Privacy Policy

What we collect

The only form on this site is the Assessment Guide download. It collects your work email, your sector, your role, and, if you choose to give it, your company — company is optional and the download works without it. Nothing else is collected: there is no contact form, so we hold no name or message content unless you email us directly. We do not run advertising trackers, and we do not build browsing profiles.

If you book a meeting, the calendar is operated by Cal ID and whatever you type into it is processed by them rather than collected here. If you email us, we hold that correspondence.

Why we collect it

• To send you the guide edition your sector selects, and to reply if you email us (we aim to reply within one business day)
• To deliver resources you request, such as the IAM Assessment Guide
• To meet legal obligations where required

We will not add you to marketing email lists based on a form submission. If we wish to send commercial electronic messages beyond responding to you, we will seek express consent first, per Canada's Anti-Spam Legislation. You may withdraw consent at any time.

Processors we use

Download-form submissions are relayed by Web3Forms, which transmits them to us by email as our data processor. Scheduling is provided by Cal ID, whose booking calendar can be opened from our contact page. The calendar loads only when you ask for it, so nothing reaches Cal ID unless you choose to open it; anything you then enter into the calendar is processed by them. This website is hosted by Vercel, and our email is operated by Zoho Mail. All four are named, with the data each can see, in the subprocessor list published on our Trust & Security page; their own privacy practices apply to their services.

Your rights

Canada (PIPEDA): you may access, correct, or withdraw consent regarding your personal information, subject to legal retention requirements.

California (CCPA/CPRA) and other US states: you may request disclosure, correction, or deletion of personal information we hold, and you will not be discriminated against for exercising these rights.

We respond to verifiable requests within statutory timeframes (generally 30 days under PIPEDA; 45 days under CCPA/CPRA). Email hello@vaultiam.com to make a request.

Security & transfers

We apply administrative, technical, and organizational safeguards appropriate to the sensitivity of the information, including TLS encryption in transit. International transfers comply with applicable privacy legislation including PIPEDA and relevant US state laws.

If you are unsatisfied with our response to a privacy concern, Canadian residents may contact the Office of the Privacy Commissioner of Canada.

Contact

vaultIAM · Toronto, ON M5A 0E7, Canada · hello@vaultiam.com