1. Introduction
My Waypoint Technologies Inc. maintains procedures for identifying, investigating, containing, responding to, and recovering from security incidents and privacy breaches.
We recognize that security incidents can affect the confidentiality, integrity, or availability of systems and information. Our goal is to respond promptly, limit potential harm, investigate root causes, and comply with applicable legal and regulatory obligations.
This statement provides a public overview of our incident response and breach notification practices.
2. How We Respond to Security Incidents
My Waypoint Technologies Inc. maintains internal incident response procedures designed to:
- Detect and assess potential security incidents
- Contain unauthorized activity and limit further impact
- Investigate the scope and nature of the incident
- Preserve relevant evidence where appropriate
- Restore affected services and systems
- Implement corrective actions to reduce the likelihood of recurrence
Response activities may involve internal personnel, service providers, legal counsel, privacy advisors, or other qualified professionals depending on the nature of the incident.
3. Privacy Breach Management
A privacy breach may occur when personal information is accessed, collected, used, disclosed, retained, modified, or disposed of in an unauthorized manner.
Upon becoming aware of a suspected or confirmed privacy breach, My Waypoint Technologies Inc. takes steps to:
- Contain the incident
- Assess the information affected
- Evaluate the likelihood and severity of potential harm
- Determine legal and regulatory obligations
- Implement remediation measures
- Document incident response activities
Each incident is assessed on its own facts and circumstances.
4. Notification of Affected Individuals
Where required by applicable law, My Waypoint Technologies Inc. will provide notification to affected individuals and regulatory authorities.
The timing, content, and method of notification will depend on factors including:
- The nature of the incident
- The types of information involved
- The likelihood of harm
- Applicable legal requirements
- Operational considerations necessary to contain and investigate the incident
Notifications may include information regarding:
- What occurred
- What information may have been affected
- Measures taken by My Waypoint Technologies Inc.
- Recommended protective actions
5. Compliance with Privacy Laws
My Waypoint Technologies Inc. maintains incident response and breach management practices designed to support compliance with applicable Canadian privacy and data protection requirements.
Where applicable, we may engage legal counsel, privacy professionals, cybersecurity specialists, insurance providers, law enforcement agencies, or regulatory authorities as part of an incident response process.
6. Third-Party Incidents
Some services used by My Waypoint Technologies Inc. rely on third-party vendors and service providers.
If a security incident originates with or affects a third-party service provider that processes information on our behalf, we may coordinate investigation, containment, remediation, and notification activities with that provider as appropriate.
Information regarding service providers is available in our Vendor & Subprocessor Disclosure.
7. Continuous Improvement
My Waypoint Technologies Inc. reviews and updates its security, privacy, and incident response practices as part of its broader governance and risk management activities.
Lessons learned from incidents, industry developments, changes in technology, legal requirements, and operational experience may result in updates to internal procedures, security controls, or governance documentation.
8. Reporting a Security Concern
If you believe you have identified a security vulnerability, privacy concern, unauthorized disclosure, or suspected security incident involving a My Waypoint Technologies Inc. product or service, please contact us promptly.
Email: security@mywaypoint.ca
Security researchers should also review our Responsible Disclosure Policy for guidance regarding authorized reporting and coordinated vulnerability disclosure.