Privacy Policy

1. Who We Are

Kingwall & Company Inc. is an Ontario-incorporated corporation providing executive governance, risk, and resilience advisory services. Our registered address is 3277 Vernon Powell Drive, Oakville, Ontario L6H 0Y5, Canada.

Muhammad Waqas Agha, Founder, President & Principal Advisor, is the designated Privacy Officer for Kingwall & Company Inc. and is responsible for overseeing our compliance with this Policy and applicable privacy legislation.

2. Information We Collect

We collect personal information only to the extent necessary to provide our services and respond to enquiries. The categories of information we may collect include:

• Contact information: Name, title, organization, email address, telephone number, and business address — provided when you contact us via our website contact form, email, or telephone
• Professional information: Your role, industry, and organizational context — relevant to assessing how we may be able to assist you
• Engagement information: Information provided in the course of an advisory engagement, including documents, data, and communications shared with Kingwall for the purpose of delivering advisory services
• Website usage information: Standard web analytics data including IP addresses, browser type, pages visited, and time spent on our website — collected through our website analytics provider
• Communications: Records of correspondence between you and Kingwall, including emails and meeting notes

We do not collect sensitive personal information (such as health information, financial account numbers, or government identification numbers) through our website. Such information may be shared with us in the course of a specific advisory engagement and is handled under the terms of the applicable engagement agreement and Mutual Non-Disclosure Agreement.

3. How We Use Your Information

We use personal information only for the purposes for which it was collected or for directly related purposes. Specifically, we use personal information to:

• Respond to enquiries and requests received through our website or by other means
• Assess whether and how Kingwall can provide advisory services relevant to your situation
• Provide, manage, and improve our advisory services to engaged clients
• Communicate with you about your enquiry, engagement, or matters we believe may be relevant to your interests
• Maintain accurate business records and comply with legal obligations
• Analyse website usage to improve our website's content and functionality

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We do not use personal information for automated decision-making.

4. Legal Basis for Processing

We collect and process personal information on the following bases:

• Consent: Where you have provided consent by submitting a contact form, subscribing to our communications, or explicitly agreeing to share information with us
• Contractual necessity: Where processing is necessary to perform our obligations under an engagement agreement with you or your organization
• Legitimate interests: Where we have a legitimate business interest in processing your information (for example, responding to unsolicited enquiries, maintaining business records, or improving our website), where this interest is not overridden by your privacy rights
• Legal obligation: Where processing is required to comply with applicable law or regulatory requirements

5. Disclosure of Your Information

We do not disclose personal information to third parties except in the following circumstances:

• Service providers: We use third-party technology platforms (including Microsoft 365 for email and document management, and website hosting providers) that may process personal information on our behalf. These providers are bound by appropriate data processing terms and are not permitted to use your information for their own purposes
• Legal requirements: We may disclose personal information where required to do so by law, court order, or at the request of a government or regulatory authority
• With your consent: We may share your information with third parties where you have given your explicit consent
• Professional advisors: We may share information with our legal counsel or accountants on a confidential basis where required to obtain professional advice

We will never disclose the identity of a client, or the existence or nature of a client engagement, to any third party without the client's express written consent.

6. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected, or as required by applicable law:

• Enquiry and contact information: 2 years from the date of last contact, unless an engagement commences
• Client engagement records (contracts, deliverables, correspondence, working papers): 7 years from engagement completion, consistent with CRA and professional practice requirements
• Financial records: 7 years from the date of the relevant transaction
• Website analytics data: Retained in accordance with the terms of our analytics provider — typically 14 months

Upon expiry of the applicable retention period, personal information is securely deleted or anonymised.

7. Data Security

We implement and maintain technical and organizational security measures appropriate to the sensitivity of the personal information we hold. These measures include:

• Multi-factor authentication on all systems containing personal information
• Encryption of data in transit and at rest
• Access controls limiting information access to authorised personnel
• Regular security updates and endpoint protection on all business devices
• Secure cloud storage through Microsoft 365 with data residency in Canada/United States
• Secure offsite backup with encryption

In the event of a privacy breach that creates a real risk of significant harm to individuals, we will notify the Office of the Privacy Commissioner of Canada and the affected individuals as required under PIPEDA within 72 hours of becoming aware of the breach.

8. Your Rights

Under PIPEDA and applicable Canadian privacy legislation, you have the following rights with respect to your personal information:

• Right of access: You may request confirmation of whether we hold personal information about you and, if so, request a copy of that information
• Right to correct: You may request correction of any inaccurate or incomplete personal information we hold about you
• Right to withdraw consent: Where processing is based on your consent, you may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice
• Right to complain: You have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) if you believe we have not handled your personal information in accordance with PIPEDA

To exercise any of these rights, please contact our Privacy Officer using the contact details below. We will respond to requests within 30 days.

9. Cookies and Website Analytics

Our website may use cookies and similar tracking technologies to improve your experience and analyze website usage. You may configure your browser to refuse cookies; however, some website features may not function correctly if cookies are disabled.

We use website analytics to understand how visitors use our website, which pages are most visited, and how we can improve the site's content. Analytics data is aggregated and does not identify individual visitors.

We do not use advertising cookies or share website analytics data with third-party advertisers.

10. International Data Transfers

Our primary technology infrastructure is hosted by Microsoft (Microsoft 365), with data centers in Canada and the United States. By using our website or engaging our services, you acknowledge that your information may be processed outside Canada. We take appropriate measures to ensure that cross-border transfers of personal information are subject to appropriate safeguards consistent with PIPEDA requirements.

11. Children's Privacy

Our website and services are directed at business professionals and organizations. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have inadvertently collected personal information from a minor, we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The "Last updated" date at the top of this page indicates when the Policy was most recently revised. We encourage you to review this Policy periodically. Continued use of our website following a material update constitutes acceptance of the revised Policy.