PERSONAL INFORMATION PROTECTION POLICY
Compliant with Quebec Law 25 — An Act to modernize legislative provisions as regards the protection of personal information
Version 2026
1. PRIVACY OFFICER
In accordance with Law 25, Nortech Solution Informatique inc. has designated the following person as Privacy Officer for all matters relating to the protection of personal information:
Privacy Officer : John Laverdière — President
Address : 181, 6th Street West, Amos, QC J9T 2V7
Phone : 819-732-0717
Email : protectionrenseignements@nortechsolution.com
2. PURPOSE
Nortech Solution Informatique inc. (“Nortech”) is committed to protecting personal information in accordance with Law 25.
This policy describes our practices regarding:
• The collection of personal information
• Its use
• Its disclosure to third parties
• Its retention
• Its protection
3. SCOPE
This policy applies to all individuals whose personal information is collected by Nortech, including:
• Current and prospective clients
• Employees and job applicants
• Suppliers and subcontractors
• Users of our IT services
• Visitors to our website
4. INFORMATION COLLECTED
4.1 Identification Data
• Full name
• Mailing address
• Phone number
• Email address
4.2 Professional Information
• Company name
• Job title or position
• Professional contact details
4.3 Technical Data
• IP address
• Connection logs
• System information (in the context of IT service delivery)
• Data collected via remote management tools (RMM, security, backup)
4.4 Financial Data
• Billing information
• Payment data (processed through certified secure payment providers)
5. COLLECTION METHODS
We collect personal information through:
• Web forms
• Phone and email
• Account opening forms
• Technical support interactions
• IT management tools (RMM, remote maintenance)
• Website navigation (cookies — see section 8)
6. PURPOSES
Collected information is used solely for the following purposes:
• Delivering IT services
• Providing technical support
• Managing client relationships
• Processing payments
• Ensuring system security
• Preventing fraud
• Improving our services
• Meeting our legal obligations
7. CONSENT
Consent is obtained as follows:
• Explicitly: through a signed form, online acceptance, or verbal declaration
• Implicitly: within an established business relationship where collection is reasonably foreseeable
Consent may be withdrawn at any time by contacting our Privacy Officer at protectionrenseignements@nortechsolution.com. Withdrawal of consent may affect the delivery of certain services.
8. COOKIES AND WEB TECHNOLOGIES
8.1 Use
Our website may use technologies such as:
• Essential cookies — required for the website to function
• Analytical cookies — used for anonymized traffic statistics
• Performance cookies — to improve the user experience
These technologies may collect: IP address, browser type, and pages visited.
8.2 Consent
Upon your first visit to our website, a consent banner is displayed. You may accept or decline non-essential cookies and update your preferences at any time.
8.3 Third-Party Tools
Our website may use third-party services such as traffic analytics tools and web hosting services. The list of active third-party cookies may change over time. You can view and manage cookies directly in your browser settings.
9. DISCLOSURE OF INFORMATION
We never sell personal information.
We may share personal information only with:
• Technology providers necessary for service delivery (e.g., Microsoft 365, Azure, IT tools)
• Certified secure payment providers
• Legal authorities, when required by law
Contractual agreements govern these disclosures and require the confidentiality of transmitted information.
10. TRANSFERS OUTSIDE QUEBEC
Some information may be hosted outside of Quebec (e.g., cloud services). Prior to any such transfer, Nortech conducts a Privacy Impact Assessment (PIA) as required by Law 25, in effect since September 2023.
Where required by law, individuals are informed before their information is transferred outside of Quebec.
11. SECURITY
Nortech’s security measures include:
• Multi-factor authentication (MFA)
• Endpoint detection and response (EDR / antivirus)
• Strict access control to systems and data
• Access and activity logging
• Regular encrypted backups
• Ongoing cybersecurity training for staff
12. CONFIDENTIALITY INCIDENTS
In the event of a confidentiality incident (unauthorized access, data breach, cyberattack, etc.), Nortech commits to:
1. Immediately containing the incident and taking reasonable measures to reduce the risk of harm.
2. Assessing whether the incident presents a risk of serious injury to the individuals concerned.
3. Notifying the Commission d’acces a l’information (CAI) promptly if such a risk is identified.
4. Notifying affected individuals promptly when their security or privacy is at risk.
5. Recording the incident in the internal confidentiality incident register and retaining it for at least five (5) years.
Quebec Law 25 requires that the CAI be notified “promptly” — there is no fixed time limit in hours specified in Quebec law, unlike the European General Data Protection Regulation (GDPR), which mandates 72 hours. The CAI’s guidelines do, however, reference this timeframe as an indicative benchmark.
13. RETENTION
Data is retained in accordance with:
• Applicable legal obligations (e.g., accounting and financial records: 7 years)
• Operational needs related to service delivery
Upon expiry of the retention period, data is either:
• Securely destroyed
• Anonymized in accordance with recognized best practices
Confidentiality incident registers are retained for a minimum of five (5) years, in accordance with the recommendations of the Commission d’acces a l’information du Quebec.
14. YOUR RIGHTS
In accordance with Law 25, you have the following rights:
Access : Request access to the personal information we hold about you.
Rectification : Request correction of inaccurate or incomplete information.
Portability : Receive your information in a structured format or request its transfer. (In effect since September 2024)
Withdrawal : Withdraw your consent at any time, subject to legal obligations.
De-indexing : Request the removal or de-indexing of personal information published online, where permitted by law.
Requests will be processed within a maximum of 30 days of receipt, in accordance with Law 25.
To exercise your rights, please contact us:
• Email: protectionrenseignements@nortechsolution.com
• Phone: 819-732-0717, attention: John Laverdiere
15. MINORS
In accordance with Law 25, we do not knowingly collect personal information from individuals under the age of 14 without the prior consent of a parent or legal guardian.
16. AUTOMATED DECISIONS
Nortech does not use fully automated decision-making processes that have a significant legal or similar impact on individuals. Should this practice be adopted in the future, we will inform the individuals concerned in accordance with the requirements of Law 25.
17. AMENDMENTS
This policy may be amended at any time to reflect changes in our practices or legal requirements. Any amendments will be published on our website with an updated revision date. In the event of a significant change, we will notify affected individuals through appropriate means.
Last updated: 2026
18. CONTACT
For any questions regarding this policy or the protection of your personal information:
Company : Nortech Solution Informatique inc.
Address : 181, 6th Street West, Amos, QC J9T 2V7
Phone : 819-732-0717
Email : protectionrenseignements@nortechsolution.com
Website : nortechsolution.com
This document is provided for informational purposes only. It does not constitute legal advice. For legal questions regarding compliance with Law 25, Nortech Solution recommends consulting a qualified legal advisor.
