Personal information governance

To be validated. This text was written to reflect how the platform actually works and the requirements of Law 25. We recommend having it reviewed by a legal advisor before the public launch.

Effective date: October 2, 2026 (updated October 3, 2026)

This policy describes the framework for retaining and destroying personal information, the roles and responsibilities of our staff throughout its life cycle, and the complaint-handling process. It is published in accordance with section 3.2 of the Act respecting the protection of personal information in the private sector. It applies to Solutions Techno-Rédac inc. in operating the Soumets ton projet platform, and to anyone who processes personal information on our behalf.

1. Principles

• Necessity: we only collect the information needed for purposes determined before collection.
• Transparency: we inform people of the purposes, use and disclosure of their information (see the privacy policy).
• Consent: we use and disclose information only for the purposes consented to, except as provided by law.
• Privacy by default: the platform’s settings offer the highest level of privacy by default (for example, clients’ contact information is never public).
• Minimal retention: information is destroyed or anonymized once its purpose has been fulfilled.

2. Roles and responsibilities

Person in charge of the protection of personal information

Anne-Marie Coulombe, President (info@soumetstonprojet.ca) holds this role, which was delegated to her in writing. She ensures compliance with the law and with this policy, in particular by:

• approving the policies and practices governing personal information;
• receiving and handling requests for access, correction, deletion and portability, as well as complaints;
• keeping the register of confidentiality incidents and coordinating the response to incidents;
• taking part in privacy impact assessments (PIAs);
• making sure staff are aware and trained.

Staff and collaborators

• Access only the information needed to perform their duties.
• Keep information confidential, including after their employment or mandate ends.
• Report any actual or suspected confidentiality incident to the person in charge without delay.

Service providers

Service providers that process information on our behalf (hosting, email, payments) are contractually bound to protect it, to use it only for the purposes of their mandate and to notify us of any incident.

3. Information life cycle

Collection

Information is collected directly from the people concerned, through the platform’s forms (posting a project, expressing interest, subscribing, contacting us, newsletter). Each form only requires the necessary fields.

Use and disclosure

Information is used for the purposes described in the privacy policy. A professional’s contact information is only disclosed to the client of the project they express interest in. No information is sold or used for profiling. Message content is encrypted. Soumets ton projet administrators may access it only in exceptional cases, to handle a dispute or a report of abuse, to respond to a request from an authority empowered to require it, or to respond to an access request made under the law. Each access is justified and recorded in a register.

Retention and destruction

Information	Retention period
Rejected or unpublished project	90 days after the decision, then destroyed
Messages exchanged in the messaging system	24 months after the last message, or as soon as the account or project is deleted, then automatically destroyed
Register of administrative access to messages	3 years after the access
Published project (listing and client contact information)	For as long as it is published, then 12 months after it is closed or removed
Expressions of interest	24 months after they are sent
Professional’s account	For the duration of the subscription, then 24 months after the last subscription ends, unless deletion is requested
Invoices and payment history	7 years (tax obligations)
Messages received through the contact form	24 months after the request is handled
Newsletter subscribers	Until they unsubscribe
Technical logs and email logs	90 days
Register of confidentiality incidents	5 years after the incident becomes known

When the period expires, information is securely deleted from the platform and from backups according to their rotation cycle, or irreversibly anonymized for serious and legitimate purposes (for example, overall statistics).

4. Privacy impact assessment (PIA)

A PIA is carried out before any project to acquire, develop or overhaul a system involving personal information (for example, adding a messaging system, a marketing tool or a new service provider), and before any disclosure of information outside Quebec.

5. Confidentiality incidents

Any unauthorized access, use or disclosure of personal information, or any loss of personal information, is a confidentiality incident. When an incident occurs, we:

• promptly take reasonable measures to reduce the risk of harm and prevent it from happening again;
• assess the risk of serious harm;
• if the risk is serious, promptly notify the Commission d’accès à l’information and the people concerned;
• record the incident in our register.

6. Complaint handling

Anyone can file a complaint about the protection of their personal information by writing to info@soumetstonprojet.ca, providing their contact information and the nature of the complaint.

• An acknowledgement of receipt is sent within 5 business days.
• The person in charge reviews the complaint and may contact the person for more details.
• A reasoned written response is sent no later than 30 days after the complaint is received.
• If the person is not satisfied, they may contact the Commission d’accès à l’information du Québec.

7. Access and correction requests

Requests must be sent in writing to info@soumetstonprojet.ca. We verify the requester’s identity and respond within 30 days. Access is free; reasonable fees may be charged for transcription or reproduction, after informing the requester.

8. Training and awareness

People with access to personal information are informed of this policy when they join and receive an annual reminder of best practices.

9. Surveys

If we conduct a user survey, the person in charge first assesses whether the survey is necessary and its ethical aspects.

10. Review

This policy is reviewed at least once a year, or whenever the platform’s activities change significantly.

11. Contact us

Solutions Techno-Rédac inc. — Soumets ton projet
Person in charge of the protection of personal information: Anne-Marie Coulombe, President
Email: info@soumetstonprojet.ca