Privacy Policy

1Who we are and what this policy covers

This policy explains how Veris Privacy ("PrivacyTenet", "we", "us") handles personal data when you visit our website or use the PrivacyTenet platform (the "Service").

Veris Privacy Inc is registered in Canada under company number 727338162, with its registered office at 1025 King Street East, Unit 107 #1563, Cambridge, ON, N3H 3P5. You can contact us about privacy at privacy@verisprivacy.com

We act in two roles:

• Controller for data about our account holders, website visitors, prospects and billing contacts. This policy covers that data in full.

• Processor for the content our customers put into the Service, such as audits, data inventory records, checklists and comments. Our customer decides what goes in and why. Section 4 explains how we handle it.

If you are an employee or client of one of our customers, contact that organisation first about data it has entered into PrivacyTenet.

2Information we collect

We do not ask for special category data about our account holders. Please do not enter it into free-text fields unless your organisation has a lawful basis to do so.

3How we use information and our legal bases

We use personal data only for the purposes below. Where UK or EU GDPR applies, each purpose has the legal basis shown.

We do not sell personal data. We do not use it for targeted advertising. We do not use customer content to train machine-learning models.

4Customer content we process for our customers

We process customer content only on our customer's documented instructions, under our Data Processing Agreement (DPA). That DPA takes precedence over this policy for customer content.

In practice this means:

• Each customer's content is kept separate from other customers' content and is visible only to users in that organisation, according to the roles they are given.

• Our staff access customer content only when needed to provide support, fix a fault or meet a legal requirement, and on a need-to-know basis.

• We do not use customer content for our own purposes.

• When a customer's contract ends, we delete or return their content as set out in section 7 and the DPA.

PrivacyTenet helps customers record and assess their processing. Its risk scores, checklists and reports are tools to support that work. They are not legal advice.

5Who we share information with

We share personal data only with the service providers we need to run PrivacyTenet, under written contracts that require them to protect it.

We keep a current list of subprocessors at privacytenet.com/subprocessors and give customers notice of changes as set out in the DPA.

We may also share personal data:

• with other users in your organisation, as the Service is designed to do (for example, your name on comments and assignments);

• with professional advisers, such as lawyers and accountants, under confidentiality;

• with authorities when the law requires it, after checking the request is valid;

• with a buyer or successor if our business is sold or merged, who must protect it as this policy describes.

6International transfers

We host the Service and its database in Canada, with DigitalOcean in Toronto. Some providers, such as Resend and Stripe, process data in the United States.

When personal data leaves the UK or the European Economic Area, we protect it with one of these safeguards:

• an adequacy decision, such as the EU-US Data Privacy Framework or the UK Extension, where the provider is certified;

• the EU Standard Contractual Clauses, with the UK International Data Transfer Addendum where UK data is involved.

You can ask us for a copy of the relevant safeguards at privacy@verisprivacy.com.

Personal information may be stored or processed outside Canada, including in the United States, where some of our service providers operate. While there, it is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities. Before transferring personal information outside Quebec, we assess whether it will be adequately protected, as Quebec law requires.

7How long we keep information

We keep personal data only as long as we need it for the purposes in section 3. The periods below are our defaults.

We may keep data longer when the law requires it or to establish or defend a legal claim.

8Security

We use technical and organisational measures suited to the sensitivity of the data we hold. These include:

• encryption in transit (TLS) for all traffic to the Service;

• passwords stored only as salted bcrypt hashes;

• role-based access controls within each organisation, and separation between organisations;

• rate limiting on sign-in and registration to slow down password-guessing attacks;

• restricted, logged administrative access to production systems;

• regular, encrypted backups.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires. Customers will be notified as set out in the DPA. To report a security issue, email privacy@verisprivacy.com

9Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;

• correct data that is wrong or incomplete;

• have your data deleted;

• restrict or object to our use of it, including for direct marketing;

• receive your data in a portable format;

• withdraw consent where we rely on it, without affecting earlier use.

California residents have the right to know, delete and correct personal information, and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioural advertising.

To use any right, email privacy@verisprivacy.com. We will reply within one month, or the period your local law sets, and may need to verify your identity. If your request concerns customer content, we will pass it to the relevant customer and help them respond.

You also have the right to complain to a data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In the EU it is the authority in your country. We would appreciate the chance to help first.

Canadian residents

We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), and the Personal Information Protection Acts of British Columbia and Alberta, where they apply.

We collect, use and disclose personal information with your consent, which may be express or implied depending on its sensitivity and your reasonable expectations. You may withdraw consent at any time, subject to legal or contractual limits. We will tell you what withdrawing means, for example that we can no longer provide the Service.

You have the right to:

• access the personal information we hold about you and learn how it has been used and to whom it has been disclosed;

• challenge its accuracy and have it corrected;

• in Quebec, receive computerised personal information you provided in a structured, commonly used technological format, and ask us to stop disseminating it or to de-index it where the law allows.

We will respond to written requests within 30 days, unless the law allows us to extend that period. If we extend it or refuse a request, we will tell you why.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). In Quebec, you may complain to the Commission d'accès à l'information (cai.gouv.qc.ca). In British Columbia or Alberta, you may complain to that province's Information and Privacy Commissioner.

10Cookies and similar technologies

The Service uses only storage that is strictly necessary to keep you signed in and to keep it secure, such as an authentication token stored in your browser. We do not use advertising or third-party tracking cookies. If we add analytics, we will update this policy and ask for consent where the law requires it.

11Children

PrivacyTenet is a business service and is not meant for anyone under 18. We do not knowingly collect data from children.

12Changes to this policy

We will post any changes on this page and update the date at the top. If a change is significant, we will tell account holders by email or in the Service before it takes effect.

13Contact us