L’IA rédige. L’humain décide.
Legal · EEA and United Kingdom
Orée Conseil is established in Québec and its clients are Québec organizations, so European data protection law applies to it only in defined circumstances. This notice sets out what those circumstances are, and what the practice undertakes when they arise. It supplements the privacy policy and, for a person in the European Economic Area or the United Kingdom, prevails over it wherever the two differ.
In brief
This summary is written to be read, not to be litigated. Where it differs from the numbered text, the numbered text governs.
Orée Conseil is established in Montréal, Québec. It has no establishment in the European Economic Area or the United Kingdom, does not direct its services at people in either, prices nothing in euros or pounds, and does not monitor anyone's behaviour anywhere. A website that is readable from Europe is not, on its own, an offering directed at Europe.
European law reaches a controller outside the Union where the processing relates to offering goods or services to people in the Union, or to monitoring their behaviour there. In practice, the situations in which this notice becomes operative are narrow and identifiable:
This notice supplements the privacy policy; it does not replace it. Everything in the privacy policy about what is collected, why, who sees it, and how long it is kept applies here too and is not repeated. Where a provision of this notice and a provision of the privacy policy cannot both be satisfied, this notice governs for a person in the EEA or the United Kingdom.
The practice has not designated a representative in the Union. Article 27 does not require one where the processing is occasional, does not include large-scale processing of special categories of data or of data relating to criminal convictions, and is unlikely to result in a risk to the rights and freedoms of individuals. Correspondence with a handful of people who write in, holding a name, an address and a message, meets that description on every limb.
The practice keeps that assessment under review, and will designate a representative in writing, and name them here, if the position changes.
No data protection officer is required under Article 37: the practice is not a public authority, its core activities do not consist of regular and systematic monitoring of individuals on a large scale, and they do not consist of large-scale processing of special categories of data. The founder is nevertheless the single point of contact for every question under this notice, in the same way she is the person in charge under the Québec Act.
For the website, the enquiry form and the correspondence that follows, the practice decides why and how the data is processed. It is the controller, and this notice is its notice.
Inside a mandate, the personal data of a client's employees, clients or suppliers is processed on the client's documented instructions and for the client's purposes. The practice is a processor, the client is the controller, and the arrangement is governed by the data protection terms of the engagement letter rather than by this notice. Those terms include the undertakings Article 28(3) requires: processing only on instructions, confidentiality, security, no sub-processor without authorization, assistance with data subject requests and with breach notification, and deletion or return at the end of the mandate.
Client material is never used to train, fine-tune or improve any artificial intelligence system, whether the practice's own or a third party's, and is never processed by a tool whose terms would permit that use.
Article 6 requires a lawful basis for every purpose, named in advance rather than chosen afterwards. The practice relies on the following, and on nothing else:
| Purpose | Data | Legal basis |
|---|---|---|
| Answering your enquiry and corresponding about it | Name, email, organization, telephone, message | Article 6(1)(b) — steps taken at your request before entering into a contract; alternatively Article 6(1)(f) |
| Assessing fit, preparing a scope and a fee estimate | The same, plus what the conversation adds | Article 6(1)(b) — pre-contractual steps |
| Performing and administering a mandate | Contact details of the people involved, correspondence, invoicing | Article 6(1)(b) — performance of the contract |
| Keeping accounting and tax records | Invoices and supporting documents | Article 6(1)(c) — legal obligation under Canadian and Québec law |
| Keeping the site available and identifying abuse | Server logs | Article 6(1)(f) — legitimate interests, described in section 6 |
| Establishing, exercising or defending a legal claim | Whatever the claim makes relevant | Article 6(1)(f) — legitimate interests; Article 9(2)(f) where special categories were unavoidably involved |
Where the practice ever relies on consent — it does not today, having no newsletter and no tracking — that consent will be sought separately, will be as easy to refuse as to give, and will be withdrawable at any time under Article 7(3) without affecting the lawfulness of what was done before.
Where Article 6(1)(f) is the basis, the balancing exercise it requires has been carried out and is summarized here so that you can test it rather than take it on faith.
| The interest | Why it is necessary | Why it does not override you |
|---|---|---|
| Keeping the site available and free of abuse | A server that cannot distinguish a reader from an attack cannot stay online. | The data is a transient log line, consulted only when something goes wrong, kept briefly, and never used to build a profile. |
| Answering an enquiry from someone who is not yet a client | A person who writes in expects an answer; not answering would be the surprising outcome. | The processing is exactly what you asked for when you pressed send, the data is minimal, and you can have it deleted at any time. |
| Being able to defend a claim | A professional practice cannot answer an allegation about work it no longer holds any record of. | Records are kept on the published schedule, not indefinitely, and are consulted only if a claim actually arises. |
You may object to any of these under Article 21, and the practice will stop unless it can show compelling legitimate grounds that override your interests, rights and freedoms, or that the processing is needed for a legal claim.
The practice does not seek, and the site does not collect, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, data concerning health, or data concerning a person's sex life or sexual orientation. It does not process personal data relating to criminal convictions and offences.
Please do not include such data in an enquiry. If it arrives unsolicited, it is deleted unless it is necessary to keep it for a legal claim, and you will be told which.
The recipients are those listed in the privacy policy: the hosting provider that serves the site, the relay that carries the enquiry form to the practice's inbox, and the provider of that inbox. Each is a processor, bound by its contract to process only on instructions. There are no other recipients, and no data is sold, shared for advertising, or made available to a broker.
The European Commission decided on 20 December 2001, in Decision 2002/2/EC, that Canada ensures an adequate level of protection for personal data transferred to recipients subject to PIPEDA. That decision remains in force and is the basis on which personal data reaches the practice where PIPEDA governs its handling of that data — which it does for personal information the practice collects, uses or discloses across a provincial or national border in the course of commercial activity. The United Kingdom maintains the equivalent finding for transfers from the United Kingdom.
The decision is partial rather than general: it attaches to the recipient's status, not to the country as a whole. Where a transfer to the practice would fall outside it, the practice will put in place the standard contractual clauses adopted by the Commission in Implementing Decision (EU) 2021/914, with the United Kingdom's international data transfer addendum where the transfer originates there, before the transfer takes place.
Some of those providers are established in the United States or serve the site from infrastructure there. For those transfers the practice relies on the standard contractual clauses incorporated in the provider's data processing agreement and, where the provider is certified under the EU–US Data Privacy Framework, on that certification. In every case the practice has assessed the transfer: what data is involved, how sensitive it is, how long it sits there, what technical measures protect it, and what access the law of the destination permits. That assessment is documented and is available to a supervisory authority on request.
The practice states plainly what the assessment cannot do: no contractual clause prevents a lawful demand by a public authority in the country where a provider is established. What it can do is keep the exposure small — a name, a work email address and a message, held briefly — and that is the measure the practice actually relies on.
You may request a copy of the safeguards applied to a transfer of your personal data, under Article 46(1), by writing to the address in section 15. Commercially confidential terms unrelated to data protection may be redacted; nothing bearing on the protection of your data will be.
Retention periods are set out in section 8 of the privacy policy and apply without change here: an enquiry that leads nowhere is destroyed within twelve months, a client file is kept for seven years from the end of the mandate, accounting records for six years from the end of the taxation year, and server logs for the short period the host retains them. Data is kept in a form permitting identification no longer than is necessary for the purposes it was processed for.
Write to the address in section 15, saying which right you are exercising. No particular form of words is needed, and you need not cite an article.
The practice answers without undue delay and in any event within one month of receiving the request. That period may be extended by two further months where the request is complex or where several requests have been made, in which case you will be told of the extension and the reason for it within the first month.
Nothing. A reasonable fee may be charged, or the request refused, only where it is manifestly unfounded or excessive, in particular because it is repetitive — and the practice bears the burden of showing that it is.
Where there is reasonable doubt about who is making the request, the practice may ask for information necessary to confirm your identity, under Article 12(6). It will ask for the least that will do, and will destroy anything provided for that purpose once the request is closed.
You will be told, within one month, why, and told of your right to complain to a supervisory authority and to seek a judicial remedy.
You may lodge a complaint with the supervisory authority of the Member State of your habitual residence, of your place of work, or of the place of the alleged infringement, under Article 77. You do not have to complain to the practice first, although you are welcome to.
The Québec and Canadian routes remain open in parallel and are set out in section 12 of the privacy policy: the Commission d'accès à l'information du Québec, and the Office of the Privacy Commissioner of Canada.
Articles 79 and 82 preserve your right to an effective judicial remedy and to compensation for damage suffered as a result of an infringement. Nothing in this notice or in the terms of use limits that right.
The technical and organizational measures are those described in section 9 of the privacy policy, applied with regard to the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing, as Article 32 requires. The practice's principal measure is structural: it collects very little, and holds it briefly.
A personal data breach is notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours of the practice becoming aware of it, unless it is unlikely to result in a risk to the rights and freedoms of individuals. Where it is likely to result in a high risk, the people concerned are told without undue delay, in clear and plain language, and told what happened and what to do about it.
This notice carries a version number and a date of coming into force at the head of the page. It is reviewed with the privacy policy, at least annually, and whenever a change in the practice's processing or in the transfer mechanisms it relies on requires it. Superseded versions are kept and provided on request.
The other documents
Questions about any of this
One person answers all four documents, in French or in English, within one business day.
aminata.diabate@oreeconseil.ca