Privacy Policy

The short version

SafeIT collects the business contact details you give us through our forms, your sign-in details if you are a member, and the basic technical data every website receives. We use it to answer you, run the members area and keep the Site secure. We store form submissions in Canada. We do not sell personal information, we do not run advertising trackers and we do not use analytics cookies. You can ask to see, correct or delete what we hold about you at any time.

1. Who is responsible for your information

SafeIT is a business of Kearns Technology Inc. ("KTI", "we", "us"), 1655 Dupont St., Suite 101, Toronto, ON M6P 3T1, Canada. [VERIFY: confirm the legal entity and address as they should appear for SafeIT] KTI is responsible for the personal information described in this policy. Under the UK and EU General Data Protection Regulation (GDPR), KTI is the "controller".

Our Privacy Officer is accountable for how we handle personal information. You can reach them at [VERIFY: privacy contact email, e.g. privacy@ the SafeIT domain] or by post at the address above, marked "Attention: Privacy Officer". [VERIFY: name or title of the Privacy Officer; Quebec law requires the title and contact details to be published]

2. What this policy covers

This policy covers personal information we collect through this website (the "Site"): the public pages, the forms and the members area.

It does not cover information we process inside a client's systems while delivering managed IT services, such as data held on a member's servers, endpoints or cloud tenants. That processing is governed by the Master Services Agreement (MSA) and data processing terms signed with that client. In that role we act on the client's instructions as a service provider (a "processor" under GDPR). [LEGAL REVIEW: confirm a DPA or data processing schedule exists in the MSA]

3. What we collect

Information you give us

Membership enquiries: your company name, your name, work email, phone number, number of sites, headcount band, how your IT is handled today, any association you belong to, and what prompted you to get in touch.
Free assessment requests: your company name, your name, work email, site location, whether you would prefer an on-site or remote assessment, and anything you already know is broken.
Member accounts: your name, work email, organization and role, which we use to set up and manage your access to the members area. [VERIFY: confirm the exact profile fields held for members]
Calls, emails and support: what you tell us when you call the support line, email us or raise a ticket, and our notes of those conversations.

Please don't include sensitive personal information (for example, health information) or security credentials in a form. We don't need them to respond.

Information collected automatically

Server and security logs: like any website, our hosting provider records technical data when you visit, such as your IP address, browser type, the pages requested and the time of the request. These logs are used to run and protect the Site.
Bot protection: our forms use Cloudflare Turnstile to check that a submission comes from a person rather than an automated script. To do this, Cloudflare processes information about your browser and device, such as your IP address and browser characteristics. We receive only a pass or fail result.
Sign-in session: if you sign in to the members area, we set a cookie that keeps you signed in. See section 8.

What we don't collect

We don't use analytics tools, advertising networks, social media pixels or cross-site tracking on the Site. We don't buy personal information from data brokers. We don't make decisions about you using solely automated processing, including profiling, that have legal or similarly significant effects.

4. How we use it, and why we're allowed to

We use personal information for the following purposes. Under the UK and EU GDPR, each one needs a legal basis, shown in brackets.

To respond to your enquiry or assessment request, including contacting you to arrange a call or site visit. (Steps taken at your request before entering into a contract; our legitimate interest in responding to business enquiries.)
To provide and manage member accounts and the members area. (Performance of our contract with your organization; our legitimate interest in giving its staff access.)
To provide support when you call or email us. (Performance of a contract; legitimate interests.)
To keep the Site and our systems secure, including preventing spam, fraud and abuse, and investigating incidents. (Legitimate interests.)
To keep records and meet legal obligations, such as tax, accounting and responding to lawful requests from authorities. (Legal obligation.)
To send you information about our services, events and roundtables, where you have asked for it or where the law allows us to contact business contacts. You can opt out at any time using the link in the message or by contacting us. (Consent, or legitimate interests where permitted.) [LEGAL REVIEW: confirm CASL, PECR and UWG requirements before any marketing email is sent; Germany in particular generally requires prior consent]

In Canada, we rely on your consent, which may be express or implied depending on the information and the purpose. When you submit a form, you consent to us using the information to respond to you. You can withdraw consent at any time, subject to legal or contractual limits, and we will tell you what that means for what we can still do for you.

Where we rely on legitimate interests, we have balanced those interests against your rights. You can object at any time (see section 9).

5. Who we share it with

We share personal information only where we need to, and we don't sell it or share it for cross-context behavioural advertising.

Within KTI. SafeIT is part of Kearns Technology Inc. KTI staff who deliver SafeIT's services may access information to respond to you and support members.
Service providers who run the Site for us:
- Supabase: stores form submissions and member accounts, in its Canada Central (ca-central-1) region.
- Resend: delivers email notifications and sign-in links. Resend processes data in the United States.
- Vercel: hosts the Site and serves pages from locations around the world, including the United States.
- Cloudflare: provides bot protection on our forms, processing data in the United States and other locations.
- [VERIFY: add any CRM, telephony or ticketing system KTI uses to handle enquiries and support calls]
Delivery partners, for members only. To deliver services under an MSA, we may share limited business contact and account information with the partners involved, such as our security operations partner Cyrebro, our backup and continuity partner Datto, our procurement partner Pax8 and our cyber warranty provider Cork. This happens under the MSA and the partners' own terms. [VERIFY: confirm what, if anything, is shared with each partner and under what agreement]
Where the law requires it, or to protect the rights, property or safety of our clients, our staff or others.
If our business changes hands, for example in a merger or sale, to the new owner, who would have to keep treating the information as this policy describes.

Our service providers may use personal information only to provide services to us, under written contracts that require them to protect it.

6. Where your information is stored and transferred

We store form submissions and member accounts in Canada. Some of our service providers process information in the United States and other countries, as described above. Information processed outside your country may be accessible to courts, law enforcement and national security authorities there.

For information about people in the UK and the European Economic Area:

The European Commission and the UK recognize Canada as providing adequate protection for personal information handled by commercial organizations under Canada's federal privacy law (PIPEDA).
Where information goes to the United States or another country without an adequacy decision, we rely on the provider's certification under the EU-US Data Privacy Framework and its UK Extension where available, or on the European Commission's Standard Contractual Clauses with the UK Addendum. [VERIFY: confirm the transfer mechanism for each provider]

You can ask us for more detail about these safeguards using the contact details in section 1.

7. How long we keep it

We keep personal information only for as long as we need it for the purpose we collected it for, and then delete or anonymize it.

Enquiries and assessment requests that don't lead to membership: [VERIFY: e.g. 24 months] after our last contact with you.
Member accounts: for as long as the membership is active, then [VERIFY: e.g. 12 months] unless the MSA requires otherwise.
Contract, billing and tax records: for the period required by law, typically six to ten years depending on the country. [VERIFY]
Server and security logs: for the short period set by our hosting and security providers, unless we need them longer to investigate an incident. [VERIFY]

8. Cookies

We use only the cookies and similar technologies the Site needs to work. We don't use them for analytics or advertising, so we don't ask for cookie consent. [LEGAL REVIEW: confirm this position under the UK PECR and Germany's TDDDG]

Members area session cookie: set when you sign in, to keep you signed in and protect your account. It is removed when you sign out or it expires.
Bot protection: Cloudflare Turnstile may store or read information on your device when you use a form, to tell people from bots. It is not used to track you across sites.

If we add any other cookies in future, we will update this policy first and, where the law requires it, ask for your consent before setting them.

9. Your rights

Wherever you are, you can ask us to:

tell you whether we hold personal information about you and give you a copy of it;
correct information that is wrong or incomplete;
delete information we no longer need or are not allowed to keep;
stop sending you marketing messages;
withdraw consent you have given.

Depending on where you live, you may have further rights:

Canada: under PIPEDA and provincial privacy laws, including Quebec's Law 25, you can also ask how your information has been used and disclosed and, in Quebec, ask for your information in a structured, commonly used technological format. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada or, where it applies, your provincial privacy commissioner, such as the Commission d'accès à l'information du Québec.
United Kingdom and European Union, including Germany: under the UK GDPR, the EU GDPR and Germany's Federal Data Protection Act (BDSG), you can also ask us to restrict processing, receive your information in a portable format, and object to processing based on legitimate interests. You have the right to complain to a data protection authority: in the UK, the Information Commissioner's Office (ICO); in Germany, the supervisory authority of the state where you live or work, or the authority of the place of the alleged infringement.
United States: if a state privacy law applies to you, you may have similar rights to access, correct and delete your information and to opt out of its sale or its use for targeted advertising. We don't sell personal information or use it for targeted advertising. We will not discriminate against you for exercising your rights. [LEGAL REVIEW: confirm which state laws apply to KTI's US activity and whether any state-specific disclosures are needed]

To use any of these rights, contact our Privacy Officer (section 1). We may need to confirm your identity first. We will respond within 30 days, or sooner where the law requires it. If a request is complex, we may take longer where the law allows, and will tell you why.

10. How we protect it

We use administrative, technical and physical safeguards suited to the sensitivity of the information. These include encryption in transit, access controls that limit personal information to the staff who need it, bot protection on forms, and passwordless sign-in for the members area. No system is completely secure. If a breach of security creates a real risk of significant harm to you, or where the law otherwise requires it, we will notify you and the relevant authorities. [VERIFY: confirm encryption at rest and any additional safeguards before listing them]

11. Children

The Site is for businesses and is not directed at children. We don't knowingly collect personal information from anyone under 16. If you believe we have, contact us and we will delete it.

12. EU and UK representatives

[LEGAL REVIEW: as a Canadian company offering services to organizations in the EU and UK, KTI may need to appoint a representative in the EU (GDPR Article 27) and in the UK (UK GDPR Article 27). If appointed, add their names and contact details here. Also confirm whether a Data Protection Officer is required under GDPR or section 38 of the BDSG.]

13. Changes to this policy

We may update this policy as the Site and our services change. The effective date at the top of this page shows when it last changed. If we make a significant change, we will highlight it on the Site and, where appropriate, tell members directly.

14. Contact us

For privacy questions or requests, contact our Privacy Officer or write to: Privacy Officer, Kearns Technology Inc. (SafeIT), 1655 Dupont St., Suite 101, Toronto, ON M6P 3T1, Canada. For anything else, use the contact page.