Privacy Policy

This policy explains what personal information ThreeShield collects, why, how we use and protect it, and the choices you have. If you have any questions, contact us through our contact form and choose the “Privacy request” topic.

Who we are and where we operate

ThreeShield Information Security Corporation (“ThreeShield”, “we”, “us”) is a Canadian federal corporation based in Calgary, Alberta. We provide cybersecurity audits, assessments, incident response, compliance, and related consulting to organizations in Canada and internationally.

ThreeShield works with organizations internationally, including businesses in the United Kingdom and the European Union. Our services are offered to organizations, not to individuals as consumers: we do not market or provide services to individuals in the UK or EU, and we do not undertake engagements that involve monitoring the behaviour of individuals located in the UK or EU. Where an engagement for a UK or EU client involves personal data, we act as a service provider (processor) under our engagement agreement and applicable data-protection terms. Because our activities are not directed at individuals in those regions and do not monitor them, we are not required to, and do not, appoint a representative under Article 27 of the UK or EU GDPR.

Information we collect

We collect only what we need to respond to you and to deliver our services.

• Contact and inquiry information. Your name, email address, phone number, company, and the details of your message when you use our contact form, book a consultation, or email or call us.
• Engagement information. During audits, assessments, penetration tests, incident response, and related work, we may access client systems, logs, configurations, and documents that can contain personal information about a client’s staff, contractors, or customers. We access this only as needed to perform the engagement.
• Business records. Contracts, statements of work, invoices, and billing details needed to manage the client relationship.
• Website information. Standard server logs and limited, privacy-respecting analytics used to keep the site secure and working. We keep cookies to a minimum.

How we use personal information

• To respond to inquiries and provide consultations.
• To deliver, manage, and support the services a client engages us for.
• To meet our legal, regulatory, and contractual obligations.
• To secure our own systems and prevent fraud or misuse.
• With your consent, to send occasional updates you can unsubscribe from at any time.

Under Canadian privacy law we rely on your consent and on the purposes a reasonable person would consider appropriate in the circumstances.

Working on a client’s behalf

When we handle personal information as part of an engagement, we act as a service provider to the client, who remains the organization responsible for that information. We process it only under our engagement agreement and the client’s instructions, keep it confidential, use it solely to perform the work, and return or securely dispose of it at the end of the engagement unless a law or the contract requires otherwise.

How we share information

We do not sell personal information. We share it only with:

• Service providers who help us operate — for example, cloud hosting, email, scheduling, and payment processing — under confidentiality and data-protection terms.
• The client and its authorized personnel, for information we handle as part of an engagement.
• Authorities or professional advisors where required by law, or to establish, exercise, or defend legal claims.

Where information is processed

ThreeShield is based in Canada and processes personal information primarily in Canada. Some of our service providers may process limited data outside Canada; where they do, we use providers that offer a comparable level of protection and appropriate contractual safeguards. Canada is recognized by the European Commission as providing an adequate level of data protection for the purposes of GDPR Article 45.

How long we keep it

We keep personal information only as long as needed for the purpose it was collected, to meet legal and contractual obligations, and to resolve disputes. Engagement materials are retained or securely destroyed according to the engagement agreement.

How we protect it

As a security firm, safeguarding information is our core discipline. We use encryption in transit and at rest for sensitive data, enforced multi-factor authentication, least-privilege access, monitoring, and regular security review. If a breach of security safeguards creates a real risk of significant harm, we notify affected individuals and the appropriate authorities as required by law.

Your rights and choices

You can ask us to access the personal information we hold about you, correct inaccuracies, withdraw consent, or unsubscribe from communications. In Canada you can challenge our handling of your information and complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner (in Alberta, the Office of the Information and Privacy Commissioner of Alberta). If you are outside Canada and have provided personal information to us, you may make the same requests, and we will respond consistently with applicable Canadian law.

To make a request, use our contact form with the “Privacy request” topic pre-selected (that link chooses it for you). We verify your identity before responding and reply within the time required by law.

Children’s privacy

Our services are intended for businesses and IT professionals and are not directed at anyone under the age of 18. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. Material changes will be posted here with a new effective date.

Contact

For any privacy question or request, contact our Privacy Officer through our contact form with the “Privacy request” topic pre-selected, or by phone at 1-403-538-5053. You can also complain to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Contact · Compliance Hub