Privacy Policy

Covered Ltd.  ·  Effective June 19, 2026  ·  Last updated August 15, 2026

Covered Ltd. (“Covered”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal information we handle. This Privacy Policy describes how we collect, use, disclose, retain and protect personal information when you visit our website at coveredcanada.ca (the “Website”) or use the services we provide to our business clients (the “Services”).

Covered provides a hosted, cloud-based enterprise resource planning platform and related services for business and organizational clients. Depending on the modules and functionality selected by a client, the Services may include accounting, project management, staff scheduling and human-resources functionality, sales management, marketing and customer-relationship management tools, field-service portal functionality and optional payroll and corporate tax information modules. The Services may process business records and personal information contained in client data, including customer and contact information, employee and payroll records, financial and banking information, receipts, tax-related information, project and field-service records, documents, images and communications. We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and other applicable Canadian private-sector privacy laws, including substantially similar provincial privacy laws where they apply.

This Privacy Policy does not apply to third-party websites, platforms or services that we do not own or control, even if they are linked from our Website or connected to the Services.

1. Our role and accountability

Covered handles personal information in two different roles:

• For Website visitors, prospective clients, account holders and clients, Covered is generally responsible for deciding why and how personal information is collected, used and disclosed.
• For personal information about our clients’ customers that we process through the Services, Covered generally acts as a service provider to the applicable client. In that context, our client is responsible for the personal information and for providing any notices and obtaining any consents required from its customers. Covered processes that information only to provide the Services, on the client’s instructions and under our agreement with the client.
• For personal information contained in data, records, documents and other materials uploaded, imported or otherwise submitted to the Services by or on behalf of a client (“Customer Content”), Covered acts as a service provider to the applicable client. The client determines what Customer Content is submitted to the Services and remains responsible for that information, including providing any required notices and obtaining any required consents. Covered does not review or use Customer Content for its own independent purposes. Covered processes Customer Content only as technically necessary to host, store, secure, back up, transmit, display, return and delete that information, provide the functionality requested by the client, comply with applicable law and perform its obligations under its agreement with the client.

If you are a customer of one of our clients and have questions about information that client collected about you or used through the Services, please contact that business directly. We will support our clients in responding to privacy requests where required by our agreement with them and applicable law.

Covered has designated a Privacy Officer who is responsible for our privacy compliance program and privacy practices. You can contact the Privacy Officer using the contact details in Section 17 below.

2. What personal information means

In this Privacy Policy, “personal information” means information about an identifiable individual. It does not generally include business contact information, such as a person’s name, title, business address, business email address or business telephone number when used solely to communicate with that person in relation to their employment, business or profession.

3. Personal information we collect and use

We limit the personal information we collect to what is reasonably necessary for the purposes identified in this Privacy Policy or otherwise disclosed at or before the time of collection. The following table summarizes the main categories of personal information we collect and the purposes for which we use it.

Access to Customer Content by Covered personnel is restricted and is permitted only where reasonably necessary to provide support requested or authorized by the client, maintain or secure the Services, investigate an actual or suspected security incident, prevent unlawful or unauthorized activity, comply with applicable law or otherwise perform Covered’s contractual obligations. Covered personnel are not permitted to access Customer Content for unrelated purposes.

4. How we collect personal information

We collect personal information:

• directly from you when you contact us, request a demo, create an account, configure your settings, use the Services, communicate with us or otherwise provide information to us;
• automatically through cookies, analytics tools, log files and similar technologies when you use the Website or Services;
• from our clients, where they provide or make available information through the Services; and
• from third-party platforms and tools that a client chooses to connect to a Covered account, such as review, booking, calendar, customer communication, automation or content tools.

5. Consent and choices

We collect, use and disclose personal information with consent where required by law. Consent may be express, such as when you submit a form or agree to receive marketing communications, or implied, such as when you provide information to us for an obvious purpose. The form of consent we seek will depend on the sensitivity of the information and the reasonable expectations of the individual in the circumstances.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may affect our ability to provide the Website or Services, or certain features of them. To withdraw consent, contact us at privacy@coveredcanada.ca. You may unsubscribe from marketing emails using the unsubscribe link in those emails or by contacting us.

Where we process personal information as a service provider for a client, clients are responsible for ensuring that they have the authority to provide Covered with personal information concerning their employees, contractors, customers and other individuals and for providing any notices and obtaining any consents required for their use of the Services. This includes any notices or consents required for employee monitoring, time tracking, location-enabled features, communications, payroll administration or similar functionality.

6. Marketing communications and anti-spam compliance

Where permitted by applicable law, including Canada’s anti-spam legislation, we may send you electronic communications about Covered, our Services, events, updates or other information that may be of interest to you. We will include an unsubscribe mechanism in commercial electronic messages where required. Even if you opt out of marketing communications, we may continue to send transactional or service-related messages, such as account, security, billing or support communications.

7. Cookies and similar technologies

Cookies are small data files stored on your browser or device when you visit a website or use an online service. We use cookies, pixels, local storage and similar technologies to operate the Website and Services, remember preferences, analyze usage and support security and marketing activities.

We may use the following categories of cookies and similar technologies:

• Essential cookies, which are necessary for the Website or Services to function, including authentication, security, load balancing and session management.
• Performance and analytics cookies, which help us understand how visitors and users interact with the Website and Services, including through Google Analytics or similar tools.
• Functionality cookies, which remember preferences and enable enhanced features.
• Marketing or targeting technologies, which may help us measure campaigns or deliver more relevant business-to-business advertising, where permitted by law.

You can usually configure your browser to refuse or delete cookies. If you disable cookies, some parts of the Website or Services may not work as intended. To opt out of Google Analytics, you can use the Google Analytics Opt-out Browser Add-on.

8. How we share personal information

We do not sell personal information. We disclose personal information only as described in this Privacy Policy, with consent where required, or as otherwise permitted or required by law. We may disclose personal information to:

• service providers that support our business and the Services, including cloud hosting, data storage, security, payment processing, customer relationship management, email delivery, analytics, support, automation, content generation and other technology providers;
• our clients, where we process information as a service provider and make information available to the relevant client through the Services;
• third-party platforms a client chooses to connect to its Covered account, but only as needed to enable the requested integration or functionality;
• professional advisers, insurers, auditors and other parties involved in administering our business;
• law enforcement, regulators, courts or other parties where we believe disclosure is required or permitted by law, including to respond to legal requests, enforce our agreements, prevent fraud or protect the rights, safety or property of Covered, our clients, individuals or others; and
• another organization in connection with a proposed or completed business transaction, such as a merger, acquisition, financing, reorganization or sale of assets, subject to appropriate confidentiality protections.

We require service providers that process personal information on our behalf to use it only for the purposes of providing services to us or to our clients and to protect it using safeguards appropriate to the sensitivity of the information.

9. Service providers and processing outside of Canada

Covered is based in Canada. Some of our service providers may store, access or process personal information outside Canada, including in the United States and other jurisdictions. Personal information processed outside Canada may be subject to the laws of the jurisdiction where it is processed, including lawful access by courts, law enforcement or national security authorities.

Covered remains accountable for personal information under its control that is transferred to service providers for processing. We use contractual, organizational and technical safeguards designed to provide a comparable level of protection. Where required by applicable law, we assess privacy-related risks before transferring personal information outside Canada or outside a province.

If you have questions about our use of service providers outside Canada, please contact the Privacy Officer.

10. Safeguards

We use physical, organizational and technological safeguards appropriate to the sensitivity of the personal information we handle. These safeguards are designed to protect personal information against loss, theft and unauthorized access, use, disclosure, copying or modification. Safeguards may include access controls, authentication measures, encryption or secure transmission measures, logging and monitoring, contractual confidentiality obligations, personnel training and internal policies and procedures.

No method of transmission or storage is completely secure. We encourage users to use strong passwords, safeguard account credentials and notify us promptly of any suspected unauthorized access to their account.

11. Confidentiality incidents and privacy breaches

We maintain procedures for identifying, assessing and responding to actual or suspected confidentiality incidents or breaches of security safeguards involving personal information. Where required by applicable law, we will notify affected individuals, clients, regulators and/or other organizations of a breach or confidentiality incident, and we will keep records of breaches and incidents as required.

Where we process personal information as a service provider for a client, we will notify and cooperate with the client in accordance with our agreement and applicable law so the client can meet its own legal obligations.

12. Retention and disposal

We retain personal information only as long as reasonably necessary to fulfill the purposes for which it was collected, to provide and improve the Website and Services, to resolve disputes, to enforce agreements and to meet legal, accounting, tax, audit, security and reporting obligations. Retention periods vary depending on the nature of the information, the purposes for which it is used and applicable legal requirements.

When personal information is no longer required, we take reasonable steps to securely destroy, delete or anonymize it. For information processed on behalf of a client, retention may also be governed by our agreement with that client and the client’s instructions.

13. Access, correction and other privacy rights

Subject to limited exceptions under applicable law, you may request access to personal information we hold about you, ask how it has been used and disclosed, and request correction of information you believe is inaccurate or incomplete. Depending on the jurisdiction and the circumstances, you may also have additional rights, such as the right to withdraw consent or request that certain information be deleted, de-indexed or no longer disseminated.

To make a request, contact us at privacy@coveredcanada.ca. We may need to verify your identity before responding. We will respond within the timeframe required by applicable law, generally within 30 days under PIPEDA, unless an extension is permitted or required.

If you are a customer of one of our clients, please direct your request to that client. We will support the client in responding to your request where required by our agreement with the client and applicable law.

14. Automated decision making, profiling and sensitive information

The Services may use automated functionality to generate calculations, reports, summaries, analyses, recommendations, dashboards and other outputs based on Content and configuration choices supplied by a client or its Users. This may include payroll, accounting and tax-related calculations or summaries. Covered does not itself use personal information to make decisions that have legal or similarly significant effects on individuals without human involvement. Clients and Users are responsible for reviewing and verifying Outputs and for any decisions or actions taken using them.

Depending on the modules and functionality selected by a client, client Content may include sensitive personal information, such as employee and payroll records, financial and banking information, tax information and government-issued identifiers. Covered processes that information as a service provider under its agreement with the client and applies safeguards appropriate to the sensitivity of the information. Clients should provide sensitive personal information only where they have determined that doing so is lawful, necessary and appropriate.

15. Children’s privacy

The Website and Services are intended for business and organizational use and are not directed to children. Covered does not knowingly collect personal information directly from children for its own purposes. The Services may process information concerning minors where that information is included in Content provided by a client, in which case the client is responsible for having the necessary authority and consent. Requests concerning that information should be directed to the applicable client.

16. Third-party links and integrations

The Website and Services may link to or integrate with third-party websites, platforms and services, such as review platforms, booking systems, calendar tools, payment processors, analytics providers or other business tools. Those third parties are responsible for their own privacy practices. We encourage you to review their privacy notices and settings. Covered is not responsible for the privacy practices of third parties that we do not own or control.

17. How to contact us or make a complaint

If you have questions, concerns or complaints about this Privacy Policy or Covered’s privacy practices, or if you wish to exercise a privacy right, please contact:

Privacy Officer
Covered Ltd.
1 Hunter St E
Hamilton, ON L8N 3W1
Canada
Email: privacy@coveredcanada.ca

We will acknowledge and investigate privacy complaints. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.

Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
Website: priv.gc.ca

18. Changes to this privacy policy

We may update this Privacy Policy from time to time. When we make changes, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Website or Services after an update means you accept the updated Privacy Policy, subject to applicable law.