Privacy Governance (Law 25)
Our compliance framework under Québec’s Act respecting the protection of personal information in the private sector. Your rights, our obligations, clearly explained.
ON THIS PAGE
01
Overview of Law 25
Québec’s Act respecting the protection of personal information in the private sector, commonly known as Law 25 (formerly Bill 64), modernizes how organizations operating in Québec collect, use, retain, and protect personal information.
Law 25 was adopted in September 2021 and implemented in three phases: September 2022, September 2023, and September 2024. It aligns Québec privacy requirements with international standards such as the GDPR while reflecting the specific legal context of Québec civil law.
Applies to you if...
02
Privacy Officer designation
Law 25 requires that every enterprise designate a person responsible for the protection of personal information. At WizeBA, this responsibility rests with the highest-ranking individual in the organization, who may delegate specific functions.
PRIVACY OFFICER
WizeBA Inc. — Privacy Officer
WizeBA Inc., Montréal, Québec, Canada
The identity and contact details of the Privacy Officer are published publicly as required by Law 25, Section 3.1.
03
Governance framework
WizeBA has implemented an internal privacy governance framework proportionate to our size and risk profile. Key elements include:
- Privacy policy Published
With your consent. We use Vercel Analytics (privacy-first, no cross-site tracking) to understand traffic patterns.
- Privacy Impact Assessments (PIA)Active
PIAs are conducted before implementing any new technology or process that involves personal information with a high privacy risk.
- Data Inventory
Maintained
An internal register of the personal information we hold, its source, purpose, retention schedule, and associated risks.
- Vendor Assessment
Active
All third-party service providers handling personal information are assessed for their privacy practices before engagement.
- Incident Response Plan
Published internally
A documented procedure for detecting, containing, and notifying the CAI and affected individuals of privacy incidents.
- Staff Awareness
Ongoing
Any WizeBA team member or contractor with access to personal information is briefed on their obligations under this framework.
04
Consent management
Under Law 25, consent must be clear, free, informed, specific, and requested for a defined purpose. WizeBA obtains consent as follows:
Website forms
All contact, booking, and newsletter forms include a clear statement of purpose and a consent checkbox where required. Consent is recorded with a timestamp.
Cookie consent
Non-essential cookies require explicit, granular opt-in. Consent choices are stored and can be changed at any time. See our Cookie Policy.
Service agreements
Client service agreements explicitly describe the personal information collected, the purpose, and the handling procedures. Clients sign before engagement begins.
Withdrawal of consent is always available without penalty. To withdraw, contact [email protected].
05
Your rights under Law 25
Québec residents
Right to access (Art. 27)
You may request access to the personal information we hold about you, how we use it, and who it has been shared with.
Right to rectification (Art. 28)
You may request that inaccurate, incomplete, ambiguous, or outdated personal information be corrected.
Right to portability (Art. 27.1)
You may request that your personal information be communicated to you or to a third party in a structured, commonly used technological format.
Right to de-indexation (Art. 28.1)
You may request that we cease disseminating, or de-index, personal information published online if its dissemination causes serious harm.
Right to be informed of automated decisions (Art. 12.1)
Where a decision based exclusively on automated processing produces significant effects, you have the right to be informed and to request human review.
Right to file a complaint (Art. 26)
If you believe your rights have been violated, you may file a complaint with the Commission d’accès à l’information du Québec (CAI).
To exercise any of these rights, submit a written request to [email protected] with the subject line “Law 25 Privacy Request.” We will acknowledge your request within 5 business days and respond within 30 days.
06
Privacy incident response
Law 25 requires that enterprises take prompt action when a privacy incident occurs and notify the Commission d’accès à l’information (CAI) and affected individuals when there is a risk of serious harm.
WizeBA’s incident response procedure includes:
- Detection and containment: Immediate steps to limit the scope and impact of the incident
- Assessment: Evaluation of the nature of the incident, data types involved, and likelihood of serious harm
- CAI notification: Confidential report to the CAI within the required timeframe if the risk threshold is met
- Individual notification: Direct communication to affected individuals with clear information on what occurred and the steps they can take
- Register update: All privacy incidents are recorded in our internal privacy incident register, as required by Art. 3.6
07
Cross-border data transfers
Under Law 25, personal information may only be communicated outside Québec if a privacy impact assessment confirms that the information will receive equivalent protection.
WizeBA uses a small number of third-party service providers whose infrastructure may process data outside of Québec or Canada. Before any such transfer, we:
- Conduct or rely on a completed Privacy Impact Assessment (PIA) for the relevant provider
- Establish contractual protections (data processing agreements with adequate safeguards)
- Ensure the provider can demonstrate compliance with principles equivalent to Law 25
A summary of active cross-border data flows is available upon request.
08
Commission d’accès à l’information
If you believe WizeBA has not adequately addressed a privacy concern, you have the right to contact the Commission d’accès à l’information du Québec (CAI):
Commission d’accès à l’information du Québec
Suite 2.36, 525 René-Lévesque Blvd. East, Québec (Québec) G1R 5S9
Toll-free: 1-888-528-7741
We encourage you to contact us first — we are committed to resolving all privacy concerns directly and promptly.
Need help understanding this?
We write our policies to be readable, not to protect ourselves. If something is unclear or you want to exercise your rights, reach out directly.