Privacy Policy

01About this policy

Grey Cybersecurity Solutions (“Grey Cybersecurity”, “we”, “us” or “our”) is a cybersecurity firm with its head office at 388 4th Avenue SE, Calgary, Alberta, Canada. This Privacy Policy explains how we collect, use, disclose and protect personal information through our website at grey-cybersecurity-solutions.com (the “Website”), by email and telephone, and in the course of our business with prospective and current clients, suppliers and job applicants.

We handle personal information in accordance with Alberta's Personal Information Protection Act (“PIPA”) and, where it applies, the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”). “Personal information” means information about an identifiable individual, as defined in those laws.

Information in our clients' systems. When we provide security services, we may encounter personal information held in our clients' systems. We handle that information only as needed to deliver the services, on our clients' instructions and in accordance with our written agreements with them and applicable law. This policy doesn't govern that information; questions about it should be directed to the organization responsible for it.

02Personal information we collect

Information you give us. We collect personal information you choose to provide, including:

• Contact form submissions: your name, email address, company name and phone number (both optional), the topic you select and the content of your message.
• Email, telephone and meetings: your contact details and anything you choose to share with us.
• Clients and prospective clients: business contact details, billing information and information needed to scope, deliver and support our services.
• Job applicants: your résumé and any information you include in your application.
• Security researchers: your contact details and the content of any vulnerability report you send us under our Vulnerability Disclosure Policy.

Please don't send passwords, credentials or sensitive personal information (such as health or financial information) through our contact form or by email unless we have agreed on a secure way to do so.

Information collected automatically. When you visit the Website, our hosting provider automatically records standard technical information, such as your IP address, browser and device type, the pages you request, the referring page and the date and time of each request. We use this information to deliver, maintain and secure the Website, including to detect and prevent abuse and attacks.

03Cookies and similar technologies

The Website doesn't use cookies, and it doesn't load advertising, analytics or social-media tracking tools.

If you choose to reveal our phone number or email address, the Website uses your browser's session storage to remember that choice for the rest of your visit. This setting stays on your device, isn't sent to us, and is cleared when you close your browser tab.

Our pages load fonts from Google Fonts. When your browser requests these fonts, Google receives your IP address and technical information about your browser. Google's handling of that information is governed by its own privacy policy.

If we introduce cookies or analytics tools in the future, we'll update this policy first and, where required by law, ask for your consent.

04How we use personal information

We use personal information for the following purposes:

• to respond to your enquiries and requests, including consultation requests and calls about security incidents;
• to provide, manage, support and invoice our services, and to administer our client and supplier relationships;
• to assess job applications;
• to investigate and respond to vulnerability reports;
• to operate, maintain and protect the Website and our systems, including detecting and preventing fraud, abuse and security incidents;
• to send you information about our services, but only where you've consented as described below; and
• to comply with our legal and regulatory obligations and to establish, exercise or defend legal claims.

We'll tell you about any other purpose before or at the time we collect your information. If we want to use your personal information for a new purpose, we'll ask for your consent unless the law permits or requires us to proceed without it.

05Consent

We collect, use and disclose personal information with your consent, which may be express or implied depending on the sensitivity of the information and the circumstances. For example, when you submit our contact form, you consent to us using the information you provide to respond to your enquiry.

In limited circumstances, the law permits or requires us to collect, use or disclose personal information without consent — for example, to comply with a subpoena, warrant or court order, to investigate a breach of an agreement or a contravention of the law, or in an emergency that threatens someone's life, health or security.

You may withdraw your consent at any time on reasonable notice, subject to legal or contractual restrictions. We'll explain the likely consequences — for example, that we may no longer be able to provide a service.

06Commercial electronic messages

We only send commercial electronic messages, such as news about our services, in accordance with Canada's Anti-Spam Legislation (“CASL”) — that is, with your express or implied consent. Every such message identifies us, includes our contact information and gives you a simple way to unsubscribe. We give effect to unsubscribe requests promptly, and in any event within 10 business days.

07How we share personal information

We don't sell, rent or trade personal information. We share it only as follows:

• Service providers. We use trusted providers for services such as website hosting, contact-form delivery (our contact form is processed by Web3Forms, which forwards submissions to our email), email and IT services. They may use personal information only to provide services to us and must protect it with appropriate safeguards.
• Professional advisers. We may share information with our lawyers, accountants, auditors and insurers where reasonably necessary, subject to confidentiality obligations.
• Legal requirements. We may disclose information where required or permitted by law, including in response to a subpoena, warrant or court order, or to protect the rights, property or safety of Grey Cybersecurity, our clients or others.
• Business transactions. If we're involved in a merger, acquisition, financing or sale of all or part of our business, personal information may be disclosed to the parties involved, subject to agreements requiring them to protect it and use it only for purposes related to the transaction, as permitted by law.
• With your consent. We may share information in other ways with your consent.

08Service providers outside Canada

Some of our service providers — including the provider that processes our contact form, our email and hosting providers, and Google, which serves the fonts on this Website — may collect, store or process personal information on our behalf outside Canada, including in the United States. Personal information stored or processed outside Canada is subject to the laws of that jurisdiction and may be accessible to its courts, law enforcement and national security authorities.

You may obtain written information about our policies and practices regarding service providers outside Canada, or ask questions about how those service providers collect, use, disclose or store personal information, by contacting our Privacy Officer.

09How we protect personal information

We protect personal information with reasonable administrative, technical and physical safeguards appropriate to its sensitivity, including access controls that limit information to personnel who need it, encryption of data in transit, secure configuration of our systems, and confidentiality obligations for our personnel and service providers.

No method of transmission or storage is completely secure, so we can't guarantee absolute security. If you have reason to believe your interaction with us is no longer secure, please contact us right away.

10Privacy breaches

If a breach of security safeguards involving personal information under our control creates a real risk of significant harm to individuals, we'll notify the Office of the Information and Privacy Commissioner of Alberta and, where required, the Office of the Privacy Commissioner of Canada and affected individuals, as required by law. We keep records of privacy breaches as required by law.

11How long we keep personal information

We keep personal information only as long as reasonably required for the purposes described in this policy or for legal or business purposes, such as meeting record-keeping obligations and resolving disputes. If we use your personal information to make a decision that directly affects you, we keep it long enough for you to have a reasonable opportunity to request access to it.

When personal information is no longer required, we securely destroy it or make it anonymous within a reasonable time.

12Your rights: access and correction

Subject to limited exceptions under applicable law, you have the right to:

• request access to the personal information we hold about you, and information about how it has been used and to whom it has been disclosed;
• ask us to correct personal information that is inaccurate or incomplete; and
• withdraw your consent to our collection, use or disclosure of your personal information, as described above.

You may also ask us to delete your personal information. We'll do so unless we need to keep it for legal, contractual or legitimate business reasons, which we'll explain to you.

To make a request, please write to our Privacy Officer using the contact details below. We may need to verify your identity before responding. We'll respond within the time required by law — generally within 30 days where PIPEDA applies, or 45 days under Alberta's PIPA — and will tell you if we need to extend that time and why. Access is usually free of charge; where the law permits a reasonable fee, we'll give you an estimate first.

If we refuse a request in whole or in part — for example, because providing the information would reveal personal information about someone else or confidential commercial information, or because it is protected by legal privilege — we'll explain why, as permitted by law.

Please help us keep your information accurate by letting us know if your contact details change.

13Questions and complaints

Our Privacy Officer is accountable for our compliance with this policy. If you have a question or concern about how we handle personal information, please contact our Privacy Officer first — we'll investigate and respond.

If you're not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta or, where PIPEDA applies, the Office of the Privacy Commissioner of Canada.

14Children

The Website and our services are intended for businesses and adults. We don't knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we'll delete it.

15Links to other websites

The Website contains links to websites and services we don't operate, such as Google Maps. We aren't responsible for their content or privacy practices, and we encourage you to review their privacy policies before providing them with personal information.

16Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in the law. We'll post the updated version on this page with a new effective date and, where appropriate, provide more prominent notice of significant changes. Where the law requires it, we'll obtain your consent before using personal information for a new purpose.

17Contact our Privacy Officer

Privacy Officer, Grey Cybersecurity Solutions, 388 4th Avenue SE, Calgary, Alberta, Canada

Email: Hidden from botsShow · Phone: +1 587-•••-••••Show · Or use our contact form.