Privacy Policy

Privacy at a Glance

• What we do: ISA Cybersecurity (ISA) is a Canadian cybersecurity and AI services company. We collect Personal Information primarily from clients, prospective clients, employees, job applicants, and website visitors.
• What we collect: Contact details, billing information, employment-related information for applicants, and limited website usage data.
• Who we share with: Authorized service providers under contractual safeguards, and only as needed to deliver our services.
• Your rights: You can access, correct, or withdraw consent regarding your Personal Information at any time by contacting our Privacy Officer at info@isacybersecurity.com or 1-877-591-6711.
• Where it lives: Primarily in Canada, with limited service-provider processing as described in this policy.

 

Overview 

At ISA Cybersecurity Inc., we are committed to protecting your privacy and safeguarding your personal and business information. This Privacy Policy applies to ISA Cybersecurity Inc. and its affiliates (collectively, “ISA”, “we”, “our” or “us”).  

This Privacy Policy describes the types of Personal Information that ISA collects, our practices relating to the collection, use, disclosure and protection of your Personal Information, the choices you have regarding such use and disclosure, and how you may access or correct that information.  

ISA collects, uses and discloses Personal Information with your consent or as otherwise permitted or required by applicable law. This Privacy Policy applies to Personal Information we collect directly from you, indirectly from third parties, and in the course of providing our services.  

As a Canadian organization operating across Canada, we designed this Privacy Policy to meet the standards prescribed by the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and, where applicable, substantially similar provincial private-sector privacy legislation, including the Personal Information Protection Act (British Columbia), the Personal Information Protection Act (Alberta), and An Act respecting the protection of personal information in the private sector, as amended by An Act to modernize legislative provisions as regards the protection of personal information (Law 25) (Québec).  

ISA primarily stores and processes Personal Information in Canada. Some service providers we use may process limited Personal Information outside Canada as part of their global infrastructure. Where this occurs, we ensure that appropriate contractual safeguards are in place to protect your Personal Information consistent with Canadian privacy law.  

We collect only the Personal Information that is necessary to fulfill the purposes identified in this Privacy Policy. We do not collect Personal Information indiscriminately, and we limit the amount and type of Personal Information we collect to what is reasonable in the circumstances.  

ISA has designated a Privacy Officer who is responsible for compliance with this Privacy Policy and applicable privacy laws. If you have any questions about this Privacy Policy or our privacy practices, or wish to exercise your privacy rights, you may contact our Privacy Officer by email at info@isacybersecurity.com, through the contact form at https://isacybersecurity.com/contact-us, or by calling 1-877-591-6711. For inquiries from Québec residents, our Privacy Officer also serves as the person responsible for the protection of personal information under Québec Law 25.  

From time to time, we may make changes to this Privacy Policy. The Privacy Policy is current as of the “last revised” date that appears at the bottom of this page.  

 

1. What is Personal Information? 

“Personal Information” means information about an identifiable individual, as defined under PIPEDA and applicable provincial privacy legislation. Examples include your name, mailing address, telephone number, email address, date of birth, financial information (such as billing or payment details), and any other information that, alone or in combination, can identify you.  

Personal Information does not include business contact information (such as your name, title, business address, business email, or business telephone number) collected and used solely for the purpose of communicating with you in your professional capacity, in accordance with section 4.01 of PIPEDA.  

 

2. How do we collect your Personal Information? 

We will always collect your Personal Information by fair and lawful means (e.g., when you engage us to provide services, use the ISA website, or speak to an ISA representative). We collect Personal Information from you and from third-party service providers, where we have obtained your consent to do so or as otherwise permitted by law.  

From time to time you may voluntarily provide ISA with unsolicited Personal Information – that is, other than where ISA has requested same (for example, through the ISA websites). If you choose to provide such information, ISA will handle it in accordance with this Privacy Policy and applicable law. Further, when providing such unsolicited information, we ask that you not provide any sensitive information.  

We use cookies and similar technologies on our website to support functionality, improve user experience, and analyze website usage. These technologies may collect information such as browser type, device information, and interactions with our website. Some cookies may be placed by third-party service providers who assist us with analytics and website performance. These third-party providers may process information in accordance with their own privacy policies; however, ISA remains responsible for Personal Information under its control and requires such providers to implement appropriate safeguards.  

Where required by applicable law, we obtain your express consent before deploying non-essential cookies or similar tracking technologies. You may withdraw your consent at any time through our cookie preference settings or by contacting us directly. Please note that disabling cookies may affect the functionality of certain parts of our website.  

In addition, in order to properly manage our website, we may anonymously log activity on our operational systems, and categorize visitors based on details such as domains and browser types. This information is reported only in aggregate to our marketing and web analytics teams.  

ISA understands the importance of protecting children’s privacy. Our websites and services are not directed at children under the age of 14. We do not knowingly collect Personal Information from minors without appropriate consent from a parent or legal guardian. If you believe that a minor has provided Personal Information without appropriate consent, please contact us so that we can take appropriate steps.  

 

3. Where do we store your Personal Information? 

We primarily store Personal Information in Canada on secure systems managed by ISA or its authorized service providers. Where service provider infrastructure involves limited processing outside Canada, appropriate contractual safeguards are in place.  

 

4. How do we use your Personal Information? 

We identify the purposes for which we use your Personal Information at the time we collect such information from you and obtain your consent, in any case, prior to such use. We generally use your Personal Information for the following purposes (the “Purposes”):  

 

○  Service delivery & billing

• to contact you in connection with the delivery of managed security services, professional services, and other service-related activities
• to process and deliver products that you have ordered from us
• to invoice and collect payment for professional services and products provided by us to you

 

○  Relationship & communications

• to develop and maintain our relationship with you and communicate with you
• to provide answers to your questions asked via the website
• to provide you with copies of our publications which you may subscribe to via our website

 

○  Events, engagement & feedback

• to register you for events and conferences
• to gather your opinion and feedback through surveys
• to obtain feedback from you about our services
• to enroll you in our promotional programs

 

○  Website & internal operations

• to improve the content of the website
• to notify you about the updates to our website
• to customize the content and/or layout of our website for each individual user, so that it is more relevant and easier to navigate for each individual user
• for internal record keeping

 

○  Marketing communications 

• We may use your contact information to send you marketing communications about our products, services, events, and other information that may be of interest to you. These communications are sent by email only.
• When you provide us with your contact information, you will have the option to indicate that you do not wish to receive marketing communications from us. We rely on consent to send marketing emails, where required by applicable law, and we do so in accordance with Canada’s Anti-Spam Legislation (CASL). If you choose to opt out, we will not send you marketing emails.
• You may withdraw your consent or update your preferences at any time by contacting us by email at info@isacybersecurity.com, through the contact form at https://isacybersecurity.com/contact-us, or by calling 1-877-591-6711.
• If you are a customer or have otherwise requested information from us, we may continue to send you service-related or informational communications as permitted by law, unless you opt out. All marketing communications include an unsubscribe mechanism that allows you to withdraw your consent at any time.

 

○  Employment

• to process your application for employment and resume

 

○  Legal

• to comply with legal and regulatory requirements

 

○  Automated decision-making

• ISA does not make decisions based exclusively on the automated processing of Personal Information that produce legal effects or significantly affect individuals. Where automated tools are used to support our services or operations, meaningful human review remains part of any decision affecting you.

 

5. To whom do we provide your Personal Information? 

We will not transfer, disclose, sell, distribute or lease your Personal Information to third parties without your permission unless this is necessary for the reasons set out in Section 4 above, or where we are required to do so by law. We may share your Personal Information with authorized agents acting on our behalf, provided they are subject to contractual obligations consistent with this Privacy Policy.  

We identify to whom, and for what purposes, we disclose your Personal Information, at the time we collect such information from you and obtain your consent to such disclosure.  

For example, we may transfer your Personal Information to third-party service providers with whom we have a contractual agreement that includes appropriate privacy standards, where such third parties are assisting us with the Purposes (e.g., service providers that provide telephone support, data storage, or processing). These third parties may operate from various jurisdictions; where this involves processing of Personal Information outside Canada, we ensure appropriate contractual safeguards are in place.  

Generally, we will only make disclosures of Personal Information to such persons for which you provide your consent. Notwithstanding the foregoing, we may also make disclosures of Personal Information to a potential acquiror in connection with a transaction involving the sale of some or all of the business of ISA or as otherwise permitted or required by law, in which case the use of your Personal Information by the new entity would continue to be limited by applicable law.  

 

6. When and how do we obtain your consent? 

We obtain your consent prior to collecting, using, or disclosing your Personal Information for any purpose. You may provide your consent to us either orally, electronically, or in writing. The form of consent that we seek, including whether it is express or implied, will largely depend on the sensitivity of the Personal Information and the reasonable expectations you might have in the circumstances. We will not, as a condition of the supply of our professional services or products, require you to consent to the collection, use, disclosure or protection of information beyond that which is required to fulfill the specified and legitimate purposes for which the information is being collected. With respect to our websites, if you subsequently choose to unsubscribe from mailing lists or any registrations, you may contact us by email at info@isacybersecurity.com, through the contact form at https://isacybersecurity.com/contact-us, or by calling 1-877-591-6711. 

 

7. How do we ensure the privacy of your Personal Information when dealing with our affiliates and other third parties? 

We ensure that all affiliates and other third parties that are retained to perform services on our behalf and are provided with Personal Information are contractually required to observe the intent of this Privacy Policy and our privacy practices.  

 

8. How long will we use, disclose, or retain your Personal Information? 

We may keep a record of your Personal Information, correspondence or comments in a file specific to you. We will use, disclose or retain your Personal Information for as long as necessary to fulfill the purposes for which that Personal Information was collected and as permitted or required by law. Retention periods are determined based on the nature of the information and applicable legal, regulatory, tax, and contractual requirements. Personal Information is securely destroyed or anonymized when no longer required for the purposes for which it was collected or as required by law.  

 

9. How can you review your Personal Information that we have collected, used, or disclosed? 

If you make a written request to review any Personal Information about you that we have collected, utilized or disclosed, we will provide you with any such Personal Information to the extent required by law. We will make such Personal Information available to you in a form that is generally understandable, and will explain any abbreviations or codes.  

Where required by applicable law, you may also request: (a) a copy of your Personal Information in a structured, commonly used technological format; or (b) that we cease disseminating your Personal Information, or that it be deleted or de-indexed, once the purpose for which it was collected has been fulfilled, subject to any legal retention requirements.  

Depending on your jurisdiction, including if you are a resident of Québec, you may have additional rights under applicable law, including the right to data portability, the right to request deletion or de-indexing of your Personal Information, and the right to withdraw your consent to the use or disclosure of your Personal Information, subject to legal or contractual restrictions.  

 

10. How do you know that the Personal Information we have on you is accurate? 

We will ensure that your Personal Information is kept as accurate, complete and up-to-date as possible. We will not routinely update your Personal Information, unless such a process is necessary. We rely on you to inform us of changes to your Personal Information, where appropriate.  

 

11. What if the Personal Information we have on you is inaccurate? 

At any time, you can challenge the accuracy or completeness of your Personal Information in our records. If you successfully demonstrate that your Personal Information in our records is inaccurate or incomplete, we will amend the Personal Information as required. Where appropriate, we will transmit the amended information to third parties having access to your Personal Information.  

 

12. How fast will we respond to your written requests? 

We will attempt to respond to each of your written requests not later than thirty (30) days after receipt of such requests. We will advise you in writing if we cannot meet your requests within this time limit. You have the right to make a complaint to the federal Privacy Commissioner in respect of this time limit, or with the applicable provincial privacy regulator in your province of residence:

• Office of the Privacy Commissioner of Canada: https://priv.gc.ca
• Office of the Information and Privacy Commissioner of Alberta: https://oipc.ab.ca
• Office of the Information and Privacy Commissioner for British Columbia: https://oipc.bc.ca
• Commission d’accès à l’information du Québec: https://cai.gouv.qc.ca

 

 

13. Are there any costs to you for requesting information about your Personal Information or our Privacy Policy or practices? 

We will not charge any costs for you to access your Personal Information in our records or to access our Privacy Policy or practices without first providing you with an estimate of the approximate costs, if any. You may withdraw your requests for access to information by notifying us within the thirty (30) day notice period disclosed on the estimate. If you do not notify us within such thirty (30) day period, we will send you a further notice indicating that you will be deemed to have withdrawn your request for access unless you advise us otherwise within thirty (30) days. If, after the expiry of this second thirty (30) day period, you have not so advised us, we will deem your request to have been withdrawn and provide you with written notice to that effect.  

 

14. How do we know that it is really you requesting your Personal Information? 

We may request that you provide sufficient identification to permit access to the existence, use or disclosure of your Personal Information. Any such identifying information shall be used only for this purpose.  

 

15. What safeguards have we implemented to protect your Personal Information? 

We have implemented physical, organizational, contractual and technological security measures to protect your Personal Information from loss or theft, unauthorized access, disclosure, copying, use or modification. These safeguards include role-based access controls, least-privilege principles, logging and monitoring of systems, and regular security reviews. The only employees who are granted access to your Personal Information are those with a business ‘need-to-know’ or whose duties reasonably require such information. ISA applies security controls appropriate to the sensitivity of the Personal Information, with enhanced safeguards for sensitive information. Employees and authorized personnel also receive privacy and security training, and are subject to confidentiality obligations.  

ISA conducts privacy impact assessments for new initiatives, technologies, or significant changes that involve the collection, use, or disclosure of Personal Information. These assessments help us identify and mitigate privacy risks before they affect you.  

ISA maintains and tests incident response procedures for identifying, containing, investigating, and remediating privacy and security incidents. In the event of a privacy breach involving Personal Information under our control, we will notify affected individuals and relevant regulatory authorities as required by PIPEDA, Law 25, and other applicable privacy legislation.  

ISA does not enter Personal Information into public or consumer-grade generative AI tools. Where AI tools are used in the course of providing our services, they operate under enterprise agreements with appropriate data protection terms.  

ISA’s Security Operations Centre (SOC) is SOC 2 Type 2 compliant, and our security program is aligned with industry frameworks including ISO/IEC 27001 and the NIST Cybersecurity Framework.  

 

16. How do you contact us regarding access to your Personal Information or our Privacy Policy and practices? 

If you have any requests relating to access, correction, or the exercise of your privacy rights, you may contact us by email at info@isacybersecurity.com, through the contact form at https://isacybersecurity.com/contact-us, or by calling 1-877-591-6711.  

If you have a concern or complaint about our compliance with this Privacy Policy or applicable privacy laws, please contact our Privacy Officer first using the contact information above. We take privacy matters seriously and will investigate and respond promptly.  

If your concern is not resolved to your satisfaction, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada, or with the applicable provincial privacy regulator in your province of residence. Contact information for these regulators is provided in Section 12.  

 

Last Revised: August 4, 2026