Subject to legal validation. Proposed retention periods and the privacy officer’s designation require confirmation. This policy is not a compliance certification or evidence that every described measure is already operational.
Scope, purposes and information collected
This policy covers personal information associated with legroupew.com and communications with Groupe W. It addresses Québec’s Act respecting the protection of personal information in the private sector, as amended notably by Law 25, and other applicable legislation, including federal Canadian law where relevant.
The contact form requests your name, organization, email address, optional phone number, selected subject and message. Language and an optional source identifier may accompany the submission. Free-text messages may contain additional information you choose to provide; please limit it to what is necessary.
Information is used to:
- respond to your request and arrange a relevant conversation;
- identify the appropriate service or contact;
- prepare and follow up on a proposal or contractual relationship where discussions progress;
- prevent abuse and protect communications;
- meet applicable legal obligations.
Information is not sold or rented. A contact request does not automatically authorize newsletters, recurring marketing, commercial profiling or AI model training. Only necessary information should be collected. Identifiable professional contacts may be personal information, subject to applicable statutory exclusions.
Processing in a client’s systems or on a client’s behalf requires separate contractual arrangements. This policy does not determine every purpose of a client’s own processing.
Consent and withdrawal
Where required, consent must be clear, free, informed, specific and requested separately for each relevant purpose. Required and optional information and the consequences of refusal must be explained.
You may withdraw consent by emailing Meriem@legroupew.com. Withdrawal applies going forward and does not invalidate lawful previous processing or processing permitted or required without consent. It may prevent a service that necessarily depends on the information; those consequences must be explained without disproportionate collection.
Express consent is sought where sensitivity or applicable law requires it. General consent does not replace necessity assessments, security obligations or transfer requirements.
Service providers, disclosure and transfers outside Québec
Access is restricted to authorized personnel and necessary service providers for hosting, communications or agreed services. Membership in Groupe W’s ecosystem does not automatically grant access to contact submissions.
Where the law permits disclosure to a service provider without separate consent for a mandate or service contract, a written agreement must address the statutory requirements, including confidentiality, restricted use, safeguards, non-retention after the mandate, notification of violations or attempted violations and verification rights. Other disclosures require an appropriate legal basis.
Before communicating personal information outside Québec, or entrusting its collection, use, communication or storage to an organization outside Québec, Groupe W must conduct a privacy impact assessment. Another Canadian province is outside Québec for this purpose. The assessment considers:
- sensitivity;
- purposes and quantity;
- safeguards, including contractual safeguards;
- the destination’s legal framework.
The operation may proceed only where the assessment establishes adequate protection, including with regard to generally recognized privacy principles. A written agreement must reflect the assessment and risk-mitigation measures. Consent, when required, is not a substitute for this assessment.
Actual hosting, backup and administrative-access locations must be verified. Offices in Québec, North York and Rabat do not establish where information is stored. Disclosures required or permitted by law remain limited to what is authorized.
Retention, destruction and anonymization
Information is retained only as long as necessary for identified purposes, subject to legally required preservation. It is then securely destroyed or anonymized for serious and legitimate purposes in accordance with statutory and regulatory requirements. Removing names or pseudonymizing records is not necessarily anonymization. Qualified supervision, re-identification risk analysis, periodic reassessment and the prescribed register are required for regulated anonymization.
Proposed schedule, requiring adoption and implementation:
- contact inquiries without a contractual relationship: 24 months after the last substantive exchange, then destruction;
- contractual files, payment documentation and records needed to protect legal rights: 7 years after the relationship ends or the relevant file closes, subject to document-specific legal requirements;
- confidentiality incident register: at least 5 years after the date or period when Groupe W became aware of the incident, as required by regulation;
- client project data: return or destruction under the contract and the client’s obligations, without a general extension solely for Groupe W’s benefit;
- technical logs and backups: the minimum documented period needed for security and provider purge cycles, to be specified after verification.
The 24-month and 7-year periods are proposed policy choices, not universal Law 25 requirements or verified current automatic deletion settings. Legal obligations or disputes may justify a limited, documented and reviewed hold. Backups must be purged on a defined cycle and not repurposed.
Your rights and requests
Subject to statutory conditions, you may request:
- confirmation that information is held and access to it;
- correction of inaccurate, incomplete or ambiguous information;
- deletion where provided by law, including where collection, disclosure or retention is unauthorized;
- withdrawal of consent and, where legal conditions are met, cessation of dissemination or de-indexing;
- computerized personal information collected from you in a structured, commonly used technological format, for yourself or a person or organization legally authorized to collect it.
Québec portability excludes information created or inferred from your information and is subject to the statutory exception for serious practical difficulties. It is not an unrestricted right to every internal record.
Submit requests in writing to Meriem@legroupew.com. Identity verification must be proportionate.
For access or rectification requests under Québec law, a written response must be provided diligently and no later than 30 days after receipt. Failure to respond is deemed a refusal. A refusal must state its reasons, legal basis and available recourse, including an application to the Commission d’accès à l’information (CAI), generally within 30 days of refusal or expiry of the response period, subject to legal requirements.
Access is free; reasonable transcription, reproduction or transmission charges may apply only as permitted by law and after notice. Deletion rights do not override mandatory preservation obligations.
Security, governance and confidentiality incidents
Safeguards must be reasonable in light of sensitivity, purposes, quantity, distribution and medium. Depending on the processing, measures include access restrictions, appropriate authentication, protected transmissions, authorization management, updates, supplier controls and incident-response procedures. No system can guarantee zero risk.
Governance policies must define responsibilities, complaints handling, retention and destruction, and incident management. Acquiring, developing or overhauling information systems or electronic services involving personal information requires privacy impact assessments where prescribed by law. Publishing this policy is not a substitute for those operational measures.
When Groupe W has reason to believe an incident has occurred, it must take reasonable steps to reduce harm and prevent recurrence. Assessment with the privacy officer considers sensitivity, anticipated consequences and likelihood of harmful use.
Where an incident presents a risk of serious injury, Groupe W must promptly notify the CAI and affected individuals, with prescribed information and subject to statutory exceptions. Notice to an organization able to reduce harm may be made within legal limits. All incidents must be entered in the required register, which is available to the CAI on request and retained for the regulatory period. GDPR’s 72-hour framework does not replace Québec’s prompt-notification obligation.
GDPR and other jurisdictions
GDPR applies only where its territorial criteria are met, including processing in the context of a relevant EU establishment, targeting goods or services at people in the Union or monitoring their behaviour there. Mere accessibility from Europe is insufficient. B2B activity is not a blanket exemption.
Where GDPR applies, processing-specific information must identify the controller, purposes, legal bases, any legitimate interests, recipients, periods, transfers and safeguards, rights, complaints and any required representative or data protection officer.
Depending on the purpose, a basis may be precontractual measures requested by the individual, contract performance where that individual is a party, a legal obligation, an assessed legitimate interest—such as responding to an organization’s representative—or valid consent. These bases are not interchangeable.
Applicable access, rectification, erasure, restriction, objection and portability rights are subject to their respective conditions. Requests must be addressed without undue delay and within one month, with a possible two-month extension for complexity or number after a reasoned notice within the first month. A complaint may be made to the competent supervisory authority.
Reportable GDPR breaches must be notified without undue delay and, where feasible, within 72 hours of awareness. Individuals must be informed without undue delay where high risk exists, unless an exception applies. Transfers outside the European Economic Area require a valid mechanism. Canada’s adequacy status does not cover every Canadian organization or processing operation and does not by itself authorize onward transfers to Morocco.
Cookies and similar technologies
Actual cookies, local storage, logs and tracking technologies must be assessed from the deployed services. Absence of third-party tracking must not be asserted without verification.
Non-essential technologies subject to consent must not be activated before a valid choice where required. Refusal and withdrawal must be as accessible as acceptance. Identification, location and profiling functions must be disclosed and controlled under applicable law. See the Cookie policy for details and the limitations of the currently unverified inventory.
Contact and privacy officer
Official privacy and legal contact:
Meriem Lahbabi — Executive Vice-President
Meriem@legroupew.com
Groupe W, 700-2828 Boul Laurier, Québec, QC G1V 0B9, Canada.
Proposed privacy officer: Meriem Lahbabi, subject to a valid written delegation. The person exercising the enterprise’s highest authority remains responsible by default until that delegation occurs. Once confirmed, the officer’s title and contact information must be published as required by law.
Sophie Marin is identified as Chair of the Board and Meriem Lahbabi as Executive Vice-President. Those titles alone do not establish the highest-authority function or a written delegation.
Send rights requests, complaints and incident alerts to the contact above. Complaints must be handled confidentially and without retaliation. Do not attach sensitive records before receiving suitable instructions.