Legal
Updated: April 19, 2026
Apex Compliance Solutions Inc. ("Apex", "we", "our", "us") operates the RailPro SMS cloud-based Safety Management System platform (the "Platform"). This Privacy Policy describes how Apex collects, uses, discloses, stores, and protects Personal Information in connection with the Platform, www.railprosms.com, and any related services (collectively, the "Services").
By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.
This Privacy Policy forms part of, and is incorporated into, the RailPro SMS Terms and Conditions (the "Terms"). Capitalized terms not defined in this Privacy Policy have the meanings given in the Terms.
This Privacy Policy applies to:
Where Apex processes Personal Information on behalf of a Company, Apex acts as a service provider / processor, and the Company acts as the controller of such Personal Information.
For the purposes of this Privacy Policy:
3.1 Authorized User Data
Includes names, email addresses, roles, authentication credentials (hashed), usage logs, and any other information provided by the Company.
3.2 Company Data
Includes safety management records, incident reports, operational data, uploaded documents, training records, and any other data the Company inputs into the Platform.
3.3 Apex Data
Includes system performance data, diagnostic logs, error reports, and metadata used to maintain and improve the Platform.
3.4 Website and Technical Data
Includes IP address, browser type, device identifiers, and essential cookies used for secure session management. Apex does not use advertising cookies or third-party marketing trackers.
Apex collects information through:
Apex does not collect Personal Information from data brokers or advertisers.
Apex uses Personal Information solely for purposes permitted under the Terms, including:
Apex does not sell Personal Information or use it for advertising.
Apex is a Canadian organization and processes Personal Information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). Apex adheres to the Ten Fair Information Principles:
6.1 Accountability: Apex is responsible for Personal Information under its control and has designated a Privacy Officer to oversee compliance.
6.2 Identifying Purposes: Apex identifies the purposes for which Personal Information is collected at or before the time of collection, including providing the Platform, supporting Authorized Users, and fulfilling contractual obligations.
6.3 Consent: Apex obtains consent for the collection, use, and disclosure of Personal Information, except where otherwise permitted or required by law. Where Apex processes Personal Information on behalf of a Company, the Company is responsible for obtaining all necessary consents from individuals.
6.4 Limiting Collection: Apex collects only the Personal Information necessary for the purposes identified in this Privacy Policy and the Terms.
6.5 Limiting Use, Disclosure, and Retention: Apex uses and discloses Personal Information only for the purposes for which it was collected, unless consent is obtained or required by law. Retention is governed by Section 12 of this Policy and Section 6.5 of the Terms.
6.6 Accuracy: Apex takes reasonable steps to ensure that Personal Information is accurate, complete, and up to date for the purposes for which it is used.
6.7 Safeguards: Apex protects Personal Information using administrative, technical, and physical safeguards appropriate to the sensitivity of the information.
6.8 Openness: Apex makes information about its privacy practices available upon request.
6.9 Individual Access: Upon request and subject to Company direction, individuals may access their Personal Information, challenge its accuracy, and request corrections.
6.10 Challenging Compliance: Individuals may direct questions or complaints regarding Apex's compliance with PIPEDA to the Privacy Officer listed in Section 15.
Apex may share Personal Information only as follows:
7.1 With the Company: Apex shares Authorized User Data and Company Data with the Company that employs or contracts the Authorized User.
7.2 With Service Providers: Apex uses vetted service providers for hosting, authentication, storage, support, and infrastructure. All service providers are bound by confidentiality and data-processing obligations consistent with PIPEDA and this Policy.
7.3 Legal and Compliance Requirements: Apex may disclose Personal Information to comply with law, regulation, subpoena, or court order.
7.4 Corporate Transactions: Personal Information may be transferred in connection with a merger, acquisition, financing, or sale of assets.
Apex does not share Personal Information with advertisers or social media platforms.
Apex uses commercially reasonable safeguards, including:
Apex retains Personal Information:
Upon termination, Apex will delete or return Company Data in accordance with the Terms.
Apex may store or process Personal Information in Canada, the United States, or other jurisdictions where service providers maintain infrastructure. Apex ensures that international transfers comply with PIPEDA's accountability and contractual-safeguard requirements.
Depending on jurisdiction, individuals may have rights to:
Authorized Users should direct all privacy requests to their Company administrator.
The Platform is not intended for individuals under 18. Apex does not knowingly collect Personal Information from children.
Apex may update this Privacy Policy from time to time. The "Updated" date reflects the effective date of the most recent version.
For questions about this Privacy Policy or Apex's privacy practices, please contact: