Privacy Policy

Privacy Policy

Last updated: 20 July 2025

HarbourGate Advisory Services (“HarbourGate,” “we,” “our,” “us”) respects your privacy. This Privacy Policy - our privacy statement and confidentiality policy  - explains how we collect, use, disclose, and protect personal information when you visit harbourgate.ca or use our cybersecurity advisory services in Halifax, Nova Scotia, and across Atlantic Canada.

1) Who this policy applies to

• Visitors to our website and people who contact us
• Prospective  and current clients and their representatives
• This policy does not cover employees/contractors (handled separately)

2) What we collect

Information you provide
Name, work email, phone, organization, role/title, and any details you submit in forms, emails, uploads, or booking tools (e.g., meeting notes, project context).

Automatic/technical data
IP address, device and browser type, pages viewed, time on page, referral source—collected via cookies and similar technologies (e.g., Google Analytics 4). If you use our booking widget, Calendly collects scheduling details you provide.

Business records (clients)
Proposal/SoW details, invoices, engagement notes, and artifacts required to deliver services.

We do not intentionally collect sensitive personal information through the website, and our services are for business users.

3) Why we use personal information

We use information to:

• Respond to inquiries, schedule consultations, and deliver requested services
• Prepare proposals and statements of work
• Send service-related communications (confirmations, deliverables, advisories) and marketing updates only with your consent
• Operate, secure, and improve our website (analytics, troubleshooting, and abuse prevention).
• Meet legal, regulatory, tax, and audit obligations

4) Cookies, analytics, and your choices

We use functional cookies (to run the site) and analytics cookies (to understand traffic).
You can control cookies via your browser settings; blocking cookies may affect certain features (e.g., scheduling). You can also opt out of analytics using browser add-ons.

5) Data residency and international transfers

Client documents and other sensitive data are stored on encrypted systems hosted in Canada. Some tools we use (e.g., analytics or scheduling) may process limited data on servers outside Canada. Remote team members outside Canada access only what’s necessary to deliver services, using secure VPN and MFA. When data is processed internationally, we apply contractual and technical safeguards.

6) Sharing & disclosure

We do not sell personal information. We share it only with:

• Service providers/sub-processors that support our operations (e.g., Microsoft 365 for email/files, secure hosting, Calendly for scheduling, and analytics providers). These parties must keep data confidential and use it only for the contracted purpose.
• Professional advisors (legal/accounting) under confidentiality
• Authorities when required by law or to protect rights, security, clients, or the public 
• If HarbourGate is involved in a merger or acquisition, information may transfer as part of that transaction under confidentiality.

7) Security

We use industry best practices to protect information, including

• Multi-factor authentication (MFA)
• Encryption in transit and at rest
• Role-based, least-privilege access
• VPN for remote access
• Regular patching and security monitoring
      No method is 100% secure, but we work to prevent unauthorized access, use,      or disclosure.

8) Retention

• Inquiry/marketing records: up to 24 months after last contact
• Contracts, billing, and engagement records: retained to meet legal/tax requirements      (typically 7 years in Canada)
      When retention ends, we securely delete or anonymize data.

9) Your rights

Subject to applicable law (e.g., PIPEDA and Nova Scotia privacy laws), you can request to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete information that is no longer required
• Withdraw consent to optional communications
• We may need to verify your identity and will respond within legally required timelines.

10) Third-party links & embeds

Our site may link to or embed third-party services (e.g., scheduling). Their privacy practices are governed by their own policies; we encourage you to review them.

11) Changes to this policy

We may update this policy from time to time. The “Last updated” date above reflects the latest version. Material changes will be posted on this page.

12) How to contact us or make a complaint

Email: info@harbourgate.ca

If you have unresolved concerns, you may contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for Nova Scotia.