Your data, plainly explained

Privacy Policy

RF Holdings Corp., operating as "Gardril" · Calgary, Alberta, Canada
Last updated: August 20, 2026 · Effective date: August 20, 2026

1. Introduction

1.1 About this notice

This Privacy Notice explains how we collect, use, disclose, and safeguard your personal information when you create an account, take a course, verify your identity, earn a certificate, or receive a verifiable digital credential through Gardril. The plain-language summary above is a quick guide only; the numbered sections that follow are the full notice and govern in the event of any conflict.

1.2 Who we are and how to reach us

RF Holdings Corp., operating under the trade name "Gardril" ("Gardril", "we", "us", "our"), is incorporated in Alberta, Canada, with its principal place of business in Calgary, Alberta. RF Holdings Corp. is the organization responsible for your personal information under Canadian privacy law and applicable U.S. state privacy laws, and the "enterprise" in charge of it under Quebec's Law 25 (the Act respecting the protection of personal information in the private sector).

1.3 Who this notice applies to

This notice applies to learners who use Gardril directly. Where a business, training organization, or safety association provides Gardril to its people under a separate agreement, that organization may act as the controller of the records it manages, and its own privacy terms may also apply. If you reached Gardril through your employer or another organization, contact them for their handling of your information.

2. Legal basis for processing

We process your personal information only when we have a valid basis under applicable privacy law. Which basis applies depends on what we are doing.

2.1 Performance of our contract with you

• Creating and running your account and delivering your courses
• Verifying that you earned your certificate and issuing it
• Processing your payment and meeting related tax and accounting duties

2.2 Our legitimate interests

• Protecting the integrity of a Gardril certificate through fraud and bot prevention — the core of what makes it trustworthy
• Securing the platform and preventing unauthorized access
• Maintaining, operating, and improving the service

2.3 Legal obligations

• Keeping payment records for the period tax and accounting law requires
• Retaining training records where a regulated sector requires it (see Section 7)
• Notifying you and the appropriate regulators of a reportable breach

2.4 Your consent

• Identity verification — specifically the biometric step, which runs under Asgard's separate explicit consent
• Issuing your certificate as a verifiable digital credential with a public verification page that displays your name and photo

Consent is explicit, informed, and freely given, and we ask for it before your purchase completes rather than after. You may withdraw it at any time by emailing privacy@gardril.com, subject to records the law requires us to keep. Withdrawing consent never invalidates a certificate you have already earned.

2.5 Sensitive information

Biometric information is treated as sensitive information under laws such as Quebec's Law 25 and Illinois's BIPA. Gardril does not collect, see, or store any biometric data, and does not receive your photo. The biometric identity check is performed entirely by Asgard Authenticate under its own explicit, informed consent, and Gardril receives only a pass/fail result. Publishing your name and photo on a public verification page is a disclosure, so we obtain your consent for it before you purchase (see Sections 2.4 and 5.2).

2.6 Automated identity decisions

Identity verification returns a pass or fail result, and a failed check can prevent certification. This step is not left entirely to software: you may ask us to have a person review a failed verification, and you can contest the outcome by emailing privacy@gardril.com. Where a decision is based exclusively on automated processing, Quebec's Law 25 gives you the right to be informed of it and to submit your observations.

3. Personal information we collect

We collect only what we need to run your account and issue a certificate that proves you earned it.

3.1 Account information

When you create an account, we store your first and last name, your email address, and your country. Accounts run on our learning platform (Moodle) at learn.gardril.com; your password is stored only in encrypted (hashed) form and is never visible to Gardril staff.

3.2 Payment information

When you pay for a course, your card details pass directly from your browser to Stripe and never touch Gardril's servers. We keep only a record of the payment: a Stripe payment reference, the amount, the GST, the currency, the course, the status, and timestamps.

3.3 Records we create

Using the platform creates records about your training: your course progress and completion date, and the pointers that link to your issued credential (its identifier, its public verification link, and the issue date). We also keep a consent log (each consent event with a reference, a timestamp, and an IP address), password-reset tokens (stored only as a short-lived, hashed token together with the request's IP address), and any access codes used to enrol.

3.4 Technical information

We collect routine technical data such as your IP address and timestamps, used to operate and secure the service. We process this under our legitimate interests (see Section 2.2).

3.5 Your photo

During identity verification, Asgard captures your photo and delivers it directly to Credential Vault for your certificate. Gardril never receives, stores, or displays your photo — our systems hold no copy of it. Gardril runs no facial recognition and derives no biometric template; the biometric identity check happens entirely within Asgard, which returns only a pass or fail result to Gardril. Your photo appears on your certificate and its public verification page as a visual check that the credential is yours — like the photo on a driver's licence — and that display is handled by Credential Vault, not Gardril.

3.6 What we do not collect

Gardril never stores your card number, your biometric data, or your photo.

4. How we use your personal information

• Run your account and deliver courses — necessary to provide the service you signed up for.
• Verify your identity and issue your certificate — with your consent; the biometric step itself runs under Asgard's separate explicit consent.
• Issue your credential in a verifiable, portable form — with your consent, so you can prove your achievement to an employer or regulator and keep it in a wallet.
• Process payments — necessary to complete your purchase, with related tax and accounting obligations.
• Protect certificate integrity — fraud and bot prevention is the core of what makes a Gardril certificate trustworthy.

5. Disclosure and sharing of personal information

5.1 Service providers

We rely on a small number of trusted service providers to deliver specialized parts of the service. Each one processes your information only for that purpose, under its own published terms and under contractual data-protection obligations. Everyday infrastructure — hosting, databases, and transactional email — is handled by providers under contract who process data on our instructions.

5.2 Your certificate and public verification

When you earn a Gardril certificate, it is issued as a verifiable digital credential that is hosted, cryptographically signed, and publicly verified by Credential Vault, our credentialing partner. Gardril's dashboard links to your certificate but does not host a copy of it. The credential is built on open, international standards — the W3C Verifiable Credentials data model and Open Badges 3.0 — so anyone you share it with can confirm it is authentic without contacting Gardril. Because this publishes your name and photo, we ask for your explicit, opt-in consent before your purchase completes.

The public verification page. Every credential has a permanent public web address of the form https://app.credentialvault.io/verify/{credential id}. No login is required — anyone who has the link can open it. The page displays your name, your photo, the course, the completion/issue date, and the current status; it also offers a PDF download and wallet/QR options. If a credential is later revoked or suspended, the page shows that status honestly with a banner. Your email address is used to issue the credential and is held within the credential record, but Credential Vault does not display it on the public page.

Public by design — treat the ID like a certificate number. Your verification page is publicly accessible to anyone who has its link or your credential ID, and that link is printed on the certificate PDF you hold. This is what allows an employer or regulator to confirm your training in seconds without contacting us. Share the link only with people you want to see it, and treat the credential ID like the number on a physical certificate — you control who you give it to, but not what a recipient does with it afterward.

Wallets and portability. Because your credential follows open standards, you can download it into a digital wallet — a W3C-compatible wallet, or Apple or Google Wallet where supported — and keep or present it independently of Gardril. Once a copy is in your wallet, or you have shared it, that copy is under your control, not ours.

Revoking is not the same as deleting. If a credential ever needs to be invalidated — an error, or a certification that later lapses — it is revoked: its status is updated so it no longer verifies as valid, and anyone who checks it will see that it has been revoked. What revocation, making a credential private, and deletion mean for you is set out in Sections 7 and 8.

What stays private. Your payment information and your biometric verification data are never shared with Credential Vault. Your email address is held within the credential record but is not shown on the public verification page. The public page shows only your name, photo, course, dates, and status.

5.3 Legal and regulatory authorities

We may disclose your personal information where we are required to by law, or where we have a good-faith belief it is necessary to comply with a legal obligation or lawful request, enforce our terms, or protect the rights, property, or safety of Gardril, our learners, or the public.

5.4 Corporate transactions

If Gardril is involved in a merger, acquisition, reorganization, or sale of assets, your personal information may transfer to the successor entity. We will notify you of any such change and of any choices you may have. A transfer as part of such a corporate transaction is not a "sale" of your personal information under laws such as California's CCPA/CPRA.

5.5 What we never do

We never sell your personal information. We never share it for third-party marketing without your consent. We never share your payment or biometric data with Credential Vault, and your email is never displayed on your public verification page.

6. Where your data is hosted

7. Data retention

Training and completion records are kept while your account is active and for as long as you keep your account — potentially for life, because a certificate is only useful if it lasts. You can request deletion at any time. Gardril keeps its own record that you completed the training even if the credential is later made private or deleted at Credential Vault.

Verification results and consent logs are kept with the related training record as proof that verification and consent occurred.

Your certificate is hosted by Credential Vault, not Gardril. Gardril holds only pointers to it (its identifier, its verification link, and the issue date) and no copy of the certificate PDF or your photo. Making a credential private or deleting it is handled through Credential Vault; Gardril can also revoke it (see Section 8).

Payment records are retained as tax and accounting law requires, typically 6 years in Canada.

Account and technical data is deleted within 90 days of account closure, except records we must keep by law.

In some regulated sectors (mining, oil and gas, occupational health and safety), the law may require training records to be kept for a set period even after a deletion request — for example, for a regulatory workplace-fatality investigation. Where that applies, we will tell you before processing your request. Biometric verification records are held by Asgard under its own statement; direct any deletion request for those to Asgard.

8. Your rights

Depending on where you live, you hold some or all of the following — and we honour the strongest set available to you:

• Access — a copy of the data we hold about you.
• Correction — fix inaccurate or incomplete data.
• Deletion — including your certificate; we comply except where the law requires retention. Deleting the credential itself is a request to Credential Vault; Gardril can also revoke it, and keeps its own record that you completed the training.
• Make your credential private / turn off public verification — claim your credential with Credential Vault and use its holder visibility control to make it private, which stops the public verification page from rendering; or ask us to revoke it. Note that making a credential private or revoking it means a verification link you previously shared with an employer will stop resolving.
• Portability — receive your data in a portable format; a verifiable credential is portable by design.
• Withdraw consent — at any time.
• Object or restrict — to certain processing.

To exercise any right, email privacy@gardril.com. We respond within 30 days (and within any shorter period a law that applies to you requires), after reasonable steps to verify your identity. Exercising your rights will never be held against you.

You may also complain to a regulator: the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Information and Privacy Commissioner of Alberta or British Columbia, or your state Attorney General in the United States.

9. Data security and breach notification

We protect your data with encryption in transit and at rest, access controls, hashed passwords, audit logging of consent, and contractual security obligations on our partners. Gardril itself holds no biometric data and no copy of your photo. For verifiable credentials, the cryptographic signing that makes a credential trustworthy is handled by Credential Vault, and trust relies on tamper-evident signatures and a status record rather than on exposing your personal data.

If a breach occurs that puts you at risk, we will notify you and the appropriate regulators without unreasonable delay, as PIPEDA, Quebec's Law 25, and applicable U.S. state laws require. We maintain a register of confidentiality incidents.

10. Age requirement

Gardril accounts are available only to learners aged 18 and older. We do not knowingly collect information from anyone under 18, and if we learn we have, we delete it promptly.

11. Cookies

Gardril uses no tracking cookies — no analytics, no advertising pixels, no third-party trackers, and no fingerprinting. When you sign in to the learning platform, your browser stores a strictly necessary session cookie that keeps you signed in; it identifies your session, not your browsing habits, and is never used for tracking or advertising. Because strictly necessary cookies of this kind do not require consent under Canadian or U.S. law, there is nothing to accept, decline, or manage, and you will not see a cookie banner. See our Cookie Settings page for details.

12. Laws this policy honours

This policy is written for learners in Canada and the United States. In Canada, that means PIPEDA, the Alberta and British Columbia PIPAs, and — where we sell into Quebec — Quebec's Law 25, which sets strict rules for sensitive information such as biometrics. In the United States, it means the FTC Act's requirement that we honour the promises on this page, state consumer-privacy laws such as California's CCPA/CPRA, state biometric-privacy laws such as Illinois's BIPA — under which the biometric step is performed by Asgard with your explicit consent — and every state's breach-notification law. Where any law gives you a stronger right, the stronger protection applies.

Issuing your certificate as a verifiable credential means your name and photo are published on a verification page that you consent to before purchase and choose whom to share with. We remain accountable under PIPEDA for the personal information we entrust to our service providers, and issuing a verifiable credential is never a "sale" of your data under laws such as California's CCPA/CPRA.

This policy is made available in French for Quebec learners — Lire la politique en français.

13. Changes to this policy

If we make material changes — especially to how identity verification works or how your credential is published — we will notify you, and where the change is material to biometric handling or to publishing your photo we will ask for your fresh consent rather than relying on notice alone. The version and effective date always appear at the top of this page.

14. Contact

Privacy Officer, RF Holdings Corp. (operating as Gardril)
privacy@gardril.com

Definitions

Personal information — any information about an identifiable individual, such as your name, email address, or photo.

Processing — anything we do with personal information, including collecting, storing, using, sharing, or deleting it.

Controller / enterprise — the organization that decides why and how personal information is handled. For your Gardril account, that is RF Holdings Corp.

Service provider / processor — a company that handles personal information on our instructions and only for the purpose we set (for example, Asgard, Stripe, and Credential Vault).

Sensitive information — categories the law protects more strictly, including biometric data. Gardril holds none.

Biometric data — measurements of your body or face used to identify you. This is handled solely by Asgard; Gardril receives only a pass/fail result.

Verifiable digital credential — a cryptographically signed, tamper-evident version of your certificate, built on the W3C Verifiable Credentials and Open Badges 3.0 standards, that anyone you share it with can confirm as authentic.

Consent — your freely given, specific, and informed agreement to a particular use of your information, which you can withdraw at any time.