Clear information about how we handle yours.

01

Scope and applicable law

This Privacy Policy describes how Rocky Ridge Security collects, uses, discloses, retains and protects personal information through this website, the client request form, email, phone calls and introductory consultations.

Rocky Ridge Security operates in Calgary, Alberta. Our handling of personal information is governed primarily by Alberta'sPersonal Information Protection Act (PIPA). The federal Personal Information Protection and Electronic Documents Act (PIPEDA) may apply to certain interprovincial or international activities.

This policy focuses on website visitors, prospective clients and business contacts. Information handled during a cybersecurity engagement may also be governed by a service agreement, confidentiality agreement, data-processing terms and the client's documented instructions. If those documents provide stronger protections, those protections will also apply.

02

Information we collect

We may collect the following categories of information:

We generally collect personal information directly from you when you complete the form, send an email, call us or speak with us. We aim to collect only what is reasonably needed for the purpose we explain at or before collection.

03

How we use information

We may use personal information to:

• receive, organize and respond to your request;
• contact you using the method and time you selected;
• understand your business, systems and security concerns;
• determine whether our services fit your needs and recommend a practical next step;
• prepare for a consultation, proposal or service agreement;
• maintain reasonable business, legal, insurance and security records;
• detect spam, misuse, fraud, security incidents or technical problems; and
• comply with applicable law or respond to lawful requests.

We do not sell, rent or trade personal information. Submitting a client request does not add you to a marketing list. We will send promotional electronic messages only where permitted by law and with any consent that is required.

04

Consent and your choices

The client request form asks you to confirm that Rocky Ridge Security may use the submitted information to respond to your request and that you have read this policy. In other situations, consent may be express or implied from the circumstances, as permitted by law.

You may decline optional fields. You may also withdraw or change consent by contacting our Privacy Officer, subject to reasonable notice and any legal, contractual or record-keeping requirements. Withdrawal may limit our ability to respond to a request or provide a service. We will explain material consequences when they are not obvious.

05

When we share information

We disclose personal information only for reasonable purposes and to the extent reasonably necessary. This may include disclosure to:

• authorized Rocky Ridge Security personnel or contractors who need the information to respond or provide an approved service;
• Cloudflare, which hosts the website, runs the same-domain form handler and provides Turnstile spam and abuse protection;
• Resend, which securely delivers accepted form submissions to our request inbox;
• providers supporting website hosting, business email, communications, security, document management or professional services;
• legal, accounting, insurance or other advisers where reasonably necessary; and
• courts, regulators, law enforcement or other parties where required or authorized by law, or where necessary to protect rights, safety or security.

Service providers are permitted to handle information only for the services they provide to us, subject to their contracts, policies and applicable law. You can review theCloudflare Privacy Policy and theResend Privacy Policy for more information about those providers.

06

Processing outside Canada

Some providers that support our website, form delivery, email or related business systems may collect, use, disclose or store personal information in Canada and the United States. Their subprocessors may operate in other jurisdictions disclosed in their own service terms.

When personal information is processed outside Canada, it may be subject to the laws of that jurisdiction and may be accessible to courts, law enforcement or national-security authorities under those laws. Rocky Ridge Security remains responsible for personal information under its control and uses reasonable measures when selecting and working with service providers.

Contact our Privacy Officer if you would like more information about our policies and practices regarding service providers outside Canada.

07

Retention and secure disposal

We keep personal information only as long as reasonably necessary for the purposes described in this policy and for legitimate business, legal, insurance, security or dispute-resolution needs. The appropriate period depends on the nature of the inquiry, the sensitivity of the information and whether a client relationship is established.

If personal information is used to make a decision that directly affects an individual, we retain that information for at least one year after the decision, as required by PIPA. When information is no longer reasonably required, we securely destroy it or make it anonymous. Backups and provider systems may retain protected copies for a limited period before normal deletion cycles finish.

08

How we protect information

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity and amount of information involved. Depending on the circumstances, these may include:

• limiting access to people who need the information;
• strong authentication and protected business accounts;
• encryption and secured devices or storage;
• confidentiality requirements and careful handling procedures;
• backups, updates and security monitoring; and
• incident-response and secure-disposal procedures.

No method of internet transmission or storage can be guaranteed completely secure. For that reason, the website form is intended for an initial business inquiry, not for credentials, patient information or detailed security findings.

09

Cookies and website data

As of the effective date of this policy, Rocky Ridge Security does not use advertising cookies, cross-site behavioural advertising or a website analytics platform. The website may use essential technical mechanisms needed for basic operation and security.

The contact form uses Cloudflare Turnstile to distinguish people from automated abuse. Turnstile processes technical and device signals and creates a short-lived verification token that our server validates before accepting a request. Blocking the required Cloudflare script, frame or essential security mechanisms may prevent the form from working properly.

If we later add non-essential analytics or similar technology, we will update this policy and provide any notice or choice required by law.

10

Access, correction and complaints

Subject to limited legal exceptions, you may make a written request to:

• access personal information we hold about you;
• ask how it has been used and to whom it has been disclosed;
• correct an error or omission;
• withdraw consent where applicable;
• ask us to delete information that is no longer reasonably required, subject to legal and contractual limits; or
• raise a concern about our privacy practices.

We may need to verify your identity before providing access or making a change. We will respond within the time required by applicable law; under Alberta PIPA, this is generally within 45 days unless a permitted extension applies. Some information may be withheld where the law requires or allows it, including certain information about another person or confidential commercial information.

Please contact us first so we have an opportunity to address your concern. If it is not resolved, you may contact theOffice of the Information and Privacy Commissioner of Alberta.

11

Privacy incidents

We assess suspected losses, unauthorized access or disclosures and take reasonable steps to contain and investigate them. If an incident creates a real risk of significant harm, we will report it to the Office of the Information and Privacy Commissioner of Alberta and provide any notices required by law.

12

Other important information

Business-to-business website

This website is intended for business and organizational users. It is not directed to children, and we do not knowingly collect personal information from children through the request form.

Third-party websites

Our website may link to external websites. Their operators are responsible for their own privacy practices, and this policy does not apply after you leave our website.

Changes to this policy

We may update this policy when our practices, providers or legal obligations change. The revised version will be posted here with a new effective date. If a change is material, we will provide additional notice where appropriate.