1. Personal Information Protection Officer

Kasvu has designated a Personal Information Protection Officer responsible for ensuring compliance with Bill 25 and answering all your questions regarding data protection.

You can contact our officer for any questions about your personal information, to exercise your rights, or to report a concern.

2. Transparency and Consent

We collect only the information necessary to provide our services. Your explicit consent is obtained before any collection, and you can withdraw it at any time without penalty.

Our commitments:

• Clear information about collection purposes before any processing
• Free, informed, and specific consent for each purpose
• Right to withdraw consent at any time via legal@kasvu.ca
• Complete transparency on how your information is used

3. Data Minimization

Kasvu limits the collection of personal information to what is strictly necessary to achieve the stated purposes, in accordance with the minimization principle required by Bill 25.

For our own business operations: We do not collect any sensitive data (health, personal finances, biometric data, political opinions). We collect only your professional contact information, organizational details, and business needs.

When acting as a processor: When we design systems for our professional clients (law firms, accounting firms, clinics), we may process sensitive data belonging to our clients and their end clients. In these situations, we always act according to our clients' documented instructions and with enhanced security measures appropriate to the professional sector involved.

4. Security and Protection

Kasvu implements technical and organizational security measures compliant with industry best practices and adapted to the sensitivity of the information processed.

Technical measures:

• SSL/TLS encryption for all data in transit
• Encryption of data at rest in our databases
• Multi-factor authentication (MFA) required for all access
• Firewalls and intrusion detection systems
• Daily encrypted backups with secure retention

Organizational measures:

• Restricted access to personal information on a least-privilege basis
• Ongoing staff training on privacy protection
• Confidentiality agreements signed by all team members
• Periodic security audits of our systems and processes
• Continuous monitoring and proactive incident detection

5. Privacy Breach Notification

In the event of a privacy breach presenting a risk of serious injury to affected individuals, Kasvu commits to act quickly and transparently.

Our commitments:

• Notify you within 72 hours of becoming aware of the incident
• Inform the Commission d'accès à l'information du Québec within the same timeframe
• Document the incident: nature, circumstances, measures taken, and future preventive measures
• Take all necessary measures to mitigate risks and prevent future incidents
• Communicate clearly recommendations to protect yourself

If the incident concerns data we process on behalf of a professional client, we will also notify that client immediately so they can fulfill their own notification obligations.

6. Retention and Secure Destruction

Personal information is retained only for the duration necessary for the stated purposes or according to applicable legal obligations.

Retention periods:

• Inactive prospects: 3 years after last interaction
• Active clients: Contract duration + 7 years (tax and legal obligations)
• Project data: Contract duration + 7 years (professional compliance)
• Marketing data: Until consent withdrawal or 3 years of inactivity

At the end of these periods, your personal information is securely and irreversibly destroyed (secure software deletion, physical destruction of media).

7. Data Location and International Transfers

Kasvu prioritizes Canadian servers for storing and processing your data to ensure maximum protection under Quebec and Canadian jurisdiction.

Priority Canadian infrastructure:

• n8n (automation): Exclusive hosting on Canadian servers
• Supabase (databases): Exclusive hosting on Canadian servers
• Cloudflare: Canadian infrastructure with global distribution for performance

Regulated international transfers:

Some service providers we use may store or process your data outside Canada. These transfers are made in compliance with Bill 25 requirements and with appropriate contractual safeguards:

• Stripe (payments): United States - Certified compliant with international data protection standards
• Google Workspace (CRM, email): United States/Europe - Standard contractual clauses
• Meta Ads Manager (advertising): United States - Aggregated and anonymized data
• OpenAI and Anthropic (AI): United States - Strict configuration prohibiting training on your data

All these providers are contractually bound to respect protection standards equivalent to those required by Bill 25.

8. Privacy Impact Assessment (PIA)

Kasvu conducts privacy impact assessments for any new project, service, or technology that may present increased risks to your personal information.

Situations triggering a PIA:

• Deployment of new artificial intelligence technologies
• Collection of new categories of personal information
• Substantial modification of our processing practices
• Projects involving sensitive data or vulnerable individuals
• Data transfers to new countries or providers

PIAs allow us to identify potential risks and implement appropriate mitigation measures before any deployment.

9. Your Rights Under Bill 25

You have extensive rights regarding your personal information. Kasvu commits to facilitating the exercise of these rights within prescribed timelines.

Your rights:

Right of access

Obtain a copy of your personal information we hold, including sources, processing purposes, and recipients.

Right of rectification

Correct inaccurate, incomplete, or ambiguous information about you.

Right to erasure

Request deletion of your data when retention is no longer justified or when you withdraw consent.

Right to portability

Receive your personal information in a structured, commonly used format, or request direct transmission to another data controller.

Right to object

Object to processing of your information for commercial prospecting purposes or in certain specific situations.

Right to withdraw consent

Withdraw your consent at any time for consent-based processing, without affecting the lawfulness of previous processing.

Right to file a complaint

File a complaint with the Commission d'accès à l'information du Québec if you believe your rights are not being respected.

10. Our Role as a Data Processor

When Kasvu designs and deploys automation or artificial intelligence systems for our clients (law firms, accounting firms, financial firms, specialized clinics), we act as a data processor or sub-processor.

In this specific context:

Our clients remain data controllers

They retain complete control over their data and that of their own clients. Kasvu makes no autonomous decisions about the use of this data.

Processing according to documented instructions

We process data only according to clear, documented instructions from our clients, recorded in our service contracts.

Data Processing Agreements (DPA)

Formal data processing agreements are systematically signed with each client, defining respective responsibilities, security measures, and processing terms.

Enhanced security measures

Our security practices are adapted to the high requirements of regulated professional sectors (professional secrecy, ethical obligations, heightened confidentiality standards).

Respect for professional secrecy

We understand and respect professional secrecy obligations applicable to lawyers, notaries, accountants, physicians, and other regulated professionals.

Client autonomy

Our clients retain all their rights and obligations as data controllers, including responding to access requests from their own clients.

This distinction ensures that our professional clients retain complete control over their data and can fully meet their own privacy protection and professional secrecy obligations.

11. Governance and Continuous Improvement

Kasvu regularly reviews its personal information protection policies and practices to ensure ongoing compliance with Bill 25 and evolving privacy best practices.

Our governance practices:

• Annual review of our policies and procedures
• Periodic compliance audits by our protection officer
• Continuous legislative and regulatory monitoring
• Mandatory annual team training on privacy
• Security system updates according to evolving threats
• Consultation with legal experts specialized in data protection

Substantial modifications: In case of significant changes to our personal information protection practices, we will inform you by email with reasonable notice.

12. Links to Our Other Policies

For a complete understanding of our data protection practices:

• Complete Privacy Policy: Comprehensive details on collection, use, and protection of your information
• Cookie Policy: Information on our use of tracking technologies