Privacy Notice

Effective Date: October 16, 2026

Introduction

Arancia is a cybersecurity company providing technology solutions, professional services, and expertise to help organizations strengthen their security posture, manage cyber risk, and protect their digital environments.

This Privacy Notice (“Notice”) describes how Arancia Technologies Inc. and Arancia Technologies USA Inc. (together, “Arancia,” “we,” “us,” or “our”) collect, use, maintain, process, and disclose personal information when you visit or interact with our website, engage with our social media platforms, register for an event or webinar, download a white paper or other resources, inquire about our cybersecurity solutions and services, or otherwise communicate with us.

For purposes of this Notice, “you” and “your” refer to individuals whose personal information we may collect or process.

This Notice applies to personal information collected through our website, business activities, marketing communications, events, and other interactions with Arancia. Personal information processed on behalf of customers in connection with our cybersecurity services may be subject to separate contractual agreements, data protection terms, and applicable customer privacy policies.

Arancia is committed to protecting personal information in accordance with applicable privacy and data protection legislation, including Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy laws, including Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), Canada’s Anti-Spam Legislation (CASL), and the General Data Protection Regulation (GDPR), where applicable. Our website and services are intended primarily for business and professional audiences and are not directed toward children. We do not knowingly collect personal information from children in violation of applicable law. Our website may contain links to third-party websites whose privacy practices differ from ours. We encourage you to review the privacy notices of those websites before providing personal information.

1. What Types of Personal Information Do We Collect?

Depending on how you interact with Arancia, we may collect the following categories of personal information:

Business Contact Information

Your first and last name, job title, employer, business address, business email address, telephone number, and other professional contact information. If you voluntarily provide additional contact details, such as a personal email address or telephone number, we may collect that information as well.

Technical and Device Information

Your Internet Protocol (IP) address, browser type, operating system, device characteristics, referral sources, and other technical information relating to how you access and interact with our website.

Audio and Visual Information

If you participate in an Arancia-hosted or sponsored event, webinar, virtual meeting, or other business activity, we may collect photographs, video recordings, audio recordings, or other information associated with your participation, where permitted by applicable law.

Cookies and Analytics Information

Arancia and its third-party service providers may use cookies, pixels, tags, scripts, and similar technologies to support website functionality, analyze website performance, understand visitor interactions, and improve our digital experience.

Depending on the technologies implemented and your consent choices, these technologies may collect information about website traffic, pages visited, device characteristics, referral sources, and interactions with website content.

Feedback and Communications

Information you voluntarily provide when responding to surveys, submitting feedback, participating in discussions, or communicating with Arancia through our website, social media platforms, or other channels.

We collect personal information only to the extent reasonably necessary for identified and legitimate business purposes.

You can opt out of the sharing of your personal information by submitting a request to our privacy contact at inquiry@arancia.io.

2. When Do We Collect Your Personal Information?

Arancia may collect personal information when you interact with us online, in person, or through our business partners.

Business Contact Information

We may collect your business contact information when you:

• Sign up to attend or participate in an in-person event or webinar
• Sign up for a contest or promotion
• Request information about our cybersecurity solutions or services
• Complete a website contact form
• Download a white paper, report, or other materials
• Subscribe to newsletters

Technical and Device Information

We may collect technical and device information when you:

• Visit our website
• Visit our social media platforms
• Sign up for a Demo or other form fills

Audio and Visual Information

We may collect audio or visual information when you:

• Participate in Arancia-hosted in-person or virtual events
• Attend a partner-hosted in-person or virtual event
• Participate in a recorded telephone or conference call conversation

Cookies and Analytics Technologies

Arancia uses cookies and analytics technologies when you:

• Sign up with our website and social media platforms
• Sign up for a demo or other form fills

If you would prefer not to be tracked, most browsers will allow you to (i) change your browser settings to notify you when you receive a cookie, which lets you choose whether to accept it; (ii) disable existing cookies; or (iii) set your browser to automatically reject cookies, however, doing so may affect how our Websites work.

3. How Do We Use Your Personal Information?

Arancia may use personal information:

• To Provide and Improve Services: To fulfill your requests, process transactions, and enhance your user experience
• To Communicate with You: To send updates, newsletters, and other information related to our products and services
• For Marketing Purposes: To offer personalized content and promotions based on your preferences and usage patterns, where permitted by applicable law and with consent where required
• For Compliance and Legal Obligations: To comply with legal requirements and protect our rights and interests

Where required by applicable law, we obtain consent before using personal information for marketing or other purposes requiring consent. We will not use personal information for materially different purposes without providing appropriate notice and obtaining additional consent where required.

4. What Is Arancia’s Legal Basis for Processing Personal Information?

If the law requires us to have a legal reason for collecting and using your personal information, such as the European Union or United Kingdom General Data Protection Regulation (either, the “GDPR”), then the reason will depend on the type of information we collect and why we collect it. When you interact with Arancia, we use your personal information either because you gave us permission (where required by law) or because we need it to provide requested services, fulfill contractual obligations, or manage customer relationships.

When you fill out a form to ask about Arancia or one of our Offerings, we use your personal information either because you gave us permission (where required by law) or because it’s in our legitimate interest to respond to your request, communicate with you and send you information about our Offerings (like via marketing calls or emails, depending on your preferences).

If you sign up for newsletters or events, request a demo, download resources or take part in surveys, we use your consent to send you more information about our Offerings that we think might interest you. You can opt out of these communications at any time by using one of the methods described in Section 9 (Individual Privacy Rights).

We also rely on your consent when it comes to using non-essential cookies on our websites. When you first visit our website, a cookie banner allows you to accept or decline these cookies, and you can change your preferences at any time through the cookie settings on our website. Essential cookies required for the website to function do not require consent. Cookie rules can vary based on where you are located.

If we need to use your personal information based on our legitimate interests, we will tell you this when collecting the data. Our legitimate interests include things like running our websites, communicating with you when you ask for information and marketing our Offerings.

Sometimes, we also need to process your information when necessary to comply with applicable laws, regulations, and lawful requests.

Arancia complies with applicable requirements under Canada’s Anti-Spam Legislation (CASL). Where required, we obtain express or implied consent before sending commercial electronic messages, including newsletters, promotional emails, event invitations, and information about our cybersecurity solutions and services. Our commercial electronic messages include appropriate sender identification, required contact information, and a clear and accessible unsubscribe mechanism, unless an applicable legal exemption provides otherwise.

You may unsubscribe from marketing communications at any time using the unsubscribe link included in our emails or by contacting us at inquiry@arancia.io.

Unsubscribe requests are processed as soon as practicable and no later than 10 business days after receipt, as required by CASL.

5. International Data Transfers

If we transfer your personal data outside of your country, we use appropriate safeguards and legal mechanisms to ensure the data is protected, such as Standard Contractual Clauses (SCCs), adequacy decisions, or other applicable transfer mechanisms.

Personal information transferred internationally may be subject to the laws of the jurisdiction in which it is processed.

6. Security Safeguards

Arancia maintains administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, misuse, or destruction.

These safeguards may include access controls, authentication measures, encryption, monitoring, employee training, incident response procedures, and appropriate oversight of third-party service providers.

We review our security practices periodically and implement measures appropriate to the sensitivity of the information and the risks involved.

Although we take reasonable precautions to protect personal information, no method of electronic transmission or storage can be guaranteed to be completely secure.

7. Retention of Personal Information

Arancia retains personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, provide services, maintain business records, and comply with applicable legal, regulatory, or contractual obligations.

Retention periods may vary depending on the type of information, the purposes for which it is processed, and applicable legal requirements. Personal information may also be retained in backup or archival systems for appropriate periods, subject to applicable safeguards and retention requirements.

When personal information is no longer required, we take reasonable steps to securely delete, destroy, or anonymize it in accordance with applicable law.

8. Incident Response and Breach Notification

In the event of a data breach, we will assess the incident, take appropriate measures to mitigate potential risks, and notify affected individuals and relevant authorities in accordance with applicable privacy legislation.

Under GDPR: Where required, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach. Affected individuals will also be notified where required by law.

Under PIPEDA: Where a breach creates a real risk of significant harm, we will report the breach to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible after determining that the breach has occurred.

Other Applicable Laws: We will comply with additional breach notification requirements under relevant provincial and international privacy legislation.

We maintain records of data breaches as required by applicable laws.

9. Individual Privacy Rights

Subject to GDPR, PIPEDA, and other applicable laws and legal exceptions, you may have the following rights regarding your personal information:

• Request access to personal information held about you.
• Request correction of inaccurate or incomplete personal information.
• Request deletion of personal information where legally applicable.
• Object to certain processing activities or request restrictions on processing.
• Withdraw consent to the collection or use of personal information.
• Request data portability where applicable.
• Obtain information regarding certain automated decision-making activities where required by law.
• Submit a complaint regarding the handling of your personal information.

If you have consented to Arancia’s collection or use of personal information, you may withdraw your consent at any time. Withdrawing consent will not affect the lawfulness of processing conducted before withdrawal or processing otherwise permitted or required by law. These rights are subject to applicable laws and may vary depending on your jurisdiction.

10. Data Protection Impact Assessments (DPIAs)

We conduct Data Protection Impact Assessments (DPIAs) as required by GDPR and other applicable privacy legislation. DPIAs are carried out when initiating new processing activities that may pose a high risk to the privacy of individuals. We assess the risks and implement appropriate measures to mitigate them.

11. Updates to This Notice

Arancia may update this Privacy Notice periodically to reflect changes in our business practices, technologies, services, or applicable legal requirements.

Any updates will be published on our website with a revised effective date. Where required by law, we will provide additional notice or obtain consent before implementing material changes to how personal information is collected, used, or disclosed. We encourage you to review this Notice periodically to stay informed about our privacy practices.

12. Contact Us

If you have any questions or concerns about this Privacy Notice or our data protection practices, please contact us at inquiry@arancia.io or at either of our offices:

Arancia Technologies Inc.
5255 Orbitor Dr, Suite #502
Mississauga, ON L4W 5M6
Canada

Arancia Technologies USA Inc.
1110 Brickell Avenue, Suite #505
Miami, FL 33131
USA