Operational Transparency Notice

Authority

Rules: PIPEDA and, in Quebec, the Act respecting the protection of personal information in the private sector. Convention 108 and its amending Protocol are referenced for alignment only: Canada is not a Party, and the Protocol is not yet in force.

Supervisory authorities: the Office of the Privacy Commissioner of Canada and, in Quebec, the Commission d’accès à l’information. You may complain to either. After a report by the Privacy Commissioner, you may apply to the Federal Court.

Legal basis: consent for the self-assessment and the comment board; legal obligation for rights requests. Each is stated with its purpose below.

Restrictions of rights: none.

Controller identification

Controller: Global Privacy Rights, operating Transparency Lab

Controller DID: did:web:transparencylab.ca

Contact: info@transparencylab.ca

Person in charge of the protection of personal information: by title, at info@transparencylab.ca

Jurisdiction: Canada (CA)

CIR: /.well-known/transparency/cir.json

Purpose declarations

• Standards demonstration: This site demonstrates TS 27560-compatible notice receipts as live running infrastructure. No personal data is collected simply by visiting.
• Controller self-assessment: If you submit the controller self-assessment, your organisation's name, the service address, your answers and any evidence links are collected, and a contact email only if you choose to give one. They are used for Transparency Lab review and are not published unless you ask to be listed in the 0PN Directory. Lawful basis: consent, evidenced by the receipt number you are shown. Stored on our server in Montreal, Canada, for twelve months or until you withdraw with your receipt number. The full notice is shown before you start.
• Comment board: If you comment on this notice and its claims on the comment board, your comment, and a display name if you give one, are collected and published on the reuse terms you choose. Lawful basis: consent, evidenced by the comment receipt you are given. Before posting you are asked to name the city where comments are stored, and to say whether you are posting from outside Canada; if you are, you confirm the transfer to Canada, and the receipt records your answers. No email, cookie or IP address is stored. Stored on our server in Montreal, Canada, until you withdraw with your receipt, and at most twelve months. Withdrawing deletes the comment at once and removes it from the board. Two reuse terms are for public rights research: a CC BY-NC-SA 4.0 research commons licence, and use by Global Privacy Rights in its non-profit digital public rights research, always cited, with no new use after you withdraw. AI training and text and data mining stay reserved unless you allow them, and then only for safety, security and privacy research.

What is collected

• Email address: only if you choose to give one, as a contact in the self-assessment or a reply address at the rights access point. Not collected by visiting any page.
• Self-assessment submissions: only if you submit one: organisation name, service address, answers and evidence links. No IP address is stored and no cookie is set.
• Comments: only if you post one: the comment, and a display name if given. Published on the board until you withdraw it.
• Receipt numbers: issued to you for a self-assessment (tl-sa-), a comment (tl-cm-) or a rights request (tl-rr-). Each is your key to that record. Receipts from the closed /wg5-2026 demonstration (TL-2026-NOTICE-) can still be used at the rights access point.
• Nothing else: no cookies, no analytics, no fingerprinting, no third-party scripts.

Infrastructure

Every page and record of this site is served from a server we operate in Montreal, Canada, hosted by Web Hosting Canada (WHC), and self-assessment submissions, comments and rights requests are stored there. Your IP address is used only to send you the page and is not stored. No request to this site leaves Canada. Cloudflare provides DNS for the domain name only and receives no request to this site. Fonts are served from this site, so no page makes a request to a third-party font service. No visitor identifiers are stored by this site beyond those described above.

Your rights: digital rights access point

Use the receipt number you were given. You do not need an account, and you do not have to identify yourself. Keep your receipt private: anyone holding it can use these rights.

Withdrawal, deletion and objection for a self-assessment take effect immediately, and "See what is held" shows the record at once. Other requests are acknowledged within 7 days and answered within 30. You receive a rights request receipt either way. To answer a request we keep the receipt number, the rights asked for, and any reply address or text you give, because the law requires us to answer it. The text and reply address are deleted when the request is closed; an answer is kept 30 days for you to collect; the request record is deleted after 24 months. Our request log keeps no reply address or text. You can also write to info@transparencylab.ca.

Full rights context: /.well-known/transparency/rights.json

Interoperability

This notice is designed to be interoperable with TS 27560 (consent record structures), the Kantara ANCR TS 27560 Extension, Release 1 (notice receipt profile), and Convention 108+ Article 14. These are technical alignment references, not ISO or Council of Europe endorsements.