Privacy Policy

1. Introduction

TJX Canada ("Company", "we", "us", or "our") respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the TJX Canada Continuous Improvement Platform ("the Platform").

This policy applies to all employees and authorized users accessing the Platform with corporate credentials (@tjxcanada.ca or @tjx.com email addresses).

2. Information We Collect

2.1 Personal Information:

• Account Information: Name, email address, job title, and distribution center location
• Authentication Data: Encrypted passwords and login credentials
• User Role Information: Your assigned role (CI Manager, Viewer, or Administrator)

2.2 Usage Information:

• Activity Logs: Login times, pages accessed, actions performed
• Project Data: Project titles, descriptions, cost savings, and other continuous improvement metrics
• System Logs: IP addresses, browser type, device information, and access patterns

2.3 Technical Information:

• Device Data: Operating system, browser version, screen resolution
• Performance Data: Load times, errors, and system performance metrics
• Security Data: Failed login attempts, suspicious activities, and security events

3. How We Use Your Information

3.1 Platform Operation:

• To provide, maintain, and improve the Platform
• To authenticate users and manage access controls
• To track continuous improvement projects and generate reports
• To enable collaboration between distribution centers

3.2 Security and Compliance:

• To monitor system security and detect unauthorized access
• To investigate security incidents and policy violations
• To comply with legal obligations and regulatory requirements
• To maintain audit trails for compliance purposes

3.3 Business Operations:

• To analyze Platform usage and improve user experience
• To generate analytics and business intelligence reports
• To communicate system updates and important notifications
• To provide technical support and troubleshooting

4. Data Security

4.1 Encryption:

• In Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2+ protocols
• At Rest: Project data is encrypted using AES-256-CBC encryption before storage
• Client-Side Encryption: Sensitive project information is encrypted in your browser before transmission

4.2 Access Controls:

• Role-based access control (RBAC) limits data access based on user roles
• Multi-factor authentication capabilities for enhanced security
• Regular security audits and penetration testing
• Automated monitoring for suspicious activities

4.3 Data Protection Measures:

• Regular automated backups to prevent data loss
• Firewall protection and intrusion detection systems
• Secure cloud infrastructure with enterprise-grade security
• Regular security updates and patch management

5. Data Sharing and Disclosure

5.1 Internal Sharing:

Your information may be shared within TJX Canada:

• With authorized employees who need access for legitimate business purposes
• With IT support and security teams for system maintenance and security
• With management for reporting and strategic planning

5.2 Service Providers:

We may share information with third-party service providers:

• Cloud hosting services (Firebase/Google Cloud Platform)
• Analytics and monitoring services
• Security and fraud prevention services

All service providers are contractually obligated to protect your data and use it only for specified purposes.

5.3 Legal Requirements:

We may disclose your information when required by law or to:

• Comply with legal processes, court orders, or government requests
• Protect the rights, property, or safety of TJX Canada, employees, or the public
• Investigate fraud, security breaches, or policy violations
• Enforce our Terms of Service and other agreements

5.4 Business Transfers:

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

6. Data Retention

6.1 Retention Periods:

• Account Data: Retained for the duration of employment and up to 7 years thereafter
• Project Data: Retained indefinitely for historical analysis and reporting
• Security Logs: Retained for 2 years for security and compliance purposes
• Audit Trails: Retained for 7 years to meet regulatory requirements

6.2 Data Deletion:

Upon termination of employment or account deactivation, personal data will be anonymized or deleted in accordance with company retention policies and legal requirements.

7. Your Rights and Choices

7.1 Access and Correction:

• You have the right to access your personal information stored in the Platform
• You can request corrections to inaccurate or incomplete data
• Contact your HR department or IT support for access requests

7.2 Data Portability:

You may request a copy of your personal data in a structured, machine-readable format, subject to technical feasibility and legal restrictions.

7.3 Objection and Restriction:

You may object to certain processing of your data or request restrictions, though this may limit Platform functionality.

7.4 GDPR Rights (European Users):

If you are located in the European Economic Area, you have additional rights under GDPR, including:

• Right to erasure ("right to be forgotten") under certain circumstances
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent

8. Cookies and Tracking Technologies

8.1 Essential Cookies:

• Authentication Cookies: To maintain your login session
• Security Cookies: To detect and prevent security threats
• Preference Cookies: To remember your settings and preferences

8.2 Analytics:

We use Firebase Analytics to understand how users interact with the Platform. This helps us improve functionality and user experience.

8.3 Session Storage:

We use browser session storage for temporary data during your active session. This data is cleared when you log out or close your browser.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable laws.

For transfers outside the EEA, we rely on:

• Standard Contractual Clauses approved by the European Commission
• Privacy Shield Framework (where applicable)
• Other legally approved transfer mechanisms

10. Children's Privacy

The Platform is intended for use by employees and authorized business users only. We do not knowingly collect information from individuals under 18 years of age.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify users of material changes through:

• Email notifications to registered users
• Prominent notices on the Platform
• Updated "Last Updated" date at the top of this policy

Your continued use of the Platform after changes constitutes acceptance of the updated policy.

12. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

Data Protection Officer
TJX Canada
Email: privacy@tjx.com
Phone: IT Service Desk
Address: Legal & Compliance Department
TJX Canada Head Office

EU Representative (for GDPR inquiries):
Email: gdpr@tjx.com

Supervisory Authority:
If you are located in the EEA, you have the right to lodge a complaint with your local data protection authority.