What we collect, why, and who to ask.

Who we are

SEB (Secure Environment Basics) is a British Columbia sole proprietorship operated by Malik Baptiste. We are the organization responsible for the personal information described below under the Personal Information Protection Act (British Columbia) ("PIPA") and, where applicable to interprovincial or cross-border activity, the federal Personal Information Protection and Electronic Documents Act ("PIPEDA").

What we collect

• Lead data — publicly available company and contact information (company name, public contact email, homepage content) gathered as part of identifying prospective clients. See how our passive assessment works.
• Engagement data — information you give us directly when you sign an authorization form or engage SEB for a paid assessment: your name, role, company, contact email, and the system prompts / model outputs generated while testing your authorized system.
• Site usage — this site uses Cloudflare Web Analytics, which Cloudflare, Inc. (United States) provides with our hosting, to see which pages are viewed and how fast they load: the pages visited, referrers, country, browser, operating system and device type, and page-load timings. Cloudflare states that it uses no cookies or local storage for this, does not fingerprint visitors by IP address, User-Agent string or any other data, does not track individual visitors over time, and does not log query strings. It keeps unsampled data for 7 days and aggregates it after that. We use no other analytics, advertising or tracking scripts, and we do not use these figures to identify or contact anyone.

Why we collect it (legal basis)

Lead data is collected and used for direct commercial outreach, consistent with the implied-consent basis for business-to-business communication under Canada's Anti-Spam Legislation (CASL) and PIPA's reasonable-purpose standard. Engagement data is collected with your express consent, given when you sign an authorization form, and is used solely to deliver the security assessment you requested.

Cross-border transfer & AI subprocessors

SEB's assessment tooling uses third-party service providers to process limited assessment data, including portions of system prompts and model outputs observed during testing. By engaging SEB or submitting a system for assessment, you consent to this processing. We do not sell your data, and we do not share it beyond service providers required to deliver the engagement or as required by law.

Retention

Engagement data is retained for 12 months after an engagement concludes, then destroyed. You may request earlier deletion at any time (see contact below). Lead data for companies we have not engaged with is retained only as long as reasonably needed for outreach purposes, and is deleted on request or opt-out.

Your rights

Under PIPA and PIPEDA, you have the right to access the personal information we hold about you, request correction of inaccurate information, and request deletion or withdrawal of consent, subject to legal or contractual retention requirements. To exercise any of these rights, contact us using the details below.

Breach notification

If SEB becomes aware of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and, where required, the Office of the Information and Privacy Commissioner for BC and/or the Office of the Privacy Commissioner of Canada, without unreasonable delay.