Privacy policy

This privacy policy describes how Oriana Solutions Inc., publisher of the Consorm platform, collects, uses, discloses, retains and protects personal information in connection with its website www.consorm.ca, its application app.consorm.com and its service (together, the "Service").

It applies to visitors of the website, to people who write to us through a form, to customers and users of the Service, and to the information of our customers' website visitors that we process on their behalf. It is written in plain language, as Law 25 requires, and must be read together with our terms and conditions.

Personal information is any information about a natural person that allows that person to be identified, directly or indirectly.

The company responsible for the personal information covered by this policy is Oriana Solutions Inc., a corporation constituted under the laws of Quebec, with its head office in Montreal, Quebec, Canada.

In accordance with Law 25, the person exercising the highest authority within Oriana Solutions Inc. acts as the person in charge of the protection of personal information (privacy officer). That person ensures compliance with this policy and the law, handles access and rectification requests and receives complaints. Their email address is allo@consorm.ca: write to them with "Protection of personal information" in the subject line. This title and contact information are published here in accordance with section 3.1 of the Act respecting the protection of personal information in the private sector.

Depending on the context, we act in one of the following two capacities:

As controller

for the information of visitors of our website, of people who write to us, and of customers and users who create an account or subscribe to a plan. We determine the purposes and means of this processing, described in this policy.

As processor

for the information of our customers' website visitors (consent data), which we process solely on behalf of and under the written instructions of the customer concerned, under a contract that meets section 18.3 of the Act respecting the protection of personal information in the private sector. For this information, the customer is the controller and its own privacy policy applies.

Information you send us through a form

When you fill in a contact, demo request or agency partnership form, we collect the information you enter: first name, last name, email address, name of your organization or agency, website, province, size and industry of the organization, budget, availability and the content of your message. This information is delivered to us by email, through our provider Resend, and is used only to answer your request.

When you request a compliance analysis with our scanner, we collect the address of the site to analyze and your email address, which is used to send you the result. The form is protected by Cloudflare Turnstile, which checks that a person, not a bot, is submitting the request.

Account and billing information

When you create an account or subscribe to a plan, we collect your name, your email address, the profile picture associated with your Google sign-in, the name of your organization and the billing information required. Payment information (card number) is processed directly by our payment provider Stripe and is never stored on our servers.

Usage and technical information

When you browse our website or use the application, we collect technical information such as access logs, IP address, browser and device type, language, pages viewed, session identifiers, the configurations you create and diagnostic data. It is used for security, troubleshooting and improvement of the Service. Traffic statistics are described in the cookies section.

Consent data processed on behalf of our customers

When a visitor interacts with a customer's consent banner, the Service records the choice made. To minimize data, this record relies on a pseudonymous identifier and does not contain the visitor's name. It may include:

• a pseudonymous consent identifier and the nature of the decision (acceptance, refusal, withdrawal, saved preferences);
• the cookie categories concerned and the version of the policy shown;
• context data such as language, country and region (province or state), and the Global Privacy Control signal;
• a timestamp, a browser fingerprint (user agent) and a one-way hash of the IP address, the plain IP address not being retained.

We do not collect any sensitive information (health, origin, opinions, biometric data) and we never ask for a password through a form or by email.

We collect personal information only for serious and legitimate purposes, determined before collection, and we use only the information necessary for those purposes:

• answer your requests sent through a form, organize a demo or evaluate a partnership;
• produce and send you the result of a compliance analysis;
• provide, operate, maintain and secure the Service and manage your account;
• process payments, billing and subscription administration;
• send you communications related to the Service (security notices, important changes, billing);
• measure website traffic and understand how it is used, with your consent where the law requires it;
• prevent fraud, abuse and security incidents, and enforce our terms;
• comply with our legal, tax and regulatory obligations.

Where your consent is required, it is requested in a manifest, free and informed manner, for specific purposes, and you may withdraw it at any time. We do not sell or rent your personal information, we do not use it for prospecting without your consent, and we do not disclose it to any third party for that party's own purposes.

Any use of your information for a new purpose not covered by this policy will be subject to new consent, except in the cases permitted by law.

Our principle

We apply to our own website what our product requires of our customers' websites. Only cookies strictly necessary for the website to work are set without your agreement. Any technology that can identify you, locate you or profile you is off by default and is only activated after your explicit consent, in accordance with section 8.1 of the Act respecting the protection of personal information in the private sector.

Consent is collected by our own Consorm banner, shown on your first visit. Refusing is as easy as accepting, and you can choose category by category. Your choice is kept for 365 days in a first-party cookie, after which it is requested again.

Categories and cookies used on www.consorm.ca

Google Tag Manager, which loads the banner and Google Analytics, sets no cookie by itself. Google Analytics cookies are only created after you consent to the "Analytics" category; until you consent, Google only receives cookieless signals without identifiers, in accordance with Consent Mode v2. If this list changes, this policy and the banner are updated at the same time.

Changing or withdrawing your consent

You can review your choices at any time by clicking "Cookie settings" at the bottom of every page of the website, which reopens the preference center. Withdrawing your consent takes effect immediately for future cookies; cookies already present can be deleted from your browser settings. You can also configure your browser to block or delete cookies, although this may prevent some features of the website from working.

On the app.consorm.com application

The application uses only the cookies strictly necessary for it to work, in particular to maintain your authentication session and your preferences (such as language). We use no analytics or advertising cookies there.

We do not sell or rent your personal information. We may disclose it to service providers (subcontractors) who act on our behalf and under our instructions, only to the extent necessary to provide the Service, and who are bound by contract to confidentiality, security and limited-use obligations. Our main subcontractors are:

We may also disclose information where the law requires it, to respond to a request from a competent authority, to protect our rights or the safety of others, or as part of a business transaction such as a merger or acquisition, in which case the information remains protected by this policy and the persons concerned are informed where the law so provides.

We favor hosting your information in Canada. However, some of our subcontractors, named above, process information outside Quebec, in particular in the United States. Before making such a disclosure, we carry out a privacy impact assessment, in accordance with section 17 of the Act respecting the protection of personal information in the private sector, which takes into account the sensitivity of the information, the purposes of its use, the protection measures and the legal framework of the destination country. These transfers are governed by contractual commitments ensuring adequate protection.

We keep personal information only for as long as necessary for the purposes for which it was collected, then securely destroy or anonymize it. Our retention periods are as follows:

Consent data is kept on behalf of the customer concerned, under its instructions and for as long as needed to prove consent. When erasure is requested, we delete the record and keep only a proof of erasure based on a one-way hash, without retaining the erased identifier.

In accordance with section 3.2 of the Act respecting the protection of personal information in the private sector, Oriana Solutions Inc. has established policies and practices governing personal information, approved by the person in charge of the protection of personal information. Their main points are:

Roles and responsibilities

the person in charge of the protection of personal information oversees the application of these policies; every team member with access to personal information is bound by confidentiality and accesses it only to the extent required by their duties (least privilege).

Inventory and minimization

we keep an inventory of the personal information we hold, its purposes, its location and the subcontractors with access to it; we collect only what is necessary and review this inventory at least once a year.

Privacy impact assessments

any project to acquire, develop or overhaul a system or service involving personal information, and any disclosure outside Quebec, is subject to a privacy impact assessment proportionate to the sensitivity of the information.

Privacy by design and by default

our products are designed to offer the highest level of privacy by default, without any action by the person concerned (pseudonymization, hashing, non-necessary cookies off by default).

Retention and destruction

we apply the retention schedule described in this policy and securely destroy or anonymize information once the purposes are fulfilled.

Training and awareness

team members receive privacy training when they join, then a yearly refresher.

Subcontractors

every subcontractor with access to personal information is bound by a written contract covering protection measures, use limited to the agreed purposes, notice in case of an incident and destruction at the end of the engagement.

Handling of requests and complaints

access, rectification and consent withdrawal requests, as well as complaints, are logged and handled according to the process described in the "How to exercise your rights" and "Contact details and complaints" sections.

Incident register

every confidentiality incident is recorded in a register kept for at least five years, with a description of the incident, the information concerned, the persons affected, the measures taken and the notices sent.

Review

these policies and practices are reviewed at least once a year and whenever the Service or the law changes significantly.

We take reasonable technical and organizational security measures, proportionate to the sensitivity of the information, to protect it against loss, unauthorized access, disclosure, copying, use or modification. These measures include encryption of data in transit (HTTPS) and at rest, role-based access control, user authentication, encryption of sensitive tokens, access logging and data minimization.

By design, the Service applies strict minimization of visitor information: the IP address is kept as a one-way hash rather than in plain text, visitor requests rely on a hash of the email address, and erasure leaves only a proof devoid of any identifier. No system can guarantee absolute security, however.

We make no decision based exclusively on automated processing that would produce legal effects or significantly affect you. The compliance scanner automatically analyzes a website, not a person. We do no profiling for targeted advertising. Traffic statistics are used only for aggregate analysis of how the website is used.

Subject to the conditions and exceptions provided by law, you have the following rights regarding your personal information:

• the right to be informed of the collection, the purposes, the means, your rights and disclosures outside Quebec;
• the right to access your information and obtain a copy;
• the right to have inaccurate, incomplete or ambiguous information rectified;
• the right to withdraw your consent at any time, including for cookies, and to object to processing where applicable;
• the right to deletion of your information or to the cessation of its dissemination, and the right to de-indexing, in the cases provided by law;
• the right to portability, that is, to receive the computerized information you provided to us in a structured, commonly used technological format;
• the right to be informed of, and to submit observations about, a decision based exclusively on automated processing;
• the right to file a complaint with us and with the Commission d'accès à l'information.

To exercise your rights, write to our person in charge of the protection of personal information at allo@consorm.ca. We may need to verify your identity before acting on your request. We answer in writing, with diligence and no later than 30 days after receiving it, free of charge. If we refuse, we give you the reasons and inform you of your recourses.

If you are a visitor of one of our customers' websites and wish to exercise your rights regarding your consent data, you must send your request to the operator of the website concerned, who is the controller. As processor, we assist that customer in acting on your request.

The Service is intended for organizations and professionals and is not intended for minors. We do not knowingly collect personal information from persons under 14 without the consent of the person having parental authority. If you believe such information has been sent to us, please let us know so we can delete it.

A confidentiality incident is any access, use or disclosure of personal information not authorized by law, its loss, or any other breach of its protection. In the event of an incident, we take reasonable measures to reduce its consequences and prevent a recurrence, we record it in our incident register and, when it presents a risk of serious injury, we promptly notify the persons concerned and the Commission d'accès à l'information, in accordance with Law 25.

Reporting an incident or a vulnerability

If you notice or suspect an incident involving personal information (an email received in error, unauthorized access, a data leak, a security flaw on our website or application), report it without delay to our person in charge of the protection of personal information at allo@consorm.ca, with "Confidentiality incident" in the subject line. Describe what you observed, the date, the information or systems concerned and, if possible, how to reproduce the problem. Do not exploit the flaw and do not keep any information obtained.

What we do next

• we acknowledge receipt of your report within two business days;
• we contain the incident and assess its severity, in particular the sensitivity of the information, the anticipated consequences and the likelihood that it will be used for injurious purposes;
• we record the incident in our register and notify the customers concerned when data processed on their behalf is involved, so they can meet their own obligations;
• when the incident presents a risk of serious injury, we notify the Commission d'accès à l'information and each person concerned, describing the incident, the information involved, the measures taken and the ways to protect themselves;
• we keep you informed of the conclusion of our analysis.

We may amend this policy to reflect changes to the Service, to our subcontractors or to our legal obligations. The version in force is the one published on this page, with its update date. In the event of a significant change, in particular a new use of your information or a new non-necessary cookie, we inform you through a notice on the website or by email and request your consent again where the law requires it.

For any question, concern or complaint about this policy or the processing of your personal information, contact our person in charge at allo@consorm.ca. We acknowledge receipt of your complaint, examine it with diligence and send you a written, reasoned answer.

If you believe your request has not been handled satisfactorily, you may file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca). If you live elsewhere in Canada, you may contact the Office of the Privacy Commissioner of Canada; in the European Union, the supervisory authority of your country.