Last updated: October 2026
7 Islands Defense & Cyber Inc., incorporated in Canada, and 7 Islands OÜ, incorporated in Estonia (together, “7i”, “we” or “our”), are committed to protecting personal information and maintaining confidentiality.
The two companies use a common website and communication channels. This policy describes how personal information is collected, used, disclosed, retained and protected in connection with their professional activities.
Depending on the commercial or contractual relationship, either company may be responsible for a particular processing activity, or both may participate in shared activities. Their respective responsibilities depend on the processing actually undertaken and applicable law. Activities of 7 Islands OÜ are subject to the EU General Data Protection Regulation (GDPR) where applicable.
We limit collection to information reasonably necessary for our activities, including names, business contact details, organization, position, correspondence, information required to assess or perform an engagement, and administrative information relating to contractual relationships.
When the website is accessed, technical data may be processed, including IP addresses, browser characteristics, connection logs and information necessary for the security and operation of the service.
We do not solicit sensitive personal information through the website. Where an engagement involves sensitive or confidential information, its handling is governed by its nature and applicable obligations.
We use information to respond to inquiries, communicate with contacts, prepare and deliver engagements, manage client and supplier relationships, meet contractual, accounting and legal obligations, and maintain the security and operation of our systems.
We do not use personal information for incompatible purposes except where permitted by law or with valid consent.
We obtain consent where required by applicable law. Consent may be withdrawn subject to applicable legal or contractual conditions and obligations.
Where the GDPR applies, processing relies on a legal basis appropriate to its purpose, such as consent, performance of or steps before entering a contract, compliance with a legal obligation, or a duly assessed legitimate interest.
We do not sell or commercialize personal information.
Where necessary, information may be disclosed to professional or technology service providers, including hosting, communications, IT, accounting and administrative providers, and to partners involved in an engagement.
Appropriate safeguards apply to such disclosures. Information may also be disclosed where required by law or to protect our rights.
Our website uses Cloudflare infrastructure. Certain technical data may be processed on infrastructure outside Québec or Canada.
Given our international activities and presence in Canada and Estonia, certain information may be accessed or processed from other jurisdictions.
Before disclosing personal information outside Québec, we conduct assessments and implement safeguards as required by applicable law. Transfers subject to the GDPR are handled in accordance with its requirements.
Our website currently uses neither Google Analytics nor Cloudflare Web Analytics, nor any other audience measurement tool intended to analyze visitor behavior.
We do not use advertising cookies or commercial profiling technologies. Our infrastructure provider may nevertheless use technical mechanisms needed for security, abuse prevention or website operation.
If these practices change, we will update this policy and implement any required notice and consent mechanisms.
We retain information for as long as necessary for the purposes for which it was collected, subject to applicable legal, professional, regulatory and contractual obligations.
When no longer needed, information is securely destroyed or anonymized as required by applicable law. Access is limited to persons who need it for their duties.
We apply administrative, technical and organizational safeguards proportionate to the nature and sensitivity of the information processed, to reduce the risks of unauthorized access, use or disclosure.
Our governance practices include appointing a privacy officer, limiting access, establishing retention and disposal rules, handling requests and complaints, and managing privacy incidents. These practices are reviewed as needed.
Depending on applicable law, you may request access to or correction of your information, withdraw consent and, where legally available, request deletion, cessation of dissemination, de-indexing or provision of certain information in a structured, commonly used technological format.
Where the GDPR applies, you may also have rights to object, restrict processing and lodge a complaint with a supervisory authority.
To exercise your rights, contact the person identified below. Reasonable identity verification may be required. We respond within legally prescribed time limits.
You may submit a complaint about our practices to the designated contact below, describing the matter and providing contact information for follow-up. We review complaints and respond in accordance with applicable requirements.
In the event of a privacy incident, we take necessary steps to limit its consequences, assess risks and provide notices required by law.
Nicolas Duguay
Privacy Officer
Contact for 7 Islands Defense & Cyber Inc. and 7 Islands OÜ
7 Islands Defense & Cyber Inc. registered address: 325 rue St-Thomas, Joliette, Québec J6E 3P8, Canada
7 Islands OÜ registered address: Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Harju maakond, Estonia
nicolas@7i-intelligence.com
Questions, access or correction requests, and complaints may be directed to this contact.
We may amend this policy to reflect changes in our activities, practices or legal requirements. The current version and its revision date are published on this website. Notices required by law will be provided where applicable.
