PIPEDA and your school’s data
PIPEDA is the Personal Information Protection and Electronic Documents Act, Canada’s federal privacy law for private-sector organisations. It governs how personal information may be collected, used and disclosed, and it gives people the right to see what is held about them.
This page describes what TUIO does with the information in a school’s account. The governing document is the privacy policy; where the two differ, the policy applies.
Last updated 19 August 2026.
The information belongs to the school
A school using TUIO decides what is collected about its families and why. TUIO holds and processes that information on the school’s behalf, to run the service the school asked for. TUIO does not use it for its own purposes and does not sell it.
The school is the organisation its families have a relationship with and the one accountable to them. TUIO is the service provider handling the information under the school’s instructions.
Where the records are held
School and family records in TUIO, and the files uploaded with them, are held in Canada, on Amazon Web Services’ Canadian infrastructure.
TUIO uses other systems to run its own business, such as handling a sales enquiry and sending email. Those are supplied by companies based in the United States, which is why the privacy policy says information may be held in Canada or the United States.
What a family can ask for
A family can ask to see the personal information held about them, and can ask for it to be corrected if it is wrong.
Requests start with the school. The school is the organisation the family has the relationship with, it holds the context, and in most cases it can act on the record directly. A request that comes to TUIO is handled together with the school.
Requests can be sent to [email protected]. The privacy policy sets out the full process, including how a request is verified and how long it takes.
How the information is protected
Two-factor authentication, encrypted traffic, Canadian hosting, staff access, backups and card handling are set out on the security page.
Payments
Families pay the school. Each school is its own merchant of record, so the money moves from the family to the school’s own bank. TUIO never holds the funds.
The card or bank number is typed into the payment processor’s own form, embedded in the TUIO page, and goes straight to that processor. TUIO never collects, transmits or stores it. The security page explains what that means for the school’s own card-industry paperwork.
Children’s information
Most of what a school keeps in TUIO is about children. The privacy policy has a section devoted to it: what may be collected, how authorisation works, how long it is kept, and who it may be shared with.
Children’s information is not used for advertising or for marketing of any kind. It is not used to train artificial-intelligence or machine-learning models.
Contact
Tuio Payments Inc., #1533-2967 Dundas St. W, Toronto, Ontario M6P 1Z2
[email protected]
1 (888) 540-0160
Requests to see or correct personal information: [email protected].
The complete legal document is the privacy policy. For technical and operational security, see the security page.
