Privacy
Policy
SORC Defence is committed to protecting the privacy and confidentiality of all personal data collected through our platforms and services.
Scope of This Policy
This Privacy Policy applies to all personal information collected, used, disclosed, or retained by SORC Defence through our website, enquiry forms, procurement processes, and direct client engagements. It covers our obligations under PIPEDA, CASL, GDPR where applicable to EU data subjects, and applicable provincial privacy legislation.
1. Information We Collect
We collect personal information only to the extent necessary for legitimate defence consultancy and procurement purposes. Categories include: full name and professional title; organisational affiliation; business email address; country of operation; nature of procurement requirement; urgency classification; and any additional information voluntarily provided. We do not collect sensitive personal information such as biometric data, financial account details, or health information through this website.
2. Legal Basis for Processing (GDPR)
For individuals in the EEA or UK, our legal bases for processing are: (a) Legitimate Interests — operating a defence consultancy and responding to procurement enquiries; (b) Contract Performance — taking steps prior to or performing a contract; (c) Legal Obligation — complying with export control laws, anti-money laundering obligations, and sanctions screening requirements; and (d) Consent — where explicitly obtained for a specific processing activity.
3. How We Use Your Information
Personal information is used exclusively for: responding to and processing defence procurement enquiries; conducting mandatory restricted party screening; performing client due diligence under ITAR, EAR, and Canadian export control requirements; maintaining records as required by law; communicating with clients regarding active or potential engagements; and improving the security and functionality of our website. We do not use personal information for marketing to third parties or sell personal data.
4. Disclosure of Personal Information
SORC does not sell or transfer personal information to outside parties except: to regulatory authorities where required by law; to legal counsel and compliance advisors engaged for specific transactions; to vetted supply chain partners on a need-to-know basis subject to confidentiality obligations; and to successor entities in a corporate restructuring, subject to equivalent privacy protections. All third-party disclosures are governed by written confidentiality agreements.
5. Data Retention
We retain personal information for as long as necessary to fulfil the purposes for which it was collected and to comply with legal obligations. Enquiry records are retained for a minimum of seven (7) years to satisfy export control record-keeping requirements. Client engagement records are retained for the duration of the engagement plus ten (10) years. Website contact submissions not resulting in an engagement are retained for two (2) years.
6. Data Security
SORC implements technical and organisational measures appropriate to the sensitivity of the information. Security measures include: encrypted communications for all sensitive client exchanges; TLS encryption for all data transmitted through this website; access controls limiting personal data access to authorised personnel; and regular review of third-party service providers. In the event of a data breach posing real risk of significant harm, we will notify affected individuals and applicable regulators in accordance with PIPEDA and GDPR obligations.
7. International Data Transfers
SORC operates from its office in Burlington, Ontario, Canada. Personal information may be transferred in the course of our operations to jurisdictions where we engage service providers or partners. For transfers involving EEA personal data, we rely on adequacy decisions, standard contractual clauses, or other appropriate safeguards as required by GDPR Chapter V. Transfers to the United States, where they occur in connection with export licensing or procurement activities, are conducted in compliance with applicable data transfer frameworks and export control regulations.
8. Your Rights
Subject to applicable law and legitimate restrictions arising from our export control and national security obligations, you have the following rights: Right of Access; Right of Rectification; Right of Erasure; Right to Restrict Processing; Right to Data Portability; Right to Object; and Right to Withdraw Consent. To exercise any of these rights, contact us using the secure channels listed on our Contact page. We will respond within thirty (30) days.
9. Cookies and Website Analytics
Our website uses strictly necessary cookies required for basic functionality and security. We do not deploy third-party advertising cookies or behavioural tracking technologies. Any analytics data collected is aggregated and anonymised and is not linked to individual identities.
10. Children's Privacy
Our services are directed exclusively to government entities, defence ministries, and professional procurement organisations. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that personal information has been collected from a minor, we will take steps to delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or operational circumstances. Material changes will be posted on this page with an updated effective date. Continued engagement with SORC following notification of changes constitutes acceptance of the revised policy.
12. Contact & Complaints
For privacy enquiries, access requests, or complaints, contact our Privacy Officer through the secure channels listed on our Contact page. If you are located in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your national data protection supervisory authority.
For access requests, corrections, or privacy complaints, contact our Privacy Officer through our secure channels.
Contact Privacy Officer