Privacy Policy

1. Introduction

Fiable Technologies (“we”, “us”, “our”) operates Trizelo, a cloud‑based workforce‑management SaaS platform. This Privacy Policy explains how we collect, use, disclose, store, protect, and retain personal data of our customers, their employees, and any other individuals (“you”, “your”) who interact with Trizelo. By using Trizelo you acknowledge that you have read, understood, and consent to the practices described herein.

2. Legal Framework

We rely on one or more of the following lawful bases (GDPR Art. 6):

• Contractual necessity – to deliver Trizelo and fulfill our service agreement with you.
• Legitimate interests – for security, fraud prevention, platform improvement (balanced against your rights).
• Consent – where we ask for explicit opt‑in (e.g., marketing communications, optional analytics).
• Legal obligation – to comply with statutory or regulatory duties (tax, labor, court orders).

3. Personal Data We Collect

4. How We Use Your Data

• Service Delivery – account creation, authentication, role‑based access control, scheduling, timesheet & payroll processing, reporting.
• Customer Support – respond to support tickets, troubleshoot issues, improve reliability.
• Security & Fraud Prevention – detect unauthorized access, maintain audit logs, enforce MFA, monitor anomalous activity.
• Legal & Regulatory Compliance – retain records for tax, labor‑law, audit requirements; respond to lawful requests.
• Product Improvement – aggregate, anonymized usage analytics to prioritize features and fix bugs (no personal identifiers).
• Communications – send transactional emails (password resets, alerts) and, where you have opted‑in, marketing or product‑update newsletters.

5. Data Sharing & Disclosure

We do not sell personal data to any third party.

6. International Data Transfers

Trizelo is hosted on cloud infrastructure located in Canada, the United States, and the European Union. When transferring personal data outside the European Economic Area (EEA) we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission, or
• Adequacy decisions (e.g., for transfers to Canada).

All transfers are recorded in our internal data‑flow register and protected by encryption in transit (TLS 1.2+).

7. Data Security

• Encryption at Rest – Sensitive columns (e.g., SSN, banking details) are encrypted using PostgreSQL `pgcrypto`.
• Encryption in Transit – All API and UI traffic uses TLS 1.2+ with strong cipher suites (`DB_SSLMODE=verify-full` in production).
• Access Controls – RBAC enforced via `config/permissions.php` and Laravel policies; least‑privilege principle applied.
• Audit Logging – Every create, update, or delete operation on personal data is recorded in the `audit_logs` table.
• Incident Response – 24/7 monitoring; security incidents are reported to affected individuals within 72 hours (GDPR Art. 33).

8. Data Retention

We perform periodic reviews and securely delete data that is no longer needed.

9. Your Rights

Depending on your jurisdiction, you may exercise the following rights:

We aim to respond to all lawful requests within 30 days (extendable to 90 days for complex cases as allowed by GDPR).

10. Cookies & Tracking Technologies

Manage preferences via your browser settings or the Privacy Settings page in Trizelo.

11. Children & Minors

Trizelo is not directed to children under 13 years of age. We do not knowingly collect personal data from minors. If you become aware that a minor has provided personal data, please contact us to have it removed.

12. Changes to This Privacy Policy

We may update this policy to reflect changes in law, technology, or business practices.

• Notification: Significant changes (affecting your rights) will be communicated via email and posted on the Privacy Policy page with a revised effective date.
• Version History: Each revision includes a short summary of changes.