Data Processing Addendum

Effective October 12, 2026

This addendum is part of the Terms of Service. "The campaign" means the organisation that signs up to KnockTurf; "KnockTurf" means 14407831 Canada Inc.

1. Roles

The campaign is the organisation responsible for the personal information it puts into KnockTurf and that its canvassers record. KnockTurf is its service provider and handles that information only on the campaign's instructions, which are these terms and the campaign's choices in the dashboard.

2. Purposes

KnockTurf processes the information only to show the campaign's doors on a map, record door visits and answers, show the campaign its results, send the messages the campaign asks it to send and, where the campaign has switched names on, keep the list of people at each address.

It does not sell the information, combine it with another campaign's, or use it to build profiles or for its own marketing. KnockTurf counts visits to bill the campaign and may use statistics that identify no one to run and improve the service. KnockTurf staff access a campaign's data only when needed to support that campaign, keep the service secure, or comply with the law, and are bound to keep it confidential.

3. Voters' lists

A voters' list issued under elections law may be used only for the purposes that law allows; in Ontario, a list from a municipal clerk may be used for election purposes only. The campaign confirms it is entitled to hold any list it uploads and will use it only for those purposes. KnockTurf holds the list for the campaign under the same restriction and uses it for nothing else.

4. Retention and deletion, with notice

Before names can be switched on, an administrator chooses either deletion a number of days (1 to 365) after voting day, or keeping the names until the campaign deletes them. A campaign that chooses to keep names remains responsible for holding them only as long as the law allows.

A campaign can also choose a date, at least 30 days away, on which its names and the contact details typed on visits are deleted. Closing a campaign sets such a date. For a campaign with no voting day, such as a marketing or advocacy campaign, a chosen date is the only way deletion is scheduled; if it sets neither, nothing is deleted automatically, and the dashboard says so.

No scheduled deletion happens without notice:

1. Every administrator is emailed individually at least 30 days before deletion, then 7 days and 1 day before.
2. If the first notice cannot be delivered to every administrator, or no administrator has an email address, the deletion does not happen.
3. Deletion takes place only after the announced day, and only if the voting day, number of days and date are still those the notice was sent for. Changing any of them starts a new notice period.

KnockTurf staff may also schedule a campaign's deletion, with the same notice, for example when an account is ending or the law requires it.

The campaign can download everything held about it at any time, and each download is logged. It can also delete all its names, or clear the contact details typed on visits, immediately from the dashboard by typing a confirmation; each is recorded, and for names the other administrators are emailed.

What is deleted: the people and their answers; any name, phone number or email recorded on door visits, including phone and email answers; the stored copies of contact messages sent to those people (blanked); and any uploaded list still waiting for confirmation.

What stays: the door-visit records, including free-text answers and notes canvassers typed, which may contain names and which the campaign should review; the address list and its saved copies, which hold addresses only; and records of downloads, requests and deletions, which hold no names.

A name, phone number or email typed on a door visit is stored on that visit whether or not names are switched on, and is cleared by these deletions. Switching names off stops their use but deletes nothing.

5. Requests about one person

A person on a campaign's list may ask the campaign what it holds about them, ask for a correction, ask not to be contacted, or ask to be removed. Administrators have a screen to answer: search the campaign's people; see everything held about one person, including phone and email typed on visits at their door; download it; correct their name, phone, email or unit; mark them do-not-contact; or remove them with a typed confirmation.

Removal deletes the person and their answers, clears the name, phone and email typed on visits at their door, and blanks the stored copies of contact messages sent to them. Visit notes and free-text answers that mention them are listed for the campaign to edit, not changed automatically.

Removal works even when names are switched off. Then search needs at least 3 characters, shows at most 20 results with initials only, and download and correction are unavailable. A full download from the dashboard includes names regardless.

When someone is marked do-not-contact or removed, KnockTurf keeps a keyed, one-way hash of their email and phone number, with no name. It stops permission to contact being recorded again, keeps them from contact messages and leaves them off call sheets. Someone who already has the same email or number could test it against this list, and a shared email or household phone may also hold back another person; an administrator can override this for someone who gives their own consent, and each override is logged.

Each request is logged with who acted, when, what was done, the person's record number and counts, but no names, emails or phone numbers. If a person writes to KnockTurf instead of the campaign, KnockTurf passes the request to the campaign's administrators promptly and helps them respond.

6. Stored copies and backups

• Saved copies of an address list hold addresses, wards, polls and counts only, never names; automated tests check this.
• An uploaded voters' list waiting for confirmation does hold names. It is kept for at most 30 minutes and deleted on confirmation, cancellation, regular clean-up or any whole-campaign deletion.
• Copies of contact messages sent from a visit (recipient email or phone and the greeting) are kept as an audit record for the campaign that sent them, and blanked when the person is removed or the campaign's names and contact details are deleted. Older copies with no campaign recorded are blanked when their recipient matches an email or phone on that campaign's own visits or people.
• A database backup is taken before each software update. It contains the data as it was at that moment, is kept for up to 30 days and is then deleted automatically. Any snapshots of the whole server are kept only as long as needed to recover the service, then deleted. KnockTurf does not edit backups, so deleted information remains in them until they expire, and they are restored only to recover the service.
• Files the campaign downloads are outside KnockTurf and are the campaign's responsibility.

7. Service providers

KnockTurf will email administrators at least 30 days before adding or replacing a provider that handles a campaign's personal information. A campaign that objects may close its account and receive a refund of unused credit. KnockTurf requires each provider to protect the information to a standard comparable to this addendum.

8. Security

Encrypted connections; uploaded lists stored privately, encrypted at rest and reached only through short-lived links; hashed passwords and expiring sessions. Each campaign's data is kept apart, so a user can reach only their own campaign, and a canvasser sees names only at doors in the areas assigned to them. Downloads of names and contact details are logged.

9. Breaches

If KnockTurf learns that a campaign's personal information has been lost, or accessed or disclosed without authority, it will tell the campaign's administrators without undue delay and no later than 72 hours after confirming it. The notice will say what happened, what information was involved, who may be affected, and what is being done, and KnockTurf will update it as it learns more.

The campaign decides whether the breach creates a real risk of significant harm and whether to notify the Privacy Commissioner and the people affected; KnockTurf will help. KnockTurf keeps a record of every breach for at least 24 months.

10. Legal demands

If a court, police force or other authority demands a campaign's information from KnockTurf, KnockTurf will disclose only what it is legally required to, and will tell the campaign first unless the law forbids it.

11. Consent to contact, and anti-spam

Permission to contact someone is recorded only when the canvasser ticks it, with the exact question shown, who asked and when. The question shown is:

May we contact you about [campaign name] by phone or email?

The contact message KnockTurf sends after a canvasser records a person's details identifies the campaign, gives its contact details and includes a working way to unsubscribe. The campaign is responsible for whether that consent and its messages satisfy Canada's anti-spam legislation and privacy law, including identifying itself and honouring opt-outs within 10 business days. People who say they do not want to be contacted are flagged and left off call sheets. Calls and messages the campaign makes outside KnockTurf are the campaign's own responsibility.

12. When the service ends

When a campaign closes, its names and the contact details typed on visits are deleted on the scheduled date as section 4 describes, and the campaign can download everything first. On the campaign's written request to privacy@knockturf.com, KnockTurf deletes everything else it holds for the campaign, including door-visit records, the address list and canvasser accounts, within 30 days of the request or of the scheduled deletion date if later, and confirms in writing. Backups expire within a further 30 days. KnockTurf keeps only the billing and tax records the law requires, and the logs described in section 5, which hold no names.

Privacy Policy · Terms of Service · Data Processing Addendum