Privacy

• Contact and booking forms. Your name, organization, work email, and whatever you choose to write. Bookings run through Microsoft Bookings and collect your name, work email and meeting time.
• The Governance Self-Check. The check itself runs entirely in your browser and sends us nothing. If you ask for a copy of your result by email, we receive your email address and that result, and nothing else.
• The mailing list. Your email address, and your name if you give it. You joined by asking us to send you something — the Booth 73 summary, the handbook, or both.
• Service requests and Working Session intake. If you send us a request or book a Working Session, the form asks for your name, title, organization, work email and phone, and a few details about your organization and what you need. We use them only to respond to you and, if we work together, to plan and deliver the work. We never ask for your staff’s names or email addresses: for a Working Session, you tell us how many people are taking part, and we send you that many private access codes to hand out.
• Prize draw entries. If you entered a CivicShift draw, we hold the entry and the contact details needed to notify a winner.
• Standard technical information. Our website host records ordinary server information — IP address, browser type, pages visited — in the way almost every website does.

The quiz records the answer and nothing that identifies who gave it — no name, no employer, no email. If you also gave us your email address at the booth, it is written as a separate record and we do not join the two. When we publish the results, they are published as counts, and no answer is traced to a person or an organization.

Both records are held in a Google Firebase database in the United States, which is named under who else is involved. One honest limit: because both are written as they happen, the order in which they were written is visible to us. We do not use it to connect an answer to a person, and nothing we publish is derived from it — but we would rather say that than claim a separation the technology does not give us.

This site uses cookies that are necessary to operate it and to make its forms work. We do not run advertising on this site and we do not use your browsing here to target you anywhere else.

The website itself, its forms, the entries those forms collect, and its ordinary server logs are hosted by GoDaddy, outside Canada. Each form entry is also sent to us, and everything that reaches us — your message, your details, and any correspondence that follows — is held in CivicShift's Microsoft 365 environment in the Canada region, and so are bookings. The mailing list is held by MailerLite, in the European Union — if you have joined the list, your email address is there as well as with us.

We keep enquiry and Self-Check information while there is a live reason to — an open conversation, or a follow-up you asked for — and remove it when there is not. Request and Working Session intake entries on the website are deleted automatically two years after you send them. Draw entries are kept until the draw is complete and the winner has claimed, and then for as long as we need them to show the draw was run properly. You stay on the mailing list until you leave it.

Anything beyond these four categories requires a signed amendment to the agreement. We do not quietly widen the list.

Findings trace back to evidence, not to a model. Our method requires three or more distinct interview sources plus at least one document-sourced item before a finding is treated as supported, and findings are classified as confirmed, gap, or unverified perception.

If you are an employee being interviewed or surveyed, this is the part written for you.

• We are never given your name, and never your email address. Your organization gives us headcounts by role, level and work area — how many people, in which positions — and nothing about who those people are. Our own tooling refuses to load a list containing people, so this is enforced in software rather than left to good intentions.
• Your employer gives you your key, not us. We generate unique one-time keys against those headcounts. Your employer assigns them at random to people within each role, hands them out, and keeps that assignment list on its own side. Nothing about who received which key ever comes back to us.
• No response is attributed to an individual in any deliverable. Ever. Not in the report, not in a dashboard, not in a debrief.
• Your employer cannot ask us for attributed responses. Our agreements do not permit us to provide them, and your employer cannot waive that on your behalf. Neither can we — we could not produce them if we wanted to.
• Results are reported by group. Any group where fewer than five people answered is withheld from the report entirely, and the report records that it was withheld.
• We can see how many keys in a role group have been used. We cannot see who used them. That count is what tells us the sample is full. Your answer is written carrying your role, your level and your work area — never your name, never your email address, and never a code derived from either. The link between you and your answers is not deleted afterwards; it is never created.
• What you write in your own words is the one thing we cannot anonymise for you. If you name your shift, your department or your supervisor in a comment, those words are yours and we cannot unsay them. We read comments and report them as themes, never quote them in a way that identifies you or anyone you name, and destroy them ninety days after delivery.

If your organization booked an AI & Modernization Working Session, you may be asked to answer a short questionnaire beforehand. Codes are not linked to names, CivicShift never receives names or email addresses, and no one at your organization sees individual answers. Only combined results are shared.

• Your code only confirms you were invited. Your sponsor receives a set of one-time codes, one per person, and hands them out. We never learn who received which code. When you submit, the code is marked used and is not stored with your answers.
• We do not record your name, IP address or device. The questionnaire runs on our website, hosted by GoDaddy outside Canada, rather than in our Microsoft environment, and it is set up so none of those details are kept with your answers.
• Individual answers are deleted automatically within four months. Where we can, we delete a session’s answers sooner: ninety days after its follow-up report. Only combined results are kept for the report.
• What you write in your own words is yours. As with any survey, if you name a person or a department in a comment, those words stay as written. We report comments as themes, never in a way that identifies you or anyone you name.

If you voted from your phone during a CivicShift session, that vote is anonymous. We collect no contact details through it and we do not use anything from a live session for any purpose other than that session.

Assessment engagements run in CivicShift's own governed Microsoft environment — Microsoft 365 and Microsoft Dataverse, provisioned in the Canada region, in Microsoft-operated Canadian data centres. Nothing is installed in your environment and nothing of yours is licensed to us.

Access is limited to Troy Palmer, on CivicShift devices with full-disk encryption, current security updates and multi-factor authentication on every account that touches client information. CivicShift has no employees, contractors or subcontractors.

• Microsoft — hosting and productivity services, Canada region. This is where everything from an engagement lives.
• GoDaddy — this website and our domain. Hosting is outside Canada. It holds what the site's own forms collect, including the anonymous Working Session questionnaire, and nothing from an assessment engagement.
• MailerLite — our mailing list. Subscriber data is stored in the European Union, in data centres certified to ISO/IEC 27001. They hold your email address and nothing else about you.
• Anthropic — AI drafting tools used in CivicShift's own business. No engagement material and no personal information reaches it. Processing outside Canada.
• Google — the Firebase database behind our trade show quiz and our live session polling. Storage and processing occur in the United States. Nothing from an assessment engagement ever reaches it — client material stays in the Canadian-region Microsoft environment described above.

Only the first of those five touches engagement material. The other four exist for the website, the mailing list, our own drafting, and the trade show. If we add another, we tell clients in writing at least thirty days beforehand, and a client who objects on reasonable grounds can end the affected engagement without penalty.

If a court, regulator, law enforcement agency or government authority — in Canada or anywhere else — demands information we hold for you, we tell you promptly, and before we disclose anything, unless the law forbids us from telling you. We disclose only what is legally required, and where we lawfully can, we give you the chance to object or to seek a protective order first. If we are barred from telling you, we record the demand and tell you as soon as that bar lifts.

We raise this because four of our five service providers process outside Canada, and because it is a fair question to ask any vendor that does. The one that holds your engagement material — Microsoft, in the Canada region — is not among them.

Three things sit outside that. We keep the final report and design documentation as delivered, together with the signed agreement and invoicing records, for as long as our professional and insurance obligations require. We keep the question set exactly as it was put to your people, and the scored results with small groups already withheld — so that a score can still be explained years later, and so a repeat review can be compared with this one rather than guessed against it. Neither holds a name, an email address or anything an individual wrote; the written comments themselves are destroyed with everything else at ninety days. And a legal hold, a regulator's demand or an unresolved incident pauses destruction until it is dealt with.

We are also straight with you about the limit of "destroyed". We delete from live systems and stop using it. We cannot selectively erase data from the platform backups Microsoft maintains, which are overwritten in the ordinary course, and we will not pretend otherwise.

If we become aware of an incident affecting your information, we tell you without unreasonable delay and in any event within 24 hours, with a fuller written account as the facts are confirmed. We preserve records, stop any scheduled destruction, and cooperate with your assessment and with any notification you decide to make. You are the notifier to regulators and to affected individuals. We support you; we do not speak for you.

CivicShift uses AI tools the way any modern firm does: drafting its own templates, marketing material, and generic text that contains no client information. That is the whole list. Performing an assessment — reading your evidence, scoring your answers, writing your findings — is done by a person, on the CivicShift Assessment Platform, without AI.

The tools we use run on a paid plan held by CivicShift, with model training switched off — terms we verify rather than assume, and if they change, this page changes.

The assessment environment runs on Microsoft's Canadian-region cloud, and Microsoft builds AI features into that platform — Copilot, AI Builder. In the environment where engagements run, those features are kept disabled. The commitment above holds at the platform level, not just at the keyboard.

The engagement framework contains a dormant mechanism — a separately signed acknowledgement — under which a narrowly defined, client-approved AI use could someday be agreed. No CivicShift service offered today uses it. It exists so that if that day comes, the decision is yours, in writing, in advance — not a policy update you find out about later.

• The record we keep of an engagement is designed to support your own record-keeping and reporting obligations.
• If you receive an access request touching information we hold, we help you respond — promptly, and at no charge.
• You remain the public body. We do not respond to regulators on your behalf, and nothing in our agreement transfers a statutory obligation of yours to us.

Under the Protection of Privacy Act, a contracted service provider is treated as an employee of the public body for privacy purposes. In plain terms: when we work for you, we are inside your privacy obligations rather than outside them. We are bound by the same rules you are, through our agreement with you — and you stay accountable for information handled on your behalf. That is how it should be, and our agreement is written to match it.

A public body may be required to complete a privacy impact assessment before a new or substantially changed programme, and for some of those it must be submitted to the Information and Privacy Commissioner. A workforce-wide survey may well be one of them — that is your privacy office's call, not ours, and we would rather raise it early than have it surface halfway through a procurement.

If you need one, we give you the vendor half at no charge: what we receive and why, where it is stored, who our subprocessors are, what security applies, how long we keep it, and how it is destroyed. You prepare it, you approve it, and you file it. We just make our part of it easy.

CivicShift is a private Alberta corporation, not a public body. Our own handling of your information is governed by Alberta's Personal Information Protection Act, and by the federal Personal Information Protection and Electronic Documents Act where information crosses a provincial or national border in the course of commercial activity. Our email is governed by Canada's anti-spam legislation. When we work for a public body, that body's obligations under the Protection of Privacy Act and the Access to Information Act reach us through our agreement with them, as Part 4 describes.

You can ask us what we hold about you, ask us to correct it, and ask us to delete it. Write to the address below and we will deal with it promptly and without charge. If we cannot delete something — because a contract, a legal hold or an insurance obligation requires us to keep it — we will tell you which, and for how long.

One thing we cannot do, and you should know why. If you answered a survey, we cannot find your response to show you, correct it or delete it — because nothing connects it to you. That is the same design that protects you, working in the direction that is less convenient. Your organization holds the list of who received which key; we never do.

You can unsubscribe from any email at any time, and it takes effect immediately.

Tell us first and give us a chance to fix it. If we cannot resolve it, you can complain to the Office of the Information and Privacy Commissioner of Alberta, and you do not need our permission to do so.

If what we do changes, this page changes first, and the date at the top changes with it. Our client agreements are written to match this page, not the other way round — so if you ever find this page and an agreement saying different things, that is our mistake and we would like to hear about it.