01
Two roles
Northgray is based in Steinbach, Manitoba, Canada. This policy covers northgray.ca and our security testing engagements.
- Our own records. For enquiries and client contacts, Northgray decides what is collected and why.
- Engagement data. During a campaign we collect information about a client's staff and premises. We do this on the client's behalf, and only as their signed agreement and our Rules of Engagement allow. The client is responsible for its own obligations to its staff, and we support them.
02
What we collect
Website visitors
- The contact form asks for your name, work email, company, phone (optional), the services you're interested in, who can authorize a test, and a message.
- Emails you send to contact@northgray.ca.
- The site sets no cookies and runs no analytics or advertising trackers. Its fonts and every other file come from our own site, so no outside company sees your visit.
- Like any website, our web host keeps standard server logs, including IP addresses, to keep the site running and secure.
Clients
- Names, job titles and contact details for your sponsor, trusted agents and emergency contacts.
- Details for the person who signs the Authorization Letter, including proof of their authority.
- Billing details.
Engagement data
- Public research on your organization done before a campaign, limited to what the scope allows.
- Audio recordings and transcripts of test calls, where the signed scope schedule includes recording. We don't record calls to people in places where the law requires every party's consent. Operators keep written notes of those calls instead.
- If a campaign uses AI voice cloning: recordings of the consenting person's voice and the voice model built from them. Both are deleted when the campaign ends.
- Records of how staff responded to test emails: timestamps and actions such as opening, clicking, reporting or submitting a form.
- Photos of premises and the markers we leave. We do not photograph people on purpose. Any face or name caught by accident is blurred or removed.
- Operator activity logs with times and locations.
- Technical evidence from external testing, such as hostnames and configuration settings.
What we don't collect
We do not keep real passwords, MFA codes or session tokens. We do not accept funds. We do not copy files, customer records or payroll data. If we see sensitive information by accident, we don't copy it, and we tell the client.
03
How we use it
- To answer enquiries and scope engagements.
- To confirm that whoever authorizes a test has the authority to do so.
- To run campaigns, keep everyone safe, and resolve any confrontation quickly.
- To write reports and debriefs.
- To bill clients, keep business records and meet legal duties.
We do not use engagement data for marketing, or for any purpose other than the engagement it came from. We don't use it to train AI models, apart from a voice clone that the cloned person has consented to for that one campaign.
04
Reports name processes, not people
Reports describe failed processes and controls. They do not name or rank the staff who were tested, and they make no disciplinary recommendations. Raw evidence, such as a recording, may still identify someone, so it goes only to the client's named trusted agents.
05
Who we share it with
- The client, for its own engagement only.
- Service providers that host our email, files and campaign tools, only as needed to run our business.
- Police, security staff or other authorities on site, when we need to show our Authorization Letter, or when the law requires it.
- A buyer or successor, if the business is sold, on the same terms as this policy.
We never sell personal information.
06
Where it's stored
Some of our service providers may store data outside Canada, including in the United States. When data is held outside Canada, the laws of that country may let its authorities access it.
07
How long we keep it
Anything due for destruction is securely destroyed within 30 days, and we confirm that in writing.
08
How we protect it
Engagement data is encrypted and kept separate for each client. Only the people working on that engagement can access it.
09
Your choices and rights
You can ask to see the personal information we hold about you, correct it, or withdraw consent where we rely on it. You can also ask how it has been used and shared. We reply within 30 days.
If you work for one of our clients and were part of a test, contact your employer first. They decide how engagement data is used, and we'll help them answer you.
If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or to your provincial privacy commissioner.
10
Breaches
If a breach creates a real risk of significant harm, we will notify the people affected, the client and the Privacy Commissioner of Canada, as the law requires. We keep a record of every breach.
11
Children
Our services are for organizations. We do not knowingly collect information from anyone under 18.
12
Changes to this policy
If we change this policy, we will update the date at the top. If a change is significant, we will tell active clients by email.
13
Contact
Privacy Officer
Northgray
20 Brandt St, Unit 3 - Suite 254
Steinbach, Manitoba R5G 1Y2
contact@northgray.ca
Start here