Privacy policy

1. Who we are

This website is operated by Shield Dynamics Inc. ("Shield Dynamics", "we", "us"), an Ontario corporation with its head office at 1153 Trellis Trail, Minden, Ontario K0M 2K0, Canada. We are responsible for personal information under our control. We have appointed a Privacy Officer who is accountable for our compliance with this policy and with applicable privacy law (see section 15).

2. Scope

This policy explains how we handle personal information collected through this website and through communications that result from it, such as enquiries and job applications. It applies to visitors in Canada, the United States and elsewhere. It does not cover information we handle as a contractor under a customer agreement. That information is governed by the agreement and the customer's instructions.

In Canada we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, substantially similar provincial laws, including Québec's Act respecting the protection of personal information in the private sector as amended by Law 25, and the Alberta and British Columbia Personal Information Protection Acts. In the United States we comply with applicable federal and state laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, "CCPA") where it applies to us.

3. Information we collect

Information you give us

• Contact form: your name, email address, organisation (optional), the topic you select and your message.
• Job applications: information you send us when applying, such as your CV, work history, education, and any eligibility information requested for roles involving controlled goods or technology.
• Correspondence: anything you include when you email or otherwise communicate with us.

Information collected automatically

• Server and security logs: IP address, browser user agent, pages requested, referring page, and date and time. We use these to operate, secure and troubleshoot the website.
• Abuse prevention: when you submit the contact form, we temporarily process your IP address to limit repeated submissions. This counter is held in memory and is not stored long term.

We do not use advertising cookies, third-party analytics, social-media pixels or fingerprinting. The website loads its fonts and scripts from our own servers, so your visit is not disclosed to third-party content providers.

We do not intend to collect sensitive personal information through this website. Please do not send us health information, government identification numbers, or classified, controlled or export-restricted information through the contact form.

4. How we use it

We use personal information only for purposes identified at or before the time of collection, which are to:

• respond to your enquiry and continue the conversation you started;
• evaluate job applications and communicate with candidates;
• screen business contacts and transactions against government restricted-party and sanctions lists, as required for a company that handles controlled goods and export-controlled technology;
• operate, maintain and secure the website, and detect and prevent fraud, spam and abuse;
• comply with legal obligations and respond to lawful requests from authorities; and
• establish, exercise or defend legal claims.

We do not use your information for automated decision-making that produces legal or similarly significant effects about you. We will not send you commercial electronic messages, such as newsletters or marketing, unless you have consented as required by Canada's Anti-Spam Legislation (CASL) and the U.S. CAN-SPAM Act. You can withdraw that consent at any time using the unsubscribe mechanism in every such message.

5. Consent

When you submit the contact form, you give express consent to our collecting and using your details to respond to you. When you apply for a role, you consent to our using your application for recruitment. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting our Privacy Officer. If you withdraw consent, we may not be able to respond to your enquiry or continue considering your application.

6. When we disclose it

We do not use third-party service providers or tools to process personal information collected through this website. Our website, contact-form processing and related systems are operated by us. We do not sell personal information. We do not "share" personal information for cross-context behavioural advertising, as those terms are defined in the CCPA. We disclose personal information only:

• to professional advisers, such as lawyers, auditors and insurers, under a duty of confidentiality;
• to government authorities where required or permitted by law, including export-control, controlled-goods and security-screening authorities in Canada and the United States;
• in a business transaction, such as a financing, merger or acquisition, to the parties involved, under confidentiality obligations and only as needed for the transaction; and
• with your consent or at your direction.

7. Where it is stored

Our website and the systems that receive and store personal information collected through it are hosted in Canada. We do not use third-party service providers that would transfer this information outside Canada. If that changes, we will update this policy before doing so, and we will use contracts and other measures to provide a comparable level of protection. Where Québec law applies, we assess the privacy impact before communicating personal information outside Québec.

8. How long we keep it

• Contact enquiries: 24 months after our last communication, unless a business relationship results.
• Job applications: 12 months after the position is filled, or longer with your consent to be considered for future roles.
• Server and security logs: 90 days, unless needed to investigate a security incident.

When information is no longer needed, we securely destroy it or anonymise it. We keep information used to make a decision about you long enough for you to access it, as PIPEDA requires.

9. How we protect it

We protect personal information with safeguards appropriate to its sensitivity. These include encryption in transit, access controls based on need-to-know, and security monitoring. We also use physical and organisational measures consistent with our obligations as a defence supplier. No system is completely secure. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and regulators as required by PIPEDA, Québec law and applicable U.S. state breach-notification laws.

10. Your rights in Canada

Under PIPEDA and applicable provincial laws, you have the right to:

• request access to the personal information we hold about you, and information about how it has been used and disclosed;
• ask us to correct information that is inaccurate or incomplete;
• withdraw your consent, as described in section 5; and
• make a complaint about our privacy practices.

If you are in Québec, you also have the right to data portability. You can also ask us to stop disseminating your information or to de-index links to it where the law allows, and to be informed about the use of technology that identifies, locates or profiles you. We don't use such technology on this website.

We respond to requests within 30 days, or tell you if we need an extension as permitted by law. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada. Depending on where you live, you can also contact your provincial regulator, for example Québec's Commission d'accès à l'information, or the Information and Privacy Commissioner of Alberta or British Columbia.

11. Your rights in the United States

California

If you are a California resident and the CCPA applies to us, this section is our notice at collection and privacy policy for the purposes of that law. In the preceding 12 months, we collected the following categories of personal information for the purposes described in section 4, from the sources described in section 3, and disclosed them for business purposes to the recipients described in section 6:

• Identifiers: name, email address and IP address.
• Professional or employment-related information: organisation, and job application details.
• Internet or other electronic network activity: server logs of pages requested.

We have not sold or shared personal information, and we do not knowingly sell or share the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit it. Retention periods are set out in section 8.

Subject to exceptions, you have the right to know what personal information we collected, used and disclosed about you; to request deletion; to request correction; and not to be discriminated against for exercising these rights. You may use an authorised agent to submit a request on your behalf. We will verify your identity, and the agent's authority, by matching information you provide against information we hold. We respond within 45 days, and may extend that period once by another 45 days where permitted.

Other U.S. states

Residents of other states with comprehensive privacy laws may have similar rights where those laws apply to us. These states include Colorado, Connecticut, Oregon, Texas, Utah and Virginia. Wherever you live, you can contact us to exercise rights of access, correction and deletion, and we will honour requests as required by law. If we deny your request, you may appeal by replying to our decision. We will tell you the outcome and how to contact your state attorney general.

Opt-out signals

Because we do not sell or share personal information or use it for targeted advertising, there is nothing for us to opt you out of. We nonetheless treat a Global Privacy Control signal as a valid request to opt out of any such processing, should our practices change.

12. Cookies and tracking

This website does not set cookies. It does not use analytics, advertising or tracking technologies. If we add strictly necessary cookies in future (for example for security), we will update this policy. We will ask for your consent before using any cookies that aren't strictly necessary.

13. Children

This website is intended for professional audiences and is not directed at children. We do not knowingly collect personal information from anyone under 16, or under 13 as defined by the U.S. Children's Online Privacy Protection Act. If you believe a child has sent us personal information, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new "last updated" date. If a change is material, we will take reasonable steps to bring it to your attention and, where required, obtain your consent.

15. Contact our Privacy Officer

To make a request, ask a question or raise a concern, contact:

Privacy Officer
Shield Dynamics Inc.
1153 Trellis Trail
Minden, Ontario K0M 2K0
Canada
Email: privacy@shield-dynamics.com