Privacy policy (CA)

1. Person in Charge of Processing

Abbe ("we," "us," or "our") operates this website and is responsible for the personal information it collects, uses, and discloses. We are subject to Quebec Law 25 (An Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25) and handle all personal information in accordance with its requirements.

Our website is hosted in Quebec by Horizon-Cumulus (9322-8310 Québec inc., Joliette, Quebec), and our consent records and privacy policy are stored at OVH's Beauharnois, Quebec data center. Where personal information is processed outside Quebec, we describe those transfers in Section 5.

2. Personal Information Collected

We collect personal information only to the extent necessary for the purposes described in this policy. The categories below reflect what is actually collected through our website and its integrated services.

  • Identification and contact information: your name and email address when you subscribe to our newsletter.
  • Device and technical identifiers: IP address, browser type, operating system, and device identifiers collected automatically when you visit our site.
  • Browsing behavior: pages visited, session duration, navigation patterns, and approximate geographic location derived from your IP address.
  • Advertising identifiers: advertising IDs and social identifiers used to measure ad performance and support targeted advertising.
  • Consent preferences: your cookie consent choices, stored locally in your browser via the Moelleux consent management platform.

We do not knowingly collect sensitive personal information such as health data, financial account numbers, or government-issued identification numbers through this website.

3. Purposes of Processing

We process personal information only for the purposes listed below. Where we rely on your consent, you may withdraw it at any time (see Section 7).

  • Website operation and security (legal basis: legitimate interest / essential function): We use session and security cookies, the Moelleux consent management platform, and Google Fonts to deliver a functional and secure website experience. Google Fonts loads typefaces from Google's servers in the United States; this involves transmitting your device identifier to Google as part of the font request. Because this service is integral to the visual rendering of the site, it is classified as essential.
  • Audience analytics (legal basis: consent): With your consent, we use Google Analytics 4 (operated by Google LLC, United States) to measure traffic, understand how visitors interact with our pages, and improve site performance. Data collected includes device identifiers, IP address, pages visited, session duration, navigation behavior, and approximate location.
  • Targeted advertising and remarketing (legal basis: consent): With your consent, we use the Meta Pixel (operated by Meta Platforms, Inc., United States) to track conversions, build audience segments, and display relevant advertisements on Meta platforms (Facebook, Instagram). Data collected includes device identifiers, IP address, pages visited, navigation behavior, advertising identifiers, and social identifiers.
  • Newsletter and marketing communications (legal basis: consent): If you subscribe to our newsletter, we use Cyberimpact (based in Quebec) to send you updates and promotional content. Your email address and name are stored on Cyberimpact's Quebec-based servers. You may unsubscribe at any time using the link in any email we send you.
  • Business email communications (legal basis: legitimate interest): We use Horizon-Cumulus Email (Quebec) for day-to-day business correspondence. Outbound email routing also passes through Microsoft 365 (operated by Microsoft Corporation, United States); see Section 5 for details on this cross-border transfer.

4. Third Parties and Processors

The table below lists every third-party service integrated into this website, as detected and declared at the time this policy was prepared. We share personal information with these parties only to the extent necessary for the stated purpose.

Name Purpose Category Transfer Outside Quebec
Moelleux (par Horizon-Cumulus) Consent management and privacy policy hosting; stores consent records and a preference cookie (moelleux_{site_key}, 13 months) in Quebec (OVH Beauharnois) Essential No — data remains in Quebec
Google Fonts Web font delivery required for site rendering Essential Yes — United States
Google Analytics 4 Audience measurement and traffic analysis Analytics Yes — United States
Meta Pixel (Facebook) Conversion tracking and targeted advertising on Meta platforms Marketing Yes — United States
Cyberimpact Newsletter and marketing email delivery Marketing No — data remains in Quebec
Horizon-Cumulus Email Business email communications Functional No — data remains in Quebec
Microsoft 365 Email routing and delivery infrastructure Functional Yes — United States

5. Transfers Outside Quebec

Quebec Law 25 (section 17) requires us to disclose when personal information is communicated outside Quebec and to confirm that an appropriate level of protection is in place before any such transfer occurs. The following transfers apply to our operations.

  • Google LLC (United States) — Google Analytics 4 and Google Fonts transfer device identifiers, IP addresses, and browsing data to Google's servers in the United States. Google LLC participates in the EU-U.S. Data Privacy Framework and applies standard contractual clauses for international data transfers. We have assessed that an adequate level of protection exists for this transfer.
  • Meta Platforms, Inc. (United States) — The Meta Pixel transfers device identifiers, IP addresses, advertising identifiers, and behavioral data to Meta's servers in the United States. Meta applies standard contractual clauses and participates in recognized cross-border transfer frameworks. We have assessed that an adequate level of protection exists for this transfer.
  • Microsoft Corporation (United States) — Outbound email sent through our infrastructure may be routed via Microsoft 365, which operates servers in the United States. Microsoft applies standard contractual clauses and maintains a comprehensive data protection program. We have assessed that an adequate level of protection exists for this transfer.

In accordance with section 17 of Quebec Law 25, we conduct or rely on a Privacy Impact Assessment (PIA) before communicating personal information outside Quebec. These assessments consider the sensitivity of the information, the purpose of the transfer, the legal framework of the destination jurisdiction, and the contractual safeguards in place. If you would like more information about a specific transfer or the safeguards applied, please contact our Person responsible for the protection of personal information (see Section 8).

Our newsletter service (Cyberimpact) and our primary email infrastructure (Horizon-Cumulus Email) store and process data entirely within Quebec. No personal information collected through those services leaves Quebec.

6. Retention Period

We retain personal information only as long as necessary for the purpose for which it was collected, or as required by law. The table below summarizes our retention practices.

Data Type Retention Period Justification
Newsletter subscriber information (name, email) Until unsubscription, then deleted within 30 days Consent-based; no longer needed once consent is withdrawn
Consent records (Moelleux cookie preference) 13 months from the date of consent Required to demonstrate valid consent under Quebec Law 25; aligns with standard consent management practice
Analytics data (Google Analytics 4) Up to 14 months (Google's default retention setting) Audience measurement and site performance optimization; limited to what Google's platform retains
Advertising and behavioral data (Meta Pixel) Up to 180 days (Meta's default event data retention) Conversion tracking and remarketing audience building; governed by Meta's data retention policies
Business email correspondence Up to 7 years Standard business record-keeping practice and potential legal obligations
Server and access logs (IP address, technical identifiers) Up to 12 months Security monitoring, incident investigation, and abuse prevention

When the retention period expires, personal information is securely deleted or anonymized so that it can no longer be linked to an identifiable individual.

7. Rights of Data Subjects

Under Quebec Law 25, you have the following rights with respect to your personal information. To exercise any of these rights, please contact our Person responsible for the protection of personal information using the details in Section 8. We will respond within 30 days of receiving your request.

  • Right of access: You may ask us to confirm whether we hold personal information about you and to receive a copy of that information in a clear and understandable format.
  • Right of rectification: If the personal information we hold about you is inaccurate, incomplete, or ambiguous, you may ask us to correct it. If we have communicated that information to third parties, we will notify them of the correction where feasible.
  • Right of erasure (right to be forgotten): You may ask us to delete personal information that was collected without a valid legal basis, that is no longer necessary for the purpose for which it was collected, or where you have withdrawn your consent and no other legal basis applies.
  • Right to data portability: You may ask us to provide the personal information you gave us in a structured, commonly used, and machine-readable format so that you can reuse it or transfer it to another organization.
  • Right to withdraw consent: Where we process your personal information based on your consent (analytics, advertising, newsletter), you may withdraw that consent at any time without penalty. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. You can manage your cookie preferences at any time through the consent banner on our website, and you can unsubscribe from our newsletter using the link in any email we send you.

If you believe your rights have not been respected, you have the right to file a complaint with the Quebec Information Access Commission (CAI) at https://www.cai.gouv.qc.ca.

8. Person Responsible for the Protection of Personal Information

In accordance with section 3.1 of Quebec Law 25, Abbe has designated a Person responsible for the protection of personal information. This person oversees compliance with Quebec Law 25, handles requests related to your personal information, and serves as your point of contact for any privacy concern.

We will acknowledge your request promptly and provide a full response within 30 days, as required by Quebec Law 25. If your request is complex or if we receive a high volume of requests, we will notify you of any extension and the reason for it.

9. Effective Date and Versioning

This privacy policy takes effect on 17 juin 2026 and supersedes any prior version.

Version: 3

We review this policy at least once a year and whenever a material change occurs in our data practices, the services we use, or the applicable legal requirements. When we make significant changes, we will update the effective date above and, where appropriate, notify you directly. We encourage you to review this policy periodically to stay informed about how we protect your personal information.