Privacy policy

Who we are

ustaff360.ca is operated by Ustaff360 Inc., 74 Alford Crescent, Toronto, Ontario M1B 4C2, Canada (registered corporate address). Ustaff360 Inc. is responsible for the personal information described in this policy.

Questions or requests about privacy go to hello@ustaff360.ca. This address reaches the person accountable for our compliance with Canadian privacy law.

This policy covers this website, its forms and our careers pages. It does not cover the systems of our clients: when our professionals work in a client’s tools, that client’s own policies and our written agreement with them apply.

Information we collect

When you contact us

Through the contact form: your name, email address, phone number (optional), company, how you prefer to be contacted, the role you are hiring for, team size, timing, hours and working time zone, and anything else you choose to tell us.

Through a care enquiry form: your name, phone number, email address, postal code, your relationship to the person needing support, the general topics you would like to discuss and your timing. We deliberately do not ask for medical details — please do not include them.

When you chat with us

Through the chat on our website: whether you are hiring or looking for a job, your name and email address if you give them, your messages, the pages of this website you visit while a chat is open, and any rating you give the chat. Details are in “Website chat” below.

When you book a call

When you book a video call with us: your name, email address, the time you chose and your time zone, and for a care consultation also your phone number. Details are in “Booking a call” below.

When you apply for a role or join our Talent Network

Your name and contact details, location and the countries you can work in, work arrangement preferences, work eligibility, experience, skills and tools, answers to role questions, your CV and any other documents you upload, and the consent you gave (including the version of this notice you agreed to).

If you email your CV to jobs@ustaff360.com or another of our recruiting addresses in response to a role, we add it to our recruitment system as an application: your name, email address, CV and the role you applied for.

If we invite you to a pre-screen: a short video or audio introduction you record, its written transcript, and your answers to our questions (for example your notice period, expected salary, remote work setup and availability for US Eastern business hours).

If we offer you a role, before you start: the joining documents we ask for, such as a resignation or experience letter, an identity document (CNIC or passport), a recent photograph, experience and education certificates, your bank account details for salary payments, and two references (their name, organisation, designation, phone number and email address). Please tell your referees that you have shared their details with us.

Automatically

• Technical information sent by your browser, such as IP address, browser type and the page you came from. Our servers use it to deliver the site, keep it secure and limit abuse. For contact enquiries the IP address is stored only as a one-way keyed code, not in readable form.
• The page address and any campaign tags (for example utm_source) of the visit in which you sent a form, so we know which page an enquiry came from.
• Bot-protection signals when you submit a form (see “Security checks on forms” below).

We do not use advertising cookies, and we do not currently use analytics. If we add analytics later, we will update this policy first.

How we use your information

• To reply to your enquiry, discuss your needs and provide the services you ask for.
• To review applications, contact candidates, arrange interviews and make recruitment decisions, including with the help of AI tools (see “Candidate privacy notice”).
• To prepare new team members for their start date, including payroll set-up and reference checks.
• To send emails you would expect, such as a confirmation that we received your application.
• To protect the website, our systems and our users against spam, fraud and abuse.
• To meet our legal obligations and to establish or defend legal claims.

We collect only what we need for these purposes and use it only for them, unless you agree otherwise or the law requires it. We do not sell personal information, and we do not use it for targeted advertising.

Our recruitment system never rejects anyone automatically. AI tools may summarise and score an application, but a person reviews every application and makes every decision.

Consent

Each form asks for your consent before you send it, and explains what it is for. You can withdraw your consent at any time by writing to us. Withdrawing consent does not affect what we did before, and we may not be able to continue with your enquiry or application without the information.

Who we share it with

Only people at Ustaff360 who need your information for the purposes above can see it. We share it outside Ustaff360 only as follows:

• Service providers that run parts of our service for us under contract and may use the information only to do so: our hosting provider (Contabo GmbH — our servers are located in the European Union), our business email provider, Cloudflare (bot checks on forms), and Anthropic (the Claude AI model that helps us review applications; see “Candidate privacy notice”). Speech-to-text for pre-screen recordings runs on our own servers, not with an outside provider.
• Clients, for candidates only: if you are being considered for a client engagement, we may share the relevant parts of your profile (such as your name, experience and CV) with that client.
• Authorities or others where the law requires it, or where needed to protect the rights, property or safety of Ustaff360, our users or others.
• A buyer or successor if Ustaff360 is involved in a merger, acquisition or sale of assets, under the same protections as this policy.

Where your information is stored

Our servers are located in the European Union. Members of our team and some of our service providers work from other countries, so your information may be accessed from outside Canada. When an application is reviewed with AI, the relevant information is processed by Anthropic in the United States. Wherever it is handled, we protect it as described in this policy, but it may be subject to the laws of the country where it is stored or accessed.

How long we keep it

• Website chats: deleted automatically 6 months after the last message in the chat, together with the name and email address you gave in it.
• Enquiries (contact and care enquiry forms): kept in our secure internal system for 12 months after our last activity on the enquiry, then deleted automatically. Our team is also notified by email. A temporary encrypted copy used only to deliver that email is deleted after 30 days.
• Bookings (video calls booked on our website): kept for 12 months after the last change to the booking, then deleted automatically. A copy of the appointment stays in our team’s own calendar as our record of the meeting.
• Candidates and Talent Network members: if we don’t take your application further, your information is deleted 3 months after your last activity (for example your last application or update). If you take part in our hiring process (for example, we move your application forward or interview you), we keep your information as a record of that process until you ask us to delete it. You can ask us to delete it at any time.
• Pre-screen recordings: the video or audio is deleted 30 days after you submit your pre-screen. The transcript and your written answers stay with your application and follow the candidate rule above.
• Joining documents: if you do not join us (for example the offer is withdrawn or declined), your joining documents, bank details and references are deleted 30 days later. If you join, we keep them as part of your employment record.
• Backups: deleted information may remain in our encrypted nightly backups for up to 14 days before those backups are overwritten.
• Security records (such as rate-limit counters and audit logs) are kept only as long as needed to protect the service.

We may keep information longer where the law requires it or to deal with a legal claim.

How we protect it

• All traffic to the website is encrypted (HTTPS).
• Enquiries waiting on the server are stored encrypted; connections to our database are encrypted.
• Uploaded documents and recordings are kept in private storage outside the website and are scanned for viruses; they cannot be opened until the scan has passed.
• Bank details and references are stored encrypted, and bank and ID numbers are masked; showing a full number is restricted to authorised staff and every view is logged.
• Staff access our recruitment system with individual accounts, role-based permissions and strong password hashing, and important actions are logged.
• Forms are protected against automated abuse with rate limits and bot checks.

No system is perfectly secure. If a breach of security creates a real risk of significant harm to you, we will notify you and the authorities as the law requires.

Your rights

You can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is inaccurate or incomplete;
• delete your information, or stop contacting you;
• withdraw a consent you gave.

Send your request to hello@ustaff360.ca. We may need to confirm your identity before acting on it. We respond within 30 days and do not charge for reasonable requests.

If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Security checks on forms

Our forms use Cloudflare Turnstile to tell people from automated bots. When a form loads, Turnstile may process technical signals from your browser (such as IP address and browser characteristics) to make that check. It is used only for security and is not used to track you for advertising.

Cookies and browser storage

We use no advertising or tracking cookies. When you open one of our enquiry forms, our server sets one strictly necessary security cookie that protects the form against forged submissions; it expires within 2 hours.

While you fill in the contact form, your answers are kept in your browser’s session storage so they are not lost if you close and reopen the form; they are removed when you close the browser tab.

When you send a message in the website chat, our server sets one strictly necessary cookie so you can continue the same conversation as you move between pages. It holds an encrypted reference to your chat (not your messages) and expires after 30 days.

Our staff sign-in area uses strictly necessary cookies to keep staff signed in securely.

Website chat

Our website chat is answered by members of our team — there is no automated assistant. The chat runs on our own chat system on our servers; your messages are not sent to an outside chat provider.

• We use your messages and any contact details you give to answer you and, if you are hiring, to follow up on your enquiry. If you are looking for a job, we may point you to our careers pages.
• If you are hiring, our team sees a short summary of your chat to help them prioritise it, based only on what you wrote and the pages you visited (for example, whether you mentioned a role we offer). It never makes decisions on its own.
• You do not have to give your name or email address to chat with us. If we are away, we ask for them so we can reply.
• Please do not share sensitive information, such as health details or passwords, in the chat.
• Chats are deleted 6 months after the last message. You can ask us to delete a chat sooner at hello@ustaff360.ca.

Access logs, location and cookies

Access logs and security monitoring

Our servers keep access logs for website operations, security monitoring, abuse prevention, troubleshooting and internal analytics. Depending on the request these can include your IP address, the time of the request, the requested page, the response status, browser (user-agent) information, the referring page, and campaign tags in the page address.

We use these logs to detect and investigate automated scanning, denial-of-service attempts and other abuse, and to understand how visitors use the site. We do not intentionally record form contents, passwords, cookies or form security tokens in them. Access logs are kept for up to 30 days, then deleted.

Approximate location from your IP address

We may derive approximate geographic and network information from your IP address using a location database held on our own server (such as MaxMind GeoLite2). This can include country, region, city, postal area, time zone and network provider. It is approximate, it may be wrong, and it is never used to find a street address or a household. If we use it, it is only to understand where visits and enquiries come from and to support security monitoring; your requests are not sent to an outside provider to look up your location.

We may also email short internal reports about site traffic to our team. These can contain visitor IP addresses and the approximate location derived from them, and are kept only as long as our team’s mailbox keeps them.

Cookies and similar technologies

This website sets no advertising or analytics cookies. We use only strictly necessary items:

• A session cookie named us360_form_session when you open a contact or care enquiry form. It is HttpOnly and SameSite=Strict, limited to the form’s address, expires on its own, and exists only to protect the form against forged requests.
• A short-lived form token and security (CSRF) token that the form fetches from our server and sends back when you submit. They store nothing about you.
• If you use the website chat, a cookie that keeps your conversation open while you browse (see “Website chat”).
• In our staff sign-in area, cookies that keep staff signed in securely.

How enquiries are protected

Enquiry details that wait to be emailed to our team are encrypted (AES-256-GCM, a unique initialisation vector for each enquiry) before they are written to storage, and the key is held only on our server. That temporary copy is used only to deliver the email and is deleted within 30 days. Forms also reject automated submissions, pause submissions made implausibly quickly, and are rate-limited.

Booking a call

When you book a call, we use your details to hold the time for you, to send you a confirmation, a reminder the day before and any changes, and to prepare for the conversation. The booking system, our team calendar and the video calls all run on our own servers — not on an outside booking or video provider.

• Your booking is added to the calendar of the team member who will speak with you. Visitors see only “Ustaff360 team”.
• The video call takes place in your browser through our own video service. We may record calls for quality and training purposes.
• The emails about your booking contain a private link that lets you reschedule or cancel. Please do not forward it.
• A care consultation asks only for the details needed to call you back. Please do not share medical details when booking.
• Bookings are deleted 12 months after the last change to them. You can ask us to delete yours sooner at hello@ustaff360.ca.

Children

This website is for businesses and job seekers. It is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has sent us information, please contact us and we will delete it.

Candidate privacy notice

This notice applies when you apply for a role or join our Talent Network. It sits alongside the rest of this policy.

• What we collect: the details and documents you give us in the application or Talent Network form (or by email to jobs@ustaff360.com), plus the notes, interview feedback and stage history our recruiters add while considering you. Later steps may add a pre-screen recording and answers and, if we offer you a role, your joining documents (see “Information we collect”).
• Why: to assess your application against the role, contact you about it and — if you joined the Talent Network — about future roles that match your interests.
• Who sees it: our recruiting team; if you are being considered for a client engagement, the relevant parts of your profile may be shared with that client.
• AI-assisted review: we may use AI tools to help us review your application. Your CV, application answers and, if you take part, your pre-screen answers and transcript are sent to Anthropic’s Claude AI model, which compares them with the role’s requirements and gives our recruiters a score, a short summary, quotes from your CV, points to clarify and suggested follow-up questions. Anthropic processes this information for us under its commercial terms and may not use it to train its models. Your joining documents, ID and bank details are never sent to an AI tool.
• Pre-screen recordings: if we invite you to a pre-screen, your recording is turned into a written transcript by speech-to-text software that runs on our own servers. Taking part is your choice; if you prefer not to record, tell us and we will arrange another way.
• Decisions: nobody is rejected automatically. AI results and screening questions only help our recruiters; a person reviews every application and makes every decision, and you can ask us to explain a decision or to have your application reviewed without AI.
• How long: if your application isn’t taken further, your profile, applications and documents are deleted 3 months after your last activity. If you take part in our hiring process, we keep them as a record of that process until you ask us to delete them — you can ask at any time. Pre-screen recordings are deleted 30 days after you submit them; joining documents 30 days after it is clear you will not join.
• Your choices: to correct your details, leave the Talent Network, withdraw an application or have your information deleted, write to hello@ustaff360.ca.

When you apply, we record the version of this notice you agreed to.

Changes to this policy

We will update this policy when our practices change. The date at the top shows when it was last updated. If a change significantly affects how we use information we already hold, we will ask for your consent where the law requires it.

Contact us

Ustaff360 Inc., 74 Alford Crescent, Toronto, Ontario M1B 4C2, Canada (registered corporate address). Email: hello@ustaff360.ca.