Privacy Policy

1. Introduction

Krestovitch Security LLP ("we," "us," "our," or "Company") is committed to protecting your privacy and ensuring you have a positive experience on our website and when using our services. This Privacy Policy explains how we collect, use, disclose, and otherwise process personal information in connection with our services and website.

This Privacy Policy applies to all individuals whose personal information we process, including clients, website visitors, and service users. We operate in compliance with applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec Law 25 (Bill 64).

2. Information We Collect

We collect personal information in various ways:

• Information You Provide: Name, email address, phone number, company name, job title, mailing address, and any other information you voluntarily provide when contacting us, requesting services, or using our website.
• Technical Information: IP address, browser type, device type, operating system, pages visited, time spent on pages, referring website, and other usage data collected through cookies and similar technologies.
• Service-Related Information: Information necessary to provide security services, including incident reports, system configurations, and communication records relevant to your engagement.
• Third-Party Information: We may receive information about you from third parties, service providers, and partners as necessary to provide our services.

3. How We Use Your Information

We use personal information for the following purposes:

• To provide, maintain, and improve our security services
• To communicate with you regarding your account, services, and inquiries
• To process transactions and send related information
• To send marketing communications (with your consent) about new services and updates
• To conduct analytics, research, and improve our website and services
• To comply with legal obligations and enforce our agreements
• To prevent fraud and detect security incidents
• To aggregate and anonymize data for statistical and analytical purposes

4. Legal Basis for Processing

We process your personal information based on:

• Consent: When you explicitly consent to processing (e.g., newsletter subscriptions)
• Contractual Necessity: To fulfill agreements and provide requested services
• Legal Obligation: To comply with applicable laws and regulations
• Legitimate Interests: To operate our business and protect our rights and the rights of others

5. Information Sharing and Disclosure

We do not sell your personal information. However, we may share information with:

• Service Providers: Third parties that help us deliver services (hosting, analytics, customer support)
• Legal Requirements: When required by law, court order, or government request
• Business Partners: With your consent, to deliver integrated services
• Business Transfers: In the event of merger, acquisition, or sale of assets

6. Data Security

We implement comprehensive security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. Our security practices include:

• Encryption of sensitive data in transit and at rest
• Secure authentication mechanisms and access controls
• Regular security audits and vulnerability assessments
• Employee training on data protection and confidentiality
• Incident response procedures for potential data breaches

While we strive to protect your information, no security system is impenetrable. We cannot guarantee absolute security of data transmitted over the internet.

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Retention periods vary depending on the context of processing and our legal obligations:

• Client account information: Retained during the service relationship and for 7 years thereafter for legal compliance
• Website analytics data: Retained for up to 24 months
• Marketing communications: Retained until unsubscription
• Incident and security data: Retained as required for legal and operational purposes

8. Your Privacy Rights

Under Canadian privacy legislation, you have the following rights:

• Right of Access: Request access to your personal information and obtain a copy
• Right of Correction: Request correction of inaccurate or incomplete information
• Right of Deletion: Request deletion of personal information (subject to legal obligations)
• Right to Withdraw Consent: Withdraw consent for processing at any time
• Right to Opt-Out: Opt out of marketing communications and third-party sharing
• Right to Complaint: Lodge a complaint with the Privacy Commissioner of Canada

To exercise these rights, please contact us using the information provided in Section 11.

9. Cookies and Tracking Technologies

We use cookies, web beacons, and similar technologies to enhance your experience, analyze usage, and facilitate marketing efforts. You can control cookie preferences through your browser settings. For more information, please refer to our separate Cookies Policy.

Types of cookies we use include:

• Essential Cookies: Required for website functionality
• Analytics Cookies: Track usage patterns and site performance
• Marketing Cookies: Support targeted advertising and promotional campaigns

10. International Data Transfers

As Krestovitch Security LLP operates primarily in Canada, personal information is generally stored and processed within Canadian borders. However, we may transfer information to service providers or partners in other jurisdictions. When transferring data internationally, we implement appropriate safeguards including standard contractual clauses and adequacy decisions recognized under applicable law.

11. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our privacy practices, please contact us:

We will respond to privacy requests within 30 days or as required by applicable law.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes via email or by posting the updated policy on our website. Your continued use of our services following such changes constitutes your acceptance of the revised Privacy Policy.

Last Updated: January 2026

13. Accountability and Compliance

Krestovitch Security LLP designates a Privacy Officer responsible for ensuring compliance with this Privacy Policy and applicable privacy legislation. Our Privacy Officer reviews our information handling practices regularly and works with all departments to ensure adherence to privacy principles.

Company Information:

• Business Name: Krestovitch Security LLP
• VAT/Registration Number: 920581431 RT 0001
• Jurisdiction: Canada (Quebec)

14. Additional Information for Quebec Residents

Quebec residents are entitled to additional protections under Quebec Law 25 (Bill 64). We comply with these enhanced privacy requirements, including explicit consent for certain processing activities and additional transparency obligations. Quebec residents have the right to:

• Obtain confirmation of whether personal information is held
• Receive free access to their personal information annually
• Lodge complaints with the Quebec Commission d'accès à l'information (CAI)
• Obtain information about the purposes and uses of their personal information