Privacy Policy

Last updated: June 30, 2026

Bastani Security ("Bastani", "we", "us") runs live cybersecurity training for businesses in the Greater Toronto Area. We take privacy seriously - it's our craft. This policy explains what personal information we collect, why, and how we handle it, consistent with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

What we collect

• When you contact or book us: your name, business, email, phone, and anything you choose to tell us about your needs.
• When we deliver a session: attendee names, work emails, and roles, plus session results recorded at the team level (for example, "30% reported the phishing email") rather than to single out individuals by name.
• Website and advertising analytics: pages viewed, links clicked, referrers, campaign parameters, approximate device/browser details, and conversion events. We use tools such as Google Analytics, Meta Pixel, PostHog, and Vercel Web Analytics to understand demand and improve marketing.

What we never collect

• We do not capture real passwords during simulations.
• We do not install software on your devices to run a drill.
• We do not use your real customer or patient data in exercises - scenarios are synthetic and fictional. In healthcare settings we never handle personal health information (PHIPA).

Why we use it

To respond to enquiries, schedule and deliver training, produce your scorecard and action plan, improve our materials, and meet our legal and accounting obligations. We use information only for the purposes it was collected for, or closely related ones, including marketing attribution and conversion measurement.

How we store and keep it

We collect the minimum we need and keep it only as long as necessary, storing it in Canada where practical. We use reputable service providers (for example, scheduling and email tools) bound to protect the data they process on our behalf.

Who we share it with

We don't sell your information. We share it only with service providers that help us run the business, including analytics and advertising platforms, and - only with your agreement - with vetted partners (such as penetration-testing specialists) where an engagement calls for it.

Your choices

You can ask to access or correct the personal information we hold about you, or ask us to delete it where we're not required to keep it. Marketing emails always include an unsubscribe option, honoured promptly (within 10 business days), in line with Canada's anti-spam law (CASL). You can also limit website tracking through your browser's cookie, tracking-protection, or ad-personalization settings.

Breaches

If a security breach ever creates a real risk of significant harm, we will notify affected people and the Office of the Privacy Commissioner of Canada as required, and keep records of breaches.

Contact us

Questions, or want to exercise a privacy right? Email contact@bastani.org or call (647) 835-6368.

We may update this policy from time to time; the date above reflects the latest version.