Privacy Statement (CA)

1. Person in Charge of Processing

This privacy policy applies to the website operated by Tout compte fait consultants Inc. (referred to in this policy as "we," "us," or "our"). We are subject to Quebec Law 25 — formally titled An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25) — which governs how we collect, use, disclose, and retain personal information about visitors and customers who interact with our website and services.

As a finance-sector business serving Quebec residents, we take our obligations under Quebec Law 25 seriously. This policy explains in plain language what personal information we collect, why we collect it, who we share it with, and what rights you have over your own information.

2. Personal Information Collected

We collect personal information in the following categories, depending on how you interact with our website:

• Identification and contact information: Your name, email address, mailing address, and phone number — collected when you fill out a contact form, create an account, or subscribe to our newsletter.
• Transaction and financial information: Purchase history, order details, billing information, and payment-related data — collected when you make a purchase through our online store (powered by WooCommerce).
• Device and navigation information: IP address, device identifiers, pages visited, session duration, approximate geographic location, and browsing behavior — collected automatically when you visit our website through analytics and functional tools.
• Advertising identifiers: Advertising IDs and social identifiers — collected by marketing tools when you interact with our site and our advertising campaigns.
• Consent preferences: Your cookie consent choices — recorded by our consent management platform to respect your preferences across visits.
• Newsletter subscription information: Your email address and communication preferences — collected when you opt in to receive our newsletter or marketing communications.

We do not knowingly collect sensitive personal information (such as health data, financial account credentials, or government identification numbers) beyond what is strictly necessary to provide our financial consulting services. If a specific service requires such information, we will notify you separately and obtain your explicit consent at that time.

3. Purposes of Processing

We use your personal information only for the purposes described below. Where we rely on your consent, you may withdraw it at any time (see Section 7).

• Operating and securing the website (Essential — no consent required): We use session data, IP addresses, and device identifiers to keep the site functional, prevent fraud and abuse, and verify that form submissions come from real users. This includes Google reCAPTCHA (Google LLC, United States), which analyzes device and behavioral signals to distinguish human visitors from automated bots. This processing is based on our legitimate interest in maintaining a secure and functional website.
• Managing consent preferences (Essential — no consent required): We use Moelleux (operated by Horizon-Cumulus / 9322-8310 Québec inc., Joliette, Quebec) to record and store your cookie consent choices. A preference cookie named moelleux_{site_key} is placed in your browser for up to 13 months. Consent records and this policy are hosted in Quebec (OVH, Beauharnois). This processing is based on our legal obligation under Quebec Law 25.
• Displaying the website correctly (Functional — consent required): We use Google Fonts (Google LLC, United States) to load typefaces that ensure the site displays as intended. Your IP address is transmitted to Google's servers in the United States when fonts are loaded. This processing is based on your consent.
• Displaying embedded videos (Functional — consent required): We embed videos hosted on YouTube (Google LLC, United States). When you play a video, YouTube may collect your IP address, device identifiers, and viewing behavior. This processing is based on your consent.
• Measuring website audience and performance (Analytics — consent required): We use Google Analytics 4 (Google LLC, United States) to understand how visitors navigate our site — which pages are most visited, how long sessions last, and where visitors come from. This helps us improve our content and user experience. This processing is based on your consent.
• Analyzing e-commerce performance (Analytics — consent required): We use WooCommerce Analytics (Automattic Inc., United States) to track sales performance, conversion rates, and customer purchasing behavior on our online store. This processing is based on your consent.
• Targeted advertising and remarketing (Marketing — consent required): We use the Meta Pixel (Meta Platforms Inc., United States) to measure the effectiveness of our advertising campaigns on Facebook and Instagram, and to show you relevant ads based on your interactions with our site. This involves the collection of device identifiers, IP address, browsing behavior, transaction data, and social identifiers. This processing is based on your consent.
• Sending newsletters and marketing communications (Consent required): If you have subscribed to our newsletter, we use your email address to send you updates, financial tips, and promotional content. We use Microsoft 365 (Microsoft Corporation, United States) to manage and send these communications. You may unsubscribe at any time using the link included in every email. This processing is based on your consent.
• Processing online orders (Legal obligation and contract performance): We collect and use your contact, billing, and transaction information to process your purchases, issue receipts, and fulfill our contractual and legal obligations as a vendor. This processing is based on contract performance and applicable legal obligations.

4. Third Parties and Processors

The following third-party services process personal information on our behalf or in connection with our website. We share only the information each service needs to perform its function.

Our website is hosted by Horizon-Cumulus (Joliette, Quebec), with DNS managed through Cloudflare. Website hosting data resides in Quebec. Our domain name system (DNS) routing passes through Cloudflare's global network, which may involve transient processing outside Quebec.

5. Transfers Outside Quebec

Several of the third-party services we use are operated by companies based in the United States. Under section 17 of Quebec Law 25 (An Act to modernize legislative provisions as regards the protection of personal information), we are required to inform you of these transfers and to ensure that personal information transferred outside Quebec receives a level of protection equivalent to that provided under Quebec law.

The following transfers outside Quebec occur in connection with our website:

• Google LLC (United States): Processes personal information through Google Analytics 4, Google Fonts, YouTube embedded videos, and Google reCAPTCHA. Google participates in the EU-U.S. Data Privacy Framework and applies standard contractual clauses for international data transfers.
• Meta Platforms Inc. (United States): Processes personal information through the Meta Pixel for advertising and conversion tracking. Meta applies standard contractual clauses and participates in recognized cross-border transfer frameworks.
• Automattic Inc. (United States): Processes personal information through WooCommerce Analytics for e-commerce performance measurement. Automattic applies standard contractual clauses for data transfers.
• Microsoft Corporation (United States): Processes email addresses and communication data through Microsoft 365 for newsletter and business email delivery. Microsoft applies standard contractual clauses and participates in the EU-U.S. Data Privacy Framework.

Before transferring personal information to any of these service providers, we conduct or rely on a Privacy Impact Assessment (PIA) — referred to in Quebec Law 25 as an évaluation des facteurs relatifs à la vie privée (EFVP) — to confirm that the receiving jurisdiction or contractual safeguards provide adequate protection. You may request a summary of these assessments by contacting our Person responsible for the protection of personal information (see Section 8).

Our website infrastructure is hosted by Horizon-Cumulus in Quebec (OVH, Beauharnois), and consent records managed by Moelleux remain in Quebec. However, because we use the services listed above, we cannot represent that all personal information collected through our website remains exclusively within Quebec.

6. Retention Period

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The table below outlines our standard retention periods.

When personal information is no longer needed, we destroy it securely or anonymize it so that it can no longer be associated with you.

7. Rights of Data Subjects

Under Quebec Law 25, you have the following rights with respect to your personal information. To exercise any of these rights, please contact our Person responsible for the protection of personal information using the details in Section 8. We will respond within 30 days of receiving your request.

• Right of access: You have the right to ask us whether we hold personal information about you, and to receive a copy of that information in a clear and understandable format.
• Right of rectification: If any personal information we hold about you is inaccurate, incomplete, or ambiguous, you have the right to ask us to correct it. If the information has been shared with third parties, we will notify them of the correction where feasible.
• Right of erasure (right to be forgotten): You may ask us to delete personal information that we collected without legal authority, or that is no longer necessary for the purposes for which it was collected. Certain information may be retained where required by law (for example, financial records subject to tax obligations).
• Right to data portability: You have the right to receive personal information that you provided to us in a structured, commonly used, and machine-readable format, and to request that it be transmitted to another organization where technically feasible.
• Right to withdraw consent: Where we process your personal information based on your consent (for example, for analytics cookies, marketing pixels, or newsletter subscriptions), you may withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. You can manage your cookie preferences at any time through our consent banner, and unsubscribe from our newsletter using the link in any email we send you.

If you believe that we have not respected your rights or have handled your personal information in a manner inconsistent with Quebec Law 25, you have the right to file a complaint with the Quebec Information Access Commission (CAI) at https://www.cai.gouv.qc.ca.

8. Person Responsible for the Protection of Personal Information

In accordance with section 3.1 of Quebec Law 25, Tout compte fait consultants Inc. has designated a Person responsible for the protection of personal information. This person oversees compliance with Quebec Law 25, handles requests related to your rights, and serves as the point of contact for any privacy-related questions or concerns.

We will acknowledge your request promptly and provide a substantive response within 30 days, as required by Quebec Law 25. If your request is complex or involves a large volume of information, we may extend this period by an additional 30 days and will notify you accordingly.

Technical note regarding email: Our business email is operated through Horizon-Cumulus (Joliette, Quebec), with data residency in Quebec. We also use Microsoft 365 (Microsoft Corporation, United States) for certain email communications. Emails sent to the address above may therefore be processed through Microsoft's infrastructure in the United States. If you have concerns about this, you may contact us by phone instead.

DMARC note: Our email authentication policy is currently configured in monitoring mode. To further protect against email spoofing, we are in the process of strengthening our email authentication settings. If you receive a suspicious email claiming to be from us, please contact us directly to verify its authenticity.

9. Effective Date and Versioning

This privacy policy takes effect on 18 juin 2026 and supersedes any previous version.

Current version: 1

We review this policy at least once a year, or whenever a material change occurs in our data practices, the services we use, or the legal requirements applicable to us. When we make significant changes, we will update the effective date above and, where appropriate, notify you by email or through a notice on our website.

We encourage you to review this policy periodically to stay informed about how we protect your personal information.