Privacy Policy

The person responsible for the protection of personal information (responsable de la protection des renseignements personnels) at PrivQC is:

Any request, complaint, or question regarding the handling of your personal information may be directed to the above contact.

This policy applies to personal information collected by PrivQC in connection with:

• Merchant accounts (businesses registered on the PrivQC platform);
• Data subjects who submit privacy requests through a Merchant's embedded PrivQC widget;
• Visitors to privqc.ca and all related subdomains.

When PrivQC processes personal information on behalf of a Merchant (acting as a service provider / sous-traitant), that Merchant's own privacy policy governs the underlying data. PrivQC processes such information solely on the Merchant's documented instructions.

Merchant Account Data

When a business registers with PrivQC, we collect: business name, business email address, website URL, and billing information (processed by our payment provider; we do not store full card details). We associate an account identifier with the Clerk authentication service.

Data Subject Request Data

When an individual submits a data access or portability request through a Merchant's PrivQC widget, we collect: the requester's email address, request type (access or portability), a description of the request (optional), identity verification status (via Stripe Identity — see §7), and timestamps. This information is collected solely to facilitate the Merchant's legal obligation to respond within 30 days.

Usage and Technical Data

We collect standard server logs (IP address, browser type, pages visited, timestamps) for security monitoring and platform reliability. These logs are retained for a maximum of 90 days.

Communications

If you contact us by email, we retain the content of that communication and your contact details to respond and for our records.

We collect and use personal information only for the following specific, explicit, and legitimate purposes:

We do not sell personal information, use it for targeted advertising, or share it with third parties for their own marketing purposes.

Collection is based on the freely given, informed, and unambiguous consent of the individual, except where another legal basis applies (e.g., legal obligation, legitimate interest proportionate to the privacy impact). Consent may be withdrawn at any time by contacting us at privacy@privqc.ca; withdrawal does not affect the lawfulness of processing prior to withdrawal.

Data subjects who submit a request through the widget consent to PrivQC processing their email address and request details solely for the purpose of facilitating the Merchant's Law 25 response obligation.

Destruction is carried out in a manner that makes recovery of the information impossible, using secure deletion for database records and S3 object lifecycle policies for files.

We engage the following categories of service providers (sous-traitants) who access personal information only to the extent necessary to perform their services:

We do not sell, rent, or trade personal information. We may disclose information if required by law, court order, or regulatory authority, or to protect the rights and safety of PrivQC, its users, or the public.

Several of our service providers are located outside Quebec and Canada (see §7). Before communicating personal information outside Quebec, PrivQC carries out a privacy impact assessment (évaluation des facteurs relatifs à la vie privée — EFVP) as required by Law 25, s. 17. We ensure that the recipient provides a level of protection equivalent to that required by Quebec law through contractual clauses and/or adequacy findings.

A summary of completed privacy impact assessments is available upon request to privacy@privqc.ca.

We implement technical and organizational measures proportionate to the sensitivity of the information and the risks identified, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256);
• Row-level security on the database; service-role access restricted to server-side code only;
• Time-limited, single-use magic links for data subject authentication;
• Identity verification via Stripe Identity before sensitive requests are processed;
• Pre-signed, expiring URLs for all downloaded data files;
• Access controls and audit logging for Merchant dashboard actions;
• Regular dependency updates and vulnerability monitoring.

In the event of a confidentiality incident (incident de confidentialité) that presents a risk of serious injury to an individual, PrivQC will:

• Notify the Commission d'accès à l'information du Québec (CAI) without undue delay;
• Notify affected individuals where the risk of serious harm warrants it;
• Keep a register of all incidents, regardless of severity, as required by Law 25;
• Take all reasonable measures to reduce the risk of harm and prevent similar incidents.

To report a suspected incident, contact privacy@privqc.ca immediately.

Subject to applicable exceptions, individuals whose personal information we hold have the following rights:

If your personal information has been processed through a Merchant's PrivQC widget, the fastest way to submit a formal data access or portability request is directly through that widget on the Merchant's website. The widget:

• Accepts access and portability requests under Law 25;
• Verifies your identity via Stripe Identity;
• Delivers a confirmation email with a reference number;
• Triggers a 30-day response clock as required by law.

For requests relating to information held by PrivQC itself (your Merchant account, or PrivQC's own processing), or if no widget is available, send a written request to:

We will acknowledge your request within 5 business days and respond within 30 days of receipt. We may request proof of identity before proceeding. If we are unable to respond within 30 days, we will notify you of the delay and the reasons for it, as permitted by law.

The PrivQC platform is not directed at individuals under the age of 14. We do not knowingly collect personal information from children under 14 without verifiable parental consent. If you believe we have inadvertently collected such information, please contact us immediately at privacy@privqc.ca.

PrivQC uses only technically necessary cookies required for platform authentication (session tokens via Clerk) and security. We do not use advertising cookies, third-party tracking pixels, or behavioural profiling technologies on this website. No cookie consent banner is presented because no non-essential cookies are set.

The embedded widget script (widget.js) placed on a Merchant's website may set a session cookie to manage the request flow. Merchants are responsible for disclosing this in their own cookie notices.

We may update this policy to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify Merchants by email at least 30 days before the changes take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

You may always find the current version at privqc.ca/privacy.

If you believe your privacy rights have been violated, you may file a complaint with PrivQC's Privacy Officer at privacy@privqc.ca. We will investigate and respond within 30 days.

You also have the right to file a complaint with the Commission d'accès à l'information du Québec (CAI):