PRIVACY POLICY AND DATA GOVERNANCE FRAMEWORK

1.0 PURPOSE AND SCOPE

This Privacy Policy (the “Policy”) establishes the protocols by which Chester WorX (“the Agency”) collects, utilizes, and safeguards Personal Information and Proprietary Data. This Policy is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. By engaging with our digital assets or services, the User (“Client,” “Visitor”) acknowledges and accepts the terms herein.

2.0 DATA CLASSIFICATION AND COLLECTION

The Agency limits collection to information strictly necessary for the execution of professional services and security operations.

• 2.1 Identity & Contact Data: Legal name, corporate affiliation, encrypted email identifiers, and telecommunications data.
• 2.2 Technical & Forensic Data: IP addresses, browser fingerprints, session metadata, and security logs.
• 2.3 Client-Provided Assets: Source code, database schemas, or network architecture details provided during security audits or web development cycles.

4.0 THIRD-PARTY INTEGRATIONS AND DATA TRANSFERS

To maintain operational efficiency, the Agency utilizes vetted third-party processors.

• Marketing & Communications: Data processed via Mailchimp is subject to their Global Privacy Statement.
• Security & Verification: Google reCAPTCHA v3 is utilized to mitigate brute-force and bot-net activity.
• Cross-Border Transfers: Data may be processed on servers located outside of Canada (e.g., United States). Such data is subject to the laws of the jurisdiction in which it is stored.

5.0 DATA RETENTION AND DISPOSAL

The Agency adheres to a “Minimum Necessary” retention schedule.

• Operational Data: Retained for the duration of the active contract plus a period of twenty-four (24) months for audit purposes.
• Security Logs: Retained for twelve (12) months unless required for ongoing forensic investigation.
• Disposal: Upon expiration of the retention period, data is subjected to cryptographic erasure or physical destruction.

6.0 CLIENT OBLIGATIONS

The Client is responsible for maintaining the confidentiality of any credentials, API keys, or secure portals provided by the Agency. Failure to secure these assets waives the Agency’s responsibility for subsequent unauthorized access.

7.0 ACCESS AND RECTIFICATION RIGHTS

Under PIPEDA, individuals maintain the right to challenge the accuracy and completeness of their Personal Information. Formal requests for access must be submitted in writing to the Privacy Officer. The Agency reserves the right to verify identity via multi-factor authentication before releasing any records.

8.0 MANDATORY DISCLOSURE

The Agency reserves the right to disclose Personal Information if required by law, or if such action is deemed necessary to comply with a legal mandate, protect the property of Chester WorX, or act in urgent circumstances to protect public safety.

9.0 AMENDMENTS

Chester WorX reserves the unilateral right to modify this Policy at any time. Continued use of the Agency’s services following such modifications constitutes an implicit acceptance of the revised terms.