Privacy Policy | Cyberphore

This Privacy Policy explains how Cyberphore Inc. ("Cyberphore", "we", "us" or "our"), a company incorporated in British Columbia, Canada, collects, uses, discloses, retains and protects personal information. It applies to information collected through cyberphore.com and its subdomains (the "Website"), through enquiries, events and marketing, and from people who contact us for business purposes.

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, the Personal Information Protection Act of British Columbia, the Personal Information Protection Act of Alberta and Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25.

1. What This Policy Does Not Cover

When we deliver security services, we process data on behalf of our clients, for example logs, alerts and system data from a client's environment. That data is handled under the written agreement with the client, who decides why and how it is processed, and under the client's own privacy policy. Questions about that data should go to the client first. This Policy covers the personal information we collect for our own purposes.

2. Our Privacy Officer

We have designated a Privacy Officer who is accountable for our compliance with this Policy and with applicable privacy law, including the duties of the person in charge of the protection of personal information under Quebec law.

Privacy Officer, Cyberphore Inc.
CF Pacific Centre, 701 West Georgia Street, Vancouver, BC V7Y 1G5, Canada
Email: privacy@cyberphore.com

3. Personal Information We Collect

Information you give us

Enquiries and assessment requests: name, work email address, company name, phone number, company size, the service you are interested in and the content of your message.
Correspondence: the content of emails, calls and meetings with us, including attachments you choose to send.
Business relationships: contact details of people at clients, prospects, suppliers and partners, and the information needed to manage that relationship, such as job title and billing contact details.
Job applications: if you apply to work with us, your résumé and the information you include in it.
Vulnerability reports: your contact details and the report you send to security@cyberphore.com.
Support requests: if you are a client, your account details on our support portal (support.cyberphore.com) and the content of the tickets, emails and attachments you send to it or to support@cyberphore.com. The portal runs on osTicket, open-source software that we host ourselves with Hostinger.

Information collected automatically

Server and security logs: when you visit the Website, our hosting provider's servers record technical information such as your IP address, browser type, the page requested, the referring page and the date and time. We use these logs to operate, secure and troubleshoot the Website.
Analytics, only with your consent: if you select "Accept analytics", Google Analytics collects information about how you use the Website, such as pages viewed, approximate location (city level), device and browser type, and how you arrived. See our Cookie Policy for details.
Choices stored in your browser: your cookie choice and recently viewed search results are stored in your own browser and are not sent to us.

We do not knowingly collect sensitive information through the Website, such as health or financial account information. Please do not include it in a form or email unless we ask for it for a specific purpose.

4. Why We Use It

We collect and use personal information only for purposes that a reasonable person would consider appropriate in the circumstances, which we identify at or before the time of collection:

to respond to your enquiry, prepare a quote or assessment and communicate with you;
to provide, manage and invoice our services and administer business relationships;
to operate, secure and improve the Website, including detecting and preventing abuse and fraud;
to understand how the Website is used, where you have consented to analytics;
to send business communications you have agreed to receive;
to assess job applications;
to meet our legal, regulatory, insurance and audit obligations and to establish or defend legal claims.

We do not use personal information to make decisions about you based exclusively on automated processing, and we do not sell personal information.

We rely on your consent, which may be express or implied depending on the sensitivity of the information and your reasonable expectations. For example, when you submit an enquiry, you consent to us using your details to respond. Analytics cookies are used only with your express consent. Where the law permits, we may collect, use or disclose personal information without consent, for example to comply with a legal obligation or investigate a breach of an agreement.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting our Privacy Officer. We will explain the likely consequences of withdrawing, for example that we may be unable to provide a service.

6. Commercial Electronic Messages

We send commercial electronic messages only in accordance with Canada's Anti-Spam Legislation (CASL): with your express consent, or where implied consent applies, such as an existing business relationship. Every such message identifies us and includes a working unsubscribe mechanism, and we act on unsubscribe requests within 10 business days. Sending us an enquiry does not by itself subscribe you to marketing.

7. When We Share It

We share personal information only as described here:

Service providers that act on our behalf, under written agreements that require them to protect the information and use it only to provide services to us. These include Hostinger (website hosting, content delivery and business email) and Google (website analytics, only with your consent).
Professional advisers, such as lawyers, accountants, auditors and insurers, under a duty of confidentiality.
Business transactions: a prospective buyer or successor in a merger, financing, acquisition or sale of all or part of our business, under an agreement that protects the information, as permitted by law.
Legal requirements: where required or permitted by law, for example in response to a valid court order, warrant or request from a government institution with lawful authority.

We do not sell, rent or trade personal information, and we do not share it for third parties' own marketing.

8. Where Information Is Stored and Processed

Our service providers may store or process personal information outside your province and outside Canada, including in the United States and the European Union. When information is outside Canada, it is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities. We assess these transfers, including as required under Quebec law, and use contractual and other measures so that the information receives protection comparable to what Canadian law requires.

Monitoring data that we process for clients of our managed security services is kept in Canadian data centres by default, under each client's agreement.

9. How Long We Keep It

We keep personal information only as long as necessary for the purposes described in this Policy, or as required by law. As a general guide:

enquiries that do not lead to a business relationship: for as long as needed to follow up, and then deleted or anonymized;
client and supplier records: for the duration of the relationship and the period afterwards needed for legal, tax and accounting purposes;
server and security logs: for a limited period needed to secure and troubleshoot the Website;
Google Analytics event data: 14 months, then deleted automatically;
job applications: for the period needed to assess the application and any legal retention requirement.

When information is no longer needed, we securely delete, destroy or anonymize it.

10. How We Protect It

As a cybersecurity company, we protect personal information with physical, organizational and technical safeguards appropriate to its sensitivity. These include encryption in transit, access limited to people who need it, multi-factor authentication, logging and monitoring, and confidentiality obligations for our team and service providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Privacy Breaches

If a breach of security safeguards involving personal information under our control creates a real risk of significant harm, or a risk of serious injury under Quebec law, we will notify the affected individuals and the relevant privacy regulator as required by law, and keep a record of the incident.

12. Your Rights

Subject to legal exceptions, you have the right to:

know whether we hold personal information about you, access it and learn how it has been used and disclosed;
ask us to correct information that is inaccurate or incomplete;
withdraw consent, as described above;
if you are in Quebec, also ask us to stop disseminating your information or to de-index a hyperlink attached to your name where the conditions in the law are met, and to receive computerized personal information you provided in a structured, commonly used technological format.

To make a request, write to our Privacy Officer at privacy@cyberphore.com. We may need to verify your identity before responding. We will respond within the time limits set by applicable law, generally within 30 days, and tell you if we need more time. Access is generally free of charge; if a fee applies, we will tell you in advance.

13. Questions and Complaints

Please contact our Privacy Officer first so we can try to resolve your concern. If you are not satisfied, you may contact the regulator that applies to you:

Office of the Privacy Commissioner of Canada: priv.gc.ca
Office of the Information and Privacy Commissioner for British Columbia: oipc.bc.ca
Office of the Information and Privacy Commissioner of Alberta: oipc.ab.ca
Commission d'accès à l'information du Québec: cai.gouv.qc.ca

14. Other Matters

Children. The Website is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16.

Third-party websites. The Website links to websites we do not control, such as regulators and technology partners. Their own privacy policies apply.

Changes. We may update this Policy to reflect changes in our practices or the law. We will post the updated Policy here with a new "last updated" date and, where the changes are significant, give additional notice.

See also our Cookie Policy and Website Terms of Use.

Privacy policy.