Data Protection and Processing Terms

1.1 Role of the Parties

In most engagements, the client is the organization that determines the purposes for which personal information is collected and used, and we act as a service provider that processes information on the client’s behalf. We handle personal information only as necessary to deliver the agreed services and in accordance with the client’s lawful instructions and applicable Canadian privacy law.

1.2 Types of Processing

The services may involve activities such as the collection, recovery, analysis, correlation, storage, and secure transfer of digital evidence or other data that may contain personal information. The exact nature of the data and processing activities depends on the engagement and is further described in the applicable statement of work, retainer, or service agreement.

2.1 Safeguards

We implement administrative, technical, and physical safeguards designed to protect personal information against loss, theft, and unauthorized access, disclosure, use, or modification. These safeguards are proportionate to the sensitivity of the information and the risks associated with the processing and may include:

• Encryption of data in transit and at rest where appropriate
• Use of secure forensic workstations and controlled laboratory environments
• Access controls and authentication mechanisms
• Logging and monitoring of access to sensitive systems
• Regular updates, security patches, and vulnerability management
• Staff training and confidentiality undertakings

3.1 Retention Periods

We retain personal information only for as long as necessary to:

• Deliver the agreed services and document our work
• Comply with legal, regulatory, or professional obligations
• Protect our rights in connection with potential claims arising from the engagement

3.2 Return or Destruction

At the end of an engagement or upon the client’s written request, we will, subject to applicable law and professional obligations, return or securely destroy personal information and related records under our control. Certain information may be retained in backup or archival systems for a limited period where required for legal, regulatory, or evidentiary purposes.

4.1 Use of Third Parties

Where we engage third-party service providers to support our work, such as secure hosting, specialized forensic tools, or communication platforms, we require them to handle personal information in a manner consistent with these Terms and applicable Canadian privacy requirements. We remain responsible for the acts of these providers in relation to personal information processed on our behalf.