Hexagon Technical Services is a registered trade name of Data Pro Services Inc. ("Hexagon," "we," "us," or "our"). We are committed to protecting the privacy of individuals whose personal information we handle in the course of our business activities. This policy explains what information we collect, why we collect it, how we use it, and the rights you have under Canadian privacy law.

This privacy policy applies to information collected by Hexagon Technical Services through our website at hexagontech.ca, through direct communications with us, and through the IT services we provide to our clients. It is written to comply with the Personal Information Protection and Electronic Documents Act ("PIPEDA"), Canada's federal private-sector privacy law.

We are accountable for the personal information under our control. By using our website or engaging our services, you acknowledge that you have read and understand this policy.

We collect personal information only when necessary to provide our services, respond to inquiries, or meet legal obligations. The categories of personal information we may collect include:

Information you provide directly

• Name, business name, and job title
• Business email address and phone number
• Mailing or service address
• Information you include in messages sent to us through our website contact form, by email, by phone, or through other channels
• Information collected during scoping discussions, site assessments, or onboarding for our services

Information collected automatically

• IP address and approximate location (derived from IP)
• Browser type and operating system
• Pages visited on our website and the date and time of access
• Referring website

Information collected during service delivery

When you engage us as a managed services or project client, we may collect technical information necessary to deliver those services, including:

• Account credentials and access tokens for systems we manage on your behalf
• Network configuration data, device inventories, and system logs
• Names and contact details of your employees as needed for support delivery
• Documentation of incidents, requests, and the work we perform

‍

Sensitive information. We do not knowingly collect information from anyone under the age of 18. We do not collect health information, financial account credentials, or government identifiers unless specifically required to deliver a contracted service.

We collect, use, and disclose personal information for the following purposes:

• To respond to inquiries submitted through our website or other channels
• To prepare proposals, quotes, and engagement documentation
• To deliver IT services we have agreed to provide
• To communicate with clients about scheduling, status updates, and ongoing service matters
• To invoice and collect payment for services rendered
• To improve our website and the services we offer
• To comply with legal, regulatory, and tax obligations
• To protect the security and integrity of our systems and our clients' systems

‍

We will not use personal information for purposes beyond those described above without first obtaining your consent or as otherwise permitted by law.

Your knowledge and consent are required for the collection, use, or disclosure of your personal information, except where otherwise permitted by law. By submitting information through our website or by engaging our services, you consent to the collection and use of that information for the purposes described in this policy.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. To withdraw consent, contact us using the information in Section 11. Withdrawing consent may limit our ability to provide you with certain services.

Hexagon does not sell, rent, or trade personal information. We share personal information only in the following circumstances:

• Service providers and vendors. We rely on a small number of trusted third-party service providers who help us operate our business, including software platforms used to deliver IT services, communications tools, hosting and infrastructure providers, and accounting services. These providers are bound by confidentiality and data protection obligations.
• Within our service ecosystem. Where we deliver work jointly with Ampel Communications Ltd. or another partner, relevant client information may be shared between us under appropriate confidentiality arrangements, only as required to complete the engagement.
• Legal requirements. We may disclose personal information when required by law, court order, or other lawful authority, or to protect our rights, property, or safety, or that of our clients.
• Business transfers. In the event of a sale, merger, or other change of control, personal information may be transferred to the acquiring entity, subject to confidentiality and continued application of this policy.

‍

Some of the service providers we rely on (for example, Microsoft 365, our professional services automation platform, our endpoint security platform, and our website host) may store or process personal information outside of Canada, including in the United States. When personal information is processed outside of Canada, it may be subject to the laws of those jurisdictions, including lawful access by foreign government authorities.

We take reasonable steps to ensure that any third party processing personal information on our behalf provides a comparable level of protection to what we are required to provide under PIPEDA.

‍

Hexagon is a security-focused organization. We protect personal information through a combination of physical, organizational, and technical safeguards appropriate to the sensitivity of the information. These include:

• Multi-factor authentication on all administrative accounts
• Endpoint detection and response (EDR) on all company devices
• Encryption in transit and at rest where technically feasible
• Role-based access controls limiting access to information on a need-to-know basis
• Centralized credential management for client systems
• Documented offboarding procedures for departing personnel
• Ongoing security awareness training for everyone in the organization

No system is perfectly secure. While we work hard to protect personal information in our care, we cannot guarantee absolute security. In the event of a privacy breach that creates a real risk of significant harm, we will report to the Office of the Privacy Commissioner of Canada and notify affected individuals as required by PIPEDA.

‍

Our website may use cookies and similar technologies to support basic site functionality and to understand how visitors interact with our site. Where we use analytics tools, the information collected is aggregated and used to improve site performance and content.

You can configure your browser to refuse cookies or notify you when one is being set. Refusing cookies may affect the functionality of some parts of our website.

‍

Under PIPEDA, you have the right to:

• Access personal information we hold about you
• Request correction of personal information that is inaccurate or incomplete
• Withdraw consent for the collection, use, or disclosure of your personal information, subject to legal and contractual restrictions
• Challenge our compliance with this policy and with PIPEDA
• File a complaint with the Office of the Privacy Commissioner of Canada if you believe your rights have not been respected

To exercise any of these rights, contact our Privacy Officer using the information in Section 11. We will respond within a reasonable time, generally within 30 days of receiving a verifiable request. We may need to verify your identity before fulfilling certain requests.

‍

Hexagon Technical Services has designated a Privacy Officer who is accountable for our compliance with this policy and with PIPEDA. To ask a question, request access to your personal information, withdraw consent, or file a complaint, please contact:

Privacy Officer

Nico Verrelli

Hexagon Technical Services (Data Pro Services Inc.)

Windsor, Ontario, Canada

Email: privacy@hexagontech.ca

Web: hexagontech.ca

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada:

Office of the Privacy Commissioner of Canada

30 Victoria Street, Gatineau, Quebec K1A 1H3

Toll-free: 1-800-282-1376

Web: priv.gc.ca

‍

This policy may be updated from time to time to reflect changes in our practices or in applicable law. The "Last Updated" date at the top of this page indicates when the policy was most recently revised. Material changes will be communicated on this page. We encourage you to review this policy periodically.

‍