Privacy Policy

Summary

CSMIC (Cybersecurity Made in Canada™) is a cybersecurity consulting firm based in Ontario, Canada. We collect only the personal information we need, use it only for the purpose we tell you about, protect it with strong security, and delete it when it is no longer needed.

We do not keep resumes or personal information longer than we need them, and we never sell personal information.

Who this policy covers

This policy applies to personal information collected through csmic.ca, the CSMIC portal (https://portal.csmic.ca), email to info@csmic.ca, and our consulting, training and recruiting activities.

CSMIC is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how private-sector organizations in Ontario collect, use and disclose personal information in the course of commercial activities. We follow its ten fair information principles: accountability; identifying purposes; consent; limiting collection; limiting use, disclosure and retention; accuracy; safeguards; openness; individual access; and challenging compliance. We do not collect personal health information.

What we collect and why

• Contact and consulting enquiries: your name, organization, email address, phone number and message, so we can answer you and provide the services you ask for.
• Job and contract applications: your name, email address, phone number (optional), city and province or country, whether you are eligible to work in Canada, your current security clearance level and expiry (if any), your resume, and the job you applied for. We use this information only to assess your application for that role.
• Right-to-represent agreements: if we propose you for a client opportunity, we record the agreement terms, your typed name, your hand-drawn signature, the date and time, the country your connection came from and your browser type, so we can prove that you consented.
• Security tools and training: the queries you type into our tools are processed to return a result and are not stored. For the training certificate, your name stays in your browser; we keep no record of it.
• Website security: to protect the portal against abuse, we check the country your connection comes from and apply request limits. Network (IP) addresses are used for these checks and are kept only in temporary security logs.

How we handle resumes

We do not keep resumes or personal information beyond what an active opportunity requires.

• When you submit a resume for a role, it is stored encrypted in our secure system in Canada and checked first for file safety (file type and active content such as macros or scripts), then reviewed by a person against the requirements of the role. We do not use artificial intelligence to screen, assess or select applicants.
• If your application is not a match, it is securely deleted: within 7 days of our decision, and in any case no later than 30 days after you apply.
• If we decide to move forward, we ask you to sign a right-to-represent agreement before your resume is shared with a client. We remove your personal contact details from the resume we share unless the client requires them, and the whole application process stays within our secure, encrypted system.
• Once the opportunity ends, your resume and agreement are securely deleted, normally 30 days after the agreement's end date and never more than 12 months after you applied.
• You can delete your application yourself at any time using the private link you receive when you apply, or by emailing us.

Consent

We ask for your consent when we collect your information, and we explain the purpose at that time. Your consent is express when you submit an application or sign an agreement. You may withdraw consent at any time, subject to legal or contractual limits (for example, once a bid has been submitted to a client, a withdrawal takes effect when the procurement rules allow). Withdrawing may mean we can no longer consider you for an opportunity.

Sharing and service providers

We share personal information only with your consent, with service providers who help us operate, or where the law requires it. We do not sell or rent personal information.

• Clients: only when you have signed a right-to-represent agreement for that client opportunity.
• Google Cloud (Canada): hosts the CSMIC portal, its database and file storage in Google's Toronto region. Applications, resumes and agreements are stored in Canada.
• Google reCAPTCHA: protects our forms and tools from automated abuse. It collects hardware and software information, such as device and browser data, and sends it to Google for analysis; this processing may take place outside Canada. Google's Privacy Policy and Terms of Service apply.
• GoDaddy: hosts the csmic.ca website and its contact form. Information you submit through the website may be processed in the United States.
• Email providers: messages you send to us are handled by our email provider.

When information is processed outside Canada, it may be subject to the laws of that country, including lawful access by its authorities. We require our providers to protect personal information with safeguards comparable to our own.

Cookies

The portal uses one essential, signed session cookie to keep you signed in and protect forms from cross-site attacks. It contains no personal information about you and expires within 12 hours. The csmic.ca website, hosted by GoDaddy, uses cookies to measure site traffic; you can manage them through the cookie notice on that site and your browser settings. reCAPTCHA may set its own cookies when it runs.

How we protect information

• Encryption in transit (HTTPS) and at rest.
• Private storage with public access blocked, access limited to CSMIC principals who sign in with multi-factor authentication, and an audit trail of access.
• File safety checks on every upload, automatic deletion schedules, and no copies of resumes on personal devices or in email where we can avoid it.
• Breach response: if a breach of security safeguards creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible and keep a record of the breach, as PIPEDA requires.

How long we keep information

• Applications that are not a match: deleted within 7 days of our decision and no later than 30 days after submission.
• Shortlisted applications without a signed agreement: deleted after 90 days.
• Signed right-to-represent agreements and the related resume: deleted 30 days after the agreement's end date, and never kept more than 12 months after the application.
• Consulting records: kept for as long as required for the engagement and for tax and legal obligations.
• Security logs: kept for a limited period (normally 30 days) and then deleted automatically.

Your rights

You may ask to see the personal information we hold about you, ask us to correct it, or withdraw your consent. Send your request to info@csmic.ca. We will respond within 30 days and may need to confirm your identity first. There is no charge.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376).

Electronic messages

We send commercial electronic messages only with your consent, as required by Canada's Anti-Spam Legislation (CASL), and every message includes a way to unsubscribe.

Children

Our services are intended for adults and organizations. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy. The effective date below shows when it last changed. Significant changes will be highlighted on our website.

Contact our Privacy Officer

Kam Ghaderi, Privacy Officer, CSMIC, Ontario, Canada. Email: info@csmic.ca.

Effective October 3, 2026.