L’IA rédige. L’humain décide.
Legal · Protection of personal information
Orée Conseil advises Québec organizations on obligations it holds itself. This policy is published under section 8.2 of the Act respecting the protection of personal information in the private sector, and it states what the practice collects, why, who else sees it, where it is held, how long it is kept, and what you can require of us.
In brief
This summary is written to be read, not to be litigated. Where it differs from the numbered text, the numbered text governs.
This policy governs the personal information that Orée Conseil collects, holds, uses and communicates through the website at oreeconseil.ca, through the enquiry form on that website, and through the correspondence that follows an enquiry. It applies to every visitor, whether or not that visitor ever becomes a client.
It does not govern personal information the practice processes inside a mandate — the files, records and systems of a client organization examined during a diagnostic. That information belongs to the client, the practice handles it as a service provider on the client's written instructions, and the terms that apply to it are set out in the engagement letter and in the protection-of-personal-information schedule attached to it, not here.
It does not govern any third-party website you reach from a link on this one. Those sites keep their own policies, and this practice has no control over them.
Orée Conseil is an advisory practice operated by Aminata Diabaté, based in Montréal and the Eastern Townships, Québec, Canada. It is the enterprise responsible for the personal information described in this policy — the controller, in European vocabulary; the person carrying on an enterprise, in the vocabulary of the Québec Act.
Section 3.1 of the Québec Act places responsibility for the protection of personal information on the person exercising the highest authority within the enterprise, and allows that person to delegate it in writing. In a practice of one, that person is the founder, and she has not delegated it. She is the person to write to for any question, request or complaint under this policy.
The following terms carry the meaning given here throughout this policy. Where a term is defined by statute, the statutory meaning governs and the wording below is a plain-language rendering of it, not a substitute for it.
The enquiry form is the only place on this website where personal information is collected. Two fields are required, because a reply is impossible without them. The rest are optional, and a message sent without them is answered in exactly the same way.
| Field | Required | Why it is asked for |
|---|---|---|
| Name | Yes | To address the reply, and to know who is writing. |
| Email address | Yes | The address the reply is sent to. Nothing else is done with it. |
| Organization | No | To understand the sector, and the obligations that come with it, before the first call. |
| Telephone | No | Only if you would rather be called than written to. |
| Message | Yes | What you want to discuss. Please keep it general — see clause 4.1 of the terms of use. |
The form also carries one field that people never see and never fill in. Anything that fills it is automated, and the submission is discarded. It collects nothing about you.
If an enquiry becomes a conversation, the practice holds what that conversation contains: emails, notes of a call, a proposed scope, and the contact details of the people on your side who take part in it. That correspondence is held for the purposes set out in section 4 and for no others.
The website is served by a hosting provider whose servers keep short-lived technical logs, as every web server does. A log line records the requesting IP address, the date and time, the page requested, the HTTP status and the browser's user-agent string. Those logs exist to deliver pages, keep the site available and identify abuse. They are not used to build a profile, they are not combined with anything you send through the form, and the practice does not consult them in the ordinary course.
This is not a list of things the practice promises to stop doing. It is a list of things this website has never done, verifiable by anyone who opens the developer tools in their browser and watches what the page loads:
Because nothing is tracked, there is no tracking to consent to, no preference centre to configure, and no banner standing between you and the page. That is a design decision. The cookie policy accounts for the single line of browser storage that remains.
If your message names a colleague, a client or anyone else, that person's information reaches the practice too. Please name people only where it is necessary, and do not include personal information you are not entitled to share. Information about third parties received this way is held under the same rules as the rest, and destroyed on the same schedule.
Personal information collected through this website is used for the following purposes and no others:
Personal information is not used for a purpose other than the one it was collected for unless you consent to the new purpose, or a law authorizes the use without consent. In practice this means an enquiry is not turned into a marketing contact, and a mandate is not turned into a case study naming you, without you agreeing to it first.
No decision affecting you is made exclusively by automated processing of your personal information. Every reply, every scope and every recommendation is written and signed by a person. This is the practice's own standard applied to itself — its refrain is that AI drafts and the human decides — and it means the notice obligation in section 12.1 of the Québec Act has nothing here to attach to.
Sending the enquiry form is your consent to the practice using what you sent in order to answer you. That consent is requested for a specific purpose, in clear terms, at the moment of collection, and it is given by an act you take deliberately — which is what section 14 of the Québec Act requires for consent to be valid.
Where consent is not the basis, the basis is named: information necessary for the conclusion or performance of a contract with you, information the practice is required by law to keep, and information necessary to establish or defend a legal claim.
You may withdraw your consent at any time by writing to the address in section 12. Withdrawal takes effect for the future: it stops the practice using your information from that point on, but it does not undo what was lawfully done before, and it does not erase records the practice is legally required to keep. If withdrawal makes it impossible to continue a conversation or a mandate, you will be told so plainly rather than left to guess.
One person. Orée Conseil is a single-practitioner practice, and the founder is the only person who reads what arrives through the form. Where a mandate requires a collaborator, that collaborator is bound in writing to confidentiality before receiving anything, and receives only what the work requires.
The website runs on infrastructure the practice does not own. Each provider below processes personal information only in order to deliver the service it is engaged for, under its own contractual undertakings, and none of them is authorized to use it for its own purposes.
| Provider | What it does | What it touches | Where |
|---|---|---|---|
| Vercel Inc. | Hosts and serves the website. | Technical server logs, and the enquiry as it passes through the site's own endpoint. Nothing is stored on the site. | United States, and its global edge network |
| Web3Forms | Relays the enquiry form to the practice's inbox. | The contents of the form: name, email, organization, telephone, message. | Outside Québec |
| Email provider | Delivers, stores and organizes the correspondence that follows. | The correspondence itself, and anything attached to it. | Outside Québec |
The access key that authorizes the relay is held on the server and never reaches your browser, so the form cannot be replayed against the practice's account from anywhere else.
The practice does not sell, rent, trade or otherwise make personal information available to anyone for consideration, and does not disclose it to advertisers, data brokers, list vendors or lead-generation services. There is no exception to this clause.
Personal information may be communicated without your consent where a law, a subpoena, a warrant, a court order or a lawful demand from a body with jurisdiction requires it. Where that happens, the practice discloses only what the demand actually reaches, and notifies you unless it is legally forbidden from doing so or is contesting the demand.
If the practice or a substantial part of its assets were transferred, personal information could be communicated to the acquirer as part of the transaction, under the conditions set by sections 18.4 and 18.5 of the Québec Act — including an agreement restricting use of the information to the completion of the transaction, and notice to you if the transaction closes and your information continues to be held.
Before communicating personal information outside Québec, an enterprise must conduct a privacy impact assessment and satisfy itself that the information will receive adequate protection, in particular in light of generally recognized principles regarding the protection of personal information. That assessment has been conducted for the providers named in clause 6.2, and it is documented.
You are not obliged to use the form. Writing directly to the address in section 12, or asking for a telephone call, avoids the relay entirely. Say so in a first line and the conversation continues by whatever means you prefer.
Section 23 of the Québec Act requires personal information to be destroyed or anonymized once the purpose it was collected for has been achieved. The practice keeps to the periods below, which are the shortest defensible in light of the limitation and record-keeping rules that apply to it.
| What | How long | Why that period |
|---|---|---|
| An enquiry that leads nowhere | 12 months from the last exchange | Long enough to recognize a returning correspondent and answer a follow-up; short enough that nothing lingers without a reason. |
| An enquiry that becomes a mandate | Merged into the client file below | It becomes part of the record of the engagement. |
| Client files and mandate correspondence | 7 years from the end of the mandate | The three-year extinctive prescription of article 2925 of the Civil Code of Québec, with a margin for a claim that arises late and for the professional record of the work. |
| Invoices, ledgers and supporting documents | 6 years from the end of the taxation year they relate to | The retention period imposed by federal and Québec tax legislation. |
| Server logs | Short term, on the host's rolling schedule | They exist to serve pages and to spot abuse, and are overwritten in the ordinary operation of the host. |
| The register of confidentiality incidents | 5 years from the date of the entry | The period fixed by the regulation made under the Québec Act. |
At the end of the applicable period the information is destroyed, or anonymized according to generally accepted best practices and for a serious and legitimate purpose, so that it no longer allows anyone to be identified, directly or indirectly. Anonymization is the exception here, not the rule: for a practice this size, destruction is simpler and safer.
Information deleted from live systems may persist in a provider's backups for a short further period before it is overwritten in the ordinary rotation. It is not restored, consulted or used during that interval.
The practice takes security measures reasonable in light of the sensitivity of the information, the purpose of its use, its quantity, its distribution and the medium it is on — the standard section 10 of the Québec Act imposes. Concretely:
No transmission over the internet and no method of storage is perfectly secure, and no honest policy claims otherwise. What the practice undertakes is to apply reasonable measures, to keep them under review, and to tell you promptly if something goes wrong — which is the subject of the next section.
The practice keeps a register of confidentiality incidents, as section 3.8 of the Québec Act requires. Every incident is entered, whether or not it turns out to present a risk, with the date, the description, the categories of information concerned, the measures taken and the notifications made. A copy of the register is provided to the Commission on request.
Where an incident presents a risk of serious injury — assessed on the sensitivity of the information, the apprehended consequences of its use, and the likelihood that it will be used for an injurious purpose — the practice notifies the Commission and each person concerned with diligence, and takes the measures reasonably capable of reducing the risk or preventing a recurrence.
A notice to you will say what happened, when, which categories of information were involved, what has been done about it, what you can do to protect yourself, and how to reach the person in charge. It will not be a sentence of reassurance with the facts removed.
Where PIPEDA applies to a communication of your information across a border, its rights of access and correction apply as well, and a complaint may be made to the Office of the Privacy Commissioner of Canada. Rights under the European regime are set out in the separate notice for the EEA and the United Kingdom.
Write to the person in charge of the protection of personal information at the address below. Say which right you are exercising, and give enough detail to find the information — roughly when you wrote, and from which address. A request need not use any particular form of words.
The practice must satisfy itself that you are who you say you are before disclosing or changing anything — releasing your information to someone impersonating you would itself be an incident. Verification is kept proportionate: usually, replying from the address that sent the original message is enough. Any identity document requested for that purpose is used for verification alone and destroyed immediately afterwards.
You will receive a written answer within 30 days of the request. A refusal, in whole or in part, will cite the provision relied on, give the reasons for it, and state the recourse open to you and the time limit for exercising it. Failure to answer within 30 days is treated as a refusal, and opens the same recourse.
Exercising these rights is free. If reproduction or transcription would involve a genuine cost, you will be told the amount before it is incurred and may withdraw the request. For a file of this size, no charge is expected.
You may apply to the Commission d'accès à l'information for a review of the practice's decision, within 30 days of the refusal or of the expiry of the 30-day period. You may also complain to the Commission about how the practice handles personal information generally, at any time, without going through the practice first.
This website is addressed to organizations and to the people who run them. It is not directed at minors, and the practice does not knowingly collect personal information from anyone under 18 through it. Where personal information concerning a minor under 14 would be collected, the consent of the person having parental authority is required, and personal information concerning a minor is in any event collected only where doing so is clearly for the minor's benefit. If you believe a minor has sent information through this site, write to the address in section 12 and it will be destroyed.
The practice does not operate a newsletter, does not send unsolicited commercial email, and does not add correspondents to a mailing list. A reply to your enquiry, and messages about a mandate under way, are not commercial electronic messages in any sense that matters: they are the conversation you started.
Any commercial electronic message the practice sends will comply with Canada's Anti-Spam Legislation: it will be sent only with your express or implied consent, it will identify the practice and give a working contact address, and it will carry an unsubscribe mechanism that remains valid for at least 60 days and is honoured within 10 business days. Consent will be asked for separately, and never bundled into the enquiry form.
This site links to public sources — the Commission d'accès à l'information, the Barreau du Québec, the Chambre des notaires du Québec, the Institut de la statistique du Québec — and to the founder's LinkedIn profile. Following such a link takes you to an organization with its own privacy practices, over which Orée Conseil has no control and for which it accepts no responsibility. No link on this site transmits anything about you to its destination before you click it.
This policy is reviewed at least once a year, and whenever the practice changes how it handles personal information. Each version carries a number and the date it came into force, both shown at the head of this page. A change that materially affects your rights, or the use made of information already collected, will be brought to your attention by a notice on the site and, where a mandate is under way, in writing to you directly. Superseded versions are kept and provided on request.
This policy is drawn up in French and translated into English for convenience. In the event of any discrepancy between the two versions, the French version prevails.
Any question about this policy, any request under section 12, and any complaint goes to the same place, and is answered by the same person.
The other documents
Questions about any of this
One person answers all four documents, in French or in English, within one business day.
aminata.diabate@oreeconseil.ca