Protection of personal information

Sorvek Security Inc. (hereinafter "Sorvek" or "we") is committed to protecting the personal information it processes in the course of operating its SaaS cybersecurity platform. This policy explains what information we collect, why we collect it, how we use it and which rights you can exercise.

The Sorvek platform is intended exclusively for businesses and professionals (B2B). We do not provide services directly to consumers.

In accordance with the Act to modernize legislative provisions as regards the protection of personal information (Law 25), Sorvek has designated a privacy officer:

Any question or request relating to this policy or to the exercise of your rights must be addressed to this officer.

In the course of providing its services, Sorvek may collect the following categories of information:

We process your personal information for the following purposes:

• Creating and managing your user account
• Providing the Sorvek SaaS Discovery platform and its features
• Authentication and platform security
• Billing and subscription management
• Technical support and handling of requests
• Improving and developing the platform (aggregated and anonymized data)
• Meeting our legal and regulatory obligations
• Communicating important service updates

We do not sell your personal information to third parties. We do not use it for advertising purposes.

In accordance with Law 25 and PIPEDA, the processing of your information relies on one or more of the following legal bases:

• Performance of the contract: processing necessary to provide the services you have subscribed to.
• Consent: for optional processing (e.g. analytics cookies). You may withdraw your consent at any time without affecting the lawfulness of prior processing.
• Legal obligation: retention of certain accounting and tax records.
• Legitimate interest: platform security, fraud prevention, and service improvement.

To withdraw your consent or exercise your rights, contact us at contact@sorvek.com.

The Sorvek platform is hosted on Amazon Web Services (AWS) infrastructure, in the ca-central-1 region (Montreal, Canada). Data is stored and processed primarily within Canadian territory.

Some service providers (in particular Stripe for billing) may process data from foreign jurisdictions (United States). In accordance with section 17 of Law 25, Sorvek has carried out a privacy impact assessment (PIA) for these transfers and has put in place the appropriate contractual measures (standard contractual clauses, compliant privacy policies).

Before any transfer of personal information outside Quebec, we ensure that the receiving country or organization offers a level of protection that is adequate or equivalent to the one provided by Law 25.

We rely on the following service providers to deliver our services. Each is bound by contractual confidentiality commitments.

We never share your information with third parties for commercial or advertising purposes.

We keep your personal information only for as long as necessary for the purposes for which it was collected or as required by applicable legal requirements.

Once these periods expire, the data is securely deleted or irreversibly anonymized.

Our website and platform use cookies and similar technologies. We distinguish two categories:

We do not use advertising pixels, retargeting cookies, or cross-site tracking technologies for commercial purposes.

In accordance with Law 25 and PIPEDA, you have the following rights regarding your personal information:

• Right of access: obtain confirmation that we hold information about you and receive a copy of it.
• Right to rectification: have any inaccurate, incomplete, or ambiguous information corrected.
• Right to erasure: request the deletion of your information, subject to legal retention obligations.
• Right to portability (s. 27 of Law 25): receive your information in a structured, commonly used technological format, or have it transferred to a designated third party.
• Withdrawal of consent: withdraw at any time your consent to processing based on it.
• Right to file a complaint: with the Commission d'accès à l'information du Québec (CAI) or the Office of the Privacy Commissioner of Canada (OPC).

To exercise any of these rights, contact us at contact@sorvek.com. We will acknowledge receipt within 5 business days and respond within 30 days of the request.

In the event of a confidentiality incident (unauthorized access, disclosure, loss, or theft of personal information), Sorvek applies the following procedure:

• Immediate assessment of the severity and extent of the incident.
• Notification to the CAI within 72 hours if the incident presents a serious risk of harm, in accordance with section 3.5 of Law 25.
• Notification to the individuals concerned as soon as possible if the incident is likely to cause them serious harm.
• Recording in the incident register internally, in accordance with the regulations.
• Corrective measures to prevent the incident from recurring.

The Sorvek platform is intended exclusively for professionals acting in the course of their duties within organizations. It is not designed to be used by minors. We do not knowingly collect personal information about minors under 18 years of age.

If we learn that a minor has provided personal information without the required parental consent, we will take the necessary steps to delete it promptly.

We reserve the right to modify this privacy policy. Any substantial change will be notified to you by email or through a visible notice on the platform at least 30 days before it takes effect.

The date of the last update is shown at the top of this document. By continuing to use the platform after the changes take effect, you accept the revised policy.

For any question about this policy or to exercise your rights:

You may also file a complaint with the competent authorities:

• Commission d'accès à l'information du Québec (CAI): cai.gouv.qc.ca
• Office of the Privacy Commissioner of Canada (OPC): priv.gc.ca