PRIVACY POLICY & DATA PROTECTION NOTICE

1.1. Privacy Commitment.

Cyber Digital Inc. (the “Company”, “we”, “us” or “our”) is a Canadian digital marketing and business support company operating through a network of specialist consultants and remote service providers. The Company recognises the importance of protecting personal information and is committed to maintaining appropriate standards of confidentiality, privacy, data security, and responsible information management.

1.2. Scope of Application.

This Privacy Policy applies to personal information collected, received, processed, stored, used, or disclosed through the Company's website, online enquiry forms, recruitment applications, consultant registration processes, digital communications, virtual assistants, and related online activities.

1.3. Individuals Covered.

This Privacy Policy applies to website visitors, prospective and existing clients, business contacts, recruitment applicants, prospective consultants, independent contractors, and other individuals whose personal information is collected in connection with the Company's activities.

1.4. Applicable Legislation.

The Company shall process personal information in accordance with applicable privacy and data protection legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA), relevant Canadian provincial privacy legislation, and other applicable international data protection requirements, including the UK General Data Protection Regulation (UK GDPR) and European Union General Data Protection Regulation (EU GDPR), where applicable.

1.5. Purpose.

This Privacy Policy explains the categories of personal information collected, the purposes for which such information is processed, the circumstances under which it may be disclosed, the measures taken to safeguard it, and the rights available to individuals in relation to their personal information.

2.1. Information Collected Directly.

The Company may collect personal information voluntarily submitted by individuals through its website, electronic forms, email communications, recruitment applications, consultation requests, and other direct interactions. Such information may include:

1. Full name, email address, telephone number, and country of residence;
2. Company name, professional position, business sector, and organisational contact information;
3. Information relating to business enquiries, service requirements, proposed projects, and consultation requests;
4. Professional qualifications, technical expertise, employment history, and industry experience;
5. Curriculum vitae, professional portfolios, LinkedIn profiles, and other information submitted during recruitment or consultant registration;
6. Availability, preferred engagement arrangements, geographical location, and areas of professional specialisation; and
7. Other information voluntarily communicated to the Company for legitimate business, recruitment, or administrative purposes.

2.2. Website and Technical Information.

When individuals access the Company's website, certain technical information may be collected automatically, depending on the website technologies used and the individual's preferences. Such information may include Internet Protocol (IP) addresses, browser type, device characteristics, operating system, referral sources, pages visited, and general website usage information.

2.3. Communications and Virtual Assistants.

Information submitted through website chat functions, automated assistants, electronic correspondence, and enquiry systems may be collected and processed for the purposes of responding to requests, understanding service requirements, and facilitating relevant communications.

2.4. Collection Limitations.

The Company shall limit the collection of personal information to that which is reasonably necessary for identified and legitimate purposes. Individuals should not submit sensitive personal information, including financial account details, government identification numbers, medical information, or other sensitive records, unless specifically requested through an appropriate secure process.

3.1. Business and Website Activities.

Personal information may be collected, used, and processed for the following purposes:

1. Responding to business enquiries and requests for information;
2. Assessing service requirements and preparing relevant commercial proposals;
3. Communicating with prospective and existing clients;
4. Facilitating consultations and related business communications;
5. Supporting the delivery, administration, and coordination of agreed services;
6. Maintaining and improving website functionality, performance, and security;
7. Evaluating website engagement and the effectiveness of digital communications;
8. Managing business relationships and associated administrative activities; and
9. Complying with applicable legal, regulatory, and contractual obligations.

3.2. Marketing Communications.

Where permitted by applicable legislation and supported by the necessary consent or other lawful basis, personal information may be used to communicate relevant service information, company updates, marketing content, and business opportunities.

3.3. Restrictions on Use.

Personal information shall not be used for purposes materially different from those communicated at the time of collection without providing any additional notice or obtaining further consent required by applicable legislation.

3.4. Lawful Processing.

Where applicable data protection legislation requires a lawful basis for processing, the Company shall identify and rely upon an appropriate basis, which may include consent, performance of a contract, steps requested prior to entering a contract, compliance with legal obligations, or legitimate interests where such reliance is lawful and proportionate.

4.1. Recruitment Information.

The Company may collect and process personal information submitted by individuals applying to join its international network of independent consultants, marketing specialists, technical professionals, researchers, and other service providers.

4.2. Recruitment Purposes.

Personal information submitted through recruitment forms, consultant applications, professional profiles, and related communications may be used for the following purposes:

1. Reviewing professional qualifications, industry experience, and specialist capabilities;
2. Assessing applicants' suitability for relevant consultancy and project-based opportunities;
3. Evaluating technical expertise, professional background, geographical knowledge, and relevant market experience;
4. Contacting applicants regarding their submissions, professional availability, and potential assignments;
5. Arranging interviews, consultations, technical assessments, or other relevant selection activities;
6. Verifying professional credentials, references, and submitted qualifications where appropriate and lawful;
7. Assessing compatibility between an applicant's expertise and specific project requirements; and
8. Maintaining applicant information for potential future opportunities where appropriately notified and permitted by applicable law.

4.3. Independent Consultant Applications.

Submission of an application or professional profile does not constitute an offer of employment, consultancy engagement, or guarantee of future work. Personal information is collected for the purpose of assessing potential professional collaboration and suitability for relevant assignments.

4.4. Applicant Data Sharing.

Applicant information may be made accessible to authorised Company representatives and appropriately engaged recruitment or assessment specialists where necessary for candidate evaluation. Information may also be disclosed to prospective clients or project partners for the consideration of specific assignments, subject to appropriate privacy safeguards and any consent required by applicable law.

4.5. International Recruitment.

As the Company operates through an international consultant network, applications may be assessed by authorised individuals located in different geographical jurisdictions. Any international access, disclosure, or transfer of applicant information shall be subject to applicable legal requirements and appropriate confidentiality and security measures.

4.6. Recruitment Data Retention.

Applications relating to unsuccessful or unengaged candidates shall ordinarily be retained for no longer than twelve (12) months following the most recent substantive recruitment activity, unless a longer period is required by law or the applicant has separately agreed to consideration for future opportunities. Applicants may request earlier deletion of their information, subject to applicable legal exceptions.

4.7. Future Consultancy Opportunities.

Where the Company wishes to retain an applicant's professional information beyond the standard recruitment period for possible future assignments, the applicant shall be informed and any consent required by applicable legislation shall be obtained. Such consent may be withdrawn in accordance with applicable privacy laws.

4.8. Applicant Rights.

Applicants may request access to, correction of, or deletion of their personal information, subject to applicable legal requirements and lawful retention exceptions. Requests to withdraw an application or cease consideration for future opportunities may be submitted using the contact details in this Privacy Policy.

4.9. Recruitment Decisions.

Recruitment and consultant selection decisions shall be based on relevant professional criteria. The Company shall not make decisions producing legal or similarly significant effects solely through automated processing without the safeguards and disclosures required by applicable legislation.

4.10. Information Relating to Third Parties.

Applicants providing professional references or information relating to other individuals must have an appropriate basis for submitting such information. The Company shall process third-party information only where necessary for legitimate recruitment and verification activities.

5.1. Consent Requirements.

Where consent is required, the Company shall obtain an appropriate form of consent before collecting, using, or disclosing personal information. Consent requests shall identify the relevant purposes and shall be presented in a clear and understandable manner.

5.2. Marketing Consent.

The Company shall comply with applicable requirements governing commercial electronic communications, including Canada's Anti-Spam Legislation (CASL), where applicable. Commercial marketing communications shall be sent only where the Company has the necessary consent or another applicable legal authorisation.

5.3. Recruitment Consent.

Submission of a recruitment application authorises the Company to consider the information for the disclosed application and selection purposes to the extent permitted by applicable law. Separate consent shall be obtained where required for unrelated marketing communications or optional retention for future recruitment opportunities.

5.4. Withdrawal of Consent.

Individuals may withdraw consent where processing is based on consent, subject to applicable legal or contractual restrictions and reasonable notice. Withdrawal shall not affect the lawfulness of processing undertaken before the withdrawal.

5.5. Unsubscribe Requests.

Marketing communications shall include an appropriate unsubscribe mechanism where required by law. Requests to discontinue marketing communications shall be processed within the period prescribed by applicable legislation.

6.1. Authorised Disclosure.

The Company may disclose personal information where reasonably necessary for legitimate business operations, service delivery, recruitment activities, technical administration, or legal compliance.

6.2. Service Providers and Consultants.

Personal information may be disclosed to authorised external consultants, technical service providers, website hosting providers, cloud service operators, recruitment support providers, and other third parties engaged to perform services on the Company's behalf.

6.3. Confidentiality Restrictions.

Third parties receiving personal information on behalf of the Company shall be subject to appropriate contractual or other enforceable confidentiality, security, and data protection requirements, consistent with applicable law.

6.4. Limited Access.

Access to personal information shall be restricted to authorised individuals who reasonably require such information for the performance of their assigned responsibilities.

6.5. Legal Disclosure.

Personal information may be disclosed where required by applicable law, court order, regulatory obligation, lawful government request, or where otherwise permitted or required for the protection of legal rights and interests.

6.6. Sale of Personal Information.

The Company does not sell personal information collected through its website or recruitment processes in exchange for monetary consideration. Any other disclosure or use of information shall be subject to the requirements of this Privacy Policy and applicable legislation.

7.1. International Operations.

The Company is based in Canada and may engage consultants, technical providers, and service partners operating in other countries. Accordingly, personal information may be accessed, processed, or stored outside the individual's country of residence.

7.2. Transfer Safeguards.

International transfers shall be undertaken in accordance with applicable data protection requirements, with appropriate contractual, organisational, and technical safeguards implemented where required.

7.3. Overseas Service Providers.

Information transferred to external providers shall be subject to appropriate restrictions regarding confidentiality, authorised processing, security, and disclosure.

7.4. Applicable Legal Requirements.

Where UK GDPR, EU GDPR, or other international transfer restrictions apply, the Company shall use an appropriate lawful transfer mechanism and any supplementary measures required under applicable legislation.

7.5. Foreign Jurisdiction Access.

Information processed or stored outside Canada may be subject to the laws of the country in which it is held, including lawful access requests by regulatory, judicial, or governmental authorities.

8.1. Security Measures.

The Company shall maintain reasonable technical, organisational, and administrative safeguards appropriate to the nature, sensitivity, and volume of personal information processed.

8.2. Protective Controls.

Such safeguards may include:

1. Access restrictions and authentication controls;
2. Secure website connections and encrypted data transmission where appropriate;
3. Restricted access to recruitment and client information;
4. Secure storage and information management practices;
5. Appropriate confidentiality requirements for consultants and third-party providers;
6. Security updates, vulnerability remediation, and relevant technical safeguards; and
7. Procedures for identifying, assessing, and responding to suspected information security incidents.

8.3. Confidentiality Obligations.

Individuals authorised to access personal information shall be required to maintain appropriate confidentiality and shall not disclose or use such information for unauthorised purposes.

8.4. Security Limitations.

Although reasonable safeguards shall be implemented, no internet-based transmission or electronic storage system can be guaranteed to be completely secure.

8.5. Data Security Incidents.

Where a personal information security incident occurs, the Company shall investigate the circumstances, implement appropriate containment measures, and comply with applicable notification, recordkeeping, and regulatory reporting obligations.

9.1. Website Technologies.

The Company's website may use cookies or similar technologies to support essential website operations, remember user preferences, assess website usage, and improve digital functionality.

9.2. Categories of Cookies.

Depending on the technologies implemented, cookies may include:

1. Essential cookies necessary for core website operation and security;
2. Functional cookies supporting user preferences and website features;
3. Analytical cookies measuring website engagement and technical performance; and
4. Advertising or marketing cookies supporting campaign attribution, where enabled.

9.3. Cookie Consent.

Non-essential cookies or tracking technologies shall be activated only where permitted by applicable law, including obtaining prior consent where required.

9.4. Cookie Preferences.

Where non-essential technologies are used, website visitors shall be given the ability to manage applicable cookie preferences through an appropriate consent management mechanism.

9.5. Third-Party Analytics.

Information processed through approved analytics or website service providers shall be subject to applicable privacy requirements and the relevant providers' privacy practices.

10.1. Virtual Assistance.

The Company's website may incorporate automated chat functions, virtual assistants, or other digital communication tools designed to respond to enquiries and facilitate access to information.

10.2. Chat Information.

Information voluntarily entered into a chatbot may include names, contact details, business enquiries, service requirements, and other information communicated during the interaction.

10.3. Purpose of Processing.

Chat information may be processed to respond to enquiries, direct requests to the appropriate contact, improve the operation of the communication service, and facilitate requested follow-up communications.

10.4. External Technology Providers.

Where chatbot services are operated through third-party technology providers, relevant information may be processed by those providers under appropriate contractual and security arrangements.

10.5. Sensitive Information.

Visitors should not submit financial details, identification documents, passwords, medical information, or other sensitive personal information through website chat functions.

10.6. Automated Responses.

Information supplied by an automated assistant is intended for general guidance and enquiry handling. Where necessary, individuals may request direct communication with an authorised Company representative.

11.1. Retention Principles.

Personal information shall be retained only for as long as reasonably necessary to fulfil the purposes for which it was collected, satisfy legal or contractual requirements, resolve disputes, and protect legitimate business interests where permitted by law.

11.2. Business Enquiries.

Personal information collected through business enquiries shall be retained only for the period reasonably necessary to manage the enquiry, related communications, and any resulting business relationship.

11.3. Recruitment Information.

Recruitment and prospective consultant information shall be retained in accordance with Clause 4 of this Privacy Policy and any applicable legal retention requirements.

11.4. Client and Contractual Information.

Information associated with established business relationships may be retained for the duration of the relevant engagement and any additional period reasonably required for applicable legal, contractual, accounting, or regulatory purposes.

11.5. Deletion and Anonymization.

Upon expiry of the relevant retention period, personal information shall be securely deleted, destroyed, or anonymized, unless continued retention is permitted or required by applicable law.

11.6. Backup Information.

Information contained within secure system backups may remain temporarily accessible until the relevant backup retention cycle expires, subject to appropriate access restrictions and security protections.

12.1. Right of Access.

Subject to applicable legislation, individuals may request confirmation of whether the Company holds their personal information and seek access to such information.

12.2. Right to Correction.

Individuals may request correction of inaccurate, incomplete, or outdated personal information held by the Company.

12.3. Right to Deletion.

Where applicable law permits, individuals may request deletion of personal information that is no longer necessary for its original purpose or is otherwise required to be erased.

12.4. Withdrawal of Consent.

Individuals may withdraw previously granted consent where permitted under applicable legislation.

12.5. Additional Rights.

Depending on the laws applicable to the individual and the relevant processing activity, additional rights may include restriction of processing, objection to certain processing activities, data portability, and rights relating to automated decision-making.

12.6. Exercise of Rights.

Requests relating to personal information may be submitted to the Company's designated privacy contact using the details provided below. The Company may request reasonable identity verification before processing such requests.

12.7. Response to Requests.

Privacy requests shall be reviewed and addressed within the periods prescribed by applicable legislation. Where a request cannot be fulfilled, the Company shall provide an explanation to the extent required by law.

12.8. Complaints.

Individuals may raise privacy concerns directly with the Company and, where applicable, submit complaints to the relevant data protection or privacy supervisory authority.

13.1. External Links.

The Company's website may contain links to third-party websites, professional networking platforms, external recruitment services, and other online resources.

13.2. Independent Privacy Practices.

External websites and services operate under their own privacy policies and data protection practices. The Company does not control the independent collection or processing activities of third-party websites.

13.3. External Applications.

Individuals accessing external services through links appearing on the Company's website should review the applicable privacy notices before submitting personal information.

13.4. Company-Selected Providers.

Where an external provider processes personal information on the Company's behalf, the Company shall remain responsible for meeting its applicable legal obligations concerning the selection and oversight of that provider.

14.1. Policy Review.

The Company may periodically review and amend this Privacy Policy to reflect changes in business operations, website functionality, recruitment practices, technology, or applicable legislation.

14.2. Publication of Updates.

Any amended Privacy Policy shall be published on the Company's website with an updated effective or revision date.

14.3. Material Changes.

Where amendments materially affect the collection, use, or disclosure of personal information, additional notification or consent shall be provided or obtained where required by applicable legislation.

14.4. Continued Processing.

The Company shall not rely solely on continued website use as consent to new processing activities where express or other specific consent is required by law.

15.1. Privacy Enquiries.

Questions, complaints, requests for access or correction, recruitment data removal requests, and other privacy-related communications may be directed to the Company's designated privacy contact.

15.2. Privacy Responsibilities.

The Company's designated privacy contact shall be responsible for receiving privacy-related enquiries, coordinating responses to individual requests, and overseeing relevant privacy compliance activities.

15.3. Applicable Rights.

Nothing in this Privacy Policy is intended to exclude, restrict, or diminish any mandatory privacy or data protection rights available to individuals under applicable law.