Privacy Policy

1. Introduction

This Privacy Policy describes the policies and procedures of CME Jobs Inc. ("CME," "we," "us," or "our") regarding the collection, use, and disclosure of your personal information when you use the CME Jobs platform (the "Platform"), available at cmejobs.com, and informs you of your privacy rights and how the law protects you.

CME Jobs is a community and employment platform providing job matching, professional identity, video communication, AI-assisted coaching and matching, events, local business discovery, community engagement, contests, advertising, verification services, and related tools (collectively, the "Services"). Not all Services are available in every jurisdiction or to every user. We are headquartered in Ontario, Canada and committed to protecting your privacy in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), Ontario's Working for Workers Act (Bill 190), the General Data Protection Regulation (GDPR) for users in the European Economic Area, and the California Consumer Privacy Act (CCPA) for California residents.

By using the Platform, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Definitions

• Account: A unique account created for you to access our Platform.
• CareerChain: CME's living employment history and verification record, including work history, employer associations, milestones, and certifications.
• CME Clip / Clip: A short video introduction recorded or uploaded by a job seeker through the Platform.
• CME Events: Job fairs, community events, festivals, and hiring events hosted or facilitated through the Platform.
• CME Local: CME's local business discovery, map, and directory feature.
• CIE (Community Impact Engine): CME's aggregated community economic impact reporting feature.
• Company: CME Jobs Inc., operating as CME Jobs, located in Ontario, Canada.
• GeoAds: Location-based advertisements served through the Platform.
• Personal Data: Any information that relates to an identified or identifiable individual.
• Service Provider: Any person or company who processes data on our behalf.
• SmartCoach: CME's AI-powered career coaching and profile optimization tool.
• SmartMatch: Our proprietary algorithmic matching system that scores compatibility between job seekers and job postings.
• Trust Score: A dynamic reputation score calculated from verified platform activity and behaviours.
• Usage Data: Data collected automatically from your use of the Platform.
• BIA: Business Improvement Area, a designated commercial district administered by a local board.

3. Information We Collect

3.1 Personal Data You Provide

When using the Platform, we may ask you to provide certain personally identifiable information, including but not limited to:

• Account Information: First name, last name, email address, phone number, password, postal code, and country.
• Job Seeker Profiles: Resume/CV, work history, education, skills, certifications, language proficiency, work preferences (schedule, commute distance, salary expectations), volunteer experience, and professional achievements.
• CareerChain and Employment Verification: Employment history entries, employer association requests, job titles, dates, promotions, and certifications. We distinguish between user-entered and employer- or system-verified information, and store provenance for all verified records. Verified records can be challenged through the process described in Section 8.4.
• Video Content: CME Clips, cover videos, video boost responses, and video reference submissions that you voluntarily record or upload through the Platform.
• Employer Profiles: Company name, industry, business description, office locations (including address and coordinates), hiring preferences, and company media.
• Application Data: Cover letters, screening question responses, interview availability, offer responses (including acceptance or decline with reasons), and withdrawal reasons.
• Reference Data: Information provided by individuals you designate as professional references, including written and video testimonials. Reference content is not automatically public — visibility follows your explicit settings and the reference provider's contact information is never made public.
• Event Data: Registration details, attendance and check-in records, QR scan logs, on-site applications, and contest entries collected through CME Events participation.
• BIA Data: Business listings, district boundaries, and business contact information submitted by BIA administrators.
• Referral Information: When you use our referral program, we collect the referral recipient's email address to send a one-time invitation on your behalf.

3.2 Usage Data (Collected Automatically)

We automatically collect certain information when you access the Platform, including:

• Device Information: Browser type, browser version, device type, and unique device identifiers for platform integrity and fraud prevention.
• Log Data: IP address, pages visited, time and date of visits, time spent on pages, and other diagnostic data.
• Platform Events: We log interactions such as application submissions, profile updates, feature usage, and engagement metrics to improve our services and generate anonymized analytics.

3.3 Location Data

We collect location information to power local features, using the least precise location sufficient for each feature. We start with your selected city or postal code, move to approximate location where needed, and request precise GPS only when a specific feature genuinely requires it and you grant permission.

• Match you with nearby job opportunities
• Calculate commute distances for SmartMatch scoring
• Serve locally relevant GeoAds based on your area
• Provide local business directory and CME Local results

Your precise device location is never disclosed to advertisers or sponsors. Payment, billing, or Stripe data is never used to build GeoAd audiences. You may enable or disable location services at any time through your device or browser settings. Disabling location services may reduce the accuracy of job matching and local features.

3.4 Camera and Media Access

With your explicit permission, the Platform may access your device's camera and photo/video library to enable CME Clip recording, video boost responses, and video reference submissions. This access is only activated when you initiate a recording or upload. We do not access your camera or media library in the background.

3.5 Payment Data

Payment information (credit card numbers, billing details) is collected and processed directly by our payment processor, Stripe, Inc. We do not store your full credit card numbers on our servers. We retain transaction records including subscription type, transaction amounts, dates, and billing status.

3.6 Cookies and Tracking Technologies

We use authentication tokens (JSON Web Tokens) stored in secure, httpOnly cookies to maintain your session. We do not use third-party advertising cookies or cross-site tracking pixels. We may use local storage for user preferences such as theme settings.

3.7 Push Notifications and Device Tokens

If you use the CME Jobs mobile app and grant notification permissions, we collect a device token (provided by Apple Push Notification service or Firebase Cloud Messaging) to deliver push notifications to your device. Device tokens are:

• Stored securely and associated with your account
• Used solely to deliver notifications you have opted into (application updates, interview reminders, KindHire messages, flash ad alerts)
• Deactivated immediately when you log out, revoke notification permissions, or delete your account
• Never shared with third parties or used for advertising purposes

You may disable push notifications at any time through your device settings (Settings > Notifications > CME Jobs) or by toggling "Do Not Disturb" in your profile.

4. How We Use Your Information

We use your personal information for the following purposes:

• To provide and maintain the Platform, including account creation, authentication, and core employment marketplace functionality.
• To facilitate employment matching through our SmartMatch algorithm, which analyzes your skills, experience, preferences, and location to calculate compatibility scores with job postings (see Section 5).
• To process applications and facilitate the hiring pipeline between job seekers and employers, including interviews, offers, and hiring decisions.
• To communicate with you, including sending transactional notifications (application updates, interview reminders, offer notifications, security alerts), service announcements, and with your consent, promotional communications.
• To provide career coaching through SmartCoach and related AI-assisted tools, including personalized profile optimization suggestions, application feedback, and career guidance.
• To maintain trust and safety, including calculating Trust Scores, awarding badges, detecting fraudulent or abusive behaviour, and enforcing platform integrity policies. Trust Scores are calculated from verified platform activity and conduct — payment data, Stripe risk information, and protected characteristics are never used as inputs. See our Trust Score page for full details on how scores are calculated and how to appeal decisions.
• To operate CME Events, including managing registration, attendance, check-ins, on-site applications, organizer reporting, and post-event follow-up.
• To process payments for subscriptions, credits, GeoAds, and other Platform purchases through our payment processor.
• To generate analytics including anonymized, aggregated reports about hiring trends, industry benchmarks, labour market conditions, and economic impact for municipalities and BIAs.
• To operate community features including the ballot and contest system, referral program, Founding Member program, and the Community Impact Engine (CIE). CIE community impact metrics are derived from aggregated, de-identified data — individual transaction or employment records are never publicly reported.
• To comply with legal obligations, including maintaining hiring records as required by Ontario's Bill 190 (Working for Workers Act) and responding to lawful requests from government authorities.

5. Matching, AI-Assisted Features, and Automated Systems

CME uses several AI-assisted and automated tools to support users and hiring decisions. These tools are designed to inform and assist — they do not independently make hiring decisions on behalf of employers. All hiring decisions are made solely by employers.

SmartMatch

SmartMatch scores compatibility between job seekers and job postings on a 100-point scale across up to 10 dimensions, including: skills match, location proximity, experience level, schedule compatibility, salary alignment, industry relevance, language fit, cultural preferences, education, and community engagement.

• SmartMatch scores are informational tools — they do not make hiring decisions.
• SmartMatch does not use race, ethnicity, gender, age, religion, sexual orientation, disability status, marital status, or any other protected characteristic under the Canadian Human Rights Act or Ontario Human Rights Code.
• Match breakdowns showing the contribution of each scoring dimension are available to users (subject to subscription tier).
• We monitor SmartMatch accuracy by tracking outcomes against scores to identify and correct potential biases.

SmartCoach and Career Tools

SmartCoach provides personalized career guidance, profile optimization suggestions, and application feedback based on your profile and platform activity. Related tools such as Career Analyzer use your profile data to generate insights and recommendations tailored to your goals. These tools support your decisions — they do not determine outcomes.

AI Data Use

We may use aggregated, de-identified patterns to improve CME's AI features, and we use your data to personalize Services for you. We do not automatically use your private CME Clips, private video messages, reference videos, payment data, or detailed CareerChain records for general AI model training. Where external AI providers process your data on our behalf, we require appropriate data processing agreements and transmit only what is necessary for the service.

If you believe a SmartMatch score is inaccurate or has resulted in unfair treatment, contact us at info@cmejobs.com.

6. How We Share Your Information

6.1 With Employers (When You Apply)

When you submit a job application, the employer receives your profile information, resume, cover letter, video content, SmartMatch score, and screening question responses. Employers cannot view your applications to other companies.

6.2 Through the Talent Pool (Opt-In Only)

If you opt into the Talent Pool after a job closes, participating employers may view a limited profile including your skills, experience summary, and match score. All contact is initiated through the Platform — employers cannot see your direct contact information until you engage. Talent Pool participation requires your explicit, dual opt-in consent.

6.3 With Job Seekers (Employer Data)

Job seekers can view your company profile, job postings, Trust Score, response rates, and publicly displayed badges. Internal hiring notes, voting records, and team deliberations are never shared with candidates beyond status updates.

6.4 With Event Organizers and BIA Administrators

Event organizers receive aggregated event analytics — registration counts, attendance, application and interaction totals — for events they manage. Organizers do not automatically receive access to attendees' private applications, messages, CareerChain records, Clips, or other CME activity unrelated to the specific event. BIA administrators can view aggregated hiring statistics and district-level analytics for their area. They do not have access to individual job seeker profiles or personally identifiable hiring data.

6.5 With Sponsors and Contest Partners

Sponsors of CME events, contests, and community programs receive aggregated campaign performance data — impression counts, participation totals, and broad engagement metrics. Sponsoring a CME event or contest does not grant sponsors access to participants' personal information. Sponsors do not receive names, emails, phone numbers, precise location, application history, employment history, or individual voting records unless a user has separately and meaningfully consented to a specific disclosure.

Contest entry and optional sponsor marketing are treated separately. Entering a CME contest does not constitute consent to receive sponsor communications. Any optional sponsor marketing consent requires a separate, unchecked opt-in at the point of entry.

6.6 With Service Providers

We share data with the following third-party service providers who process it on our behalf:

• Stripe, Inc. — Payment processing, subscription billing, and fraud prevention. Subject to Stripe's Privacy Policy. Stripe payment, fraud, and KYC data is firewalled from CareerChain, SmartMatch, Trust Score, and advertising systems.
• Amazon Web Services (AWS) — Cloud hosting, data storage, and content moderation services.
• Twilio / SendGrid — Email delivery and SMS verification services.
• Google Maps Platform — Map display, geocoding, and address autocomplete services.

6.7 For Legal Purposes

We may disclose your personal information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency), or if we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of CME Jobs Inc.
• Prevent or investigate possible wrongdoing in connection with the Platform
• Protect the personal safety of users or the public

6.8 Aggregated and Anonymized Data

We share anonymized, aggregated data with BIAs, municipal governments, and research partners for economic impact reporting, labour market analysis, and community development, including CIE community impact metrics. This data cannot be used to identify individual users.

6.9 Business Transfers

If CME Jobs Inc. is involved in a merger, acquisition, or asset sale, your personal data may be transferred. We will provide notice before your data is transferred and becomes subject to a different Privacy Policy.

6.10 How CME Does Not Use Your Information

• We do not sell, rent, or trade your personal information to third parties for their marketing or advertising purposes.
• Sponsoring a CME event or contest does not grant sponsors access to your personal information.
• Your precise device location is never disclosed to advertisers.
• Payment card, bank, or Stripe billing information is not used in SmartMatch, CareerChain, or Trust Score calculations.
• Stripe fraud or risk assessments are not converted into a human reputation or employment score.
• Protected characteristics are not used as employment matching criteria.
• Private video messages are not used for unrelated advertising.
• Private, identifiable Clips, messages, and reference content are not automatically used for general-purpose AI model training.

7. Data Retention

We retain your personal information according to the following schedule:

• Active Accounts: We retain your data for as long as your account is active and for a reasonable period afterward to fulfill any remaining contractual obligations.
• Bill 190 Compliance Records: Under Ontario's Working for Workers Act, CME retains compliance archives — including job posting versions, application communications, interview records, and hiring decisions — for a minimum of three (3) years after the hiring process concludes. These records are sealed and immutable once a job posting is closed.
• CareerChain Records: Employment history, verifications, and employer associations are retained for the life of your account. Verified records follow audit-trail rules — they can be challenged through Section 8.4 but are not silently altered.
• Event Records: Registration, attendance, and check-in data are retained for 24 months after an event, after which they are anonymized or deleted unless required for an active compliance or legal matter.
• Contest and Ballot Records: Entry and ballot records are retained for 12 months after a contest closes for fraud prevention and prize fulfilment purposes, then deleted or anonymized.
• Financial Records: Transaction and billing records are retained for seven (7) years in accordance with Canadian tax and accounting requirements.
• Platform Event Logs: Usage events and analytics data are retained for up to 24 months, after which they are anonymized or deleted.
• Deleted Accounts: Upon account deletion request, we remove your personal information within 30 days, except where retention is required by law (e.g., Bill 190 compliance records, financial records, or active legal proceedings). Stripe retains payment and financial records independently in accordance with their own legal obligations — CME cannot delete records Stripe is required to maintain.
• Video Content: Videos are deleted when you remove them or when your account is deleted, except where they form part of a sealed compliance archive.

8. Your Privacy Rights

8.1 Rights Under PIPEDA (All Canadian Users)

Under the Personal Information Protection and Electronic Documents Act, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Withdrawal of Consent: Withdraw consent for certain processing activities. Note that withdrawing consent for core services may limit Platform functionality.
• Deletion: Request deletion of your account and personal information, subject to legal retention requirements.
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada.

8.2 Rights Under GDPR (European Economic Area Users)

If you are located in the European Economic Area, you have additional rights under the GDPR:

• The right to access, rectify, or erase your personal data
• The right to restrict or object to processing
• The right to data portability
• The right to withdraw consent at any time
• The right not to be subject to decisions based solely on automated processing (including profiling) that produce legal or significant effects
• The right to lodge a complaint with a supervisory authority

Our legal bases for processing under GDPR include: consent, performance of a contract, legitimate interests (improving our services, fraud prevention), and legal obligations.

8.3 Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the CCPA:

• The right to know what personal information is collected, used, shared, or sold
• The right to delete personal information held by us (subject to exceptions)
• The right to opt-out of the sale of personal information — we do not sell your personal information
• The right to non-discrimination for exercising your CCPA rights

8.4 Exercising Your Rights

To exercise any of your privacy rights — including access, correction, deletion, consent withdrawal, Talent Pool opt-out, or to challenge CareerChain verification records you believe are inaccurate — contact us at info@cmejobs.com. We will respond within 30 days (or sooner if required by applicable law). We may need to verify your identity before processing your request.

9. Consent

By creating an account and using the Platform, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. Where required by law, we obtain explicit consent before:

• Recording or collecting video content (camera access)
• Collecting precise geolocation data
• Sending promotional or marketing communications (CASL compliance)
• Sharing your profile through the Talent Pool
• Processing sensitive personal information

Entering a CME contest or ballot does not constitute consent to receive marketing communications from sponsors. Any optional sponsor marketing consent is obtained through a separate, unchecked opt-in at the point of entry.

You may withdraw consent at any time by updating your account settings or contacting us. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

10. Electronic Communications (CASL)

CME complies with Canada's Anti-Spam Legislation (CASL). We categorize our electronic communications as follows:

• Transactional Messages (no additional consent required): Application status updates, interview reminders, offer notifications, security alerts, account verification, password resets, Bill 190 compliance communications, and payment confirmations.
• Service Messages (implied consent for active users): Platform updates, feature announcements, policy changes, and subscription-related communications.
• Promotional Messages (express consent required): Marketing emails, contest promotions, and special offers. You may unsubscribe at any time using the link provided in each message.

Every commercial electronic message from CME includes our identity, mailing address, and a functioning unsubscribe mechanism as required by CASL.

11. Data Security

The security of your personal data is important to us. We implement industry-standard technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Secure password hashing using bcrypt
• JWT-based authentication with secure, httpOnly cookies
• Role-based access controls limiting data access to authorized personnel
• Device integrity checks and anomaly detection for fraud prevention
• Immutable compliance archives protected by database-level triggers
• Regular security reviews of platform code and infrastructure

CME maintains internal procedures for detecting and responding to suspected or confirmed privacy and security incidents, and will make legally required notifications to affected users and authorities where applicable.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

12. Children's Privacy

The Platform is not intended for individuals under the age of 16. We do not knowingly collect personally identifiable information from anyone under 16. Any expansion of Platform access to users under 16 — including school or youth pilot programs — requires a separately approved consent model before implementation. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at info@cmejobs.com. If we become aware that we have collected personal data from anyone under 16 without verification of parental consent, we will take steps to remove that information promptly.

13. International Data Transfers

CME is a Canadian platform. Some of our service providers and subprocessors — including Stripe and AWS — may process data in other jurisdictions, including the United States and other countries in which those providers operate. Your information may be subject to applicable foreign laws in those jurisdictions. Where data is transferred outside of Canada, we ensure adequate safeguards are in place through contractual data processing agreements to protect your information to a standard comparable to Canadian and, where applicable, European privacy law.

Your consent to this Privacy Policy followed by your submission of personal information represents your agreement to such transfers.

14. Links to Third-Party Sites

The Platform may contain links to other websites or services that are not operated by us. If you click on a third-party link, you will be directed to that party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date and version number. For material changes, we will provide notice through the Platform or by email before the change becomes effective.

You are advised to review this Privacy Policy periodically for any changes. Changes are effective when they are posted on this page.

16. Contact Us / Privacy Officer

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact our Privacy Officer:

If you are a Canadian resident and are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.

If you are an EU resident, you may lodge a complaint with your local data protection supervisory authority.