Privacy and data handling statement

From sponsor companies: legal and operating names, incorporation particulars, business and tax registration numbers, registered and operating addresses, directors and beneficial owners, financial statements, banking references, insurance certificates, and the identity and contact details of the authorised signing officer.

From delegates: full name, nationality, date of birth, passport number and expiry, employer and role, contact details, a passport data-page scan, a photograph, and the signed delegate undertaking.

From platform use: account email, authentication events, upload and submission timestamps, and the decisions recorded by our reviewers.

To verify that a sponsor company is a genuine, active Canadian registered business with the standing and capacity to sponsor an exhibition delegation.

To verify the identity of each delegate attending the allocated counter and to produce the serialized invitation instrument.

To satisfy Rutalien's own audit, tax, insurance and sanctions-screening obligations, and to answer lawful requests from exhibition organisers, venue operators and public authorities.

Documents, passport scans and photographs are held in access-controlled private storage. Files are readable only by the uploading sponsor and by authorised Rutalien reviewers.

Access is enforced at the database and storage layer by row-level policies bound to the authenticated account, not by interface controls alone.

Every submission, review decision, issuance and revocation is written to an immutable audit log recording the actor and timestamp.

Exhibition organisers and venue operators, limited to the information required to admit the delegation to the allocated counter.

Insurers, auditors and professional advisers under confidentiality, where necessary for the operation of the allocation.

Public authorities in Canada where disclosure is required by law or by a valid legal process.

Public serial verification discloses only the serial, status, sponsor company name, exhibition, venue, counter reference, delegate count, issuance date, expiry and issuing officer. Delegate particulars are never published.

Corporate and delegate records are retained for seven years from the date of issuance or final refusal, then securely destroyed.

Rejected or withdrawn files are retained for two years to evidence the decision, unless a longer period is required by law.

Revoked instruments remain verifiable for their full retention period so that counterparties can confirm the revocation.

Sponsors may access, correct or complete the corporate and delegate records they have submitted through the sponsor portal at any time before submission for review.

Delegates may request access to, or correction of, the personal information Rutalien holds about them by writing to the compliance desk through the sponsor company. Requests are answered within thirty days.

Requests to erase records that Rutalien is legally required to retain will be refused, with the legal basis stated in writing.