I. Utilization of Customer Data

Through its ongoing operations, Provider (LaniSys Solutions Inc.) may inadvertently receive information in the form of domain names, credit card numbers, business plans, and application designs which the parties consider to be proprietary and confidential of both Provider’s Customers as well as the customers/end users of Provider’s Customers. Unlike other hosting providers that “may share customer information with selected parties”, Provider will never share customer data or communications with any party outside of Provider without Customer’s knowledge beforehand — except if Provider has justification for disclosing said data or communications for purposes of making contact with, bringing legal action against, or identifying an individual or entity believed to cause interference or harm to the property or rights of Provider and/or its Customers, or innocent bystanders. In addition, Provider will use Customer data to communicate information deemed worthy of Customer attention such as system information and reserves the right to communicate with Customers regarding current or future Provider products/services. Customer data or communications will also be disclosed if required by law or deemed appropriate to protect the interests of LaniSys Solutions Inc. or its Customers.

If Provider needs to contact Customer due to violations of Provider’s Acceptable Use Policy brought on by the customer/end user of Provider’s Customer, Provider will first attempt to contact Provider’s Customer — not the customer/end user of Provider’s Customer. If Provider’s Customer does not respond and the situation harms the integrity of Provider’s network in any way whatsoever, Provider reserves the right to contact the customer/end user of Provider’s Customer directly. Both Provider and Provider’s Customer will protect the confidential material and information that may be disclosed between Provider and Provider’s Customer. Therefore, both Provider and Provider’s Customer agree as follows: I. CONFIDENTIAL INFORMATION. The term “Confidential Information” means any information or material which is proprietary to Provider or Provider’s Customer, whether or not owned or developed by Provider or Provider’s Customer, which is not generally known other than by Provider or Provider’s Customer, and which Provider or Provider’s Customer may obtain through any direct or indirect contact with each other.

Confidential Information includes without limitation business records and plans, customer lists and records, trade secrets, technical information, products, inventions, product design information, pricing structure, discounts, costs, computer programs and listings, source code and/or object code, copyrights and other intellectual property, and other proprietary information.

II. PROTECTION OF CONFIDENTIAL INFORMATION.

Both Provider and Provider’s Customer understand and acknowledge that the Confidential Information has been developed or obtained by Provider or Provider’s Customer by the investment of significant time, effort and expense, and that the Confidential Information is a valuable, special and unique asset of Provider or Provider’s Customer which provides Provider or Provider’s Customer with a significant competitive advantage, and needs to be protected from improper disclosure. In consideration for the disclosure of the Confidential Information, Both Provider and Provider’s Customer agree to hold in confidence and to not disclose the Confidential Information to any person or entity without the prior written consent of the other party. In addition, both Provider and Provider’s Customer agrees that:

1. No Copying/Modifying. Neither Provider nor Provider’s Customer will copy or modify any Confidential Information without the prior written consent of the other party.
2. Application to Employees. Further, neither Provider nor Provider’s Customer shall disclose any Confidential Information to any employees of the other party, except those employees who are required to have the Confidential Information in order to perform their job duties in connection with the relationship formed between Provider and Provider’s Customer. Each permitted employee of one party to whom Confidential Information is disclosed shall sign a non-disclosure agreement at the request of the other party.
3. Unauthorized Disclosure of Information. If it appears that either Provider or Provider’s Customer has disclosed (or has threatened to disclose) Confidential Information in violation of this Privacy Statement, the non-violating party shall be entitled to an injunction to restrain the violating party from disclosing, in whole or in part, the Confidential Information. The non-violating party shall not be prohibited by this provision from pursuing other remedies, including a claim for losses and damages.

III. RETURN OF CONFIDENTIAL INFORMATION.

If Provider’s Customer has violated the Privacy Statement of Provider or vice versa, the violating party shall return to the violated party all written materials containing the Confidential Information upon the written request of the violated party. The violating party shall also deliver to the violated party written statements signed by the violating party certifying that all materials have been returned within five (5) days of receipt of the request.

IV. LIMITED LICENSE TO USE.

Neither Provider nor Provider’s Customer shall acquire any intellectual property rights under this Privacy Statement except the limited right to use set out above. Provider and Provider’s Customer acknowledge that, as between Provider and Provider’s Customer, the Confidential Information and all related copyrights and other intellectual property rights, are (and at all times will be) the property of the respective party who was originally granted the rights, even if suggestions, comments, and/or ideas made by Provider or Provider’s Customer are incorporated into the Confidential Information or related materials during the period of this Privacy Statement.

V. GDPR

Section V provides mandatory information as required under Articles 13 and 14 of the European General Data Protection Regulation (GDPR) regarding the transparency of personal data processing. Definitions of certain terms within this notice are explained in the appendix.

1. Your Rights
   As a Data Subject you have rights under the GDPR. These rights can be seen below. Provider will always fully respect your rights regarding the processing of your personal data, and has provided below the details of the person to contact if you have any concerns or questions regarding how we process your data, or if you wish to exercise any rights you have under the GDPR. www.lanisys.ca/contact-privacy
2. Contact Details
   The identity and contact detail for the Data Protection Officer within LaniSys Solutions Inc. is:
   Operations Officer
   LaniSys Solutions Inc.
   Erasure requests can be filled via a webform at www.lanisys.ca/contact-privacy
3. Data Protection Principles
   The Provider has adopted the following principles to govern its collection and processing of Personal Data:
   • Personal Data shall be processed lawfully, fairly, and in a transparent manner.
   • The Personal Data collected will only be those specifically required to provide services, security of these service, marketing (unless opted-out) or support of services. Such data may be collected from accessing Providers website or services.
   • Personal Data shall only be retained for as long as it is required to fulfill contractual requirements, or to provide security statistics.
   • Personal Data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are collected and/or processed.
   • The Data Subject has the right to request from Provider access to and rectification or erasure of their personal data, to object to or request restriction of processing concerning the data, or to the right to data portability. In each case such a request must be put in writing to www.lanisys.ca/contact-privacy as in Section 3 above.
4. Transfers to Third Parties
   Personal Data shall not be transferred to a country or territory outside Canada unless the transfer is made to a country or territory recognized by the EU as having an adequate level of Data Security, or is made with the consent of the Data Subject.All internal group transfers of Personal Data shall be subject to written agreements under the Company’s Intra Group Data Transfer Agreement (IGDTA) for internal Data transfers which are based on Standard Contractual Clauses recognized by the European Data Protection Authority.

Appendix – Definitions of certain terms referred to above:

Personal Data:
(Article 4 of the GDPR): ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing:
(Article 4 of the GDPR): means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, erasure or destruction.

Legal Basis for Processing:
(Article 6 of the GDPR): At least one of these must apply whenever personal data is processed:

1. Consent: the individual has given clear consent for the processing of their personal data for a specific purpose.
2. Contract: the processing is necessary for compliance with a contract.
3. Legal obligation: the processing is necessary to comply with the law (not including contractual obligations).
4. Vital interests: the processing is necessary to protect someone’s life.
5. Public task: the processing is necessary to perform a task in the public interest, and the task or function has a clear basis in law.
6. Legitimate interests: the processing is necessary for the legitimate interests of the Data Controller unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

Data Controller:
(Article 4 of the GDPR): this means the person or company that determines the purposes and the means of processing personal data.

Data Processor:
(Article 4 of the GDPR): means a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller.

Data Subject Rights:
(Chapter 3 of the GDPR) each Data Subject has eight rights. These are:

1. 1. The right to be informed; This means anyone processing your personal data must make clear what they are processing, why, and who else the data may be passed to.
   2. The right of access; this is your right to see what data is held about you by a Data Controller.
   3. The right to rectification; the right to have your data corrected or amended if what is held is incorrect in some way.
   4. The right to erasure; under certain circumstances you can ask for your personal data to be deleted. This is also called ‘the Right to be Forgotten’. This would apply if the personal data is no longer required for the purposes it was collected for, or your consent for the processing of that data has been withdrawn, or the personal data has been unlawfully processed.
   5. The right to restrict processing; this gives the Data Subject the right to ask for a temporary halt to processing of personal data, such as in the case where a dispute or legal case has to be concluded, or the data is being corrected.
   6. The right to data portability; a Data Subject has the right to ask for any data supplied directly to the Data Controller by him or her, to be provided in a structured, commonly used, and machine-readable format.
   7. The right to object; the Data Subject has the right to object to further processing of their data which is inconsistent with the primary purpose for which it was collected, including profiling, automation, and direct marketing.
   8. Rights in relation to automated decision making and profiling; Data Subjects have the right not to be subject to a decision based solely on automated processing.

VI. GENERAL PROVISIONS

This Privacy Statement sets forth the entire understanding of the parties regarding confidentiality. Any amendments must be in writing and signed by both parties. This Privacy Statement shall be construed under the laws of the Province of Québec, Canada. This Agreement shall not be assignable by either party, and neither party may delegate its duties under this Privacy Statement, without the prior written consent of the other party. The confidentiality provisions of this Privacy Statement shall remain in full force and effect after the effective date of the time Provider’s Customer signs up for products and/or services from Provider.

Security of Data

LaniSys Solutions Inc. has enacted electronic, physical and internal operation policies for the protection, alteration, misuse or loss of data which has been collected from customers.

Opt Out & Modifications

While Customers are not permitted to opt out of receiving communications essential for network utilization or information deemed vital for account management, Customers are permitted to opt out for purposes of receiving marketing information.