This Privacy Policy explains how Csw Technologies Inc. collects, uses, stores, shares and protects personal information when you visit our website, contact our control room, or engage us for monitoring and systems design services. The policy is written for the person reading it rather than for a lawyer, and we have tried to keep every sentence plain.
This website and the monitoring work described on it are operated by CSW Tech, the developer and systems practice behind the Csw Technologies Inc. name. When this policy refers to the Company, it means Csw Technologies Inc., with its registered address at 1 Queen St N, Tilbury - N0P 2L0, Canada (CA). You can reach us at alert@cswtech.lat or on +19285925347 at any time.
We keep the policy long on purpose. A short policy that hides the important choices is not a courtesy. If anything below is unclear, write to us and we will explain it in a direct reply.
1. Scope of This Policy
This policy applies to personal information that the Company collects through the website at cswtech.lat, through email and telephone contact with the control room, and through the monitoring and systems design services we provide to clients. Personal information means information about an identifiable individual, including a name, an email address, a telephone number, a job title and a record of communications.
The policy does not cover information that has been aggregated or de identified so that it can no longer be linked to a person. It also does not cover the internal records that a client keeps about its own staff, even where those records are stored on a system that we watch under a monitoring agreement. In those cases the client remains responsible for the personal information, and we act only as a service provider under the terms of the engagement.
If you visit the website only to read the pages and do not submit a form or send an email, the amount of personal information we hold about you is very small. Most of what the website collects in that case is technical data needed to deliver the pages to your browser and to keep the service reliable.
2. Who Is Responsible for Your Information
The Company is responsible for the personal information described in this policy. The registered address is Csw Technologies Inc., 1 Queen St N, Tilbury - N0P 2L0, Canada (CA). The control room operates from the same address, and the person who oversees privacy matters can be reached by email at alert@cswtech.lat or by telephone on +19285925347.
Where we process personal information on behalf of a client, the client is the organization that decides why the information is processed and we are the organization that carries out the processing. In that arrangement the client is the party to whom you should address a request about your own records, and we will assist the client promptly when such a request reaches us.
We do not sell personal information, and we do not operate an advertising network. Any description of sharing in this policy should be read with that starting position in mind.
3. Information We Collect
We collect three broad categories of information. The first is information you give us directly. The second is information generated when you use the website. The third is information that arrives through the monitoring work we perform for clients.
Information you give us
- Your name and the name of your organization when you send a contact request or open an engagement.
- Your email address, telephone number and postal address when you provide them for correspondence.
- The subject and content of messages you send to the control room, including any attachments you choose to include.
- Billing and invoicing details that a client supplies so that we can issue an invoice for services.
- Notes that we take during meetings, handover sittings and reviews, where those notes relate to a named person.
Information generated by the website
- Your internet protocol address and the approximate region associated with it.
- The browser type, operating system and device type that your browser reports.
- The pages you request, the time of the request and the referring page where one is supplied.
- Technical logs that record errors and slow responses so that we can keep the website available.
Information that arrives through monitoring
- Alert records that may contain the name of the engineer who acknowledged an alarm.
- Shift logs and handover lines signed by engineers who work in the control room.
- Escalation maps and rosters that name client contacts and their telephone numbers.
- Runbook pages that describe a client system where a named person is part of the procedure.
We ask for only the information we need for the purpose at hand. Where a form asks for a field that is optional, we say so, and you are free to leave it blank without losing access to the service.
4. Where Information Comes From
Most of the personal information we hold comes directly from the person it relates to. You type it into a form, you send it in an email, or you say it during a meeting or a handover call. Where a client supplies the details of its own staff so that we can build a roster or an escalation map, the information reaches us from the client rather than from the individual, and the client is responsible for having a lawful basis to share it with us.
A small amount of information arrives automatically from your browser when you request a page. That information is technical and is used to deliver the page and to protect the service. It is not used to build a profile of your interests, and we do not combine it with information from other websites.
We may also receive information from a service provider that helps us send email or host the website, where that provider passes back a delivery record such as a bounce or a delivery confirmation. Those records are limited to what is needed to operate the communication and are retained only for as long as the operation requires.
5. Why We Use Information
We use personal information for the purposes described below. Each purpose is tied to a real activity of the business, and we do not keep information for a purpose that we cannot describe plainly.
- To reply to a contact request and to answer the questions you send to the control room.
- To prepare a proposal, a scope document or an assessment for a prospective client.
- To operate a watch bay, an alert roster, an escalation map and an on-call handover for an existing client.
- To send an invoice, to keep accounting records and to meet tax and corporate obligations.
- To improve the website by understanding which pages cause errors or slow responses.
- To protect the service against abuse, fraud and unauthorized access.
- To comply with a legal obligation or to respond to a lawful request from a public authority.
- To establish, exercise or defend a legal claim where a dispute arises.
We do not use personal information for automated decision making that produces legal effects for an individual. The control room relies on named engineers making deliberate decisions, and that is a design choice as much as a privacy one.
6. Lawful Bases for Processing
Where the law requires us to identify a lawful basis, we rely on one or more of the following. We rely on consent where you have clearly given it, for example when you ask us to add you to a mailing list or when you agree to a recording of a meeting. You can withdraw consent at any time, and withdrawal does not affect processing that took place before the withdrawal.
We rely on the performance of a contract where processing is needed to deliver the services that a client has engaged us to provide. This includes building a roster, operating a watch bay and holding an on-call handover. We rely on our legitimate interests where processing is needed to keep the business running in a reasonable way, such as protecting the website from abuse, improving reliability and maintaining business records. When we rely on legitimate interests we consider whether those interests are outweighed by the rights of the individual and we put safeguards in place where they are needed.
We rely on a legal obligation where processing is required by tax law, corporate law or a binding order from a court or regulator. Where the law of a particular jurisdiction requires a different basis, we apply that basis for individuals in that jurisdiction.
7. Monitoring Data and Client Systems
The control room watches systems rather than people. Our watch bays read technical conditions such as whether a storefront resolves, whether a certificate is valid and whether a backup job finished. Those conditions are not designed to observe an individual, and we do not use them to evaluate the performance of an employee of a client.
Some records do contain a name, because a handover is signed by an engineer or because an alert is acknowledged by a named person. Those records exist so that the chain of custody for an alarm is clear. We keep them under the retention rules in this policy and we share them with the client that owns the system, because the client needs to know what happened on the night of an incident.
Where a client system contains personal information about the clients of that client, we treat that information as confidential to the client. We do not read it for our own purposes, we do not sell it and we do not use it to train a model. Access is limited to the engineers who need it to restore a service or to investigate an incident, and access is logged.
10. Service Providers
We use a small number of service providers to run the business. A hosting provider delivers the website and stores the documents that the control room needs to reach during a shift. An email provider delivers messages to and from alert@cswtech.lat. An accounting provider holds invoices and payment records. Each provider is chosen for reliability and is bound by written terms that require confidentiality, security and a limit on the use of the information to the service that is being provided.
We review our service providers when an engagement starts and again when a provider changes its terms in a way that affects privacy or security. If a provider cannot meet our requirements we replace it rather than accept a weaker standard. Where a provider processes information outside Canada, we take the steps described in the international transfers section below.
Some providers act only on our written instructions and have no independent right to use the information. Others act as independent controllers for a narrow purpose, such as an email provider that needs to process metadata to deliver a message. We describe the role of a provider in our internal record so that a request from an individual can be routed to the right party.
11. International Transfers
The control room operates from Tilbury, Ontario, in Canada. Some of our service providers store data in Canada and some store it in the United States or in the European Union. Where information is transferred outside Canada, we take reasonable steps to ensure that it receives a comparable level of protection, for example by using a provider that offers standard contractual clauses or an equivalent safeguard.
Before a transfer takes place we consider the sensitivity of the information and the legal environment of the destination. Where a transfer would create a risk that we cannot adequately address, we keep the information in Canada or we choose a different provider. We also review transfers once a year so that a change in the law of a destination country does not go unnoticed.
If you would like to know which countries are involved for a particular engagement, write to alert@cswtech.lat and we will tell you. We will not promise a country that we cannot guarantee, and we will explain the safeguard that applies.
12. How Long We Keep Information
We keep personal information for as long as it is needed for the purpose for which it was collected, and then we delete it or anonymise it. The periods below are our standard starting points. A particular engagement may set a different period in the written agreement, and where that happens the agreement takes precedence for the information it covers.
- Contact requests that do not lead to an engagement are kept for twelve months and then deleted.
- Proposals and scoping notes are kept for two years after the last contact, so that we can answer a question about an earlier discussion.
- Client rosters, escalation maps and runbook pages are kept for the length of the engagement and for twelve months afterwards, so that a handover to a new provider is possible.
- Watch bay logs and handover records are kept for two years, in line with the review cycle that most clients expect.
- Invoices and accounting records are kept for the period required by Canadian tax law and for any additional period that our accountant advises.
- Website error logs are kept for ninety days and then deleted on a rolling basis.
When a retention period ends we delete the information from our active systems and from the backup sets within the backup rotation that applies to the relevant system. A backup copy may survive for a short period inside the rotation, and it is deleted when the rotation reaches it. We do not keep a second archive of personal information for its own sake.
13. How We Protect Information
We protect personal information with a combination of technical controls, physical controls and plain working habits. Access to the control room records is limited to named engineers who need the records for a shift. Accounts are protected by strong authentication, and shared passwords are not used for any system that holds client information. The network in the control room is separated from the public internet by a firewall, and administrative access is granted only from inside that network or through an authenticated remote path.
Documents that contain personal information are stored in a system that encrypts data in transit and at rest. Email that leaves the control room is encrypted in transit where the receiving server supports it. Physical documents such as a printed runbook page are kept in a locked cabinet at the Tilbury address, and the cabinet is cleared at the end of each engagement.
We train the engineers who work in the control room on the basic habits that prevent most incidents: verifying a request before acting on it, locking a screen when leaving a desk, and reporting a suspicious message rather than clicking through it. We also keep a written incident procedure so that a security event is handled in the same disciplined way as an alarm on a watch bay.
No system is perfectly secure. We describe our controls honestly rather than promising that a breach can never happen. What we can promise is that we will detect an incident quickly, contain it, tell the affected parties without delay and learn from it in writing.
14. Your Rights
Subject to the law that applies to you, you have the following rights in relation to the personal information that we hold about you. We honour these rights for everyone who contacts us, and we do not require you to explain why you are making a request.
- The right to be informed about how your information is used, which is the purpose of this policy.
- The right to request a copy of the personal information that we hold about you.
- The right to ask us to correct information that is inaccurate or incomplete.
- The right to ask us to delete information where we no longer have a lawful reason to keep it.
- The right to ask us to restrict the use of information while a question about it is being resolved.
- The right to object to processing that is based on our legitimate interests.
- The right to receive information in a portable format where the law provides for it.
- The right to withdraw consent at any time where consent is the basis for processing.
- The right to complain to a privacy regulator if you believe your information has been handled improperly.
To exercise a right, write to alert@cswtech.lat or call +19285925347. We will confirm your identity before we release information, because we do not want to hand a record to the wrong person. We aim to reply within thirty days. If a request is complex we will tell you why and give you a realistic date for a full reply.
There is no fee for a reasonable request. If a request is manifestly unfounded or excessive, we may explain that we are unable to act on it and we will tell you which regulator you can approach. Where we act as a service provider for a client, we will forward your request to the client that controls the information and assist that client in answering it.
15. Privacy for Children
The website and the services described on it are intended for organizations and for adults acting in a professional capacity. We do not knowingly collect personal information from children under the age of sixteen. If you believe that a child has sent us personal information, write to alert@cswtech.lat and we will delete the information promptly.
Where a client system that we watch serves a younger audience, the client is responsible for the information that the system collects from its own users. Our watch bays read technical conditions and do not read the content that a young user submits, and we do not build a profile of any individual user of a client system.
If we learn that information has been collected from a child without the consent of a parent or guardian, we will delete it as soon as we can and we will take reasonable steps to prevent a repeat.
16. Marketing Communications
We do not run a large marketing programme, and we do not send bulk email to people who have not asked for it. When we send a note about a service, a change to the control room or a review cycle, it is usually because the recipient is an existing client or has asked to hear from us. Every marketing message includes a clear way to opt out, and the opt out is honoured immediately.
Opting out of marketing does not stop transactional messages such as an invoice, a handover confirmation or a notice about a security incident. Those messages are part of the service and are sent even where you have declined marketing.
We do not share an email list with a third party for marketing purposes, and we do not use a contact that was given to us for an engagement to promote an unrelated service.
17. Security Incidents and Notice
If we become aware of a security incident that creates a risk to personal information, we follow a written procedure that begins with containment. The engineer who detects the incident notifies the person responsible for privacy matters, who assembles a small response team and records the timeline in a single log. The team decides whether the incident is contained, what information is affected and which parties need to be told.
Where the law requires notice, we notify the relevant regulator and the affected individuals without undue delay. The notice explains what happened, what information was involved, what we have done to contain it and what the affected person can do to reduce the risk. We do not wait for a complete picture before telling the people who are affected, and we follow up with a fuller account once the investigation is closed.
Where we process information on behalf of a client, we notify the client as soon as we become aware of an incident so that the client can meet its own notification duties. The notification includes the facts as we know them and does not shift blame to a provider before the facts are clear.
18. Third Party Websites
The website may contain a link to a site that we do not operate, for example a map service or a professional directory. A link is not an endorsement of the privacy practices of the destination, and this policy does not apply once you leave our pages. We encourage you to read the privacy notice of a site before you submit personal information to it.
We do not embed a third party advertising widget, and we do not permit an invisible tracking script to load from a partner site. Any embedded content that we do use is limited to what is needed to display the page, and it is described in the cookie section above where it sets a cookie or a local storage entry.
19. Changes to This Policy
We review this policy at least once a year and whenever we change a service, a provider or a working practice in a way that affects privacy. When a change is material, we update the effective date at the top of the page and we post a short note on the homepage for a reasonable period. A change that expands the use of personal information is announced before it takes effect, so that an individual has a chance to object.
We do not apply a change retroactively to information that was collected under an earlier version of the policy unless the law permits it and the change is consistent with the original purpose. The current version of the policy always sits at this address, and the previous version is available on request.
20. How to Contact Us
For any question about this policy, a request to exercise a right or a complaint about the handling of personal information, contact the Company at the details below. The control room reads every message, and a named person will reply.
Csw Technologies Inc.
1 Queen St N, Tilbury - N0P 2L0, Canada (CA)
Email: alert@cswtech.lat
Phone: +19285925347
If you are not satisfied with our reply, you may contact the privacy regulator in your jurisdiction. In Canada the relevant authority is the Office of the Privacy Commissioner of Canada, and we will cooperate fully with any review that it undertakes.