PRIVACY POLICY

Last updated: July 25, 2026
Version: 1.0

1. Purpose and scope

ImpactQC (“ImpactQC,” “we,” “us,” or “our”) respects the privacy of website visitors, prospects, clients and other people with whom we do business.

This policy explains how ImpactQC collects, uses, discloses, retains and protects personal information in connection with:

impactqc.ca and its language versions;
contact forms, consultation requests and communications;
commercial communications where the person has consented or the law otherwise permits them;
proposals and delivery of services;
administration of client relationships; and
cookies and similar technologies.

This policy applies to personal information ImpactQC processes for its own activities. When we operate, host or maintain a website for a client, that client generally determines the purposes for processing information collected on its website. The client’s privacy policy then applies to its visitors, and ImpactQC acts under its contract with that client and applicable law.

2. Business and Privacy Officer

ImpactQC is a registered business name in Quebec.

The person exercising the highest authority within ImpactQC acts as the person in charge of the protection of personal information unless the function is delegated in writing.

Title: Privacy Officer / Person in Charge of the Protection of Personal Information
Email: admin@impactqc.ca
Telephone: 438-882-3255

Requests for access, correction, withdrawal of consent, portability, deletion where available, and privacy questions or complaints should be sent to this person.

3. Information we may collect

Depending on how you interact with ImpactQC, we may collect the following categories.

3.1 Information you provide

first and last name;
email address;
telephone number;
company name, role and professional contact details;
project description, needs, objectives, indicative budget and timeline;
messages, inquiries, questionnaire answers and communications;
information needed for a proposal, contract or invoice;
payment information limited to what our payment provider makes available to us; and
content, documents, technical access or other information voluntarily supplied for an engagement.

Do not submit medical information, detailed financial information, government identification numbers, passwords, biometric information or other sensitive information through an ordinary contact form.

3.2 Information collected automatically

When you use the site, our systems or those of our providers may collect:

IP address;
device type, operating system and browser;
language, time zone and technical settings;
pages viewed, links used, approximate visit source and session duration;
date, time and technical request logs;
cookie or similar identifiers; and
consent-preference information.

An IP address, online identifier or combination of technical data may be personal information when it can directly or indirectly identify an individual.

3.3 Information from third parties

We may receive information from:

a representative of your organization;
a client who authorizes us to contact you for an engagement;
lawful public sources or professional platforms;
a referral partner;
analytics, advertising, scheduling or marketing platforms where permitted; or
a service provider used to administer our operations.

Where required, we will inform you of the source on request.

4. Purposes

We use personal information only for determined, serious and legitimate purposes, including to:

respond to an inquiry or schedule a consultation;
assess a project and prepare a proposal or statement of work;
verify a client’s or representative’s identity and contact details;
enter into, perform and administer a contract;
design, host, secure, maintain or optimize websites and digital tools;
integrate and administer CRM systems, forms, automations and campaigns;
provide support and engagement communications;
invoice, collect amounts owing and maintain accounting records;
prevent fraud, abuse and security incidents;
diagnose errors, maintain performance and protect our systems;
measure site use and improve services where consent preferences permit;
personalize or measure advertising and remarketing where the person activates those functions;
send newsletters or commercial communications in accordance with law;
document consents and preferences;
comply with legal, regulatory, tax, accounting and record-keeping obligations; and
establish, exercise or defend legal rights.

We do not sell or rent personal information.

We seek valid consent where required by law. A consent request is presented separately from other information where required and describes its purposes in clear and simple language.

Marketing consent is optional and separate from a service inquiry. Refusing promotional communications does not prevent ImpactQC from answering an inquiry, sending a proposal or communicating information needed to perform a contract.

You may withdraw consent, subject to applicable legal or contractual restrictions and reasonable notice. Withdrawal does not operate retroactively against processing that was already lawful.

6. Cookies, analytics, advertising and profiling

The site may use cookies and similar technologies.

6.1 Strictly necessary technologies

These enable basic operation, security, load balancing, language selection, form transmission and storage of privacy choices. They cannot always be disabled without impairing a requested function.

The site may use a WPML language cookie and WordPress or Gravity Forms mechanisms needed for a selected function.

6.2 Audience measurement

Subject to your activation, ImpactQC plans to use Google Analytics to understand site use, measure content effectiveness and improve the experience. Settings should minimize collection to what is reasonably necessary.

Google Search Console may be used to measure visibility in search results. By itself, this tool generally does not place a visitor-tracking cookie in the browser of a person visiting the site.

6.3 Advertising and remarketing

Subject to your activation, ImpactQC plans to use Meta advertising technologies, including the Meta Pixel, to measure campaigns, create audiences and display more relevant advertising.

Advertising analytics, remarketing and other functions that identify, locate or profile must remain disabled until you activate them through the consent manager, unless a legal exception applies.

6.4 Preference management

You may accept all optional categories, reject them or customize your choices. A permanent “Manage Privacy Preferences” link should appear in the footer.

The consent manager should provide the current list of technologies, providers, purposes and durations. ImpactQC will update this policy before enabling a new category of technology that materially affects privacy.

7. Commercial communications

ImpactQC may use ActiveCampaign or an internal system to administer newsletters and certain commercial communications.

We send commercial electronic messages only where we have the required consent or another legal rule permits them. Each commercial message must identify the sender, provide required contact information and include a working unsubscribe mechanism.

A project inquiry, resource download or acceptance of this Privacy Policy does not automatically constitute newsletter consent. The marketing sign-up box must be optional and unchecked by default.

We may keep limited evidence of consent, unsubscribe or objection to honour preferences and demonstrate compliance.

8. Disclosures and service providers

We limit access to people and providers who need it for the described purposes. Depending on the systems actually enabled, recipient categories may include:

hosting, DNS, CDN, web application firewall and backup providers;
email, calendar and scheduling services;
WordPress, Gravity Forms and related technical providers;
CRM and automation providers, including ActiveCampaign when selected;
analytics and advertising providers, including Google and Meta when enabled;
invoicing, accounting and payment providers;
cloud storage, project-management and technical-support providers;
authorized consultants, employees, contractors and subcontractors;
legal and accounting advisers, insurers and auditors; and
public authorities where required by law.

Providers must process information under their contractual and legal obligations. We seek to limit disclosure to what is needed for the relevant service.

We may also disclose information in a reorganization, financing, sale of assets or similar transaction, subject to appropriate confidentiality measures and legal requirements.

9. Processing outside Quebec

Our providers, subcontractors, servers or backups may be located in Quebec, elsewhere in Canada or in the United States. Information may therefore be processed or accessed outside Quebec and be subject to the laws of that location.

Before disclosing personal information outside Quebec where required by law, ImpactQC must assess the relevant privacy factors and govern the disclosure through a written agreement that takes the assessment into account.

10. Retention and destruction

ImpactQC keeps information only for the period reasonably required for the determined purposes, legal requirements and dispute management. As an operational rule, unless another obligation or legal hold applies:

general inquiries and unsuccessful prospects: up to 24 months after the last meaningful interaction;
unaccepted proposals: up to 24 months after expiry;
project records and client communications: during the engagement and generally 3 years afterward;
contracts, invoices, and tax or accounting records: generally 7 years after the relevant fiscal period;
ImpactQC website forms: up to 24 months, then deletion or transfer into a justified client file;
marketing consent and unsubscribe evidence: as needed to demonstrate compliance, generally up to 3 years after the last relevant event;
identifiable or pseudonymous analytics: configured as briefly as reasonably possible, targeting 14 months or less;
rotating backups: generally up to 90 days, subject to provider capabilities and security obligations; and
information required for a dispute, investigation or legal obligation: until final resolution and expiry of the applicable period.

When purposes are complete and no law requires retention, information is securely destroyed or, where authorized and appropriate, anonymized under applicable requirements.

Data processed for a client may follow the period agreed with that client.

11. Security

ImpactQC applies reasonable administrative, technical and physical measures appropriate to the sensitivity, quantity, use, distribution and medium of the information, which may include:

access controls and least privilege;
authentication and account management;
encryption in transit where supported;
patching, updates and monitoring;
backups where included in an engagement;
logging, abuse protection and network security;
confidentiality duties for authorized personnel; and
incident-management procedures.

No transmission or system is completely risk-free. This policy is not a guarantee of invulnerability or a service-level commitment. Any more specific statement—such as “AES-256,” backup frequency, off-site location, restoration capability, WAF or DDoS protection—should be published only if accurate for the applicable service and documented in the statement of work.

12. Confidentiality incidents

ImpactQC maintains an incident-response process and register where required. Where an incident presents a risk of serious injury, ImpactQC promptly notifies the Commission d’accès à l’information and affected individuals in accordance with law.

Where we process information for a client, we notify that client without undue delay of a known relevant breach or attempted breach under the contract and applicable requirements.

13. Your rights

Subject to legal conditions and exceptions, you may:

request access to your personal information;
request correction if it is inaccurate, incomplete or equivocal;
withdraw consent;
request information about collection, use, disclosure and retention;
request cessation of dissemination or de-indexation where available;
request certain computerized information collected from you in a structured, commonly used technological format;
object to commercial communications; and
complain to ImpactQC or the competent authority.

A request must be in writing and permit reasonable identity verification. We respond within the legally required period, generally no later than 30 days after receiving a sufficiently clear request.

14. Children

The site and ImpactQC services are intended for businesses, professionals and adults. We do not knowingly seek information from a child under 14. Such collection should not occur without required consent from a person with parental authority or a tutor, unless a legal exception applies.

15. Third-party links and services

The site may link to third-party services. Their practices are governed by their own policies. ImpactQC is not responsible for their independent practices, but remains responsible for its own disclosures under applicable law.

16. Changes

We may amend this policy to reflect changes in practices, tools or obligations. The date and version will be updated. Where a change is material, an appropriate notice will be displayed or sent to affected people.

17. Contact and complaints

To exercise a right, ask a question or make a complaint:

Privacy Officer / Person in Charge of the Protection of Personal Information
ImpactQC
Email: admin@impactqc.ca
Telephone: 438-882-3255

We examine complaints confidentially and communicate the outcome within a reasonable period.