Privacy Policy

Knightstone Student Communities Inc. ("KSC," "we," or "our") cares about your privacy. This policy explains what personal information we collect, how we use it, and your rights.

This policy applies to anyone interacting with our student housing or other KSC services. It covers information you provide to us online (such as on our website or app) and offline (for example, when filling out a form or calling us). If you visit our properties, we may collect information using key cards or security cameras.

If we change this policy, we'll update the effective date at the top and notify you if changes are significant (for example, by posting a notice online). Check this policy from time to time to see how we protect your information.

1. Introduction and Scope

This privacy policy explains what personal information KSC collects, how we use it, and your choices.

Who this policy covers:

Anyone using student housing or related services in Canada, including those applying, living, visiting, or using our websites—such as residence applicants, current and former residents, short-term accommodation guests, and residence visitors.

What "personal information" means:

Any details that can identify you, such as your name, email, phone number, or address.

How we collect information:

• Online: Using our websites, apps, or emails.
• In-person: Filling out paper forms, signing a lease, talking to staff, or using building entry cards.
• On-site: Security cameras in common areas record video. Entry cards record times and doors you use.

Consent:

By using KSC services or providing us with your information, you agree that we can collect and use it as explained here. You can ask us to stop using your personal information, unless the law tells us we must keep it. However, we sometimes can't stop using some of your personal information, if it prevents us from providing services we're legally required to provide.

Updates:

If we change this policy, we'll post the new date at the top. For major changes, we'll also notify you online or by email.

Questions or concerns?

You can contact us anytime if you want to know more or have concerns about your personal information.

2. What Personal Information We Collect

We collect personal information to provide our services and ensure the safety of our buildings. Here's what we might collect and why:

• Contact details: Your name, address, phone number, email, and sometimes identification numbers (like a driver's license or student card) to confirm who you are.
• Student and demographic information: School name, program, and year. Sometimes we ask about gender or language to match roommates or provide the right services. We don't ask for information like background unless necessary and only with your permission.
• Application and lease information: Answers you give on applications, your lease details (start and end dates, rent, accommodation), emergency contacts, and any guarantor (like a parent or guardian who signs with you).
• Financial information: Documentation confirming student status, records of rent payments, and relevant payment details (such as a bank account used for rent). Credit card information is not retained after payment processing is complete.
• Residency details: Notes about your stay, such as maintenance requests, roommate names, or if you take part in events. If you request a parking space, we collect car details.
• Short-term lodging data: For short stays, identification (such as government ID at check-in), contact info, and payment card.
• Health information: We may collect health-related information (such as medical conditions or accessibility needs) to promote your safety and accommodate your needs, and only if you choose to provide it.
• Security data: Entry card logs and security camera videos in common areas are used for building security.
• Online data: When you use our website or apps, we collect things like your device type and which pages you visit, using cookies (small files that help our website work).
• Communications: We keep records of calls, emails, or chats with us to help answer your questions and improve our service.

You don’t have to give all this information, but it may limit which services you can use. Sensitive data is collected only when needed, and with your clear permission.

3. How We Collect Information

We collect your personal information in a few ways:

• Directly from you: Most of your information comes straight from you. For example, when you fill out a housing application, sign a lease, or contact us for help, you provide your details. If you use our website, you might enter your information to create an account or get support. We’ll tell you what is required and what’s optional.
• Automatically: Some information is collected on its own. Building systems record when you use your entry card and when you use the common areas. Our website collects data using cookies.
• From others: Sometimes, we get your information from other sources. For example, if your school arranges housing with us, it may send us your name and school email. If you book a short stay through a partner or university, it sends us your booking info.
• Technology: If we use apps or smart devices, we’ll let you know what data is collected—like your phone’s location or device ID.

We collect information fairly and only for clear reasons. We don’t collect anything in secret. If you’re ever unsure why we need something, just ask us and we’ll explain.

4. How We Use Personal Information

KSC collects and uses your personal information to provide housing and related services, communicate with you, and meet legal requirements. Here’s how we use your data:

• Providing housing: We use your information to review applications, assign rooms, manage your stay, and handle rent or fees (like collecting payments and sending receipts).
• Helping you: If you contact us with questions or problems, we use your info to respond and improve our service. For example, if you request a repair, we use your details to arrange help.
• Safety and security: We use data like building entry records or cameras to keep everyone safe. If there’s an emergency, we may use your contact info to reach you or your emergency contact.
• Payments: We process payments and refunds using your financial info, like bank or credit card details, and keep these records as required by law.
• Important messages: We send you notices about rent, your lease, or maintenance, and facility matters. These aren’t marketing messages—you need to receive them if you’re a resident and you cannot opt out.
• Service improvements: We may look at trends or feedback to make our services better, often using data that can’t identify you directly.
• Marketing and events: If you agree, we may send info about new services or events. You can opt out anytime.
• Following the law: Sometimes we use your personal information to meet legal obligations, like sharing details for taxes or with authorities if required.
• Business needs: For things like internal reporting or if our company changes ownership, your info may be shared as needed, but it is always protected by our privacy rules.
• Other uses with consent: If we want to use your info for something new, we’ll ask for your permission first.

We use your data to support your housing experience and our responsibilities. We do not sell your personal information or use it for reasons unrelated to your stay. All important decisions affecting you involve a person, not just a computer. We don’t use AI to make important decisions about you, without human supervision.

5. Sharing of Personal Information

We do not sell your personal information. We only share it when necessary and always protect it. Here’s how sharing works:

• Service providers: We hire other companies to help us, like payment processors, IT firms, or companies that run background checks. For example, when you pay rent, your info goes to a payment company to process the payment. These companies only use your data to do their job for us and must keep it safe.
• Staff and contractors: Only people who need your information for their work can see it. For example, maintenance staff might get your name and unit number to fix something in your room, but not your payment details.
• Roommates: If you share a unit, we might give your name and contact info to your roommates so you can connect before moving in.
• Legal and safety: We share info if the law requires it (like a police request or tax law). In emergencies, we may give your details to first responders, like paramedics.
• Business changes: If our company is sold or changes ownership, your data may go to the new owner, but they must keep it safe like we do.
• With your consent: If you ask us to, for example to give a landlord reference, we share your info as you direct.

We only share with your guarantor the information needed for their responsibilities (like payment balances), unless you consent or the law requires otherwise.

Whenever we share your info, we try to give only what’s needed—nothing extra. We keep records of what we share when required by law. We require by contract any company that gets your info to protect it.

If you have questions or want to know more about how your information is shared, please ask us.

6. Data Storage and Security

We use several ways to protect your personal information.

• Physical security: Paper files (like signed forms) are kept in locked cabinets or rooms. Only staff who need these documents can access them.
• Tech security: Your information is stored on secure computers and servers. Sensitive details (like banking info and passwords) are encrypted, meaning they are turned into secret codes. When you send data online, it’s protected by special security (called SSL/TLS). Access to our systems requires a password, and sometimes an extra security step. We update our software often to fix any security issues.
• Staff access: Only staff who need your information for their jobs can see it. For example, leasing staff see your application, but maintenance workers only see what they need (like your name and unit number). All staff and contractors sign agreements to keep your data private.
• Third-party companies: If we use a service provider (like a payment processor), we choose companies with strong security. We only give them the information they need. If something goes wrong (such as a data breach), they must tell us right away.
• Data stored outside Canada: Some of your data might be stored in other countries, for example, by a cloud service. If so, your info might be seen by courts or police in those places. In such cases, we ensure it is protected to standards required by Canadian and Quebec law.
• Protecting devices: Company laptops and phones are password-protected and encrypted. Staff do not store your information on personal devices.
• Regular checks: We regularly test our security to find and fix any problems.

Even with our best efforts, no system is 100% safe. If you think your data with us is not secure, please contact us right away.

7. Retention and Disposal

KSC keeps your personal information only as long as needed to do our job or meet the law. Different information is kept for different durations, depending on what the law says and what we need for our work.

• Applicants and residents: We keep your information for 7 years after your application is closed or after you move out. After that, we delete your info.
• Short-term guests: If you stay for a short time, we keep your info for 7 years for billing or tax purposes, then delete it.
• Inquiries: If you only ask for information and do not become a customer, we delete your info after 1 year after last data entry into your file.
• Website data: We keep website logs and cookie data for a few months up to a year. Cookies are small files that remember your visit. You can remove these in your browser.
• Emails and calls: Important emails or calls are kept as long as your file is kept, then deleted. Unconnected emails are deleted regularly.
• Security cameras: Video is usually saved for up to 90 days, then erased unless needed longer for an incident.
• Backups: We make backup copies of data, which are deleted in regular cycles. Deleted info may stay in backups for a short time before it’s gone everywhere.

When it’s time to delete your info, we do so safely. Digital records are erased so they can’t be recovered. Paper records are shredded.

Some laws require us to keep certain data for a minimum time. If there is a legal case or money owed, we keep your info until it is resolved.

We do not keep your information forever. If you have questions, contact us. In some cases, you can ask us to erase your data.

8. Your Rights and Choices

You have several rights related to your personal information. Here’s what you need to know, in simple terms:

• See your information: You can ask to see what personal info we have about you. Write to our Privacy Officer (see Section 11). We will ask for ID to make sure it’s you. We usually reply within 30 days.
• Fix your information: If something is wrong or out of date (like your address), tell us and we’ll update it. You may also be able to update your info yourself in your online account.
• Withdraw consent: If you agreed to things like marketing emails, you can change your mind anytime. Use the “unsubscribe” link in emails or contact us to stop other uses. For some uses, like billing, we still need to keep sending emails.
• Delete your information: You can ask us to delete your info if we don’t need it anymore. Sometimes we must keep some info due to the law (for example, for taxes or legal reasons).
• Automated decisions: If a computer system makes a decision about you (for example, accepting or rejecting an application), you can ask us to explain how it works. Right now, people are still involved in important decisions.
• Cookies and tracking: You can control cookies in your browser. We only use essential cookies unless you agree to more.
• Directory sharing: If you do not want your name on any resident list, let us know. We will try to respect your wishes where possible.

If you want to use any of these rights, contact our Privacy Officer. We will not treat you differently for making a request, but sometimes deleting or restricting data may affect our ability to serve you (like if you are a resident and ask us to delete needed info). If you have concerns, you can also contact privacy regulators. We encourage you to talk to us first so we can help.

9. Breach Notification

In the event of a privacy breach involving personal information under our control, we will act promptly and in accordance with applicable privacy laws.

If we determine that the breach poses a real risk of significant harm (as defined under the Personal Information Protection and Electronic Documents Act (PIPEDA)) or a risk of serious injury (as defined under the Quebec’s Law 25), we will:

• notify the appropriate privacy regulator:
  • The Office of the Privacy Commissioner of Canada (OPC) for breaches affecting individuals outside Quebec.
  • The Commission d’accès à l’information (CAI) for breaches affecting individuals in Quebec;
• notify affected individuals as soon as feasible, providing sufficient information to understand the nature of the breach, the personal information involved, the potential consequences, and the steps they can take to mitigate harm;
• maintain a record of all privacy breaches, whether or not they meet the threshold for notification, in accordance with legal requirements.

KSC will also take immediate steps to contain the breach, investigate its cause, and implement corrective measures to prevent recurrence.

10. Special Provisions for Quebec Residents

(The following additional provisions apply to personal information collected from individuals residing in the province of Quebec, in compliance with Quebec’s Act respecting the protection of personal information in the private sector, including modifications from Law 25.)

If you live in Quebec, some extra privacy rules apply to your personal information. Here are the main points, explained simply:

• Privacy Officer: Quebec law says we must have a person in charge of privacy. Our Privacy Officer’s contact info is below.
• Consent for Minors: If you’re under 14, we need your parent’s or guardian’s permission to collect your info. If you’re 14 or older, you can usually give consent yourself. KSC mainly serves people over 17.
• Sensitive Information: Some info, like health records, are called “sensitive.” We’ll ask for clear permission before collecting this kind of info. For example, if you need accommodations for medical reasons, we’ll explain what we need and get your written consent.
• Automated Decisions: If a computer makes a decision about you (like accepting or rejecting an application), we’ll let you know. Right now, all major decisions have human review. If you have questions, ask us and we’ll explain how it works.
• Data Portability: You can ask for your info (that you gave to us) in a digital file (like CSV or JSON) so you can give it to someone else. This doesn't include notes we made ourselves.
• Right to Deletion: You can ask us to delete your info if we don’t need it anymore. If your info is public through us (like a post on a forum), you can ask us to remove it. If we need to keep it for legal reasons, we’ll let you know.
• Communication in French: You can get this policy and other documents in French. We’ll reply to you in French if you’d like.
• International Transfers: If your info leaves Quebec (for example, to servers outside the province), we check that it will still be well-protected. We make sure security steps are in place before moving any info.
• Complaints: If you aren’t happy with how we handled your privacy concern, you may contact Quebec’s privacy office (Commission d’accès à l’information).

If you have questions about these rules or want to exercise one of these rights, contact our Privacy Officer.

11. Contact Our Privacy Officer

Please direct any of the following to the Privacy Officer:

• questions about how KSC collects or uses your personal information;
• requests to access, correct, or delete your personal information;
• withdrawal of consent for a particular use of your information;
• concerns or complaints about privacy – if you believe your data has been misused or a privacy breach has occurred;
• requests for this Policy in an alternate format (e.g., French version).

When you contact us, please provide sufficient information to allow us to understand and respond to your request (for example, your name and the context of your interactions with KSC, and specific details of your inquiry).

We will acknowledge and investigate any complaint and respond within a reasonable timeframe. If a complaint is found to be justified, we will take appropriate measures to resolve the issue, including, if necessary, amending our policies and practices.

If after contacting us you feel we have not addressed your privacy concerns, you have the right to escalate the issue to the relevant privacy commissioner’s office:

• Office of the Privacy Commissioner of Canada (for PIPEDA-related matters outside Quebec):
  Website: https://www.priv.gc.ca
  Phone (toll-free): (800) 282-1376
  Address: 30 Victoria Street, Gatineau, QC, K1A 1H3, Canada.
• Commission d’accès à l’information du Québec (for Quebec law matters):
  Website: https://www.cai.gouv.qc.ca
  Phone: (888) 528-7741
  Address: 525, boul. René-Lévesque Est, bureau 2.36, Québec, QC, G1R 5S9, Canada.

These authorities can provide you with information about your privacy rights and assist in resolving concerns. We sincerely hope, however, to resolve any issues directly with you in a prompt and satisfactory manner.

12. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in how we handle your information or to follow the law. When we make big changes, we will update the date at the top and let you know, for example by posting a notice online or sending an email.

If you keep using KSC’s services after changes to the Policy, it means you accept the new terms. If you do not accept the changes, you can stop using our services or ask us to remove your information, as long as it follows any contracts or the law.

Check this page regularly to see if anything has changed. If you have questions, contact our Privacy Officer. We work hard to protect your personal information and your trust in us is important.