Privacy policy

9467-0775 Québec inc. (NEQ 1173861320), registered trade name “Conformité PME” · In effect since August 3, 2026 · Last updated: November 5, 2026

Protecting personal information is our business - this is how we apply to ourselves the rules of the Act respecting the protection of personal information in the private sector (Law 25). This policy covers the conformitepme.ca website, your customer account, our newsletter and all of our tools:

• Law 25 audit - analysis of your website;
• Law 96 scan - language analysis of your website;
• Psychological harassment prevention - questionnaire and generated policy;
• Child labour - questionnaire and employer kit;
• Proof register - distribution of your documents to your staff and acknowledgements of receipt (see section 8, devoted entirely to it).

1. Purpose of collection - why we collect your information

We collect personal information only for the following purposes, determined before any collection:

• Provide website audits (Law 25, Law 96): analyze the site you submit and present you the results;
• Provide the questionnaire tools (harassment prevention, child labour): assess your business’s practices from your answers, then produce the corresponding policy or kit;
• Distribute your documents to your staff, if you use the proof register, and record who received and read them;
• Manage your customer account: creation, authentication and the history of your audits;
• Process your purchases: invoicing the deliverable and delivering it by email;
• Send you our newsletter, only if you consented (unsubscribe in one click);
• Keep the service secure: abuse prevention (usage limit) and technical logging.

The questionnaires are about your business’s practices, not about individuals: we never ask you to name an employee, a victim or a person complained about. If you nonetheless enter personal information in a free-text field, it follows the same retention and security rules as the rest of your file.

We collect only the information necessary for these purposes, and we use it for no other purpose without your consent. We never sell your information.

2. Means of collection - how the information is collected

• Directly from you, when you fill in a form: account creation (first name, last name, email, password), audit request (website address), answers to the compliance questionnaires, newsletter subscription (email);
• From your business, for the proof register: your staff’s email addresses, and their names if you provide them - you enter them, and nothing else is requested;
• Automatically while you browse: our server logs the IP address and the pages viewed; the IP address is also used to apply the free-audit limit (collected and kept temporarily);
• Through our payment processor (Stripe) when you buy: we receive a payment confirmation and your email, never your card number.

Cookies: this site only uses essential cookies - a session cookie that keeps you signed in to your account. No advertising, profiling or audience measurement cookie is set: we collect no information by this means outside the session. If we ever added one, your consent would be requested beforehand, through a banner letting you accept or refuse.

Audience measurement, without cookies: we measure traffic to the site with Cloudflare Web Analytics, a tool that sets no cookie, uses no identifier and builds no profile. We see aggregated totals - pages viewed, origin, country, load time - never a particular visitor. This is what lets us improve the site without collecting personal information for that purpose.

3. Retention period

At the end of these periods, the information is securely deleted or anonymized.

4. Security measures

We protect your information with measures proportionate to its sensitivity:

• Encryption of communications (HTTPS/TLS) across the whole site;
• Passwords protected by strong hashing (bcrypt) - never stored in clear text;
• Restricted access to systems, reserved for authorized staff;
• Payments processed by Stripe (PCI-DSS certified) - no card number passes through our servers;
• Regular backups and separation of databases;
• Confidentiality incident register and notification procedure: in the event of an incident presenting a risk of serious harm, we will notify the persons concerned and the Commission d’accès à l’information.

5. Disclosure and transfers outside Quebec

Your information is hosted in Canada, on servers located in Toronto (DigitalOcean). Some of our service providers do, however, process information outside Quebec, notably in the United States and the European Union. Before each disclosure outside Quebec, we carry out a privacy impact assessment (s. 17) and we contractually ensure adequate protection:

6. Your rights

Under Law 25, you may at any time:

• Access the personal information we hold about you;
• Request its correction if it is inaccurate or incomplete;
• Request its deletion (closing your account, unsubscribing);
• Withdraw your consent to the newsletter or to any optional use;
• Request that we stop disseminating information about you.

To exercise your rights, write to us at the address below. We reply within a maximum of 30 days. If you are not satisfied with our answer, you may file a complaint with the Commission d’accès à l’information du Québec.

7. Contact details of the person in charge of the protection of personal information

For any question about this policy or our practices, or to reach us about your personal information, contact the person in charge at the details above.

8. The proof register: processing on behalf of your business

Only one of our tools touches your staff’s information, and it only does so at your request: the proof register, which gives your compliance documents to your employees and keeps a record of who received and read them. Our role there is different from the rest of the site: you are the party responsible for this information within the meaning of Law 25, and we act as your service provider (s. 18.3).

• The minimum: the person’s email address, and their name only if you provide it. No title, no department, no number.
• A single purpose: giving them your documents and recording the acknowledgement of receipt. These addresses never join our newsletter and are used for nothing else.
• No behaviour measurement: we record that a document was opened and acknowledged, with its date. Nothing else is observed, and none of our tools tests or evaluates your staff.
• Removal is not erasure: a person who leaves your business stops receiving your mailings, and their acknowledgements of receipt remain for as long as they serve as your proof. Erasure can be requested.

If you are an employee of a business that uses the register and wish to exercise your rights, first approach your employer, who is the party responsible. You can also write to us at the details in section 7: we will relay your request.

Our other tools are addressed only to the person using them. The questionnaires are about your business’s practices - the number of people concerned, the procedures, the measures taken - and no field asks you to name anyone.

Changes to this policy

Any significant change will be published on this page with a new update date. Because the services are intended for businesses, they are not directed at minors under 14 and we do not knowingly collect their information.