Privacy Policy

Sun IT Solutions is an Ontario-based IT and cyber security company. We work from 151 Front Street West, Suite 402, Toronto, and 220 Royal Crest Court, Suite 19, Markham, Ontario L3R 9Y2. In this policy, “Sun IT Solutions”, “we”, “us” and “our” all refer to that company.

We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and its fair information principles. When we deliver services for a client, that client's service agreement also describes how information is handled on their behalf. In those situations the client decides why the information is held, and we handle it on their instructions.

Most of what we hold comes from you. We collect it when you fill in a form on this website, send an email, call us, open a support ticket, ask for a quote, go through onboarding, or apply for a job. While delivering services we may also receive information from a client, from someone a client has authorized to speak for them, or from a provider working alongside us. You can read most of this site without telling us who you are.

We use personal information to answer enquiries, provide support and the services you have contracted, prepare quotes, run accounts and billing, tell you about changes to your services, assess job applications, and meet our legal obligations. Website information helps us see how the site is used and keep it working properly — which pages are read, which forms are used, and where something breaks.

We do not sell personal information. We do not trade it or rent it to anyone.

Marketing email is sent only in line with Canada's Anti-Spam Legislation (CASL), with a working unsubscribe link in every message, and you can unsubscribe at any time. Service and account messages — a security alert, an invoice, a maintenance notice — may still be sent, because they are part of the service you receive.

We share personal information only where it is needed, and only in the situations below.

• Service providers. Trusted companies that help us deliver services: cloud email and productivity platforms, remote support tools, monitoring and management platforms, documentation systems, ticketing systems and billing platforms. They work under contract, on our instructions, and only for the purpose we engaged them for.

• Authorized client contacts. Where a client has named people who may receive information about their account, tickets or projects.

• Legal requirements. Where the law, a court order or a lawful request from a public authority requires or permits us to disclose it.

• Business transfer. If the business is sold, merged or reorganized, information may transfer as part of that transaction, under confidentiality arrangements that continue to protect it.

Some of these providers store or process information outside Canada, including in the United States. Members of our technical support team are also located outside Canada, including in Sri Lanka, and may access information remotely in order to deliver support.

We use contracts, access limits and other safeguards to give information a comparable level of protection. Information processed in another country can still be subject to that country's laws, and may be accessible to its authorities.

We use technical and organizational safeguards matched to how sensitive the information is: access controls, multi-factor authentication, encrypted connections, logging and regular security reviews. Access is limited to the people who need it to do their work.

No system is completely secure. If a breach of security safeguards creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as PIPEDA requires, and we keep records of breaches.

When the information sits inside a client's own systems, that client's reporting duties are governed by law and by their service agreement with us, and we support them through the process.

We keep personal information only as long as we need it for the purpose it was collected, for account records, and to meet legal requirements. After that we securely destroy it or anonymize it.

For managed service clients, the end of an agreement includes a 30-day offboarding period. During those 30 days we make the client data we hold available for export. When the period ends, remaining data may be deleted and hosted and backup services stop, unless something different has been agreed in writing.

That offboarding period applies to client data held under a managed service agreement. It does not cover every website enquiry, quote or job application. If you are a client leaving us, arrange your exports before the period ends.

This site uses cookies and local storage to make features work and to remember your preferences, and it uses analytics such as Google Analytics to understand how visitors find and use the site. A cookie banner records the choice you make when you first arrive.

You can manage or clear cookies in your browser settings at any time. Blocking them may affect some features, such as remembering a preference between visits.

Websites we link to are outside our control. They have their own privacy policies, and we encourage you to read them before sharing information there.

You can ask to see the personal information we hold about you, and ask us to correct anything that is inaccurate or incomplete. We may need to verify your identity first, so that we do not hand information to the wrong person.

We respond within 30 days as PIPEDA requires, unless a permitted extension applies. If we refuse a request, we will explain why and set out your options.

You can also ask us to delete information. Some records — invoices, tax records, signed agreements, security logs — have to be kept for legal or contractual reasons, so we will tell you what has to stay and why.

You can withdraw consent to optional uses at any time, subject to legal and contractual limits, and we will explain what that means for your account or services.

For information held inside a client's own systems, contact that organization first. We handle it on their instructions, so they are the ones able to act on your request.

This website is built for business enquiries and is not directed at children. We may handle children's information only where a client holds it in systems we support, and then only as that client instructs.

If you have a concern about a child's information, contact us and name the organization or service it relates to, so we can trace the right records.

Contact our Privacy Officer at help@sunitsolutions.ca or 416-479-0505, or through the contact page and ask for the Privacy Officer. Tell us what happened, which information is involved and what outcome you are looking for. We aim to respond within 30 days.

If our answer does not resolve it, you can file a complaint with the Office of the Privacy Commissioner of Canada.

We update this policy when our practices or the law change, including if new federal privacy legislation replaces PIPEDA. The date at the top of the page shows the version you are reading, and the current version always applies.

If you need this policy in another format, such as large print or a plain document, ask us and we will provide it.