Privacy Policy

1. Who we are

InnoAgentic is operated by [LEGAL ENTITY NAME], a [LEGAL FORM] registered in Quebec under enterprise number [NEQ], with its principal place of business at [FULL ADDRESS].

Person in charge of the protection of personal information

Law 25 requires a named individual to be accountable for the protection of personal information. That person is [NAME], [TITLE], reachable at [EMAIL] and [PHONE].

2. Information we collect

Describe only what is actually collected. Anything listed here that you do not in fact collect creates a compliance problem rather than solving one.

Information you provide

• Contact details you send us by email or through a form: [FIELDS]
• Content of your correspondence with us
• [ANY OTHER DIRECTLY COLLECTED INFORMATION]

Information collected automatically

• [IP ADDRESS — CONFIRM WHETHER RETAINED AND FOR HOW LONG]
• [BROWSER, DEVICE AND OS INFORMATION, IF COLLECTED]
• [PAGES VISITED AND REFERRING SITE, IF COLLECTED]

This website currently loads no third-party scripts, no external fonts and no advertising or tracking pixels. If that changes, this section must change with it.

Information we do not collect

[STATE EXPLICITLY WHAT YOU DO NOT COLLECT — e.g. payment details, biometric data, sensitive personal information]

3. Why we collect it

Law 25 requires each purpose to be identified before collection, and prohibits using the information for a different purpose without fresh consent.

• Responding to enquiries you send us — [CONFIRM]
• Providing and operating the services you request — [CONFIRM]
• Security, fraud prevention and diagnosing technical faults — [CONFIRM]
• Meeting legal and regulatory obligations — [CONFIRM]
• [ANY OTHER PURPOSE]

4. Consent and legal basis

[DESCRIBE HOW CONSENT IS OBTAINED — for each purpose, whether it is express or implied, and how it can be withdrawn. Under Law 25, consent must be requested separately for each purpose, in clear and simple language, and must be express where the information is sensitive.]

[IF ANY INDIVIDUAL UNDER 14 MAY USE THE SERVICE, DESCRIBE PARENTAL CONSENT — Law 25 requires it below that age.]

5. Cookies and analytics

[STATE WHETHER COOKIES ARE USED AT ALL. This website currently sets none. If you later add analytics, name the provider, state what it collects, whether it uses cookies, and how a visitor can refuse — Law 25 requires that technology allowing a person to be identified, located or profiled be deactivated by default.]

6. Sharing and service providers

We do not sell personal information. We share it only where necessary, and only with:

• Infrastructure providers. [NAME THEM — e.g. Cloudflare for hosting and content delivery; state what each one processes]
• Communication providers. [NAME THEM, IF ANY]
• Legal authorities, where disclosure is required by law.
• [ANY OTHER RECIPIENT]

[CONFIRM THAT EACH PROVIDER IS BOUND BY A WRITTEN AGREEMENT LIMITING USE TO YOUR INSTRUCTIONS — required by Law 25.]

7. Transfers outside Quebec

Law 25 requires a privacy impact assessment before personal information is communicated outside Quebec, and requires that the information receive adequate protection there.

[STATE WHETHER INFORMATION LEAVES QUEBEC, TO WHICH COUNTRIES, WHICH PROVIDERS ARE INVOLVED, WHETHER AN ASSESSMENT HAS BEEN CONDUCTED, AND WHAT SAFEGUARDS APPLY. Note that a global content delivery network typically means data does leave the province.]

8. Automated processing and AI systems

InnoAgentic builds autonomous AI systems. Where a decision about an individual is made exclusively by automated processing, Law 25 requires that the person be informed of it and be able to submit observations to a member of staff able to review the decision.

[STATE WHETHER ANY DECISION ABOUT AN INDIVIDUAL IS MADE EXCLUSIVELY BY AUTOMATED MEANS. If none is, say so plainly. If some are, describe the personal information used, the principal factors leading to the decision, and how a person may request review by a human.]

[STATE WHETHER PERSONAL INFORMATION IS EVER SENT TO THIRD-PARTY AI MODEL PROVIDERS, WHICH ONES, AND WHETHER IT MAY BE USED FOR TRAINING.]

9. Retention

Personal information is kept only as long as the purpose for which it was collected requires, then destroyed or anonymised.

• Correspondence: [PERIOD]
• Technical and security logs: [PERIOD]
• [OTHER CATEGORIES AND PERIODS]

10. Your rights

Subject to the conditions and exceptions set out in law, you may:

• Access the personal information we hold about you
• Correct information that is inaccurate, incomplete or ambiguous
• Withdraw consent to a given use
• Request de-indexing — that we cease disseminating information or that a hyperlink to it be de-indexed, where dissemination causes serious injury to your reputation or privacy
• Receive your information in a portable format, in a structured and commonly used technological format
• Be informed of the reasons behind an exclusively automated decision concerning you
• Complain to the Commission d'accès à l'information du Québec

Requests go to the person named in section 1. We respond within [PERIOD — 30 days is the statutory maximum]. [DESCRIBE HOW YOU VERIFY THE IDENTITY OF A REQUESTER.]

11. Security

[DESCRIBE THE ACTUAL MEASURES — encryption in transit and at rest, access controls, tenant isolation, secret management, logging and audit, staff training, periodic review. Describe only what is genuinely in place; an inaccurate security claim is worse than a modest one.]

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Confidentiality incidents

Law 25 requires that a confidentiality incident presenting a risk of serious injury be reported to the Commission d'accès à l'information and to the individuals concerned, and that a register of incidents be maintained.

[DESCRIBE YOUR INCIDENT PROCESS AND WHO MAINTAINS THE REGISTER.]

13. Changes to this policy

We may update this policy. The date at the top reflects the most recent revision. [STATE HOW MATERIAL CHANGES ARE COMMUNICATED, AND WHETHER FRESH CONSENT IS SOUGHT.]

14. Contact and complaints

Questions, requests and complaints about personal information go to [NAME] at [EMAIL], or by mail at [FULL ADDRESS].

If you are not satisfied with our response, you may contact the Commission d'accès à l'information du Québec.