Privacy policy

1Who we are

SentiaSec is a business operated in Montréal, Quebec. It offers organizations a managed phishing simulation and employee training program.

This policy applies to the personal information we collect when you write to us, when you visit this website and when we carry out a mandate for a client. Unless otherwise stated, the sections cited refer to Quebec's Act respecting the protection of personal information in the private sector (CQLR, chapter P-39.1), referred to below as “the Quebec Act”.

2Person in charge of the protection of personal information

The person in charge of the protection of personal information answers any question, request or complaint about your personal information.

Title

Business owner

Email

contact@sentiasec.com

Subject line

“Privacy”

3What we collect

When you write to us

We receive what your message contains: your name, your email address, the name of your organization and whatever you choose to tell us.

When you visit this website

• No forms, no cookies, no audience measurement tools, no advertising.
• To display the page, our host Netlify technically receives your IP address.
• If you pause the animation on the home page, that choice is stored in your browser only. It is never sent to us.

When we carry out a mandate

To deliver the program to a client, we process information about its employees: name, work email address, department, and results in simulations and training.

We process this information on behalf of the client, which remains responsible for it. It is hosted on a vendor partner's security awareness platform. The hosting region is confirmed to the client in writing before anything is signed.

4Why we use it

We use your personal information only to:

• Display this website (your IP address, received by our host).
• Reply to your message.
• Prepare and carry out a mandate.
• Invoice our services.
• Handle your requests and complaints, and meet our legal obligations.

We never sell your personal information. We never market our services to our clients' employees.

5Who may have access to it

Within SentiaSec, only our two specialists have access to it. We also use the following providers:

• Microsoft: email (Microsoft 365).
• Netlify, a company based in the United States: website hosting and delivery.
• Our vendor partner: simulation and training platform, for mandates only.

Communication outside Quebec

Some of these providers operate outside Quebec. Your personal information may therefore be communicated outside Quebec.

Before communicating personal information outside Quebec, we undertake to first assess the protection it would receive there. We take into account, in particular, its sensitivity, the purposes for which it would be used, the protection measures that would apply, including contractual ones, and the laws of the place where it would be communicated. We undertake to communicate it only if that protection is adequate, and to cover the communication with a written agreement (s. 17).

6How long we keep it

• If you wrote to us without becoming a client: 24 months after the last exchange, then deleted.
• During a mandate: for the term of the contract only. The contract sets out in writing how we return the information to the client and destroy it when the contract expires; we keep none of it afterwards.
• After these periods: we keep no personal information.

The only exception: invoices and accounting records, kept for as long as tax laws require.

7Our governance practices

The Quebec Act requires every business to establish policies and practices governing the protection of personal information (s. 3.2). Here are ours.

Roles and responsibilities

• The person in charge of the protection of personal information approves our policies and practices.
• They keep the register of confidentiality incidents.
• They handle requests for access and rectification, as well as complaints.
• Within SentiaSec, only our two specialists have access to personal information, through accounts protected by two-factor authentication.

Confidentiality incidents

If we have reason to believe that a confidentiality incident has occurred, we take reasonable measures to reduce the risk of injury and to prevent a similar incident, and we record the incident in our register (ss. 3.5 and 3.8). For information we hold on our own behalf, if the incident presents a risk of serious injury, we promptly notify the Commission d'accès à l'information and the persons concerned (s. 3.5). For information we process on behalf of a client, we notify the client's person in charge of the protection of personal information without delay. The client then gives the notices required by law, and we help it do so.

Complaints

To complain about how we handle your personal information, write to the person in charge at contact@sentiasec.com, subject line “Privacy”. We reply in writing. You may also file a complaint with the Commission d'accès à l'information at any time (s. 81).

Requests for access and rectification

Your request must be made in writing, and you will need to confirm your identity (s. 30). We reply in writing no later than 30 days after receiving it (s. 32).

If we refuse your request, or do not reply within that time, you may submit the disagreement to the Commission d'accès à l'information within 30 days of the refusal or of the end of that period (ss. 42 and 43).

8Your rights

In Quebec

• Access: find out whether we hold personal information about you, and obtain a copy (s. 27).
• Portability: receive the computerized information you provided to us in a structured, commonly used technological format, unless doing so raises serious practical difficulties (s. 27).
• Rectification: have information corrected if it is inaccurate, incomplete or equivocal, or if its collection, communication or keeping is not authorized by law (s. 28).
• Withdrawal of consent: withdraw your consent to the communication or use of your information (s. 8).

To exercise these rights, write to the person in charge (section 2). Time limits and recourse are described in section 7.

Elsewhere in Canada

Where the Personal Information Protection and Electronic Documents Act (PIPEDA) applies, you may also request access to your personal information and its correction (Schedule 1, Principle 4.9). You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice (Principle 4.3.8). You may file a complaint with the Office of the Privacy Commissioner of Canada (s. 11 of PIPEDA).

In the European Union

Where the General Data Protection Regulation (GDPR) applies, you have, under the conditions it sets out, the rights of access, rectification, erasure, restriction of processing, data portability and objection (Arts. 15 to 18, 20 and 21 of the GDPR). Where processing is based on your consent, you may withdraw it at any time (Art. 7). You may also lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77).

Our legal bases (Art. 6 of the GDPR): performance of a contract or of steps taken at your request before entering into a contract, to answer a request for our services, carry out a contract and invoice it; our legitimate interests in replying to the other messages we receive, displaying this website securely and keeping our accounting records. For information we process on behalf of a client, the client determines the legal basis.

Are you an employee of one of our clients? Your employer remains responsible for the information processed during the program. Please send your request to your employer first. If you write to us, we forward it to your employer and help them respond.

9Changes to this policy

Any change to this policy is announced on this page, with its update date. We also notify our clients, and the people we correspond with, by email.