This English version is provided for convenience. In case of any discrepancy between the French and English versions, the French version prevails.
Infra Info places fundamental importance on the protection of personal information. It is our business — and this policy applies to our own activities the same requirements we help our clients meet. It explains what personal information we collect, why, how we use it, to whom we disclose it, how long we keep it and what your rights are.
This policy applies to the infrainfo.ca and monitoresults.ca websites (including the mapping platform), as well as to all of our consulting activities (the "Sites and Services"). It is established in accordance with the Act respecting the protection of personal information in the private sector (Quebec, CQLR c. P-39.1), as amended by Law 25.
1. Person in charge of the protection of personal information
| Item | Details |
|---|---|
| Company | Infra Info |
| Person in charge of the protection of personal information (privacy officer) | Carl Boyer, President |
| Email — general inquiries | rp@infrainfo.ca |
| Email — privacy officer | cboyer@infrainfo.ca |
| Phone | 450-543-1516, ext. 222 |
| Address | 13405, rue Claude, Mirabel (Québec) J7J 1A4 |
The privacy officer ensures that this policy is applied, handles requests regarding the rights of the persons concerned and acts as the point of contact for any question about personal information (s. 3.1, P-39.1).
2. Who this policy applies to
Our Sites and Services are intended exclusively for organizations — mainly in the private sector — and their employees and representatives. They are not intended for consumers or for persons under eighteen (18) years of age; we do not knowingly collect personal information from minors.
This policy applies to you if you are:
| Category | Description |
|---|---|
| Visitor | You visit infrainfo.ca or monitoresults.ca. |
| Platform user | You hold a password-protected account on the Monitoresults platform in connection with a mandate (representative or employee of a client). |
| Business contact or prospect | You ask us for information, a quote or a meeting, or you subscribe to our communications. |
| Client representative | You are an executive, employee or point of contact of a client organization in connection with a mandate (mapping, audit, PIA, support, attestation). |
| Training participant | You attend training or an awareness session given by Infra Info. |
| Applicant | You apply for a job or a collaboration with Infra Info. |
This policy does not apply:
- To personal information contained in our clients' records. In the course of our mandates, we may be exposed to personal information (of our clients' customers or employees) contained in the documents, systems or inventories our clients entrust to us. For this information, Infra Info acts as a mandatary or service provider within the meaning of section 18.3 of P-39.1: the person responsible is our client. If you wish to exercise your rights regarding this information, please contact the organization concerned directly (for example, your employer or the business you deal with). Upon receiving such a request, we will direct you to the appropriate person in charge and notify them.
- To the practices of third-party websites to which our Sites may link. We invite you to consult their own privacy policies; we are not responsible for their practices.
- To information anonymized in accordance with the law, which no longer allows you to be identified.
3. Information collected and purposes
We apply the principles of necessity and minimization (s. 5, P-39.1): we collect only the information necessary for purposes determined before collection, and internal access is limited to the actual needs of each role. At the time of collection, we inform you of the elements required by section 8 of P-39.1 (purposes, means of collection, rights of access and rectification, right to withdraw consent, and, where applicable, the possibility of disclosure outside Quebec).
| Context | Information collected | Purposes | Consent |
|---|---|---|---|
| Visiting the Sites | Limited technical data: IP address, browser and operating system type, pages viewed, timestamp (see §9 — Cookies) | Operation, security and diagnostics of the Sites; verification that the connection originates in Canada (by IP address only) | No cookies (see §9) |
| Monitoresults platform account | Name, position, organization, business email, password (hashed), login and usage logs | Create and manage your account, give access to the platform under your organization's mandate, ensure security and traceability | Necessary to perform the service agreement with your organization |
| Request for information or a quote | Name, position, organization, business email and phone number, content of your request | Respond to your request, prepare a service proposal | Expressed through your request (direct collection, stated purpose) |
| Performance of a mandate | Business contact information of points of contact, positions and roles, email exchanges, mandate-related content | Carry out the agreed mandate, provide follow-up, document the deliverables | Necessary to perform the service agreement |
| Billing and accounting | Billing contact information, billing history | Invoice, collect payment, meet our tax obligations | Necessary to perform the agreement and meet legal obligations |
| Training | Name, position, organization, attendance, attestations where applicable | Organize the training, issue attestations, keep proof of them | Necessary to provide the requested service |
| Newsletter and professional communications | Business email, consent and unsubscribe history, opens and clicks where applicable | Inform you of our services, publications or activities | Express or implied under CASL (see §4); unsubscribe at any time |
| Application | Resume, cover letter, professional background, references | Assess the application, communicate with you | Expressed through your application; additional checks with separate consent |
What we do not do:
- we do not collect any precise geolocation data — the IP address is enough to verify where the connection comes from;
- we do not buy contact lists or use third-party data enrichment;
- we do not combine your information with data from social networks or data brokers;
- we do not collect any sensitive information (biometrics, health, personal finances) in the normal course of our activities.
4. Consent and commercial communications
In Quebec, the processing of personal information is based on consent (manifest, free, enlightened and given for specific purposes — s. 14, P-39.1) and on the exceptions provided by law only. Simply using our Sites does not constitute consent: when your consent is required, we ask for it explicitly, through a positive action on your part. Any use for a new, incompatible purpose requires new consent (s. 12, P-39.1).
For commercial electronic messages, we comply with both P-39.1 and Canada's Anti-Spam Legislation (CASL):
- express consent, or implied consent within the limits of CASL (inquiry: 6 months; business relationship: 24 months);
- identification of the sender in every message;
- an unsubscribe mechanism processed within 10 days at most, at no cost and without justification;
- retention of proof of consents and unsubscribes.
You may withdraw your consent at any time (see §11).
5. Disclosure of your information to third parties
We never sell personal information and we do not share it with advertising networks, advertisers or "affiliates". We may disclose it only in the following cases:
| Recipient | Context | Safeguards |
|---|---|---|
| Technology service providers | Hosting of the Sites and the platform, email, cloud office suite, project management, analysis and support tools | Disclosure limited to what is necessary; written agreement in accordance with section 18.3 (purposes, confidentiality, destruction); see §6 for location |
| Legal partner | Legal component of certain mandates, when required and agreed with the client | Solicitor-client privilege; disclosure limited to the mandate |
| Authorities or courts | When required by law (order, warrant, legal obligation) | Verification of the validity of the request; disclosure limited to what is required |
| Commercial transaction | Possible sale or reorganization of the business | Only under the cumulative conditions of section 18.4, P-39.1 (necessity, prior agreement, use limited to the transaction, destruction or return if the transaction does not take place) |
The detailed list of our suppliers that process personal information is kept in our internal supplier register.
6. Disclosure outside Quebec
Some of our technology suppliers host or process data outside Quebec, notably in the United States (for example, cloud services such as the Microsoft suite). Before any disclosure of personal information outside Quebec, we carry out the assessment provided for in section 17 of P-39.1 (sensitivity, purposes, protection measures, legal framework of the receiving jurisdiction), and we proceed only if the assessment, documented in writing, shows adequate protection.
Measures applied: written agreements with suppliers, encryption, named access with multi-factor authentication and, for AI tools, systematic prior pseudonymization of content (see §10). When information is processed outside Quebec, it may be subject to the laws of those jurisdictions and, in certain circumstances, accessible to their authorities.
7. Retention and destruction
We keep personal information only as long as necessary for the purposes for which it was collected, then for the time required by our legal obligations (notably tax obligations — a minimum of 6 years for financial records) or to defend our rights. When that period ends, the information is securely destroyed (compliant shredding for paper; secure erasure meeting recognized standards for digital media; deletion requests confirmed in writing for cloud services) or anonymized in accordance with the law (s. 23, P-39.1).
Indicative retention periods by context (details are kept in our internal retention schedule):
| Category | Indicative period |
|---|---|
| Monitoresults platform accounts | Duration of your organization's mandate + deactivation at the end of the mandate and retention according to the engagement letter |
| Mandate files and deliverables | Duration of the mandate + legal and contractual obligations |
| Billing records | 7 years |
| Proof of consent and unsubscribes (CASL) | 3 years after the last communication |
| Unsuccessful applications | Destroyed immediately |
| Requests to exercise rights | 5 years |
If you make a request for access or rectification, any destruction of the information concerned is suspended until all recourses have been exhausted (s. 36, P-39.1).
8. Security measures
We apply security measures proportionate to the sensitivity of the information, including: multi-factor authentication on systems containing personal information; named access limited to actual needs; encryption of communications and storage; logging; backups; and documented internal governance procedures. Our practices are based on recognized frameworks (ISO 27001/27002, CAN/CIOSC 104). Since no system offers absolute security, we also maintain an incident management protocol (see §12).
9. Cookies and similar technologies
Our Sites use no cookies or similar technologies, and load no scripts, fonts or content from third parties.
- We use no advertising cookies, no behavioural or interest-based advertising, no social media tags and no sharing with advertising networks.
- Should we ever introduce non-essential cookies (for example, for audience measurement), they would only be activated with your prior consent, obtained through a preferences module set up for that purpose, which can be withdrawn at any time, with a validity period not exceeding 13 months.
10. Artificial intelligence
In our activities, we may use artificial intelligence tools for document analysis and the production of deliverables. Our safeguards are strict and documented:
- systematic prior pseudonymization of content before any processing by an AI tool;
- meaningful human oversight: no AI output is used without human validation;
- configuration excluding the use of our content to train models, checked periodically;
- internal logging of uses;
- an internal privacy impact assessment (PIA) covering these uses, kept up to date.
We make no decision based exclusively on automated processing of personal information (s. 12.1, P-39.1).
11. Your rights
You may exercise the following rights by contacting the privacy officer (contact information in §1):
| Right | Description |
|---|---|
| Access | Obtain confirmation that information about you exists and receive a copy of it (s. 27 and following) |
| Rectification | Have inaccurate, incomplete or equivocal information corrected. Platform users can also update their account information directly |
| Withdrawal of consent | Withdraw your consent at any time, subject to legal or contractual requirements |
| Objection to prospecting | Stop all commercial communications — effective immediately (s. 22) |
| Portability | Receive the computerized information you provided to us in a structured, commonly used technological format (s. 27) |
| Cessation of dissemination / de-indexing | Under the conditions set out in section 28.1 |
| Automated decision | Be informed and request a human review — not applicable at Infra Info (see §10) |
| Deceased persons | The persons referred to in section 40.1 may exercise certain rights under the conditions provided |
We respond in writing within 30 days at most. In the event of a full or partial refusal, our response states the reasons, the applicable provision and your recourses, including an application for the examination of a disagreement before the Commission d'accès à l'information du Québec (CAI). Reasonable identity verification may be required before the request is processed.
If your request concerns information processed by Infra Info on behalf of a client (see §2), we will direct you to that client, who is responsible for it.
12. Confidentiality incidents
Any confidentiality incident (unauthorized access, use or disclosure, loss or other breach) is handled under an internal protocol: assessment of the risk of serious injury, immediate measures to reduce the risk, entry in the incident register and, where there is a risk of serious injury, prompt notice to the CAI and to the persons concerned (s. 3.5 to 3.8, P-39.1).
13. Updates to this policy
We may amend this policy to reflect changes in our practices or in the legal framework. The date of the last update appears at the top of the document. In the event of a significant change, a notice will be posted on our Sites at least thirty (30) days before it takes effect.
14. Contact us and governing law
For any question, complaint or request about this policy or your personal information:
General inquiries: rp@infrainfo.ca
Carl Boyer, President and person in charge of the protection of personal information
Infra Info — 13405, rue Claude, Mirabel (Québec) J7J 1A4
cboyer@infrainfo.ca · 450-543-1516, ext. 222
This policy and any dispute arising from it are governed by the laws applicable in Quebec. If you are not satisfied with how your request was handled, you may contact the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca).