Privacy Policy

Privacy and Personal Information Protection Policy

In accordance with Law 25 (RLRQ, c. P-39.1) — In effect since April 1, 2026

1. Governance

Boulangerie Humanité takes its responsibilities regarding the protection of personal information seriously by ensuring appropriate governance in the area of privacy. It applies the standards set out in the Act respecting the protection of personal information in the private sector (Law 25) and acts with transparency toward users of its services.

2. Legal Framework

This policy details the application by Boulangerie Humanité of the provisions of the Act respecting the protection of personal information in the private sector (RLRQ, c. P-39.1), as of December 1, 2023.

3. Scope

This policy applies to personal information submitted by users to Boulangerie Humanité, whether through the website, forms, or in the context of its activities.

4. Personal Information

Personal information refers to any information about a natural person that allows them to be identified directly or indirectly. This includes: name, gender, age, date of birth, phone number, mailing address, email address, banking information, credit card number, IP address, and photo.

5. Consent

Unless a legal exception applies, no personal information will be collected without first obtaining the user’s manifest, free, informed, and specific consent. This consent may be withdrawn at any time.

When the user consents, their personal information is used by Boulangerie Humanité solely for the purposes set out in this policy. If a user refuses to consent, their information will only be used to communicate with them, unless a legal provision permits otherwise.

In limited cases, consent may be implicit, provided that the information given to the user is clear, accessible, and understandable.

6. Collection of Personal Information

Boulangerie Humanité collects from each user, verbally or in writing, the information necessary to:

• Communicate with users and identify their needs;
• Provide services, products, and information;
• Allow partners and suppliers to offer relevant services;
• Manage the relationship with the user;
• Meet its legal obligations.

The organization also uses the following tools that may collect data automatically:

• Google Analytics — Audience measurement and visitor behavior analysis on the website. See Google’s Privacy Policy and data privacy in Google Analytics.
• WordPress — Website content and form management.

These tools may host or process data outside Quebec. In such cases, a privacy impact assessment is conducted beforehand, as required by Law 25.

Contact forms on the website include a reference to this policy to inform users at the time of collection, in accordance with the transparency obligations of Law 25.

7. Disclosure of Personal Information

Boulangerie Humanité maintains the confidentiality of personal information and only shares it with third parties in accordance with this policy and the law.

It may occasionally share a nominative list of users (name, address, email, phone) with partners, provided that:

• A contract exists with the partner specifying the exclusive use of the data;
• A simple, free opt-out option has been offered to the user;
• It does not infringe on privacy.

Users may refuse to have their information included on these lists by writing to: [email protected]

No data is transmitted outside Quebec without a risk assessment and a guarantee of equivalent protection.

8. Accuracy and Retention of Personal Information

Boulangerie Humanité ensures that the personal information in its possession is accurate, up to date, and complete. If errors are identified, the organization will contact the user to correct the information and notify affected third parties if applicable.

Personal information is retained only for as long as necessary for the purposes for which it was collected. Once that period has elapsed, the data is securely destroyed, deleted, or anonymized.

9. Protection of Personal Information

Boulangerie Humanité applies administrative, technological, and physical security measures to protect information against loss, theft, unauthorized access, or disclosure. These include:

• IT security measures;
• Restricted access systems;
• Confidentiality agreements with employees and suppliers.

Contractual agreements with technology providers specify security and confidentiality obligations.

10. Access and Rectification

Any user may:

• Request access to their personal information;
• Request correction of inaccurate or outdated information;
• Request deletion of unnecessary data.

Requests must be sent in writing to the person responsible (see section 11). Boulangerie Humanité will respond within 30 days. In the event of a refusal, the reasons will be communicated in writing along with available recourses.

11. Person Responsible for the Protection of Personal Information

The person responsible for the protection of personal information is:

• Name: Ana Claudia Gamboa
• Title: Marketing & Export Director
• Email: [email protected]

12. Policy Updates

Boulangerie Humanité reserves the right to modify this policy at any time. In the event of a significant change, users will be notified by email or through a notice on the website. When required, new consent will be requested.

13. Effective Date

This policy has been in effect since April 1, 2026.

14. Privacy Impact Assessment (PIA)

Before any project involving personal information, Boulangerie Humanité conducts a privacy impact assessment (PIA), particularly in the following cases:

• Implementation or modification of an IT or cloud-based system;
• Transmission of data outside Quebec;
• Use of third-party platforms (Google Analytics, CMS, marketing tools);
• Projects likely to have a significant impact on privacy.

The conclusions of this assessment allow for the adoption of adequate security and compliance measures before the project is implemented.