Privacy Notice

InfoDefender™ product benefits are provided by Sontiq™, a TransUnion® company. InfoDefender™ provides identity theft protection services intended for use by Canadian customers. "We", "Our" or "Us" refer to Sontiq Inc. This Privacy Notice describes how we collect, use, share, and protect the Personal Information you may provide to us and we collect about you. It applies to Personal Information you may supply when you use the InfoDefender website and mobile app that link to this Privacy Notice (“Site”). When we process your Personal Information, we follow the privacy principles of applicable Canadian law, the Personal Information Protection and Electronic Documents Act (PIPEDA) to ensure the information is:

• Used lawfully, fairly and in a transparent way.
• The knowledge and consent are required for the collection, use, or disclosure of personal information, except where inappropriate
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate as updated by you from time to time.
• Kept only as long as necessary.
• Kept securely.

We may collect Personal Information from you and about you from third parties. This Privacy Notice does not apply to data we receive from third parties unless it is combined with Personal Information you have provided to us.

If you do not agree to the terms of this Privacy Notice, please do not provide us with any Personal Information and do not use this Site. We also recommend that you review the Site’s Terms of Use. This document governs your use of the Site.

This Notice will answer many of the questions you have about the use of your information. These include:

1. What information does the Site collect?
2. How do we use the information collected?
3. Where does processing of the information occur?
4. How is the information protected?
5. How Do I Change My Information and Communications Preferences?
6. How and When Do We Share Information with Third Parties?
7. Does Third-Party Content, Links to Sites, and/or Apps Appear on the Site?
8. How is children’s information processed?
9. About Changes to the Privacy Notice?
10. Who do I contact with questions and concerns?

1 WHAT INFORMATION DOES THE SITE COLLECT?

1.1 INFORMATION YOU PROVIDE US

We collect personal information about you for the sole purpose of responding to your queries, and fulfilling the services you have requested and are enrolled in.

The following outlines the information we may collect:

Personal Information, such as your first and last name, address, phone number, username and password, credit card number, social insurance number and email address (“Personal Information”); and

Demographic Information, such as information about your age and gender (“Demographic Information”). If we combine Demographic Information with your Personal Information, we will treat the combined data as Personal Information.

We may collect this information through various forms and in various places in the Site. If you register for an account, through “contact us” forms, or when interacting with the Site, we may collect Personal Information.

1.2 LOCATION-BASED INFORMATION

We may use location-based services to determine your location. We do this to verify your location, deliver you relevant content based on your location, and to enable the location-based services we offer. You may be able to change the settings on your Device to prevent it from providing your location.

1.3 INFORMATION THIRD PARTIES PROVIDE ABOUT YOU

We may supplement the Personal Information we collect directly from you with information from third parties. This allows us to enhance our ability to provide the services you have requested.

The Site may allow access to third-party websites, online services, or applications. In return the third-party may provide personal and other information to us. For example, if you select a social media icon (such as for Facebook, Twitter, or Instagram), we may have access to the information from them.

We may also receive information about you from your friends and others that use the Site. This will happen when they submit content to us or post on the Site.

When we receive information from those sources and combine it with Personal Information, the new information will be treated as Personal Information under this Privacy Notice.

1.4 INFORMATION WE COLLECT AUTOMATICALLY

In addition to any Personal Information you provide to us, we may use a variety of technologies that automatically collect certain information whenever you visit or interact with the Site. When we associate Usage Information with your Personal Information, we will treat it as Personal Information.

This Usage Information may include:

• Your IP address, UUID – universally unique identifier, or another unique identifier (“Device Identifier”). This is automatically assigned to your device.
• Your device functionality (including browser, operating system, hardware, mobile network information, etc.).
• The areas within our Site that you visit and your activities there, including remembering you and your preferences.
• Your device location.
• Other device data, such as the time of day.

We use various methods and technologies to store or collect Usage Information (“Tracking Technologies”). The Tracking Technologies used on the Site include:

Cookies – A cookie is a small data file placed on a device when it is used to visit the Site. Cookies may be disabled or removed by tools that are available as part of most commercial browsers. Each browser you use must be set separately. Please be aware that if you disable or remove cookies on your device, some parts of our Site may not function properly.

Web Beacons – Web beacons are small images that may be included in our Site and in our messages. Web Beacons may be used for a number of purposes such as counting visitors to the Site, monitoring how users navigate the Site, counting how many sent emails were actually opened, or counting how many particular links were actually viewed.

Embedded Scripts – An embedded script collects information about how you use the Site. The code is temporarily downloaded onto your Device while you are connected to the Site and is deactivated or deleted when you leave.

Browser Fingerprinting – Browser fingerprinting is based on the analysis of information from your Device. Items such as your operating system, plug-ins, system fonts and other data are used to create a unique ID to identify your device.

Entity tags – An entity tag, or ETag, is an opaque identifier assigned by a web server to a specific version of a resource found at a web server. If the resource content ever changes, a new and different ETag is assigned. Used in this manner ETags are a form of Device Identifier. ETag tracking may generate unique tracking values even where the consumer blocks cookies.

Recognition Technologies – Recognition technologies make assumptions about users and devices such as that a user of multiple devices is the same user.

1.5 IF YOU FAIL TO PROVIDE PERSONAL INFORMATION

If you fail to provide certain information when requested, we may not be able to provide part of our service to you (such as monitoring your credit card for unlawful activity), or we may be prevented from complying with our legal obligations.

2 HOW DO WE USE THE INFORMATION COLLECTED?

We may use your Personal Information, Demographic Information or Usage Information that is subject to this Privacy Notice:

• to provide you with services such as to protect your identity,
• to process transactions or provide you with information such as to send you electronic newsletters,
• to provide you with special offers or promotional and marketing materials (including sweepstakes and contests), including to let you know about new products, services, or upcoming events,
• to improve the Site including the user experience, marketing endeavors, and our Site offerings,
• to customize your experience on the Site,
• to serve you specific content or ads that are relevant to you,
• to provide customer support,
• to contact you with regard to your use of the Site and, in our discretion, changes to the Site and/or Site’s policies,
• for internal business purposes, and
• for purposes disclosed at the time you provide your information or as otherwise set forth in this Privacy Notice.

We will only use your Personal Information for the purposes for which we collected it and related purposes. You will be notified if we need to use your personal information for an unrelated purpose. We may also process your Personal Information where the processing is required or permitted by law.

2.2 AUTOMATED DECISION MAKING

We do not make decisions using automated means that have legal or similar impacts to you. “Automated decision making” is when choices are made by computers without the involvement of a person.

Automated decision is made in the following circumstances:

• Where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights.
• With your explicit written consent and where appropriate measures are in place to safeguard your rights.
• Where we have notified you of a decision and given you 21 days to request a reconsideration.

3 WHERE DOES PROCESSING OF THE INFORMATION OCCUR?

Our Site operates in the United States. Information we collect, including Personal Information, will be transferred, processed, stored, and used in the United States.

The data protection laws in the United States may differ from those of Canada. Your information may be subject to access requests from governments, courts, or law enforcement according to the laws of the United States.

3.1 HOW LONG IS PERSONAL INFORMATION RETAINED?

We only retain your personal information for as long as necessary to fulfill the purposes for which it was collected. This includes satisfying any legal, accounting, or reporting requirements.

When you give up your membership, your Personal Information is retained for a short period of time in the event you decide to rejoin. After this period, your Personal Information will be securely destroyed or obfuscated.

4 HOW YOUR INFORMATION IS PROTECTED

The security of your personal information is of critical importance to us. Our security controls are independently audited, annually to meet the highest security standards in the industry:

• the Payment Card Industry Data Security Standards (PCI DSS) Level 1 controls, including a Report on Compliance (RoC) issued by a Qualified Security Assessor (QSA)
• the American Institute of Certified Public Accountants (AICPA) SOC 2, Type 2, (Report on Controls at a Service Organization) based on the Trust Services Criteria relevant to Security, Availability, Processing Integrity, Confidentiality, and Privacy, and
• the US National Institute of Standards and Technology (NIST) 800-53 Risk Management Framework

We utilize technologies, policies, and procedures to provide comprehensive protection for all our systems and applications. Integrity and confidentiality of data is of the highest importance.

We use industry-standard safeguards to protect your information.

You are responsible for maintaining the confidentiality of any Password(s) and all activities that occur using your Password(s). You should notify us immediately of any unauthorized use of your Password or accounts. Please contact us (see below) if you believe your Personal Information has been exposed.

 

5 HOW DO I CHANGE MY INFORMATION AND COMMUNICATIONS PREFERENCES?

You are responsible for the accuracy of the information you share with us. This information may be reviewed and updated through the

• Site’s registration forms or
• “Manage Account” tab on your account dashboard.

You also may write to us directly to update or delete your contact information or to request that we stop sending you any form of communication. These requests should be sent to us by regular mail to:

InfoDefender / Sontiq
Attn: Chief Privacy Officer
99 Avenue Rd SPH1,
Toronto ON M5R 2G5

We may ask you to provide additional information before making these changes. This may be done to verify your identity.

When you update your information, we will make good faith efforts to make the requested changes in our systems as soon as reasonably possible. We may need to retain prior information as business records in some situations.

 

5.1 PERSONAL INFORMATION REQUESTS

With some restrictions, you may make requests of us with regard to your personal information. Please contact our Privacy Office, support@infodefender.ca, with these requests.

Access – You may request a copy of the personal information we hold about you. To see the information we hold, log in to your account and review the information from the InfoDefender member dashboard. You will not have to pay a fee to access your personal information in the member dashboard(s) while your account is current (or to exercise any of the other rights). Please note that, for security, we cannot provide your full Social Security Number or your full credit card numbers.

Transfer – You may request we provide an electronic copy of the information you have provided to us to be shared in a format that may be sent to a third party.

Correction – You may request that we modify any incomplete or inaccurate information we hold about you. To modify information we hold about you, log in to your account and update the information in the InfoDefender member dashboard.

Erasure – You may request that we delete elements of your information. Please note that it is not always possible to completely remove all of your information from our systems. This is often due to legal or regulatory requirements. Also, some data may remain on our backup media for a limited period of time.

Restrict processing – You may request that we suspend the processing of your personal information. You may want to do this, for example, if you want us to verify the accuracy of the information. Another example may be to ask us to confirm the reason the processing is occurring. You may do this by logging in to your account and removing your personal information from the InfoDefender member dashboard. The information may be restored at a later time.

5.2 WITHDRAWING CONSENT

In some very limited cases we process your Personal Information based upon your consent. You have the right to withdraw your consent for processing in these situations at any time.

To withdraw your consent, please log in to your account and delete the information from the InfoDefender member dashboard.

 

6 HOW AND WHEN DO WE SHARE INFORMATION WITH THIRD PARTIES?

We may share Personal Information and other information with third-parties. This is done

• to provide service to you,
• to protect our and others’ interests, and
• in the event of a transfer of the business.

We may also share your information with related companies. These include our parent company, our subsidiaries, and affiliates.

There are times when we share information in an anonymized or aggregate form with our partners. In these cases, the identity of the individual(s) whose information is shared cannot be directly discerned from the information we provide.

All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information. We do not allow our third-parties to use your personal data for their own purposes.

6.1 SHARING TO PROVIDE SERVICE TO YOU

We may use third-party vendors to perform certain services on our behalf. These services:

• assist in the operation, design, and hosting of the site,
• tracking activity on the site by collecting analytic information,
• manage a database of customer information,
• send you special offers,
• perform administrative services,
• provide credit report information, and
• provide other services designed to assist us in maximizing our business potential.

These vendors may have access to user information to carry out the services they are performing. This may include Device Identifiers and Personal Information which we provide to the vendors.

Third party analytics and other service providers use their own Tracking Technologies on your Device. These third parties may collect or have access to information about you. This may include Personal Information which we do not provide. We are not responsible for the technologies or activities of these third parties.

6.2 SHARING TO PROTECT OUR AND OTHERS INTERESTS

We may use and share your information including Device Identifiers and Personal Information to third parties to:

• satisfy any applicable law, regulation, subpoena, governmental request, or legal process if, in our good faith opinion, such is required or permitted by law,
• protect and/or defend the Site’s Terms of Use or other policies applicable to the Site, including investigation of potential violations,
• protect the safety, rights, property, or security of the Site or any third party,
• to detect, prevent or otherwise address fraud, security, or technical issues, or
• identify users to third parties to protect their interests subject to applicable law. By extension, this may include disclosure to law enforcement agencies.

The previous disclosures may be made without our providing notice to you.

6.3 SHARING IN THE EVENT OF A TRANSFER OF THE BUSINESS

We may disclose and transfer your Personal and other information

• to a subsequent owner, co-owner or operator of the Site or applicable database, or
• in connection with a merger, consolidation, or restructuring, of our business,
• in connection with the sale of substantially all our interests or assets, or
• in connection with other corporate change.

The above sharing may occur during the course of any due diligence process.

 

7 DOES THIRD-PARTY CONTENT, LINKS TO SITES, AND/OR APPS APPEAR ON THE SITE?

The Site may contain content, links, or applications that are supplied by a third party. These third parties may collect Usage Information and your Device Identifier for their own commercial purposes. In some cases, you may be directed to other sites and applications that are operated by third parties that we do not control. These third parties may have their own terms of service, privacy policies, or other policies. We are not responsible for the practices employed by these third parties.

For example, if you “click” on a link you may be taken off the Site onto a different Internet location. These other online services may track your activities, collect information about you, and may or may not have their own published privacy policies. We are not responsible for practices of these third parties.

We encourage you to review any available policies before using third party applications. Exercise caution in connection with these applications

 

8 HOW IS CHILDREN’S INFORMATION PROCESSED?

We understand the importance of protecting the privacy of children. The Site is not intended for use by children under the age of eighteen (18). we do not knowingly collect Personal Information from children.

If you believe your child has provided personal information without your consent, we will dispose of it as per applicable law. Simply contact us at support@infodefender.ca to let us know of the situation.

 

9 ABOUT CHANGES TO THE PRIVACY NOTICE?

This Privacy Notice may change at any time. A new revision of this Privacy Notice will be reflected by a change in the Effective Date. Any changes will be effective as of that Effective Date.

We will not use your previously collected Personal Information in a way that is significantly different than stated in the Privacy Notice which was effective on the date the information was collected. However, we may request your consent for any new uses.

 

10 WHO DO I CONTACT WITH QUESTIONS AND CONCERNS?

If you have any questions about this Privacy Notice or our practices, please contact us.

Postal Mail:

InfoDefender / Sontiq
Attn: Privacy Officer
99 Avenue Rd SPH1, Toronto ON M5R 2G5

Email: support@infodefender.ca

Telephone Number:
From within Canada and U.S: 1 (866) 322-0497

We may need to request specific information from you to help us confirm your identity. We do this to ensure that your Personal Information is not disclosed inappropriately.