Privacy policy

Privacy summary

Getracked collects information used to operate, secure, support, and bill for its services. Basic server and security logs are created when a page is requested. If you start a live chat, the site stores the information and conversation needed to provide that chat. If you accept optional website analytics, the site also records first-party page visits, clicks, and meaningful mouse hovers so Getracked can understand and improve the website.

• What: contact and account details, service and support records, live-chat messages, billing records, website/security logs, and optional interaction analytics.
• Why: to answer requests, provide and secure services, administer accounts, bill customers, prevent abuse, and meet legal duties.
• Who: authorized Getracked personnel and service providers that need the information for those purposes, or other parties when required or permitted by law.
• Your choices: you can request access or correction, ask a privacy question, and withdraw consent where consent is the basis for processing and withdrawal is legally and contractually available.

For a field-by-field explanation of this website, see Data collection & cookies.

1. Scope and accountability

This policy applies to personal information under Getracked’s control in connection with this website, sales inquiries, customer accounts, hosted services, billing, and support. A service order or a specific product notice may provide additional details; if it conflicts with this policy, the more specific notice applies for that service to the extent permitted by law.

Getracked is responsible for personal information under its control, including information processed on its behalf by service providers. The person responsible for privacy compliance is:

Privacy Officer, Getracked
PO Box 68507 RPO Great Lakes, Brampton, ON L6R 0J8, Canada
Open the privacy contact form (subject: Privacy Request)
1-416-814-5537

2. Personal information we collect

Depending on how you interact with us, we may collect:

• Identity and contact information: name, business name, job title, mailing address, email address, and telephone number.
• Account and service information: customer identifiers, authorized contacts, selected services, service configuration, assigned resources, access and authentication records, and related instructions.
• Billing and transaction information: billing contact, invoices, payment status, transaction references, tax information, and records needed for accounting. Payment providers may collect payment-card or banking details directly.
• Communications and support records: emails, call details, tickets, troubleshooting information, and content you choose to provide.
• Live-chat information: your name, email address, messages, conversation status and times, message-read times, typing-activity timestamps, last page path, and HMAC-pseudonymized source-address and user-agent identifiers.
• Device, network, and security information: IP address, IP access rule and reason, rule expiry time, request time, requested URL, response status, browser or user-agent information, referrer, authentication and administrative activity, and security events.
• Optional website interaction information: a random visit identifier, encrypted source IP address, page path, referrer host, viewport size, selected theme, clicked or hovered element label, approximate position on the page, hover duration, and event time. Form values and typed text are excluded.
• Facility-access information, where applicable: identity verification, access authorization, entry and exit records, and security monitoring associated with colocation access.

We collect information directly from you, from a person you authorize, automatically from systems you use, and from service providers or public sources where permitted by law.

When you use the public contact form, you provide your name, email address, optional telephone number, selected department, subject, message, and consent confirmation. The form briefly processes the source IP address to enforce request limits, then records an HMAC-pseudonymized source identifier, timing, outcome, department, and a pseudonymized email identifier in its operational audit log. The message itself is not written to that audit log, although it is delivered to and retained in Getracked’s email system.

When you start live chat, you provide your name, email address, opening message, and consent confirmation. The application validates the address format and domain, checks the address against administrator-managed abuse-prevention lists, rate-limits the source and address, and stores the conversation so authorized administrators can respond. Message-read times support read receipts, and recent typing timestamps support typing indicators. The browser receives a random conversation credential; the server stores only its one-way hash.

When you accept optional analytics, the application records a random tab-session identifier, interaction information, and your source IP address. The IP address is encrypted at rest so an authorized administrator can review sessions and investigate traffic, and a separate one-way identifier supports counting. Declining optional analytics prevents these optional records from being sent.

3. Why we collect, use, and disclose information

We identify our purposes before or when information is collected. We use personal information to:

• respond to questions and prepare quotes or service orders;
• provide live chat and maintain conversation continuity between pages;
• create and administer customer accounts and verify authorized users;
• provision, operate, maintain, support, and secure services;
• route network traffic, investigate technical issues, and enforce the Acceptable Use Policy;
• issue invoices, process payments, collect amounts owing, and maintain accounting and tax records;
• detect, prevent, and respond to fraud, abuse, security threats, and legal violations;
• with consent, understand page use and interaction patterns to improve website navigation, content, and layout;
• communicate service notices, maintenance information, security alerts, and material policy changes;
• meet legal, regulatory, insurance, audit, dispute-resolution, and record-keeping obligations; and
• complete a proposed or completed business transaction as permitted by law.

We do not sell or rent personal information.

4. Consent and your choices

We obtain meaningful consent where required and explain material collections, uses, disclosures, and reasonably foreseeable consequences. Some processing is necessary to provide a requested service, protect systems, collect an amount owing, or comply with law and may not be optional.

Optional website analytics—including the source IP, session, page, click, and hover records described above—remain off unless you select Accept optional analytics. You can withdraw that choice using Privacy choices in the footer. Declining stores only the choice needed to keep optional analytics off.

Live chat starts only when you submit the chat form. It uses functional browser storage to keep your conversation available across pages and is not controlled by the optional-analytics choice. You can end the chat and clear its browser credential from the chat window. Authorized administrators can permanently delete an individual conversation or all retained chats from the protected admin panel. Contact the Privacy Officer to request access to or deletion of a server-side conversation, subject to lawful retention requirements.

You may withdraw consent to optional processing by contacting the Privacy Officer. Withdrawal does not affect processing already lawfully completed and may be limited by legal or contractual requirements. If withdrawal makes a service impossible to provide, we will explain the effect before acting on the request.

We send commercial electronic messages only where permitted by Canada’s anti-spam legislation. Marketing messages will identify the sender and include an unsubscribe method. Service, security, billing, and transactional messages may still be sent when needed to administer an existing relationship.

5. When we disclose information

We disclose only the information reasonably necessary for the purpose. Recipients may include:

• data-centre, network, cloud, domain, email, security, and technical-support providers;
• billing, payment, accounting, collection, insurance, and professional-adviser providers;
• a customer’s authorized representatives and suppliers involved in that customer’s service;
• law-enforcement, courts, regulators, emergency services, rights holders, or other persons when disclosure is required or permitted by law; and
• parties to a financing, reorganization, sale, merger, or transfer of all or part of the business, subject to applicable safeguards.

Service providers are expected to protect information and use it only for authorized purposes. Getracked remains accountable for personal information under its control.

6. Processing outside your province or Canada

Getracked is based in Ontario, Canada. Some service providers may process or store information in another province or country. Information in another jurisdiction may be subject to that jurisdiction’s laws and lawful access by courts, law-enforcement, or national-security authorities. Contact the Privacy Officer for information about current processing locations relevant to your service.

7. Retention and disposal

We retain personal information only as long as reasonably necessary for the identified purpose, an active or reasonably anticipated business relationship, security and abuse prevention, legal limitation periods, and tax, accounting, regulatory, or contractual requirements. Retention varies by record type and sensitivity.

The public contact form’s operational metadata logs are configured for a 30-day retention period, and its rate-limit timestamps expire after 24 hours. Live-chat records default to a 365-day retention period, adjustable by an administrator from 30 to 730 days. Injection-attempt records default to 90 days, adjustable from 30 to 365 days, and contain a one-way hash of the rejected value rather than the submitted text. Optional website analytics—including encrypted source IP addresses—default to a 90-day retention period, which an administrator can adjust from 7 to 365 days. IP block and allow-list entries remain until expiry or administrator removal; expired entries may be removed automatically after 30 days. Hosting or security access logs and delivered email messages follow the retention schedules applicable to those systems. When information is no longer required, we securely delete, destroy, or anonymize it, subject to backups and legal holds. Backup copies are isolated from ordinary use and expire under scheduled retention cycles.

8. Safeguards and privacy incidents

We use administrative, technical, and physical safeguards appropriate to the sensitivity, amount, format, and storage of information. Measures may include access controls, authentication, encryption in transit, encryption at rest for readable application IP records and SMTP credentials, one-way identifiers, logging, monitoring, backups, staff procedures, vendor controls, and secure disposal. Website forms use field allowlists, length and format validation, prepared database statements, output encoding, same-origin or CSRF checks, request limits, and high-confidence injection screening. The contact form also uses a signed time-limited token, hidden anti-bot field, privacy-minimized logging, and authenticated encrypted SMTP delivery. Live chat uses an unguessable browser credential whose one-way hash is stored on the server.

No method of storage or transmission is completely secure. If a breach of security safeguards occurs, we investigate, contain, document, and assess it. We notify affected individuals, regulators, and others when required by applicable law and take reasonable steps to reduce the risk of harm and recurrence.

9. Access, correction, and other rights

Subject to legal exceptions, you may ask whether we hold personal information about you, request access to it, request correction of inaccurate or incomplete information, and ask how it has been used or disclosed. We may need to verify your identity before responding.

Quebec residents may also have rights available under Quebec law, including rights concerning consent, portability, de-indexation, and cessation of dissemination where the statutory conditions are met. The Privacy Officer is the person in charge of the protection of personal information for requests relating to Quebec.

To make a request, contact the Privacy Officer in writing and describe the records or concern. We will respond within the period required by applicable law or explain any permitted extension or refusal.

10. Children

Getracked services are intended for organizations and adults who can enter contracts. We do not knowingly collect personal information from children through this public website. Contact the Privacy Officer if you believe a child has provided personal information.

11. Changes to this policy

We may update this policy to reflect changes in services, practices, or law. The current version and its effective date will remain available here. If a change creates a new material use or disclosure requiring consent, we will provide notice and obtain consent as required.

12. Questions and complaints

Send privacy questions, access or correction requests, and complaints to the Privacy Officer using the contact details in section 1. We investigate privacy complaints and explain the outcome.

If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada or, where applicable, a provincial privacy regulator such as Quebec’s Commission d’accès à l’information.