Privacy Policy

Last updated: August 10, 2026

Who we are

Quality Screening Reports is the screening division of Quality Credit Reporting and provides background screening to North American organizations. References in this policy to Quality Credit Reporting, QCR, Quality Screening Reports, QSR, “we,” “us,” or “our” refer to Quality Credit Services Limited. Our head office is at 210-80F Centurian Drive, Markham, Ontario L3R 8C1.

We use an investigative approach to find useful, credible, and current information for reports requested by our customers. This policy summarizes the measures we take to comply with applicable privacy law. If you need more detail about a particular practice, contact our Privacy Officer using the information below.

How personal information relates to our business

We collect personal information in two main contexts:

• Serving our customers. When a customer asks us to prepare a report, we collect information about the person who is the subject of that report on the customer’s behalf. The customer’s own privacy notice governs the customer’s collection, use, and disclosure of that information.
• Operating our business. We collect information for our own use when someone visits our website, contacts us, subscribes to communications, retains us, applies for employment, or exercises a privacy right.

Who this policy covers

This policy applies to the personal information of:

• Individuals who are the subject of a screening, credit, verification, or investigative report;
• Customer organizations and their authorized users of our services and platform;
• Website visitors, contacts, and subscribers; and
• Job applicants and other people who interact with our business.

The laws we follow

We handle personal information in accordance with applicable Canadian federal and provincial privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws such as Alberta’s and British Columbia’s Personal Information Protection Acts and Quebec’s private-sector privacy law. As a consumer reporting agency, we also comply with provincial consumer reporting legislation, which governs permissible purposes, what a report may contain, how long adverse information may be reported, and who may receive a report. Where a check involves United States sources, we handle that information in accordance with applicable law.

Serving our customers

Why customers request reports

Our customers are businesses that need reports for legitimate business purposes. These purposes can include evaluating the credit worthiness or suitability of a business partner, client, franchisee, tenant, or prospective employee, and investigating or recovering a debt. Customers may include franchisors, landlords, employers, creditors, and agents acting for creditors.

Lawful purpose and consent

Before collecting information for a customer, our employees assess the stated purpose to confirm that there is a legitimate reason for the report and determine what consent the law requires. The customer is responsible for giving the person any notice required by law and for establishing a lawful purpose. Where consent is required, it is usually obtained as part of an application for employment, tenancy, franchising, credit, or another business relationship, and we keep evidence of that consent on file.

Every Quality Screening Reports background screening order requires the person’s signed consent before a search begins. Consent is tied to the checks on that order, not treated as a blanket authorization. Sensitive checks, including criminal record and credit file checks, require express consent to the specific check. Our Screening Consent & Authorization page explains this process.

In other QCR matters, consent may not be required where applicable law permits or requires collection without consent, including to investigate potential fraud, a suspected violation of law, or a breach of an agreement, to recover a debt, or to comply with a legal requirement.

What we collect for reports

We collect only the information reasonably needed for the report a customer has requested. We may verify information the person gave the customer and, depending on the authorized report, collect:

• Identity details, including legal name, date of birth, address history, and government-issued identification;
• Signed consent and authorization records;
• Criminal record and court information;
• Current and former employment and education history;
• Professional credentials and licences;
• Reference information;
• Credit file information, where specifically authorized and relevant to the lawful purpose;
• Driving records, where specifically authorized; and
• Other information relevant to the ordered report or the business relationship under review.

Sources may include the person, our customer, credit bureaus, current and former employers, educational institutions, references, banks and other creditors, courts, licensing and professional bodies, and public or government databases. Government sources may include corporate databases, land titles registries, Sheriff’s abstracts, Office of the Superintendent of Bankruptcy records, personal property security registries, and driver’s abstracts from a provincial ministry of transportation.

How report information is used and disclosed

Information collected for a report is used only to prepare that report for the customer. We do not use personal report or screening information for marketing, and we do not sell personal information. Every QSR report is reviewed by a trained screening specialist before release. We may disclose limited information to a third party when reasonably necessary to obtain or verify a source response. For example, we may need to provide relevant details from an application to a bank, employer, institution, or other source so that source can confirm the information. We limit that disclosure to what the verification requires.

We provide the completed report only to the customer that requested it, unless the person’s consent authorizes delivery to another party or the law otherwise permits or requires disclosure. A report may reveal information the person did not disclose to the customer and may be used by the customer to make a decision about credit, employment, tenancy, franchising, or another business relationship. A credit file inquiry obtained for employment screening does not include a credit score and does not affect the person’s credit score. Other QCR credit reports would not normally affect a credit score with a credit bureau.

What never appears in a QSR report

Consumer reporting law limits what a background screening report may contain, and we apply those limits to every QSR report:

• Old adverse information is excluded. Adverse information older than the limits set by provincial consumer reporting law is not reported, generally seven years and six years in British Columbia.
• Pardoned convictions are never reported. A conviction for which a pardon or record suspension has been granted does not appear in a report.
• Charges without a conviction are not reported. Criminal charges that did not result in a conviction, and other non-conviction information, are not part of standard checks.
• Vulnerable sector checks are not run by us. A vulnerable sector check can only be processed through the applicant’s local police service. We do not run these checks directly.

Operating our business

When and why we collect information

We collect information when someone subscribes to a newsletter or other communication, submits a website form, makes an inquiry, retains us, uses our website, products, or services, applies for employment, or exercises a right described below. If a person has submitted a form or subscribed to a communication, we may be able to recognize that person during later website visits.

We use business and website information to:

• Identify and communicate with potential customers;
• Respond to requests and provide contracted services;
• Verify identity and secure our website, products, and services;
• Monitor how our website, products, and services are used and learn what we can improve;
• Develop new or improved products and services;
• Measure marketing and, where used, show advertisements on other websites or social media based on prior interactions with us;
• Detect, investigate, and prevent fraud, security incidents, and improper use;
• Investigate and resolve complaints; and
• Enforce our rights and comply with applicable law.

We aim to communicate only with people who want to hear from us or for whom our communications are relevant. People can use the preference or unsubscribe controls in a communication. If unwanted communications or advertisements continue after preferences are changed, contact us so we can investigate.

Consent for business operations

We generally rely on implied consent when a person initiates contact and provides contact information, or navigates a website on which this policy is posted. We ask for express consent before collecting sensitive information for our own business purposes. We may collect, use, or disclose information without consent where the law requires or permits it, including to investigate a suspected breach of an agreement or violation of law, detect or prevent fraud, or collect a debt.

Business, contact, and employment information

We collect contact information needed to communicate and conduct business. From customer organizations we also collect business details, account credentials, service requests, orders, and payment records. If we are doing business with a person or considering an employment application, we may need additional information such as a date of birth, current and former addresses, current and former employers, and other information relevant to that relationship.

Cookies, analytics, and online advertising

We and service providers acting for us may collect an IP address, browser and device type, approximate location, pages and areas visited, links or buttons selected, time spent on a page, referring website, form activity, scroll depth, and other online activity information. Providers may use identifiers to recognize prior website visits or interactions with online advertisements, match a person to a contact or social media profile, and add relevant website activity to our contact record for the business purposes described above.

Providers used for website inquiries, analytics, and marketing may include HubSpot, Google, and LinkedIn. The current public website uses Google Analytics to understand how visitors find and use it. Our Google Analytics events do not include public form contents, screening records, order information, or activity in the secure portal, and we do not use this Google Analytics implementation for advertising personalization. Other QCR marketing activities may use providers such as LinkedIn to measure interactions with advertising or deliver interest-based advertising.

The secure portal and our identity provider use the authentication and security cookies needed to provide the service. Website and advertising choices are explained under Website and advertising choices.

How business information is shared

We limit use of personal information to the purposes for which it was collected. We generally disclose information only with consent, to service providers supporting our operations, or as otherwise permitted or required by law. Our service providers are subject to contractual confidentiality, privacy, and security obligations appropriate to the service they provide. Service providers may be located in Canada, the United States, or elsewhere. We assess the privacy and security risks of using them, but information they hold may be subject to different laws and to lawful access by governments, law enforcement, courts, or regulators in those jurisdictions.

Platform providers include Clerk for identity, authentication, and session security; Resend for transactional account and order notices; HubSpot for website inquiries and lead management; Google for public website analytics; Stripe for hosted card checkout and payment events; and providers used for North American hosting, DNS, TLS, delivery, and operational monitoring. Stripe receives payment amount, currency, and opaque order and payment references, not candidate documents or report contents.

We may also disclose information when reasonably necessary to enforce our rights or terms, protect the proper use of our website, products, or services, collect a debt, detect or investigate fraud, respond to lawful requests from authorities with jurisdiction, or comply with law. Information may be disclosed as part of a proposed or completed business transaction such as a financing, merger, or sale of all or part of the business, subject to applicable legal safeguards.

Safeguards

We use physical, technical, and organizational controls to protect personal information against loss, unauthorized access, unauthorized use, and unauthorized disclosure. For security reasons, we do not publish every safeguard. Our controls include:

• Physical controls that monitor and limit access to our premises and secure storage areas;
• Secure destruction of paper and electronic media;
• Policies and procedures governing transmission of personal information by email, fax, and other means;
• Encrypted website connections when sensitive information is transmitted;
• Encryption of sensitive documents at rest, role-based access, and report audit trails; and
• Need-to-know access limits for employees and service providers.

Screening data is hosted within North America. Depending on where a person lives and which sources or providers are involved, some information may be processed outside the person’s province or Canada and be subject to the laws of that jurisdiction. Our Security Practices page describes our controls in more detail.

How long we keep information

We retain personal information only as long as needed for the purpose for which it was collected and to meet legal, regulatory, audit, dispute, and recordkeeping obligations, after which it is securely destroyed. Completed reports and consent records are retained for up to seven years following report delivery, or longer where law requires. Identification and supporting evidence are normally deleted after 90 days unless an active dispute, investigation, or legal hold requires longer retention. Withdrawing consent does not require us to destroy information that the law requires us to retain or that our documented retention practices require for legitimate recordkeeping or protection from legal claims. Our Data Retention Policy explains the applicable periods and secure disposal process.

Exercising your rights

Report information can be sensitive. Before releasing it, we ask questions and may request documents to confirm the requester’s identity. In some cases, we may ask the person to visit us in person to prove identity. A person may also arrange to visit us in person to review information we have collected about them.

A written rights request should include the requester’s name, address, a telephone number where we can call during business hours, and, if known, the name of the business that asked us to prepare a report. Send the request to the Privacy Officer using the contact information below.

Access to information

A person may request access to personal information we hold about them. Access is provided subject to any limited exception allowed by law and after we verify identity. There is no fee to request access to a QSR screening report. We respond to access requests within 30 days, unless the law permits an extension.

Disputing accuracy

A person may challenge information they believe is inaccurate or incomplete and provide the correct information. We investigate the issue at no cost. If our record was inaccurate, we correct it and notify anyone to whom we provided the report, as required by law. If the disputed information came from another reporting agency, such as Equifax or TransUnion, we identify that source and direct the person to that agency’s dispute process. Our Disputes & Corrections page explains our process and timelines.

Withdrawing consent

A person may withdraw consent to continued collection, use, or disclosure of personal information, subject to legal or contractual restrictions and reasonable notice. For consent originally obtained by a QCR customer, including consent for a report, the person should contact that customer. For a QSR screening order, the person may also contact us so any work still in progress can be stopped and the requesting organization can be informed. Withdrawal does not undo a disclosure already lawfully made or override applicable retention obligations.

Website and advertising choices

A visitor can limit website-use data by blocking or deleting cookies in their browser. Interest-based advertising choices are also available through the Network Advertising Initiative and AdChoices in Canada. Opting out of interest-based advertising does not necessarily stop all advertising. It means participating companies should no longer personalize those ads using the opted-out website activity. A visitor may still see contextual or non-personalized advertisements.

Complaints

Our Privacy Officer is accountable for compliance with applicable privacy law. A person who believes we have not met our legal obligations or followed this policy may make a complaint. The Privacy Officer will investigate whether it is well-founded and whether corrective action is required. If the person is not satisfied with our response, they may contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy commissioner.

Children and minors

Our services are not directed to children, and the current QSR portal rejects screening orders for individuals under 18. We do not knowingly collect information online directly from children under 13.

Contacting us

To ask a privacy question, make an access or correction request, withdraw consent, or make a complaint, email order@qcsl.com with “Attention: Privacy Officer” in the subject, call our Markham office at (905) 470-4200, call toll free at (800) 655-9564, or write to:

Changes to this policy

We review this policy regularly and update it when our practices or legal obligations change. The date at the top reflects the most recent revision.