Your data, plainly explained

Privacy Policy

RF Holdings Inc., operating as "Gardril" · Calgary, Alberta, Canada
Effective date: June 10, 2026

1. Who we are

RF Holdings Inc., operating under the trade name "Gardril" ("Gardril", "we", "us"), is incorporated in Alberta, Canada, with its principal place of business in Calgary, Alberta, Canada. RF Holdings Inc. is the organization responsible for your personal information under United States and Canadian privacy law, and the "enterprise" in charge of it under Quebec's Law 25.

Privacy Officer: privacy@gardril.com

2. What Gardril collects

We collect only what we need to run your account and issue a certificate that proves you earned it:

Using the platform also creates records about you: your course progress and completions, your certificate, the pass/fail result of identity verification (never the biometric data itself), a log of the consents you give, and routine technical data such as IP address and timestamps.

Your headshot is ordinary personal data, not biometric data. Gardril only displays it and never runs facial recognition on it.

3. What our partners collect

Two trusted partners handle the sensitive data, under their own published terms:

4. Why your data lives in Canada

5. Why we use your data

• Run your account and deliver courses — necessary to provide the service you signed up for.
• Verify your identity and issue your certificate — with your consent; the biometric step itself runs under Asgard's separate explicit consent.
• Process payments — necessary to complete your purchase, with related tax and accounting obligations.
• Protect certificate integrity — fraud and bot prevention is the core of what makes a Gardril certificate trustworthy.

Consent is explicit, informed, and freely given. You may withdraw it at any time by emailing privacy@gardril.com, subject to records the law requires us to keep. Withdrawing consent never invalidates a certificate you have already earned.

6. How long we keep things

Training records and certificates are kept while your account is active and for as long as you choose to keep the credential — potentially for life, because a certificate is only useful if it lasts. You can request deletion at any time.

Your headshot can be removed on request without deleting the rest of your credential.

Verification results and consent logs are kept with the related training record as proof that verification and consent occurred.

Payment confirmations are retained as tax and accounting law requires, typically 6 years in Canada.

Account and technical data is deleted within 90 days of account closure, except records we must keep by law.

In some regulated sectors (mining, oil and gas, occupational health and safety), the law may require training records to be kept for a set period even after a deletion request (e.g., for a regulatory workplace fatality investigation). Where that applies, we will tell you before processing your request. For biometric data held by Asgard, we will direct your deletion request to Asgard, whose own retention and destruction practices are set out in its terms.

7. Your rights

Depending on where you live, you hold some or all of the following — and we honour the strongest set available to you:

• Access — a copy of the data we hold about you.
• Correction — fix inaccurate or incomplete data.
• Deletion — including your certificate and headshot; we comply except where the law requires retention.
• Portability — receive your data in a portable format.
• Withdraw consent — at any time.
• Object or restrict — to certain processing.

To exercise any right, email privacy@gardril.com. We respond within 30 days, after reasonable steps to verify your identity. Exercising your rights will never be held against you.

You may also complain to a regulator: the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Information and Privacy Commissioner of Alberta or British Columbia, or your state Attorney General in the United States.

8. The laws this policy honours

This policy is written for learners in Canada and the United States. In Canada, that means PIPEDA, the Alberta and British Columbia PIPAs, and Quebec's Law 25, which sets strict rules for sensitive information such as biometrics. In the United States, it means the FTC Act's requirement that we honour the promises on this page, state consumer-privacy laws such as California's CCPA/CPRA, state biometric-privacy laws such as Illinois's BIPA — under which the biometric step is performed by Asgard with your explicit consent — and every state's breach-notification law. Where any law gives you a stronger right, the stronger protection applies.

This policy and the consent materials are made available in French for Quebec learners — Lire la politique en français.

9. Security and breach notification

We protect your data with encryption in transit and at rest, access controls, hashed passwords, audit logging of consent, and contractual security obligations on our partners. Gardril itself holds no biometric data.

If a breach occurs that puts you at risk, we will notify you and the appropriate regulators without unreasonable delay, as PIPEDA, Quebec Law 25, and applicable U.S. state laws require. We maintain a register of confidentiality incidents.

10. Age requirement

Gardril accounts are available only to learners aged 18 and older. We do not knowingly collect information from anyone under 18, and if we learn we have, we delete it promptly.

11. Cookies

We use only the cookies and local storage necessary to keep you signed in and operate the platform. Non-essential cookies are off by default and used only if you opt in.

12. Changes to this policy

If we make material changes — especially to how identity verification works — we will notify you, and where the change is material to biometric handling we will ask for your fresh consent rather than relying on notice alone. The version and effective date always appear at the top of this page.

13. Contact

Privacy Officer, RF Holdings Inc. (operating as Gardril)
privacy@gardril.com