Privacy Policy

1. INTRODUCTION

1.1 Commitment to Privacy

ThinSky ("ThinSky," "Company," "we," "us," or "our") is committed to protecting the privacy and security of personal information. As a cybersecurity services provider, we understand the critical importance of data protection and handle all personal information in accordance with Canadian privacy laws.

1.2 Scope of This Policy

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you:

• Visit our website at www.thinsky.com;
• Engage our cybersecurity services;
• Communicate with us via email, phone, or other channels;
• Apply for employment with us;
• Interact with us at events or conferences.

1.3 Applicable Legislation

This Privacy Policy is designed to comply with:

• Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5;
• Canada's Anti-Spam Legislation (CASL), S.C. 2010, c. 23;
• Quebec's Act respecting the protection of personal information in the private sector (Law 25);
• Other applicable provincial and federal privacy legislation.

2. PIPEDA FAIR INFORMATION PRINCIPLES

ThinSky adheres to the ten (10) Fair Information Principles set out in Schedule 1 of PIPEDA:

Principle	Our Commitment
1. Accountability	We are responsible for personal information under our control
2. Identifying Purposes	We identify the purposes for collection at or before the time of collection
3. Consent	We obtain meaningful consent for collection, use, and disclosure
4. Limiting Collection	We collect only information necessary for identified purposes
5. Limiting Use, Disclosure, and Retention	We use information only for stated purposes and retain it only as long as necessary
6. Accuracy	We keep personal information accurate, complete, and up-to-date
7. Safeguards	We protect personal information with appropriate security measures
8. Openness	We make our privacy policies and practices readily available
9. Individual Access	We provide individuals access to their personal information
10. Challenging Compliance	We have procedures to receive and respond to complaints

3. PERSONAL INFORMATION WE COLLECT

3.1 Categories of Personal Information

(a) Identity and Contact Information

• Full name, job title, and organization
• Business address, phone number, and email address
• LinkedIn profile URL

(b) Technical and Access Information

• IP address, browser type and version, device information
• Operating system, access credentials (for service delivery)
• Log data and usage information

(c) Financial and Billing Information

• Billing address, payment card information (processed by third-party payment processors)
• Bank account information for wire transfers

(d) Service-Related Information

• Security assessment findings, system configurations
• Network diagrams, vulnerability data, incident reports

3.2 Information We Do NOT Intentionally Collect

• Social Insurance Numbers (SIN), except where required by law for employment;
• Health information, except as incidentally disclosed;
• Biometric data;
• Information about children under 18.

4. PURPOSES FOR COLLECTION, USE, AND DISCLOSURE

Purpose	Description
Service Delivery	To provide cybersecurity services, including assessments, monitoring, and consulting
Contract Administration	To manage contracts, invoicing, and payment processing
Communication	To respond to inquiries, provide support, and send service-related communications
Security Operations	To perform security monitoring, incident response, and threat analysis
Legal Compliance	To comply with legal obligations, court orders, and regulatory requirements
Business Operations	To manage our business, including quality assurance and service improvement

5. CONSENT

We obtain consent through express consent (written agreements, checkbox acknowledgments, email opt-in) and implied consent (providing business contact information for service inquiries).

You may withdraw consent at any time by contacting our Privacy Officer or using unsubscribe links in marketing emails.

6. DATA RETENTION

Information Type	Retention Period
Client contracts and records	7 years after termination of services
Financial and tax records	7 years (as required by CRA)
Security assessment reports	Duration of engagement plus 3 years
Marketing contacts	Until consent is withdrawn
Website analytics	26 months (anonymized thereafter)
Employment applications (unsuccessful)	1 year

7. SECURITY SAFEGUARDS

As a cybersecurity company, we implement robust security measures including:

• Encryption: AES-256 encryption for data at rest; TLS 1.3 for data in transit
• Access Controls: Role-based access control (RBAC); multi-factor authentication (MFA)
• Network Security: Firewalls, intrusion detection/prevention systems, VPNs
• Monitoring: 24/7 security monitoring, log management, SIEM

8. YOUR PRIVACY RIGHTS

Right	Description
Access	View the personal information we hold about you
Correction	Correct inaccurate information
Deletion	Request deletion (subject to legal requirements)
Portability	Receive your data in portable format (Quebec residents)
Withdraw Consent	Stop certain processing activities

We will respond to all requests within 30 days.

9. COOKIES AND TRACKING

We use cookies and similar technologies to improve your experience. You can control cookies through your browser settings or our cookie consent banner.

10. PRIVACY OFFICER AND CONTACT

Privacy Officer
ThinSky
Email: privacy@thinsky.com

We will acknowledge receipt of all privacy inquiries within 5 business days and provide a substantive response within 30 days.

11. COMPLAINTS

If you are not satisfied with our response, you may file a complaint with:

Office of the Privacy Commissioner of Canada (OPC)
30 Victoria Street, Gatineau, Quebec K1A 1H3
Phone: 1-800-282-1376
Website: www.priv.gc.ca

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice before the changes take effect.