B2B / Data Processor Compliance

Data Processing Agreement

Last Updated: May 18, 2026 (Version 1.0)

Important Context for Union Locals

Under Canadian privacy laws (including PIPEDA), the Union Local acts as the Data Controller. You hold the direct relationship with union members and are responsible for obtaining appropriate consent to represent them.

Virtual Steward acts as the Data Processor (Service Provider). We only process member and inquiry data at your strict direction to provide and optimize the software platform. We never sell, share, or monetize member data.

1Scope of Processing

Virtual Steward provides an AI-powered helper, grievance tracking, and member communication tool for union representatives. In providing this service, stewards may upload personal member details, collective agreements, inquiry descriptions, and associated evidentiary files.

All processing activities are conducted solely to operate the dashboard, power case-specific RAG (Retrieval-Augmented Generation) query matching, and send notifications at the instruction of authorized stewards.

2Strict Data Compartmentalization & Localization

Strictly Local

Every Local's data is strictly compartmentalized. We do not aggregate query data or member lists across different Locals. Analytics, embeddings, and context indices remain strictly bound to your Local.

Canadian Safeguards

Your data is stored securely using enterprise-grade hosting with Row-Level Security (RLS) policies enforced database-wide, restricting file and query visibility to only authenticated and authorized representatives of your Local.

3Union Local (Controller) Obligations

As the Data Controller, the Union Local represents and warrants that:

You have collected, and will continue to collect, all member information in compliance with PIPEDA and any applicable provincial laws.
You have obtained necessary consents or hold appropriate legal authorization (e.g., representation cards, collective bargaining rights) to process member inquiries and files.
You will ensure only authorized representatives (stewards, dispatchers, admins) are provisioned access to the Virtual Steward dashboard.

4Data Removal & Deletion (End of Purpose)

PIPEDA mandates that personal data must be purged once its original operational purpose ends.

Steward Action: Authorized Local Admins and Lead Stewards have direct capabilities within the platform to permanently purge case files, chat timelines, and RAG embeddings.
Irreversible: When a steward triggers a deletion, the record is immediately purged from active search databases and cascading constraints cleanly erase all associated digital items.
Member Requests: Since members do not hold individual Virtual Steward accounts, any member requests for data deletion must be handled by the Local Steward, who can execute the purge within the admin dashboard.

5Contact & Privacy Inquiries

For any questions regarding this Data Processing Agreement, technical safeguards, or security posture, please reach out to our team at:

Email: privacy@virtualsteward.ca