Privacy Policy
Kapa Cyber Canada ("we", "us", or "our") is committed to protecting the privacy of visitors to our website and the individuals we do business with. This policy explains what personal information we collect, who else it reaches, and the choices available to you. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.
Information we collect
We collect personal information that you choose to give us. There are three ways that happens:
- Our contact form — your name, email address, company name, and the contents of your message.
- Our resource pages — the cybersecurity checklist, the breach readiness check, the cyber-insurance readiness check, the Quebec Law 25 readiness check, and the CPCSC Level 1 readiness check each offer to email you a copy. If you use that, we collect your name and email address, and which resource you asked for.
- Booking a call — the "book a call" links on this site go to Calendly, a third-party scheduling service. Whatever you enter there is collected by Calendly under its own privacy policy and shared with us.
The readiness checks themselves score your answers in your own browser. Your answers are never transmitted to us or stored anywhere — only your name and email are sent, and only if you ask for the emailed copy.
What we do and do not store
We want to be precise about this, because it is unusual. When you submit any form on this site, the contents are passed to Brevo, our email service provider, which delivers them to our inbox as an email. We do not operate a customer-relationship management system or a database, and this website has no server-side storage of its own. Your information exists in our email inbox and in Brevo's systems — nowhere else that we control.
Transfers outside Canada
Brevo is a French company, so personal information you submit through this site is transferred outside Canada and processed in the European Union. While it is outside Canada, it is subject to the laws of that jurisdiction, and may be accessible to foreign courts, law enforcement, and regulatory authorities under those laws. Cloudflare and Google, described below, are United States companies and may likewise process data outside Canada. PIPEDA requires us to tell you this before you decide whether to send us anything.
How we use your information
We use the information you provide to respond to your inquiries, send you the resource you asked for, communicate with you about your request, and meet our legal and regulatory obligations. We do not sell your personal information.
Consent
By submitting information through a form on this site, you consent to us using that information to respond to and follow up on your inquiry. You may withdraw your consent at any time by contacting us, subject to legal and contractual restrictions.
Service providers and third parties
These are every third party that receives data through this website:
- Cloudflare (United States) — hosts this website and serves it through its network. Every request you make to this site, including your IP address, passes through Cloudflare's infrastructure.
- Cloudflare Web Analytics — measures page views. It is cookieless: it sets no cookie, assigns you no cross-site identifier, and stores nothing on your device. Because it cannot track you, it runs without asking your permission.
- Google Analytics 4 (United States) — website
analytics. It sets cookies on your device (including
_ga) and loads only if you opt in using the cookie banner. Beyond page views, we record when a visitor completes one of the readiness checks, including the resulting score, band, and number of gaps identified — never the individual answers. - Ahrefs Web Analytics (Singapore) — a second analytics tool, reporting traffic and referral data. It also loads only if you opt in to analytics.
- Brevo (France) — the email service that receives every form submission from this site and delivers it to us, and that sends you the resource you requested. See "Transfers outside Canada" above.
- Calendly (United States) — third-party scheduling, used by the "book a call" links. It collects whatever you enter into its booking form.
We may also disclose information where required by law.
Cookies and storage on your device
Nothing that sets a cookie loads on this site until you choose to allow it. When you first visit, a banner asks you to decide, with analytics and marketing both switched off by default. You can change your choice at any time using the Cookie settings link in the footer.
Whatever you choose, this site stores the following on your device:
-
theme— remembers whether you chose the light or dark version of the site. -
consent— remembers the cookie choice you made, so you are not asked again.
Both are stored in your browser's local storage, are readable only by this site, and are never sent to us. If you opt in to analytics, Google Analytics will additionally set its own cookies, which are governed by Google's privacy policy rather than this one. You can clear all of it through your browser settings.
Data retention
We keep personal information only as long as necessary to fulfil the purposes described in this policy or as required by law, after which it is securely deleted. Because your information lives in our email inbox and in Brevo, deleting it means deleting it from both.
How we protect your information
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information to protect it against loss, theft, and unauthorized access, use, or disclosure.
Your privacy rights
Subject to applicable law, you have the right to access the personal information we hold about you, to request corrections, to ask that we delete it, and to ask questions about how it is handled. To exercise these rights, contact us using the details below.
Third-party links
Our website links to third-party sites. We are not responsible for the privacy practices of those sites and encourage you to review their policies.
Changes to this policy
We may update this policy from time to time. The "last updated" date above reflects the most recent revision.
Contact us
If you have questions about this policy, want to exercise any of the rights above, or want your information deleted, contact us at info@kapacyber.ca.