Privacy Policy

Effective date: 2026-10-09

1. Who we are

WaiverNorth is operated by 846155 Yukon Inc., operating as North60 Consulting ("North60", "we", "us"), PO Box 11028, Whitehorse, YT Y1A 6L6. We are responsible for the personal information under our control and abide by the requirements of the Personal Information Protection and Electronic Documents Act ("PIPEDA") and other applicable privacy laws.

Our Privacy Officer, Tobias Barth, can be reached at privacy@north60consulting.com.

2. Two kinds of information

Information we control: information about visitors to waivernorth.com, people who contact us or join our waitlist, and the administrators and staff of our customers.

Information we handle for our customers: when a Guest signs a waiver with a tour operator, lodge or other business that uses WaiverNorth, that business decides what is collected and why, and is responsible for it. We store and process that information on the business's behalf and only on its instructions. Guests with questions or requests about their waiver should contact that business first. If a Guest contacts us, we will pass the request on and help the business respond.

3. What we collect

Website visitors: technical information such as IP address, browser type and pages visited, kept in server logs for security. We count page views on waivernorth.com with Vercel Web Analytics, which sets no cookie and does not identify visitors. We do not use advertising or tracking cookies. Our contact form uses Cloudflare Turnstile to block spam.

People who contact us or join the waitlist: name, email address, company and your message.

Customer administrators and staff: name, email address, role, sign-in and two-step verification details, and a record of actions taken in the console.

Billing contacts: company and billing details. Card payments are handled by our payment processor, and we do not store card numbers.

Guests, on behalf of our customers: the information the business's form asks for. This usually includes name, date of birth, email, phone, country and postal code, an optional emergency contact, a booking reference, and answers to the business's own questions, which may include health or safety information. It also includes the signature and initials, an optional photo, the date and time, IP address and device details, whether the email address was confirmed, marketing consent, and for minors the parent or guardian's details and signature.

4. How we use it

We make use of the collected data as follows:

• To provide the Service: publishing waivers, collecting signatures, creating the signed record and making it available to the business.

• To keep a reliable record: storing each signed waiver unchanged with a signing record (time, device, IP address and a document fingerprint).

• To send service emails: email confirmation and the signed copy to Guests, and notifications, sign-in links and invitations to customer staff.

• To secure the Service, prevent misuse and meet legal obligations.

• To reply to messages, provide support and handle billing.

• To send news about WaiverNorth, only to people who asked for it, with an unsubscribe link in every message, as required by Canada's anti-spam law.

We do not sell personal information. We do not use Guest information for our own marketing.

5. Consent

We collect and use personal information with consent, which may be express or implied depending on the situation. Guests give their information to the business through its form. You may withdraw consent for future use of your information, subject to legal and contractual limits. A signed waiver is a legal record and cannot be withdrawn once signed.

6. Where information is stored and who helps us

Signed waivers, signatures, photos and attachments are stored in Canada. We use the following service providers:

• Amazon Web Services: storage of signed waivers in Canada (Central), with a backup copy in Canada (West). Email delivery from Canada (Central).

• DigitalOcean: database, Toronto

• Vercel: hosting of the website and application. Application processing runs in Montréal. Pages are delivered through a global network.

• Cloudflare: domain name services, spam protection and email forwarding (global).

• Stripe: payments (Canada and United States)

Our providers may only use personal information to provide their service to us, under contracts that require them to protect it. Where a provider processes information outside Canada, it is subject to the laws of that country and may be accessed by its authorities.

7. How long we keep it

We keep collected information on the following basis:

• Signed waivers: for the retention period set by the business that collected them, which is 7 years after signing unless it chooses a different period, and longer while a record is needed for a claim. Claims can arise years after an activity, and for minors the time limit usually starts only when they come of age. Records are deleted within 90 days after the retention period ends.

• Customer accounts: while the account is active and for 2 years after it closes, except signed waivers as above. Trial accounts without a plan: deleted 30 days after the trial ends, including their waivers.

• Invoices and billing records: 6 years, as required by Canadian tax law.

• Messages from our contact form: 2 years.

• Waitlist: until launch or until you unsubscribe.

• Screenshots sent with support requests: 90 days.

• Security logs: 12 months.

• Email addresses that bounced or unsubscribed: kept so that we can continue to respect that choice.

8. How we protect it

We use encryption in transit and at rest, strict separation of each customer's data, two-step verification for administrators, write-protected storage for signed waivers, encryption of records waiting on kiosks, audit logs of access and changes, and limited staff access: our staff view Guest information only when needed for support, and each access is recorded. No system is perfectly secure, but we work to protect information in line with its sensitivity.

9. Breaches

If a breach of security safeguards affects personal information, we notify the affected business without undue delay. Where a breach creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as PIPEDA requires, or help the business to do so. We keep a record of every breach.

10. Your rights

You may ask to see the personal information we hold about you, ask us to correct it, and withdraw consent as described above. We respond within 30 days and may need to confirm your identity. Guests should contact the business they signed with first, and we will help it respond.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

11. Children

WaiverNorth is not directed at children. Information about minors is collected only through a business's waiver form, with a parent or guardian's signature where the business requires it.

12. Cookies

We use only cookies needed for the Service to work, such as keeping you signed in. We count page views on waivernorth.com with Vercel Web Analytics, which sets no cookie and does not identify visitors. We do not use advertising or tracking cookies.

13. Changes to this policy

We will post any update on this page with a new effective date, and notify customers by email of material changes.

14. Contact

Privacy Officer: Tobias Barth, 846155 Yukon Inc., operating as North60 Consulting, PO Box 11028, Whitehorse, YT Y1A 6L6. privacy@north60consulting.com