Digital Front DeskA visitor-management demonstration usually starts with a tablet and a welcome screen. Before choosing a system, follow the information behind that screen: what is collected, where it goes, who can see it and how it is removed.
These five questions give Canadian small-business owners a practical starting point for a supplier conversation. They are not a compliance assessment or legal advice. The rules that apply can differ by province, sector, organisation and activity.
The Office of the Privacy Commissioner of Canada identifies accountability, identifying purposes, consent, limiting collection, limiting use and retention, safeguards and openness among PIPEDA's principles. Its overview also explains the role of substantially similar provincial laws and personal-health-information legislation. Read PIPEDA requirements in brief.
1. What visitor information do we need—and why?
Ask for a list of every field the system can collect and which fields are required by default. Separate a field's availability from your need to use it.
For each field, finish the sentence: "We collect this because…" If nobody can explain the purpose, question whether the field belongs in your check-in process. A host's name may help reception route a visitor; a photograph or identity-document scan needs a separate, considered justification.
Check whether you can disable optional fields and whether visitors can understand the request. Do not use an open-ended visit-purpose box as an invitation to enter sensitive medical, legal or family information unnecessarily.
Ask the supplier: "Can you show the minimum-data configuration, including everything that still appears in logs, notifications and exports?"
2. Where is data stored, and where else is it processed?
"Hosted in Canada" is a useful fact to investigate, but not a complete data-flow description. Ask separately about the application, database, uploaded files, backups, support access, email, SMS, analytics and optional AI services.
Storage location and processing location can be different. A Canadian database does not prove that every notification provider or support tool processes all data only in Canada.
The OPC's cross-border guidance explains that PIPEDA does not prohibit transfers to another jurisdiction for processing, while organisations remain accountable for protecting information under outsourcing arrangements. That guidance has scope limitations and is not a universal answer for provincial, public-sector or sector-specific requirements. Read the OPC cross-border processing guidance.
Ask the supplier: "Can you provide a current data-flow and processor list, including optional features, backup locations and contractual protections?"
Digital Front Desk's public visitor page describes Canadian storage for its application, database and files. Buyers should still review the current privacy information and ask about the complete processing chain before deciding whether it fits their requirements.
3. Who can see, export or change visitor records?
Think beyond the reception screen. Identify who can view today's arrivals, search historical visits, download a CSV, edit staff access, or change retention settings. Ask how administrative accounts are protected and how access is removed when someone leaves.
Notifications are part of access control too. Does an arrival message reveal more than the recipient needs? Can a forwarded link expose visitor details? Does a shared tablet show previous visitors' names?
Exports need particular attention. A spreadsheet downloaded to a personal laptop creates another copy outside the application's own controls. Decide who may export it, where it may be kept and when it should be deleted.
Ask the supplier: "Please demonstrate access for an ordinary staff member and an administrator, including what each can export and what happens when access is revoked."
4. How long is each type of information retained?
Avoid choosing a retention period simply because it is the software's default. Establish a schedule based on your stated purposes and applicable obligations, then check whether the system can implement it.
Ask about typed visitor details, photographs, ID images, visit timestamps, audit logs, notification records and backups separately. These may not have identical lifecycles.
Also distinguish hiding a record from deleting information. Removing an entry from a screen does not prove its data has been erased. Ask what happens to shared visitor profiles, downloaded files and copies held by subprocessors when an individual visit is removed.
Ask the supplier: "Can you demonstrate the difference between hiding a visit, deleting its details and closing our account, and explain any information retained afterward?"
5. What do visitors need to know, and whom can they contact?
A short check-in notice should help visitors understand the collection instead of surprising them after they submit a form. Explain the purpose, relevant uses and how to find the fuller privacy information. Make it clear how someone can ask questions or request access or correction where applicable.
A notice is not a substitute for determining the appropriate consent and legal basis for your circumstances. Avoid bundling unrelated marketing permission into the routine act of announcing an arrival. Offer a staff-assisted route for people who need help understanding or using the screen.
Ask the supplier: "Can we customise the visitor notice and show our privacy contact without hiding the essential information behind an unreadable block of text?"
Turn the answers into a buying checklist
Keep a short record of the supplier's answers, supporting documents, unresolved questions and who will review them. A verbal assurance is less useful than a specific configuration, documented policy or demonstrated control.
Before going live, test the chosen fields, staff permissions, notifications and deletion behaviour with demo records. Have the person responsible for privacy review the real configuration—not just the marketing page. Get specialist advice for regulated or sensitive settings.
For a step-by-step operational guide, read Replacing Your Paper Visitor Log: A Guide for Canadian Small Businesses. To see our own workflow, explore Digital Front Desk visitor management or ask for a demonstration.
Questions about visitor-data privacy in Canada
Does visitor-management software have to store all Canadian visitor data in Canada?
There is no single answer for every organisation. The OPC's PIPEDA guidance does not impose a blanket ban on cross-border processing, but accountability remains and other laws, contracts or sector requirements may apply. Ask about both storage and processing and seek advice for your circumstances.
Is Canadian hosting enough to make visitor check-in software PIPEDA compliant?
No. Hosting location does not establish how your organisation collects information, explains its purposes, manages consent, controls access or applies retention rules. Review the full workflow and supplier arrangements rather than relying on a hosting label.
How long should a small Canadian office keep visitor sign-in records?
Choose a period justified by your purposes and applicable obligations; there is no universal period supplied by this guide. Document the decision and confirm that the software handles the relevant information types and exceptions as required.
Should a clinic ask visitors to enter health information at a reception kiosk?
Do not assume a general visitor check-in system is suitable for collecting clinical information. Determine what reception actually needs, which health-privacy rules apply, and whether the collection and safeguards are appropriate. Use a properly reviewed clinical workflow when needed.
Can a visitor sign-in system send arrival alerts without exposing the full visitor record?
That depends on the product and its configuration. Ask to inspect the actual notification, recipient rules and linked pages. Test who can open a link and whether the message contains only the information needed for the arrival workflow.
Does deleting a visitor from the screen also delete their photographs and backups?
Not necessarily. Hiding a visit, deleting a profile, removing media and expiring backups can be separate operations. Ask the supplier to explain and demonstrate each one, including any copies in exports or third-party services.
What should we ask a visitor-software supplier before signing a contract in Canada?
Ask for its collection defaults, complete data-flow and processor list, access controls, retention/deletion behaviour, incident process, export options and contract terms. Review the answers against your actual organisation's needs rather than accepting a general compliance slogan.
This article provides general buying guidance, not legal advice. Follow the linked official guidance and obtain qualified advice about the laws and obligations that apply to your organisation.