Privacy Policy

Company Name: RawSecLabs Limited

Registered Address: Toronto, Ontario, Canada

Company Registration: Registered in Canada

Data Protection Officer Contact: info@rawseclabs.com

General Contact: contact@rawseclabs.com

We use your information for the following purposes:

• Service Delivery: To provide cybersecurity consulting, penetration testing, and compliance services
• Communication: To respond to enquiries, provide project updates, and deliver service communications
• Billing: To process payments and issue invoices for services rendered
• Compliance: To maintain regulatory compliance and audit records
• Security: To protect our systems, clients, and prevent fraudulent activities
• Marketing: With your consent, to send relevant security insights and service updates
• Improvement: To analyse usage patterns and improve our services
• Legal Obligations: To comply with legal and regulatory requirements

We process your personal data on the following legal bases under GDPR:

• Contract Performance: Processing necessary for the performance of our service contracts and pre-contractual enquiries
• Legitimate Interests: For business development, security monitoring, fraud prevention, and service improvement, balanced against your rights
• Legal Obligation: To comply with legal and regulatory requirements, including tax, accounting, and data protection laws
• Consent: For marketing communications, newsletter subscriptions, and non-essential cookies (withdrawable at any time)

We may share your information with the following categories of third parties:

• Service Providers: Cloud infrastructure providers, payment processors, email service providers, and other third-party services essential to our operations
• Professional Advisors: Legal counsel, accountants, and other professional advisors as necessary
• Regulatory Authorities: When required by law, court order, or regulatory request
• Business Transfers: In connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business

We do not sell your personal data to third parties for their marketing purposes. All third-party processors are subject to appropriate data processing agreements and security standards.

Your information may be transferred to and processed in countries other than the country in which you reside. These transfers may involve countries that do not provide the same level of data protection as your home jurisdiction.

When we transfer your data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where the destination has been recognised as providing adequate protection
• Binding corporate rules for intra-group transfers
• Other appropriate legal mechanisms under applicable data protection laws

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include:

• Encryption of data at rest and in transit using industry-standard protocols
• Strict access controls and authentication mechanisms
• Regular security assessments and penetration testing
• Secure data storage and processing environments
• Staff training and security awareness programs
• Incident response and business continuity procedures

Despite our security measures, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.

We retain your personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

• Enquiry Data: Retained for 2 years from last contact, or longer if a business relationship is established
• Client Data: Retained for the duration of the business relationship plus 7 years for legal and tax purposes
• Assessment Data: Retained according to project requirements and client agreements, typically 1-3 years
• Marketing Data: Retained until consent is withdrawn or the purpose is no longer served

Under GDPR and applicable data protection laws, you have the following rights:

To exercise these rights, please contact us at info@rawseclabs.com. We will respond to your request within 30 days, unless extended by law for complex requests.

We use cookies and similar tracking technologies to collect information about your browsing activities on our website. Cookies are small text files stored on your device that help us provide better functionality and analyse usage patterns.

• Essential Cookies: Required for basic website functionality and security. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors use our website to improve performance and user experience.
• Marketing Cookies: Used to deliver relevant advertisements and track marketing campaign effectiveness (with consent).

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect website functionality.

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to remove that information.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on our website and updating the "Last updated" date. We encourage you to review this policy periodically.

If you have any questions about this Privacy Policy, our data practices, or your rights, please contact us:

If you are located in the European Economic Area, you also have the right to lodge a complaint with your local data protection authority.