CERTILATE Privacy Policy

Plain-language summary. CERTILATE uses personal information to provide certified translation services, operate and secure its platform, process payments, support users, and meet legal obligations. Translation documents may contain highly sensitive information. This Policy explains what we collect, how we use and share it, where it may be processed, how long we keep it, and the choices and rights available to you.

1. Who We Are

CERTILATE INC. (also referred to as “CERTILATE,” “we,” “us” or “our”) is a federal corporation with its registered office at 6-2160 Highway 7, Suite 260, Vaughan, Ontario L4K 1W6, Canada.

CERTILATE operates an online certified-translation agency. Customers submit documents and order details, eligible independent certified translators may review a limited preview and submit quotations, and CERTILATE assigns and manages the order. The assigned translator—not CERTILATE—certifies the translation and is responsible for the translator’s professional work and use of professional credentials.

CERTILATE is accountable for personal information under its control. Questions, complaints and privacy requests may be sent to:

• Privacy Officer
• Email: privacy@certilate.com
• Mail: 6-2160 Highway 7, Suite 260, Vaughan, Ontario L4K 1W6, Canada

2. Scope of This Policy

This Policy describes how CERTILATE handles personal information in connection with the CERTILATE website, platform, customer and translator accounts, translation orders, quotations, payments, support, complaints, and related communications. It applies to customers, prospective customers, website visitors, translators and translator applicants, and people whose information appears in documents submitted to CERTILATE.

This Policy does not govern an independent third party’s handling of information for its own purposes. Links to external websites or services are provided for convenience; their privacy practices are governed by their own policies.

This Policy is intended to reflect requirements under Canada’s Personal Information Protection and Electronic Documents Act and applicable provincial private-sector privacy laws. Mandatory rights under applicable law are not limited by this Policy.

3. Personal Information We Collect

We collect personal information that is reasonably necessary to provide and administer our services, operate and protect the platform, meet legal obligations, and manage our relationships. Depending on how you interact with CERTILATE, this may include:

• Account and contact information. Name, email address, telephone number, preferred language, account credentials, profile details and communications preferences.
• Order information. Source and target languages, service level, timing, delivery instructions, quotations, order status, translator assignment, revisions, complaints, approvals and acceptance records.
• Documents and translation content. Source documents, images, text, metadata, completed translations, declarations, affidavits, certification packages, supporting materials, messages, notes and corrected versions. These materials may include sensitive information about you or other people, including identity, immigration, legal, medical, financial, employment, education, family and information about minors.
• Payment and transaction information. Amounts, taxes, fees, refunds, payment status, chargeback and payout information, and limited payment-method information made available by the payment processor. CERTILATE does not intend to store full payment-card numbers or card security codes.
• Translator and applicant information. Contact and profile information, language pairs, professional association membership and credentials, verification records, availability, quotations, assignments, performance, correction and complaint history, payment details and tax-related information.
• Delivery information. Recipient name and address, delivery instructions, carrier and tracking information where printed delivery is requested. Printed delivery is handled by the translator or a delivery provider, not by CERTILATE.
• Technical and acceptance information. IP address, device and browser information, login and security events, timestamps, account and order identifiers, accepted policy or agreement version, checkbox wording, and records of electronic consent or acceptance.
• Support and complaint information. Messages, files, correction requests, evidence, investigation notes, decisions, outcomes and related communications.
• Marketing preferences. Whether you separately choose to receive promotional communications and your subscription or unsubscribe status.

Please submit only the information needed for the translation or related service. If a document contains another person’s personal information, you must have authority to provide it to CERTILATE for the requested service.

4. How We Collect Personal Information

We collect personal information:

• directly from you when you create an account, upload documents, request or provide a quotation, pay, communicate with us, request support, or use the platform;
• from a customer or authorized representative who submits information about another person;
• from translators, professional associations or public professional directories when we verify credentials, eligibility or current professional status;
• automatically through essential platform technologies, security logs and cookies when you use the website or platform;
• from payment processors, delivery providers and other service providers involved in a transaction; and
• from lawful sources when reasonably necessary to investigate fraud, security events, complaints or legal claims.

5. How We Use Personal Information

We use personal information for identified and appropriate purposes, including to:

• create and administer accounts and verify contact, professional or account information;
• receive, display and manage translation requests, quotations, assignments, deadlines, revisions, approvals, complaints and completed orders;
• provide eligible translators with a limited, blurred preview of up to the first three pages of a submitted document so they can assess the request and prepare a quotation;
• provide the complete source material to the assigned translator after payment is confirmed;
• process payments, refunds, chargebacks, translator payouts and tax or accounting records;
• facilitate certification, including the assigned translator’s use of an applicable professional-association portal;
• support printed delivery where requested, while the translator remains responsible for sending the printed package to the address supplied by the customer;
• provide customer support, investigate complaints, address corrections, prevent fraud and resolve disputes;
• operate, maintain, secure, test, troubleshoot and improve the platform and service;
• maintain evidence of notices, consent, contract acceptance and transactions;
• comply with legal, regulatory, tax, accounting, security and professional obligations; and
• send service messages and, only with separate consent where required, promotional communications.

CERTILATE does not sell or rent personal information. We do not use customer documents to train CERTILATE or third-party artificial-intelligence models.

6. Consent and Other Authorized Processing

We obtain consent appropriate to the sensitivity of the information and the purpose of collection, use or disclosure, unless applicable law permits or requires processing without consent. By submitting an order, document or other person’s information, you confirm that you are authorized to do so and to instruct CERTILATE to process it for the requested service.

You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. Withdrawal will not affect processing already lawfully completed and may prevent CERTILATE from providing or completing a service. We will explain material consequences where appropriate.

Where permitted by law, we may also process personal information without consent to investigate fraud, collect a debt, respond to an emergency, comply with a court order or other legal requirement, or establish, exercise or defend a legal claim.

7. How We Share Personal Information

We disclose personal information only for an identified purpose, as reasonably necessary to provide or administer the service, or as permitted or required by law. Recipients may include:

• Eligible translators. Before assignment, eligible translators may receive a blurred preview of up to the first three pages and limited order information for quotation purposes. They must use it only for that purpose and comply with applicable confidentiality obligations.
• Assigned translator. After payment, the assigned translator receives the documents and order information needed to perform and certify the translation, communicate about the order, and address included corrections.
• Professional associations. The assigned translator may upload source documents and translations to the relevant association portal to obtain an electronic stamp, declaration, affidavit or other certification package, where that process is required or available.
• Service providers. Hosting, cloud infrastructure, payment, email, support, security, translation-technology, analytics limited to essential operations, and delivery providers may process information on our behalf under contractual or other safeguards.
• Authorized personnel. Authorized CERTILATE administrators, support personnel, software engineers and contractors may access information where reasonably necessary for service delivery, support, security, maintenance, troubleshooting, incident response or legal compliance.
• Business transactions. Information may be disclosed in connection with a proposed or completed financing, investment, reorganization, merger, sale or transfer of all or part of the business, subject to appropriate confidentiality and use restrictions and applicable law.
• Authorities and other lawful recipients. We may disclose information when permitted or required by law, including to courts, regulators, law-enforcement authorities, tax authorities, insurers, auditors or professional advisers.

8. Cross-Border Storage and Processing

Personal information may be stored, accessed or processed outside your province or outside Canada. CERTILATE’s production hosting environment is located in Boston, Massachusetts, United States. Payment processing, translation technology, email or support services, professional-association portals, authorized personnel and other service providers may operate in Canada, the United States or other countries.

Information processed in another jurisdiction may be subject to that jurisdiction’s laws and may be accessible to courts, governments, regulators or law-enforcement authorities in accordance with those laws. CERTILATE remains accountable for personal information transferred to service providers for processing and uses contractual, administrative and technical safeguards appropriate to the circumstances.

Before initiating or materially changing a cross-border processing arrangement, CERTILATE assesses relevant privacy factors, including sensitivity, purpose, location, safeguards and applicable legal requirements. You may contact the Privacy Officer for information about service providers or countries involved in processing your information, subject to security and confidentiality limits.

9. Translation Technology and Automated Processing

After payment is confirmed, CERTILATE may use approved translation-assistance technology, including DeepL, to support the assigned translator’s workflow. Document content may be transmitted to the provider under the applicable business or API service configuration. The assigned certified translator remains responsible for reviewing, correcting, completing and certifying the final translation.

The platform may use automated rules to determine eligibility, present translation opportunities, rank quotations or support assignment decisions. Criteria may include language pair, verified professional status, ability to meet the customer’s deadline, price, turnaround, fair opportunity for newer translators, relevant correction history, and complaint or escalation history. CERTILATE may review or override an automated recommendation where operationally appropriate.

Where a decision is based exclusively on automated processing and applicable law provides a right to information or review, the affected person may contact the Privacy Officer to request information about the principal factors and parameters, correct relevant personal information, and submit observations to an authorized person who can review the decision.

10. Cookies and Similar Technologies

At the effective date of this Policy, CERTILATE uses only cookies and similar technologies that are necessary to operate and secure the website and platform. These may support login sessions, authentication, security, load balancing, fraud prevention, language or interface preferences, and records of consent or acceptance.

CERTILATE does not use advertising, cross-site tracking, session-replay or optional analytics cookies at the effective date. If we later introduce a non-essential technology, we will update the applicable notice and obtain consent where required before activating it for the user.

You can configure your browser to block or delete cookies. Blocking essential cookies may prevent account access or important platform functions from working properly.

11. Safeguards and Access

CERTILATE uses administrative, technical and contractual safeguards appropriate to the sensitivity, amount, format, location and use of the information. These safeguards are designed to reduce risks of unauthorized access, use, disclosure, alteration, loss or destruction and may include account authentication, secure transmission, restricted administrative access, confidentiality obligations, vendor controls, backups, monitoring, maintenance and incident-response procedures.

Customer documents may be accessed by authorized CERTILATE personnel where reasonably necessary for support, security, troubleshooting or service delivery. CERTILATE applies administrative, technical and contractual safeguards appropriate to the sensitivity of the information.

No method of transmission or storage is completely secure. Users must protect their credentials, use a strong and unique password, sign out of shared devices, and promptly notify CERTILATE of suspected unauthorized access.

12. Translator Handling of Documents

An assigned translator may download customer documents to a personal computer or other device when reasonably necessary to complete, certify and deliver the translation or use a professional-association portal. Translators must protect the documents, restrict access, use them only for the assigned order, and comply with their agreement, professional obligations and applicable law.

A translator may not disclose a document to another person, delegate the translation, or use document content for another purpose except as authorized by the customer and CERTILATE or required by law. The translator remains solely responsible for the translator’s production, certification, credentials and any permitted assistance or delegation.

Unless a longer period is required by law, a professional obligation, a dispute hold or written CERTILATE instruction, translators must delete local copies no later than seven days after the order closes. Copies retained under an exception must remain protected and may be used only for the permitted purpose.

13. Retention and Deletion

We retain personal information only for as long as reasonably necessary for the identified purposes, to meet legal, regulatory, tax, accounting and professional obligations, and to establish, exercise or defend legal claims. The following schedule applies unless a longer or shorter period is required or permitted by law, a legal hold, an active dispute, security needs or a valid deletion request:

When a retention period expires, CERTILATE deletes or anonymizes the information using reasonable procedures. Information in backups is removed according to the applicable backup-rotation cycle and is not restored except for continuity, security or disaster-recovery purposes. If restored, expired information will again be subject to deletion controls.

A customer may request early deletion after an order is completed. We will delete eligible information, but may retain information that is necessary for certification integrity, transaction records, fraud prevention, a complaint or legal claim, tax or accounting obligations, security, or another lawful purpose. We will explain any material refusal or limitation.

14. Access, Correction, Portability and Other Requests

Subject to applicable law and reasonable identity verification, you may ask CERTILATE to:

• confirm whether we hold personal information about you and explain how it has been used or disclosed;
• provide access to your personal information;
• correct information that is inaccurate, incomplete or out of date;
• withdraw consent, where processing is based on consent and withdrawal is legally available;
• delete eligible personal information or close your account;
• provide eligible computerized personal information in a structured, commonly used technological format, or transmit it to an authorized person or organization, where applicable law requires portability;
• obtain information about, correct relevant information used in, or request review of an exclusively automated decision where applicable law provides that right; and
• raise a privacy concern or challenge our compliance.

Send a request to privacy@certilate.com. Describe the information or account involved and the request you are making. We may request information reasonably necessary to verify identity and authority. Do not send unnecessary identity documents by ordinary email.

We ordinarily respond within 30 days, subject to a lawful extension. Access may be limited by legal privilege, another person’s privacy, confidential commercial information, security concerns, legal restrictions or disproportionate cost where the law permits. If we refuse all or part of a request, we will explain the reason and available recourse, unless prohibited by law.

15. Privacy and Security Incidents

If CERTILATE becomes aware of a loss, unauthorized access, use or disclosure, or other breach of safeguards involving personal information, we will investigate, contain and document the incident, take reasonable corrective measures, and notify affected individuals and privacy regulators when required by applicable law.

If you believe personal information or an account has been compromised, contact privacy@certilate.com promptly and include only the details needed for us to identify and respond to the incident.

16. Children and Information About Minors

CERTILATE accounts and services are intended for people who have reached the age of legal capacity applicable to the transaction. The translation documents customers submit may nevertheless contain personal information about children or other minors, including birth, education, medical, immigration or family records. The person submitting that information must have authority to do so and should submit only what is necessary for the requested service.

17. Service and Promotional Communications

We may send transactional or service communications needed to administer an account or order, including payment, assignment, deadline, delivery, correction, complaint, security and legal notices. These messages are part of the requested service and are not promotional subscriptions.

Promotional communications are sent only in accordance with applicable law and, where required, separate consent. Each promotional electronic message will include the prescribed sender information and an unsubscribe mechanism. We will process an unsubscribe request within the period required by law. Unsubscribing from promotions does not stop necessary service communications.

18. Changes to This Policy

CERTILATE may update this Policy to reflect changes in law, technology, providers, business operations or privacy practices. The current version and effective date will be posted on the website. Where applicable law requires notice or consent for a material change, we will provide that notice or obtain that consent before the change applies to the affected information.

A change to this Policy does not authorize CERTILATE to use previously collected personal information for a new purpose without any notice or consent required by law.

19. Questions and Complaints

Contact the Privacy Officer first so CERTILATE can investigate and respond:

• Email: privacy@certilate.com
• Mail: Privacy Officer, CERTILATE INC., 6-2160 Highway 7, Suite 260, Vaughan, Ontario L4K 1W6, Canada

We will acknowledge and investigate privacy complaints and provide a response within a reasonable period. If you are not satisfied, you may have the right to complain to the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator, including the Commission d’accès à l’information du Québec, depending on the circumstances.