not to be unhelpful, but because we are not permitted to act on a client’s data without their instruction.
If you are not sure who to ask, contact our Privacy Officer and we will point you to the right place.
What we collect, and why
We collect only what we need for the purpose at hand, and we tell you the purpose at the time — either on the form you are filling in or in the conversation we are having.
Visitors to bky.ca
- IP address, browser and device type, referring page, pages viewed, and approximate location derived from the IP address
- Cookie and analytics identifiers — see section 6
Why: To keep the site available and secure, to diagnose faults, and to see which pages are useful. We do not try to identify individual visitors from it.
People who contact us
- Name, organization, email address, phone number
- Whatever you choose to tell us about your organization and what you need
Why: To answer you, prepare a proposal, and keep a record of what was discussed. If a conversation does not go anywhere, we keep enough to remember that we spoke and why.
Client and prospective client contacts
- Name, title, organization, work contact details
- Notes on requirements, meetings, and correspondence
- Billing and account contacts
Why: To quote, contract, deliver, invoice, and support your account, and to tell you about things relevant to it — see section 7.
Job applicants
- Résumé and cover letter, employment and education history, references
- Contact details, and anything else you send us
Why: To assess your application and get back to you. If we would like to keep it on file for a future opening, we will tell you and you can decline.
Individuals whose information reaches us through service delivery
Delivering managed IT and software puts us in contact with information about a client’s staff and their contacts: user accounts and directory entries, device and session records, the contents of support requests, and whatever sits inside the systems we administer, host, or build.
Why: To deliver what the client engaged us for, and nothing else. This is the service-provider role described in section 3.
Suppliers, partners, and subcontractors
- Contact and account details for the people we buy from and work with
Why: To run our own operations.
What we do not collect
We do not knowingly collect information we have no use for. We do not buy personal information from data brokers. We do not use personal information to train artificial intelligence models, our own or anyone else’s, and we do not permit the vendors we use to do so with our clients’ data.
Consent, and how to withdraw it
Most of the time you give us information knowingly — you fill in a form, send an email, sign a contract, or apply for a job. That is your consent, for the purpose that was obvious at the time.
Where we rely on implied consent, it is for something you would reasonably expect from the interaction: answering an enquiry you started, or servicing an account you hold. Where the purpose is not obvious, we ask.
You can withdraw consent at any time by contacting our Privacy Officer. Two honest caveats: withdrawing consent is not retroactive, and some information we have to keep regardless — records required to honour a contract, to meet a tax or legal obligation, or to defend a claim. If withdrawal means we can no longer provide something, we will tell you before it takes effect rather than after.
Cookies, analytics, and website logs
bky.ca sets cookies. Some are necessary for the site to work — session handling, security, and remembering choices you make. Others belong to the analytics service we use to measure how the site is used, in aggregate, so we can tell which pages are worth keeping.
We do not use cookies to build advertising profiles, and we do not sell what our analytics collects. If you want to know which measurement services are running on bky.ca at any given time, ask our Privacy Officer and we will tell you.
You can block or delete cookies in your browser. The site will still work; the measurement will be less accurate.
Our web server keeps access logs — the same request records any web server keeps — for security and troubleshooting, and we keep them only as long as they are useful for those purposes.
Commercial electronic messages
If we send you a commercial email, it is because you asked us to, because you are a client, or because we have an existing business relationship of the kind Canada’s Anti-Spam Legislation recognizes. Every commercial message we send identifies us, gives you a way to reach us, and carries a working unsubscribe link that we act on promptly.
Unsubscribing from marketing does not stop the messages we need to send you about a service you actually hold — invoices, maintenance windows, incident notices, security advisories. Those are part of the service.
Who we share information with
We do not sell personal information, and we do not rent, trade, or share it for anyone else’s marketing.
We do share it, narrowly, with:
- Service providers who work on our behalf — hosting, cloud platforms, email and productivity, security and backup tooling, remote monitoring and support tooling, payment processing, accounting, and professional advisors. Each is bound to use the information only for the service it provides us. You can ask our Privacy Officer for the current list.
- Our clients, where the information is theirs — the section 3 role.
- Anyone you direct us to, with your consent.
- Where the law requires it — a court order, a subpoena, a lawful demand from a regulator or law enforcement, or where PIPA permits or requires disclosure. We do not hand over more than the demand actually compels, and we tell the person affected unless we are prohibited from doing so.
- A purchaser, in a business transaction. If BKY is ever sold, merged, or reorganized, personal information may transfer as part of the business. PIPA permits this for the purpose of the transaction and requires the information to continue being used for the purposes it was collected for. Any purchaser would be bound to that.
Where your information is stored
BKY is an Alberta company and our team works from Edmonton and Calgary. We do not offshore support or development, and we do not use offshore call centres.
We do rely on established cloud platforms to host systems and store information, and some of those platforms operate data centres in more than one country. Where information is stored or accessed outside Canada, it is subject to the laws of that country, including lawful access by its courts and authorities.
Ask us where your data lives
Alberta’s PIPA requires us to name someone who can answer questions about our use of service providers outside Canada, and to tell you what those providers do. That person is our Privacy Officer.
If you are evaluating LabourConnex, Election Portal, or Union Drive, ask. We will tell you in writing which country hosts the platform, which country holds its backups, and who can access it — before you sign anything. For an organization running a vote, that is a reasonable question and we treat it as one.
Where we hold information about individuals in Quebec, Law 25 adds its own requirements for transfers outside the province. Given the range of organizations we serve across Canada, we assess that rather than assume it.
How we protect information, and how long we keep it
We apply the same controls we build for clients: access limited to the people who need it for their role, multi-factor authentication, encryption in transit and at rest where the platform supports it, network and endpoint monitoring, tested backups, patching, and vendor review. Staff are trained on their privacy obligations and are bound by confidentiality terms.
No safeguard is absolute, and we will not claim otherwise. What we can say is that we treat our own environment as seriously as we treat a client’s, and that we test rather than assume.
We keep personal information only as long as it serves the purpose it was collected for, or as long as the law requires — then we destroy or de-identify it. Where information has been used to make a decision about someone, PIPA requires us to keep it for at least a year afterward so the decision can be reviewed.
One practical point about deletion, because it is where most organizations quietly overstate what they do: removing a record from a live system does not remove it from a backup taken yesterday. When we delete something at your request, we remove it from live systems straight away, and it then ages out of our backups on the normal backup cycle. If you need to know that cycle, or how long we keep a particular kind of record, ask our Privacy Officer and we will tell you.
Your right to access and correct your information
You can ask us:
- What we hold about you, how we have used it, and who we have disclosed it to. PIPA gives you that right and gives us 45 days to respond, with an extension available if we need it and tell you why.
- To correct it, if it is wrong or incomplete. We will fix it and, where it matters, tell anyone we gave the incorrect version to.
- To delete it, which we will do where we are not required to keep it. Where we are required to keep it, we will tell you why.
Send the request to our Privacy Officer. We may need to verify who you are before we answer — that protection exists for your benefit, and we will ask for no more than the situation requires. Access is free in ordinary cases; if a request is unusually large we will give you a cost estimate first and you can decide whether to proceed.
There are limits. We may have to withhold information that would reveal something about another person, that is subject to solicitor-client privilege, that would compromise an investigation or a security measure, or that belongs to a client rather than to us. If we withhold something, we will say so and say on what basis.
If something goes wrong
If personal information in our control is lost or accessed without authorization, we investigate, contain it, and assess the risk to the people affected.
Where the incident creates a real risk of significant harm, PIPA requires us to report it to the Office of the Information and Privacy Commissioner of Alberta without unreasonable delay, and the Commissioner may require us to notify the individuals affected. Where PIPEDA applies, we report to the Privacy Commissioner of Canada, notify affected individuals, and keep a record of the breach. Where the information belongs to a client, we notify the client so they can meet their own obligations, on the timeline our agreement with them sets.
We would rather tell you about a problem than have you find out some other way.
Children
bky.ca is a business site and our services are sold to organizations, not to children. We do not direct anything here at children and we do not knowingly collect their personal information. If you believe a child’s information has reached us, contact our Privacy Officer and we will remove it.
Some systems we host for clients — apprenticeship and training records, for instance — may contain information about people under 18. That is client information under section 3, and the client’s own consent practices govern it.
Changes to this policy
We update this policy when our practices change or the law does. The date at the top of this page is the date of the current version. If a change is significant we will say what changed rather than quietly reposting the page, and where consent is required for the new purpose we will ask for it.
Questions, concerns, and complaints
Start with us. Our Privacy Officer will look into anything you raise and answer you in writing.
Troy Young, President — Privacy Officer, BKY Technologies
- Email privacy@bky.ca
- Phone (780) 464-5239
- Mail PO Box 62052, RPO Westmount, Edmonton, Alberta, T5M 4B5, Canada