Legal

Privacy Policy

This policy explains what personal information Procura Solutions collects, why we collect it, how we protect it, and what you can ask us to do with it.

Last updated: August 3, 2026

01Who this policy applies to

This policy applies to personal information collected by Procura Solutions (“Procura Solutions”, “we”, “us”) through this website, by email, and in the course of providing consulting services to our clients.

It is written to meet our obligations under Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25. Where we serve clients or receive visitors outside Quebec, additional laws may also apply, including Canada's PIPEDA and, for visitors in the European Union, the GDPR.

Information we handle on behalf of clients

When we implement or maintain a system for a client, we may access personal information that belongs to that client — their employee, customer, or supplier records. In that situation the client remains responsible for that information and we act on their instructions under a written agreement. This policy governs information we collect for ourselves; the client's own privacy policy governs theirs.

02Person responsible for the protection of personal information

Under Law 25 we must designate a person responsible for the protection of personal information and publish their title and contact details. That person is:

• Title: Founder, Procura Solutions
• Email: info@procurasolutions.com

Contact this person for any question about this policy, to exercise your rights, or to make a complaint.

03What we collect

Information you give us

When you submit the contact form or write to us, we collect your name, work email address, company name, approximate number of employees, the type of work you are asking about, and whatever you choose to write in the message field. The contact form is processed and stored by our website host, Netlify, Inc. (Netlify Forms) — see section 05. If we go on to work together, we collect the business contact details and project information needed to run the engagement.

Please do not send us sensitive personal information — health information, government identifiers, financial account numbers — through the website form. It is not the right channel for it, and we do not need it to answer an enquiry.

Information collected automatically

This website does not use analytics or tracking cookies. Our hosting provider automatically records standard web server logs for every visitor — such as IP address, browser type, and the page requested — which it needs to deliver the site and keep it secure. If we ever add analytics, we will describe what it collects here and, where required, give you a way to turn it off.

If we use any technology that identifies, locates, or profiles you, we will tell you before it is activated and give you a way to turn it off, as Law 25 requires.

04Why we collect it, and your consent

We collect personal information for these purposes and no others:

• To answer your enquiry and, if relevant, to prepare a proposal;
• To carry out and manage work you have engaged us to do;
• To meet our legal, accounting, and professional obligations;
• To improve this website.

When you send us a message you are consenting to us using your information for the first purpose. Your consent is specific to the purposes described here — if we ever want to use your information for something new, we will ask you first, separately, and in plain language.

You can withdraw your consent at any time by writing to the person named in section 02. Withdrawing consent does not affect anything we did lawfully before you withdrew it, and it may mean we can no longer provide a service you have asked for.

We do not sell personal information. We do not share it for anyone else's marketing. We do not add you to a mailing list because you contacted us.

05Who has access to it

Inside Procura Solutions, access is limited to the people who need the information to do their job. Outside Procura Solutions, we currently share personal information only with our website hosting provider, Netlify, Inc., which also collects and stores submissions from our contact form (Netlify Forms) on our behalf, and only to the extent it needs the information to provide that service to us. We do not use a separate CRM or email marketing platform for these submissions; if that changes, we will name the provider here before it starts processing your information. Every provider we use is bound by its standard data processing terms, requiring it to protect the information and use it for no other purpose.

We may also disclose information where the law requires it, for example in response to a valid court order.

06Where it is stored, and transfers outside Quebec

This website, and the messages submitted through our contact form, are hosted and stored by Netlify, Inc., which operates infrastructure primarily in the United States. Personal information you send us directly by email is stored using our email provider's infrastructure.

Some of our service providers may store or process information outside Quebec. Before communicating personal information outside Quebec, Law 25 requires us to assess whether it would receive adequate protection there, taking into account the sensitivity of the information, the purpose, the protections in place, and the legal framework of the destination. We carry out that assessment and record it, and we do not proceed where the protection is inadequate.

07How long we keep it

We keep personal information only as long as needed for the purpose it was collected for, or as long as a law or professional obligation requires, then we destroy it securely or anonymize it so it can no longer be used to identify anyone. Procura Solutions is a new business and has not yet run engagements long enough to require a fixed retention schedule; as we take on projects, we will describe the applicable retention periods here.

08How we protect it

We apply security measures proportionate to how sensitive the information is, including access controls limiting who can see what, encryption in transit and at rest where available, multi-factor authentication on our business accounts, and periodic review of who has access to what.

No system is perfectly secure, and we do not claim otherwise. What we commit to is applying reasonable measures and telling you honestly if something goes wrong.

09If something goes wrong: confidentiality incidents

A “confidentiality incident” means unauthorized access to, use of, or disclosure of personal information, its loss, or any other breach of its protection. If one occurs, we:

• Take reasonable steps immediately to reduce the risk of harm and prevent it recurring;
• Assess whether the incident presents a risk of serious injury, considering the sensitivity of the information, the likely consequences, and the likelihood it will be misused;
• Where there is a risk of serious injury, promptly notify both the Commission d'accès à l'information du Québec and each affected person, unless doing so would hinder an investigation;
• Record the incident in our register of confidentiality incidents, which we maintain as Law 25 requires and which we provide to the Commission on request.

Where a notification could allow you to reduce your own risk, we will tell you what happened, what information was involved, and what we recommend you do.

10Automated decisions

We do not make decisions about you based exclusively on automated processing of your personal information. If that ever changes, we will tell you at the time of the decision, explain the personal information used and the main factors behind it, and give you the opportunity to submit observations to a person who can review the decision.

11Your rights

You have the right to:

• Access — ask what personal information we hold about you and receive a copy;
• Rectify — have information corrected if it is inaccurate, incomplete, or ambiguous;
• Withdraw consent — as described in section 04;
• De-index or cease dissemination — ask us to stop disseminating information or to de-index a link to it, where the law allows;
• Portability — receive the computerized personal information you provided to us in a structured, commonly used technological format, or ask us to transfer it to someone else;
• Complain — raise a concern with us, and if you are not satisfied with our answer, with the Commission d'accès à l'information du Québec.

How to exercise them

Write to the person named in section 02. We may need to verify your identity before answering, so that we do not disclose your information to someone else. We will respond within 30 days of receiving your request. If we refuse a request, we will tell you why in writing, point to the provision of the law we are relying on, and explain how to seek a review by the Commission.

Exercising these rights is free.

12Changes to this policy

We may update this policy as our practices or the law change. The date at the top shows when it was last updated. If a change is significant, we will make it clear on this page rather than relying on you to notice.

13Contact

Questions about this policy, or about how we handle your information, go to the person named in section 02, or to info@procurasolutions.com.

To contact the regulator directly: Commission d'accès à l'information du Québec, cai.gouv.qc.ca.