Privacy statement

1. PURPOSE

This Privacy Statement describes how DECASULT Inc. collects, uses, discloses, retains, and protects personal information obtained in the course of its business activities, the provision of its professional services, and the use of its website. 

DECASULT recognizes the importance of protecting the privacy of the individuals with whom it interacts, including its clients, partners, suppliers, job applicants, website visitors, and any other affected individuals. 

DECASULT is committed to processing personal information in accordance with applicable privacy laws, including the Act respecting the protection of personal information in the private sector, as amended by Bill 25, as well as any other applicable legislation.

2. SCOPE

This statement applies to personal information collected by DECASULT in the course of its business activities, communications, services, administrative processes, and website. 

It does not apply to third-party websites accessible through links that may appear on the DECASULT website. These sites are governed by their own privacy policies.

3. PERSONAL INFORMATION COLLECTED

DECASULT limits the collection of personal information to what is necessary for the purposes identified at the time of collection or otherwise authorized by law. 

Depending on the context, DECASULT may collect the following personal information. 

3.1 Inquiries, Communications, and Web Forms 

When you contact DECASULT by phone, email, mail, web form, or any other means of communication, the following information may be collected: 

  • first and last name;
  • email address;
  • phone number;
  • mailing address;
  • city;
  • zip code;
  • IP address;
  • any other information voluntarily provided in connection with the request.

This information is collected to respond to requests for information, follow up on communications, and provide the requested services. 

3.2 Subscription to Communications and Newsletters 

When an individual subscribes to DECASULT’s communications, the following information may be collected: 

  • first name;
  • last name;
  • email address.

This information is used to send institutional, professional, or promotional communications, provided the individual has consented or where permitted by law. 

3.3 Professional Services and Business Relationships 

In the course of providing professional services or conducting business, DECASULT may collect certain information necessary to fulfill its mandates, including: 

  • first and last name;
  • email address;
  • phone number;
  • organization represented;
  • information necessary to fulfill the engagement or for administrative follow-up.

This information is used solely for the purposes of providing services, managing engagements, communicating with stakeholders, and complying with DECASULT’s contractual or legal obligations. 

3.4 Statistics and Website Usage 

In connection with the use of its website, DECASULT may collect certain technical or statistical information, including: 

  • IP address;
  • type of device used;
  • browser type;
  • pages viewed;
  • date and time of visit;
  • duration of visit;
  • anonymized or aggregated statistical data.

This information is used to ensure the proper functioning of the website, improve the user experience, analyze website traffic, and optimize DECASULT’s digital services.

4. PURPOSES OF USE OF PERSONAL INFORMATION

DECASULT uses the personal information it collects solely for the purposes for which it was obtained or for any other purpose authorized by law. 

  • to respond to requests for information;
  • to provide the requested professional services;
  • to maintain relationships with clients, partners, suppliers, and other stakeholders;
  • to manage communications and newsletter subscriptions;
  • to manage DECASULT’s mandates, files, and professional activities;
  • improve services, communication tools, and the website;
  • ensure the security of systems, data, and communications;
  • prevent fraud, unauthorized access, or malicious activities;
  • comply with applicable legal, regulatory, contractual, or professional obligations.

DECASULT does not sell the personal information it holds.

5. CONSENT

When required by law, DECASULT obtains the consent of the individual concerned before collecting, using, or disclosing their personal information. 

Consent must be explicit, freely given, informed, and provided for specific purposes. It may be withdrawn at any time, subject to applicable legal or contractual restrictions. 

However, withdrawing consent may limit DECASULT’s ability to provide certain services or respond to certain requests.

6. DISCLOSURE OF PERSONAL INFORMATION TO THIRD PARTIES

DECASULT may disclose certain personal information to third parties when necessary to provide its services, administer its operations, or comply with its legal obligations. 

  • technology service providers;
  • web hosting providers;
  • electronic communications service providers;
  • accounting, legal, or administrative service providers;
  • platforms used to send communications or newsletters;
  • service providers related to security, spam prevention, or protection against automated bots;
  • public authorities, courts, or regulatory bodies when required by law.

When DECASULT discloses personal information to a service provider, it takes reasonable measures to ensure that such information is adequately protected and used only for the intended purposes.

7. DISCLOSURE OUTSIDE QUEBEC

Certain personal information may be disclosed or made available to service providers located outside Quebec, particularly when DECASULT uses technological tools, cloud services, or digital platforms. 

When required by law, DECASULT conducts a privacy impact assessment before disclosing personal information outside Quebec. 

DECASULT also ensures that appropriate safeguards are in place to preserve the confidentiality and security of the personal information in question.

8. RETENTION OF PERSONAL INFORMATION

DECASULT retains personal information only for as long as necessary to fulfill the purposes for which it was collected, subject to applicable legal, regulatory, contractual, or professional obligations. 

As a general guideline, retention periods may vary depending on the nature of the information and the context in which it was collected, including: 

  • up to 60 months following the end of the business relationship or the provision of the service for information related to contact requests or communications;
  • up to 12 months following unsubscription for information related to newsletters;
  • up to 12 months after the end of service for certain information related to support or professional services, subject to applicable requirements; 
  • up to 24 months for certain statistical data related to website usage.

Upon expiration of the applicable retention periods, personal information is securely destroyed, deleted, or anonymized in accordance with DECASULT’s internal policies and applicable laws.

9. SECURITY MEASURES

DECASULT implements reasonable security measures to protect personal information from unauthorized access, use, disclosure, loss, theft, alteration, or destruction. 

These measures may include, among others: 

  • access controls for personal information;
  • limiting access to authorized individuals only;
  • the use of approved technology platforms;
  • IT security measures;
  • awareness training for individuals with access to personal information;
  • internal incident management procedures;
  • periodic review of security practices.

Despite the measures in place, no technological system can provide absolute security. DECASULT is, however, committed to taking reasonable steps to ensure the protection of the personal information it holds.

10. PRIVACY INCIDENTS

A privacy incident refers, in particular, to the unauthorized access, use, disclosure, loss, or any other unauthorized compromise of personal information. 

In the event of a privacy incident, DECASULT will take reasonable measures to: 

  • minimize the risk of harm;
  • assess the nature and severity of the incident;
  • document the incident;
  • take appropriate corrective measures;
  • notify the affected individuals when required;
  • notify the relevant authorities when required by law.

DECASULT maintains a record of privacy incidents in accordance with applicable legal requirements.

11. COOKIES AND SIMILAR TECHNOLOGIES

The DECASULT website may use cookies, as well as similar technologies. 

These technologies may be used to: 

  • ensure the proper functioning of the website;
  • improve the user experience;
  • measure website traffic;
  • analyze content performance;
  • optimize DECASULT’s digital services;
  • prevent certain risks related to the site’s security.

Visitors to the website can configure their browser to reject or limit certain cookies. However, some features of the site may not function properly as a result.

12. LINKS TO THIRD-PARTY SITES

The DECASULT website may contain links to websites operated by third parties. 

DECASULT is not responsible for the privacy practices, content, or security measures of these third-party sites. Anyone accessing a third-party site is advised to review the privacy policy applicable to that site before providing any personal information.

13. RIGHTS OF DATA SUBJECTS

Subject to applicable laws, any data subject may exercise certain rights with respect to personal information held by DECASULT. 

These rights may include, in particular: 

  • the right to be informed of the existence of personal information concerning them;
  • the right to access their personal information;
  • the right to request the correction of inaccurate, incomplete, or ambiguous information;
  • the right to withdraw consent, where processing is based on consent;
  • the right to request the deletion of certain information, where its retention is no longer necessary or where permitted by law;
  • the right to file a complaint regarding the processing of their personal information.

All requests must be submitted to the person responsible for privacy at DECASULT. 

DECASULT will process requests in accordance with the timeframes and procedures set forth in applicable laws.

14. RIGHTS OF DATA SUBJECTS

Subject to applicable laws, any data subject may exercise certain rights with respect to personal information held by DECASULT. 

These rights may include, among others: 

  • the right to be informed of the existence of personal information concerning them;
  • the right to access their personal information;
  • the right to request the correction of inaccurate, incomplete, or ambiguous information;
  • the right to withdraw consent, where processing is based on consent;
  • the right to request the deletion of certain information, where its retention is no longer necessary or where permitted by law;
  • the right to file a complaint regarding the processing of their personal information.

All requests must be submitted to the person responsible for privacy at DECASULT. 

DECASULT will process requests in accordance with the timeframes and procedures set forth in applicable laws.

14. HANDLING OF REQUESTS AND COMPLAINTS

Any request for access, correction, or withdrawal of consent, or any complaint regarding the protection of personal information, must be submitted in writing to the person responsible for the protection of personal information. 

DECASULT will handle all requests and complaints confidentially, diligently, and fairly. 

When necessary, DECASULT may request additional information to confirm the identity of the individual concerned or to clarify the scope of the request. 

If an individual believes that their rights have not been respected, they may also contact the Commission d’accès à l’information du Québec.

15. PROTECTION OF MINORS’ INFORMATION

The DECASULT website is not specifically intended for minors. 

DECASULT does not knowingly collect personal information from minors without the appropriate consent when required by law. 

If DECASULT discovers that personal information has been collected from a minor without the required authorizations, it will take reasonable measures to delete such information or obtain the necessary consent, as applicable.

16. AMENDMENTS TO THIS PRIVACY POLICY

DECASULT reserves the right to amend this privacy policy to reflect changes in its practices, services, technological tools, or legal obligations. 

Any amendments take effect upon publication on the DECASULT website, unless otherwise specified. 

The most recent version of the statement is available on the DECASULT website.

17. CONTACT INFORMATION

If you have any questions regarding this statement, wish to exercise your rights, or wish to file a complaint regarding the protection of personal information, you may contact DECASULT’s Privacy Officer. 

DECASULT Inc. 

Attn: Privacy Officer 

600 De Maisonneuve Boulevard West, Suite 3200, Montreal, Quebec H3A 3J2
Phone: 514 849-7697 
Email: sdrissi@decasult.com 

  1. EFFECTIVE DATE

This Privacy Policy takes effect on September 29, 2026 and supersedes any previous version published by DECASULT.