Breach Response Policy

Effective 31 August 2026. This policy sets out what The Alpha Nova does when personal information in our control is lost, accessed without authorization, or disclosed without authorization. It reflects the breach obligations in PIPEDA and its Breach of Security Safeguards Regulations.

Scope

This applies to personal information we hold as an organization and, unless a client contract says otherwise, to personal information we process on behalf of a client. Where we process a client's data, we notify that client without delay so they can meet their own obligations; they remain the organization in control of the information.

Who is responsible

Athif Shaffy, Co-Founder & Software Lead, as Privacy Officer, owns the response. Anyone at The Alpha Nova who suspects a breach must report it to the Privacy Officer immediately and directly. There is no intermediate approval step, and no one is penalised for reporting something that turns out not to be a breach.

1. Contain

Stop the exposure first. Revoke or rotate affected credentials, remove access, take a system offline if that is what it takes, and recover copies where possible. Preserve logs and evidence before changing anything that would destroy them.

2. Evaluate the risk

The Privacy Officer assesses whether the breach creates a real risk of significant harm to any individual, considering the sensitivity of the information, the probability of misuse, who obtained it, and whether it was encrypted or otherwise unusable. Significant harm includes humiliation, damage to reputation or relationships, loss of employment or professional opportunity, financial loss, identity theft, and damage to or loss of property.

3. Notify

• Office of the Privacy Commissioner of Canada — reported as soon as feasible after we determine a real risk of significant harm exists.
• Affected individuals — notified as soon as feasible, directly where we can reach them. The notice states what happened, when, what information was involved, what we have done, what they can do to reduce their risk, and how to contact us.
• Other organizations — including affected clients, processors, law enforcement or a regulator, where notifying them may reduce the risk or is required.

4. Record

We keep a record of every breach of security safeguards, including those judged not to meet the notification threshold, and retain each record for at least 24 months after the day we determined the breach occurred. Records are available to the Privacy Commissioner on request.

5. Learn

After containment the Privacy Officer records the root cause and the fix, and updates safeguards, tooling or training so the same route closes. A breach that recurs the same way is treated as an unresolved incident, not a new one.

Reporting a suspected breach

If you believe information held by us has been exposed, tell us immediately: info@thealphanova.com or +1 437 424 5384. Please include what you saw, where, and when. We would far rather investigate a false alarm than miss a real one.