Privacy Policy

This Privacy Policy is a draft provided for general information. It is not a substitute for legal advice. WhiteHat Software recommends that you consult with a qualified privacy and data protection attorney to ensure compliance with applicable laws in your jurisdiction.

1. Who we are

WhiteHat Software Inc. is a boutique software engineering and efficiency consulting firm based in British Columbia, Canada. We serve clients worldwide through custom software development, legacy modernization, efficiency consulting, and related services.

Contact: hello@whitehatsoftware.com | 604-200-3676 | whitehatsoftware.com

2. What information we collect

We collect personal information you voluntarily submit to us, plus a limited set of first-party, server-side attribution data described in Section 2.1. We do not use cookies for analytics, third-party analytics or advertising pixels (e.g., Google Analytics, Meta Pixel), or cross-site tracking, and we do not sell or share this data with third parties.

2.1 Website attribution data (first-party, server-side)

To understand which channels and pages bring visitors to our site, we record a limited set of first-party attribution signals server-side, without analytics cookies: UTM campaign parameters, HTTP referrer, landing page, and funnel events such as quote-form submission. This data is processed on our own systems, hosted on our infrastructure providers (see Section 5.1 and Section 9).

Attribution data is not tied to your identity unless and until you submit our quotation or contact form. At that point, we associate the attribution data collected during that visit with your lead record so we know which channel and page led to your inquiry. Attribution data for visits that never result in a form submission is not linked to any individual and is retained only in unmatched form for a limited period (see Section 6).

We do not use this data for cross-site tracking, third-party advertising, or profiling, and we do not sell or share it with third parties.

2.2 Information from our quotation form

When you submit a request for consultation through our website, we collect:

• Name
• Email address
• Company name
• Phone number (optional)
• Project description and details you choose to share
• Budget range (optional)

2.3 Information from direct communication

When you email us or call us directly, we collect the information you choose to share, which may include your name, email, phone, company, and the substance of your inquiry.

2.4 Website security and bot protection

We use Cloudflare Turnstile to protect our website from automated abuse. Cloudflare may set cookies and collect limited technical data (IP address, user agent, timestamp) to detect and prevent bot activity. We do not use this data for profiling or marketing. For details, see Cloudflare's privacy policy at cloudflare.com/privacy.

3. How we use your information

We use the information you provide and the attribution data described in Section 2.1 for the following purposes:

• To respond to your inquiry — assessing fit, providing a free consultation, and discussing potential projects.
• To deliver services — fulfilling contracts, managing projects, and communicating about your engagement.
• To send transactional emails — confirmations, project updates, and invoices (via Resend, our email service provider).
• For legal compliance — responding to lawful requests from regulators, law enforcement, or courts.
• To understand lead attribution — associating first-party attribution data (Section 2.1) with your lead record once you submit a form, so we know which channel and page led to your inquiry.

We do not use your information for marketing email campaigns without your explicit consent. If you provide your information through the quotation form, we may follow up once about fit and opportunity; you can opt out at any time.

3.1 Consent records (CASL)

When you submit our quotation or contact form, we record that you gave express consent to be contacted, along with the consent type, timestamp, and source (e.g., which form and page). This record supports our compliance with Canada's Anti-Spam Legislation (CASL).

If you ask us to stop contacting you or to unsubscribe from follow-up communications, we will honor that request within the timelines required under CASL. To unsubscribe or object, contact us using the details in Section 14.

4. Legal basis for processing (GDPR and similar laws)

For individuals in the EU, EEA, UK, and other jurisdictions with similar data protection laws, we process your personal information on the following lawful bases:

• Legitimate interest — assessing potential client fit and pursuing business inquiries, and measuring the effectiveness of our marketing channels through the first-party attribution data described in Section 2.1.
• Performance of a contract — delivering services and managing your project once engaged.
• Consent — for any non-essential communications (e.g., optional project case studies).
• Legal obligation — responding to lawful government requests and maintaining compliance records.

5. Who we share your information with

We only share your information with trusted service providers who need it to deliver services or support our operations:

5.1 Service providers

• Resend — transactional email delivery. We share your email address and relevant project details necessary for sending confirmations and updates.
• Cloudflare — website hosting, security, and CDN services. Cloudflare may process limited technical data (IP, user agent) for bot protection and performance.
• Amazon Web Services (AWS) — cloud infrastructure and data storage. Your information is encrypted at rest and in transit.

5.2 We do not sell or rent your information

We do not sell, rent, trade, or share your personal information with third parties for marketing or profit. We will not do so in the future without your explicit, informed consent and advance notice.

5.3 Legal requirements and safety

We may disclose information if required by law, court order, subpoena, or lawful government request. We will make reasonable efforts to notify you of such requests unless legally prohibited.

6. Data retention

We retain your information for as long as necessary to provide services and fulfill the purposes outlined in this policy. Specifically:

• Quotation form submissions: Retained for 3 years to support business records, follow-up inquiries, and legal compliance.
• Active client information: Retained for the duration of the engagement plus 7 years for accounting, tax, and legal purposes.
• Email communications: Retained according to email retention policy, typically 7 years for business record purposes.
• Website logs: Retained by Cloudflare per their standard retention policy (typically 24 hours for free tier; up to 1 year for paid tiers).
• Website attribution data (Section 2.1): Attribution data matched to a lead record (i.e., you submitted a form) is retained for as long as the underlying quotation/contact record, per the schedule above. Unmatched attribution data (visits that never convert to a form submission) is retained for no longer than 13 months from collection, then deleted.

You may request deletion of your information at any time (see "Your rights" below), subject to legal retention obligations (e.g., tax records, contract fulfillment).

7. Data security

We implement industry-standard technical, organizational, and administrative safeguards to protect your information from unauthorized access, alteration, disclosure, and destruction:

• Encryption in transit: All data transmitted to our servers is encrypted using TLS/SSL (HTTPS).
• Encryption at rest: Sensitive data stored on our servers is encrypted using industry-standard algorithms.
• Access controls: Access to personal information is restricted to authorized personnel who need it to perform their duties.
• Infrastructure: We host on AWS with robust physical and logical security controls.
• Regular reviews: We periodically assess and update our security practices.

No method of transmission over the internet or storage is 100% secure. While we implement strong safeguards, we cannot guarantee absolute security. Please contact us immediately if you suspect a data breach.

8. Your privacy rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

8.1 General rights (applicable in most jurisdictions)

• Right to access: You may request confirmation of what information we hold about you and receive a copy.
• Right to correction: You may request that we correct inaccurate or incomplete information.
• Right to deletion: You may request that we delete your information, subject to legal retention obligations.
• Right to withdraw consent: If we rely on your consent, you may withdraw it at any time.
• Right to object: You may object to certain processing activities (e.g., marketing communications).

8.2 GDPR and UK GDPR rights (EU, EEA, and UK residents)

If you are in the EU, EEA, or UK, you also have:

• Right to data portability: You may request your information in a portable, machine-readable format.
• Right to restrict processing: You may request that we limit how we use your information while you verify accuracy or contest legality.
• Right not to be subject to automated decision-making: We do not make decisions about you based solely on automated processing.
• Right to lodge a complaint: You may file a complaint with your data protection authority (e.g., the ICO in the UK, national DPA in EU member states).

8.3 CCPA and California privacy rights (California residents)

If you are a California resident, you have the right to:

• Know what personal information is collected, used, shared, or sold: We will provide this information in a clear, accessible format.
• Delete personal information: Subject to certain exceptions (e.g., fulfilling contracts, legal compliance), we will delete information upon request.
• Opt-out of "sales": We do not sell personal information. If we begin to do so, you will have the right to opt out.
• Correct inaccurate information: You may request correction of inaccurate personal information.
• Limit use of sensitive personal information: You have the right to limit our use of sensitive information to purposes reasonably necessary to provide services you requested.
• Opt-out of automated decision-making: We do not engage in automated decision-making that produces legal or similarly significant effects.

California residents also have the right to non-discriminatory treatment if they exercise privacy rights.

8.4 PIPEDA and BC PIPA rights (Canadian residents)

If you are a Canadian resident, under PIPEDA and BC PIPA you have the right to:

• Know what information we have about you: We will provide a summary of personal information and explain how it is used.
• Correct inaccurate information: You may request correction of errors or omissions.
• Opt-out of non-essential processing: You may opt out of marketing and non-essential communications.
• Request deletion: Subject to legal retention requirements, you may request deletion of your information.
• File a complaint: If you believe we have violated PIPEDA or BC PIPA, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPCC).

8.5 How to exercise your rights

To exercise any of these rights, contact us at:

Email: hello@whitehatsoftware.com
Phone: 604-200-3676
Mailing address: WhiteHat Software Inc., British Columbia, Canada

We will respond to your request within 30 days (or the timeframe required by law in your jurisdiction). We may ask you to verify your identity before processing your request. We will not charge a fee unless your request is manifestly unfounded or excessive.

9. Cross-border data transfers

WhiteHat Software is based in British Columbia, Canada. When you submit information through our website, it may be transferred to, stored in, and processed in Canada or other countries where we or our service providers operate (including the United States via AWS).

For EU and UK residents: We rely on Standard Contractual Clauses (SCCs) and other transfer mechanisms recognized under GDPR and UK GDPR to legitimize transfers of your data outside the EEA/UK. We have Data Processing Agreements (DPAs) in place with all service providers that process personal data. For more details, contact us.

10. Third-party links and services

Our website may contain links to third-party websites and services (e.g., social media, cloud providers). We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party services before providing your information.

11. Cookie policy

For detailed information about cookies, including how to manage your preferences, see our separate Cookie Policy.

12. Children's privacy

Our website and services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will delete it promptly. If you believe we have collected information from a child, please contact us immediately.

13. Updates to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated policy on our website with a new "Last updated" date. If we make material changes, we will notify you by email or prominent notice on our website. Your continued use of our website constitutes acceptance of the updated policy.

14. Contact us about privacy

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Disclaimer: This Privacy Policy is a draft provided for general information and is not a substitute for legal advice. We strongly recommend consulting with a qualified privacy attorney to ensure compliance with applicable privacy laws in your jurisdiction. Laws vary by location, and this policy may need adjustment based on your specific circumstances and obligations.