Privacy Policy

NorthPath Training ("NorthPath", "we", "us") protects the personal information of the people and businesses who use our online training platform. As a private organization in Yukon, we follow the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair information principles. When we deliver a program funded by the Government of Yukon, we also handle program information as our funding agreement requires, including the requirements that flow from the Yukon Access to Information and Protection of Privacy Act (ATIPP).

We collect only what we need for the purposes listed in this policy, we tell you those purposes before or when we collect the information, and we protect it with safeguards that match how sensitive it is.

Our Privacy Officer is responsible for our compliance with this policy:

Privacy Officer: Dr. Belissa Estaniza Cochachin Carrera

Email: privacy@northpathtraining.ca

Mail: 113 Mallard Way, #115, Whitehorse, YT Y1A 0J6, Canada

Phone: (867) 687-8227

• Participants: people who register for training, including participants in the Building UP program funded by the Government of Yukon.
• Employers: businesses and their account managers who use the employer hub.
• Employees invited by an employer to take a course.
• Visitors to our website and certificate verification page.

Account information

Name, email address, password (stored only as a secure hash), preferred language, and, for employer accounts, business name, contact person, phone number, and province or territory.

Building UP participant information

The Government of Yukon and the Government of Canada require service providers to collect the following information from every program participant:

• Social Insurance Number (SIN)
• First and last name, date of birth
• Physical address and mailing address (if different)
• Phone number and email address
• Employment status at the start of the service
• Highest level of education
• Preferred language of communication

You may also choose to tell us your gender, marital status, number of dependents, whether you have a disability, whether you are Indigenous, and whether you are an immigrant and your year of immigration. These questions are optional and each one includes "Prefer not to say".

At the end of your participation we ask for your end date and your employment status at that time.

Building UP employer information

Business type, number of employees, sector (four-digit NAICS code), confirmation that the business is not a government or government corporation, the underrepresented groups the business wants to reach, and the services we provide to the business.

Learning information

Courses you are enrolled in, lesson progress, activity and quiz answers, skills check results before and after a course, exam attempts and scores, certificates, and accommodation requests.

Identity verification and exam supervision (only for courses with a supervised exam)

Some courses have a supervised final exam. For those courses only, we collect a photo of a government-issued photo ID, a separate selfie, room-scan photos taken before the exam, still webcam photos and still screen captures taken at intervals during the exam, and a final webcam photo. We do not record continuous video or audio. Automated software may compare faces to help a human reviewer; the software never decides the outcome.

Technical information

IP address, browser and device type, login records, and security logs.

Messages to our assistants

If you use our course assistant (Tina) or accessibility assistant (Aquin), we process the messages you type so the assistant can answer. Please do not enter personal information in these messages.

• To create and manage your account and give you access to courses.
• To deliver training, track progress, and issue and verify certificates.
• To confirm your eligibility for a funded program and to enroll you in it.
• To report program results to the Government of Yukon, which shares them with the Government of Canada, as the program requires.
• To measure whether training helped (skills checks, employment status at the end, and follow-up questions).
• To verify identity and protect the integrity of supervised exams.
• To give employers the information they need to support their team's training.
• To send you service messages and, only if you agree, notices about new courses.
• To keep the platform secure, prevent fraud, and meet legal obligations.
• To produce statistics that do not identify you.

We ask for your express consent when you register. Building UP participants and employers give a separate, versioned consent to share their program information with the Government of Yukon and the Government of Canada. Notices about new courses are sent only if you opt in, and every notice includes a one-click unsubscribe link.

You can withdraw your consent at any time by writing to privacy@northpathtraining.ca, subject to legal and contractual limits. If you withdraw consent to program reporting, you may no longer be able to take part in a funded program, but information already reported cannot be recalled.

We do not sell personal information.

• Government of Yukon (Labour Market Development). We report participant and employer information quarterly, as the Building UP program requires. The Government of Yukon shares this information with the Government of Canada. Government monitoring officers may review program records.
• Your employer, only if your employer invited you to a course. Your employer can see your course status, results, and certificates. Your employer never sees your SIN or your Building UP registration answers.
• Organizations that referred you do not receive your personal information from us.
• Service providers that host or run parts of the platform for us, under agreements that limit their use of the information (see section 9).
• When the law requires or permits it, for example in response to a court order.

• We use your SIN only for program reporting to the Government of Yukon. It is never used as an account number or login.
• It is encrypted in our application (AES-256-GCM) before it is stored. Only the last three digits are shown on screen.
• Only two designated people can view a full SIN: our Privacy Officer and our technical lead. Every view is recorded in a log that cannot be edited.
• Program coordinators and employers cannot see SINs.

| What | Provider | Location |

|---|---|---|

| Database, files, ID and exam images | Supabase (on Amazon Web Services) | Montréal, Canada |

| Application servers | Vercel | Montréal, Canada (requests pass through Vercel's global network) |

| Face comparison for supervised exams | Amazon Rekognition | Montréal, Canada |

| Email delivery | Resend | United States |

| Messages to the course assistant (Tina) and the accessibility assistant (Aquin) | Google (Gemini) | United States |

| Course video delivery | Bunny.net | Global content network |

Information processed outside Canada is subject to the laws of that country and may be accessed by its authorities. We choose providers that commit to protecting the information they process for us.

• Building UP program records, including SIN: for the period our funding agreement with the Government of Yukon requires, then securely destroyed or returned as that agreement directs.
• Accounts, learning records, and certificates: while your account is active and for the validity of your certificate plus three years, so certificates can be verified.
• ID photos, selfies, room scans, webcam photos, and screen captures: deleted 90 days after the review decision, unless an appeal, investigation, or legal obligation requires us to keep them longer.
• Security logs and the SIN access log: as long as needed for security and to show compliance.

When information is no longer needed, we delete it or make it anonymous.

• Encryption in transit (TLS) and at rest.
• Application-level encryption for SINs.
• Role-based access: each person sees only what their role needs.
• Audit logs for sensitive actions.
• Database access rules that block direct access to program tables.

No system is completely secure. If a breach of security safeguards creates a real risk of significant harm, we will notify the people affected and the Office of the Privacy Commissioner of Canada as soon as feasible, notify the Government of Yukon as our agreement requires, and keep a record of every breach for at least 24 months.

You can ask to see the personal information we hold about you, ask us to correct it, withdraw consent, or make a complaint. Write to privacy@northpathtraining.ca. We respond within 30 days, unless the law allows an extension.

If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca). For information held by the Government of Yukon, you can contact the Yukon Information and Privacy Commissioner.

We use only the cookies needed to keep you signed in and to remember your settings. We do not use advertising cookies or third-party tracking.

Building UP participants must be at least 16 years old. Our platform is not intended for anyone under 16.

We will post any change on this page with a new version number and date. If a change affects how we use information you already gave us, we will ask for your consent again.