Privacy Policy

When you visit any page of our website or submit our contact form, we collect:

• Your name (when you submit the form)
• Your email address (when you submit the form)
• Your message content (when you submit the form)
• Your IP address (collected on every page you visit, for security monitoring, spam prevention, and website traffic analytics)
• Your approximate location and network — city, region, country, internet service provider, and whether the connection appears to be a VPN or proxy — derived from your IP address, for security monitoring and traffic analytics
• Your browser and operating system information (collected site-wide, for technical support, security monitoring, and analytics)
• The page you came from (referrer URL, for understanding traffic sources and detecting abuse)
• The pages you view and the language version you use (to measure site traffic and understand which content is most useful)
• Campaign parameters from links you follow (e.g. utm_source), when present, to understand which referral sources bring visitors

We use the information we collect to:

• Respond to your inquiries and provide requested information
• Communicate with you about our services
• Monitor our contact page for spam, abuse, and security threats
• Prevent spam and abuse of our contact form
• Improve our website and services
• Measure website traffic and understand which pages and language versions are most useful
• Comply with legal obligations

When you subscribe to our newsletter or mailing list, we collect:

• Your email address
• Your IP address (for security and abuse prevention)
• Your browser and device information
• Your language preference
• Subscription and confirmation timestamps

How We Use Newsletter Information

We use newsletter subscription information to:

• Send you periodic updates, articles, and news about our services
• Confirm your subscription via double opt-in (you must click a confirmation link in the email we send you)
• Manage your subscription preferences and process unsubscribe requests

Consent and CASL Compliance

In accordance with Canada's Anti-Spam Legislation (CASL), we use a double opt-in process: after you submit your email address, you will receive a confirmation email with a link you must click to complete your subscription. We will not send you marketing communications until you have confirmed your subscription. Every email we send includes an easy one-click unsubscribe link.

Newsletter Data Retention

Confirmed subscribers remain on our mailing list until they unsubscribe. Unconfirmed subscription requests (where the confirmation link was never clicked) are automatically deleted after 30 days. Unsubscribe records are retained as proof of opt-out to ensure we do not inadvertently contact you again. Confirmation links expire after 7 days for security purposes; if your link expires, you may subscribe again to receive a fresh confirmation email.

Your Newsletter Rights

• Unsubscribe at any time using the one-click link in any email
• Request information about your subscription status
• Request deletion of your subscription data

Under Canadian privacy law, you have the right to:

• Access your personal information we hold
• Request correction of inaccurate information
• Request deletion of your information (subject to legal obligations)
• Withdraw consent for future communications
• File a complaint with the Privacy Commissioner of Canada

Person in Charge of the Protection of Personal Information

Blacksand Forensics has designated a Person in Charge of the Protection of Personal Information, responsible for overseeing our compliance with Quebec privacy law. You can reach our privacy officer at privacy@blacksandforensics.com, or by mail at Blacksand Forensics, 86-50 Burnhamthorpe Rd W, Suite 443, Mississauga, ON L5B 3C2, Canada.

Your Rights Under Law 25

In addition to the rights listed above, Law 25 provides Quebec residents with:

• Right to data portability — to obtain your personal information in a structured, commonly used technological format.
• Right to de-indexing or cessation of dissemination — to request that we stop disseminating your personal information or that hyperlinks providing access to it be de-indexed, in the circumstances set out in section 28.1 of the Act.
• privacy.quebec.rights.withdraw
• Right to file a complaint with the Commission d'accès à l'information du Québec.

Data Controller

The data controller for personal information collected through this website is Blacksand Forensics, 86-50 Burnhamthorpe Rd W, Suite 443, Mississauga, ON L5B 3C2, Canada. You can reach us at privacy@blacksandforensics.com.

Lawful Basis for Processing

We rely on the following lawful bases under GDPR Article 6:

• Newsletter subscription: your consent (Article 6(1)(a)), which you may withdraw at any time using the one-click unsubscribe link in any email we send you.
• Contact-form submissions, website traffic analytics, and abuse / security monitoring: our legitimate interests in responding to inquiries, understanding how our website is used, and protecting the website from abuse (Article 6(1)(f)).

International Transfers

Our infrastructure providers — Vercel (website hosting) and Supabase (database and authentication) — operate from the United States and other regions. Personal information collected through this site may therefore be transferred to and processed outside Canada and the European Economic Area. Where applicable, transfers are made under appropriate safeguards such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum.

Additional Rights Under GDPR

In addition to the rights listed in the section above, GDPR / UK GDPR provides:

• Right to data portability — to receive a copy of your personal information in a structured, commonly used, and machine-readable format (Article 20).
• Right to object — to object at any time to processing of your personal information that is based on our legitimate interests (Article 21).
• Right to lodge a complaint with your local supervisory authority (e.g. the Information Commissioner's Office in the United Kingdom, or the data protection authority in your EU member state).