Privacy Policy

1. Who We Are

IT-TEAM Operations Inc. (“IT-TEAM,” “we,” “us,” or “our”) is a federally incorporated Canadian corporation with its principal place of business at 1 King Street West, Suite 1600, Toronto, Ontario, M5H 1A1. We provide outsourced IT infrastructure, web development, CRM, automation, and digital marketing services to businesses across Canada and the United States.

Questions about this policy may be directed to our Privacy Officer at: privacy@itopsi.com

2. Information We Collect

We collect personal information only for identified, legitimate business purposes. Categories of information we may collect include:

• Contact information: Name, email address, phone number, job title, and company name provided through our website contact forms, audit tools, or direct communication.
• Account and engagement information: Information provided during onboarding, including technical environment details, vendor lists, and operational data necessary to deliver our services.
• Usage information: Standard server logs, IP addresses, browser type, and pages visited when you use our website or client portal.
• Communication records: Records of correspondence between you and IT-TEAM, including emails, support tickets, and meeting notes.
• Financial information: Billing contact details and invoice records. Payment card data is processed by our PCI-compliant payment processor and is not stored by IT-TEAM.

We do not collect sensitive personal information (health records, SIN numbers, biometric data) unless specifically required to deliver a service and authorized by a signed data processing agreement.

3. How We Use Your Information

We use personal information to:

• Respond to inquiries submitted through our website or contact channels
• Deliver contracted IT operations, web, CRM, automation, and marketing services
• Manage client onboarding, ongoing support, and account administration
• Send service-related communications (support updates, maintenance notices, invoices)
• Improve our website and service delivery based on aggregated, anonymized usage data
• Comply with applicable law, regulatory requirements, and court orders

We do not sell personal information. We do not use client data for marketing purposes. We do not share personal information with third parties except as required to deliver contracted services or comply with law.

4. Client Data & Confidentiality

All client engagements are covered by a mutual non-disclosure agreement. Client operational data — including network topologies, system credentials, employee records, and business data processed through managed systems — is treated as strictly confidential and subject to the following protections:

• Client data is logically segregated per client; no cross-client data access
• Data is encrypted at rest (AES-256) and in transit (TLS 1.3)
• Access is restricted to IT-TEAM personnel with documented need and role-based authorization
• Client data is never used for marketing, training AI models, or any purpose outside the contracted scope
• On contract termination, client data is returned or deleted per the exit playbook within 30 days

5. Data Retention

We retain personal information only as long as necessary for the purposes for which it was collected, or as required by applicable law:

• Website inquiry data: 24 months from last contact, unless an engagement begins
• Client engagement data: Duration of contract plus 7 years, for tax and legal compliance
• Support records: 3 years from ticket resolution
• Financial records: 7 years, as required by the Canada Revenue Agency

6. Cookies & Website Tracking

Our website uses strictly necessary cookies for session management and security. We may use analytics cookies (Google Analytics) to understand aggregate usage patterns. Analytics data is anonymized and not linked to individual identity.

We do not use advertising cookies, cross-site tracking cookies, or behavioral profiling. You may disable cookies in your browser settings; this will not affect your ability to use our website.

7. Third-Party Service Providers

We engage a limited number of third-party service providers who process personal information on our behalf, including cloud infrastructure providers (AWS, Azure), email platforms, and accounting software. All processors are subject to data processing agreements, privacy commitments, and are selected for compliance with Canadian privacy law requirements.

A list of our current sub-processors is available on request.

8. Your Rights Under PIPEDA

Under PIPEDA, you have the right to:

• Know what personal information we hold about you and how it is used
• Access your personal information and request corrections to inaccuracies
• Withdraw consent to certain uses of your information (subject to legal and contractual obligations)
• Lodge a complaint with the Office of the Privacy Commissioner of Canada if you believe your rights have been violated

To exercise any of these rights, contact our Privacy Officer at: privacy@itopsi.com

9. Security

IT-TEAM maintains SOC 2 Type II certification. Our security controls include role-based access control, multi-factor authentication across all internal systems, endpoint detection and response, network segmentation, encrypted backups with tested restore procedures, and annual third-party penetration testing. A copy of our SOC 2 report is available under NDA to prospective and current clients.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active clients by email at least 30 days before taking effect. The current version of this policy is always available at itopsi.com/privacy.

11. Contact

For privacy-related inquiries, corrections, or complaints: