How we protect your information

1. Who this policy covers

This policy applies to Hensen IT Consulting ("we", "us", "our"), and covers personal information we handle when you visit our website, contact us, become a client, or when we provide IT services to your organization.

We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other privacy laws that apply to our work.

2. Information we collect

Information you give us

• Contact details such as name, company, job title, email address and phone number.
• The content of enquiries, support requests and correspondence.
• Billing and account information needed to invoice your organization.

Information we access while providing services

• Staff names, user accounts, email addresses and device details needed to set up and support your systems.
• System logs, device health data and security alerts generated by monitoring and management tools.
• Business files, mailboxes and databases that we may see or handle while performing support, migrations or backups.

Information collected automatically

• Basic technical data when you visit our website, such as browser type and pages viewed.

3. How we use it

We use personal information only for the purposes it was collected for, or purposes a reasonable person would expect, including to:

• Respond to enquiries and prepare quotes.
• Deliver, monitor, secure and support the IT services you have engaged us for.
• Manage accounts, billing and contracts.
• Send service notices, security alerts and maintenance updates.
• Meet legal, regulatory and insurance obligations.

We do not sell personal information, and we do not use client data for marketing, profiling or training of any product.

4. Client data and confidentiality

When we work inside your systems, the data there belongs to your organization. We act on your instructions and handle it under these commitments:

• Need-to-know access. Only the staff assigned to your account can access your systems, and only for the work you have requested.
• Confidentiality agreements. All staff and subcontractors sign confidentiality agreements before they are given access to client environments.
• Separate credentials. We use named, individual administrator accounts with multi-factor authentication. Shared or generic logins are not used.
• No browsing. We do not open, read or copy business files, email content or records unless a task requires it, and then only to the extent required.
• Logged activity. Remote sessions and administrative actions are logged so access can be reviewed.
• Mutual NDAs on request. We will sign your organization's non-disclosure or data processing agreement where needed.

5. When we share information

We share personal information only in these cases:

• Service providers we use to deliver our services, such as backup, monitoring, ticketing and email security platforms. They are bound by contract to protect the information and use it only for our services.
• Vendors and manufacturers, such as Microsoft or hardware suppliers, when needed to open a support case or process a licence or warranty on your behalf.
• Within Hensen Holdings, for shared administration, under the same protections described here.
• Legal requirements, when required by law, court order or a valid request from a public authority. Where permitted, we will tell you first.
• Business transfers, if our business is sold or reorganized, subject to the same protections.

6. Storage and transfers

We store information in Canada wherever practical. Some service providers we rely on may process or store data outside Canada, including in the United States. When this happens, the information is protected by contract but may be subject to the laws of that country. Clients who require Canadian-only data residency can ask us to configure services accordingly.

7. How we protect it

We use safeguards matched to the sensitivity of the information, including:

• Encryption of data in transit and of backups at rest.
• Multi-factor authentication on all administrative and internal systems.
• Role-based access, regular access reviews and prompt removal of access when staff leave.
• Patched and monitored internal devices with endpoint protection.
• Ongoing privacy and security training for our team.

No system is completely secure, but we work to reduce risk and respond quickly when something goes wrong.

8. Retention and disposal

We keep personal information only as long as needed for the purposes above or as required by law, such as tax and accounting rules. When a client relationship ends, we return or securely delete client data and credentials as agreed, and revoke our access. Storage devices we dispose of are wiped or physically destroyed.

9. Breach notification

If we become aware of a breach of security safeguards involving personal information under our control, we will contain it, investigate it, and notify affected clients without delay. Where a breach creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as required by PIPEDA, and keep a record of the breach.

10. Your rights and choices

You can ask to access the personal information we hold about you, ask us to correct it, or withdraw your consent to certain uses, subject to legal and contractual limits. We will respond within 30 days. If your information is held by us on behalf of your employer or another client, we may refer your request to that organization.

You can unsubscribe from non-essential emails at any time. Service and security notices are part of our services and cannot be switched off while you are a client.

11. Website and cookies

Our website does not use advertising or tracking cookies. Our pages load fonts from Google Fonts, which may receive your IP address and browser details. Information you submit through the contact form is sent to our ticket system and used only to reply to your enquiry.

Our client portal uses only essential cookies: one keeps you signed in and one protects forms against forgery. They expire when you sign out or after a period of inactivity. The portal records sign-in activity (time, IP address and outcome) to protect accounts, and stores your authenticator setup key encrypted.

12. Changes to this policy

We may update this policy as our services or the law change. The effective date at the top of the page shows when it was last revised. Significant changes will be communicated to clients directly.

13. Contact our Privacy Officer

For questions, requests or complaints about privacy, contact our Privacy Officer:

Email

privacy@hensenitconsulting.comCopy

Mail

Privacy Officer, Hensen IT Consulting, Ontario, Canada

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.