Privacy Policy

This privacy policy describes how 1MPACT Partenaires d'affaires inc. (“1MPACT”, “we”) collects, uses, discloses, retains and destroys personal information in connection with operating the 1mpact.ca website and the internal software that 1MPACT uses to prepare, send and obtain acceptance of its service proposals from its clients (together, the “Service”). It is established in accordance with Québec's Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as modernized by Law 25 (Act to modernize legislative provisions as regards the protection of personal information).

1. Person in charge of the protection of personal information

The person in charge of the protection of personal information at 1MPACT is:

Mathieu Beaufort
Person in charge of the protection of personal information
1MPACT Partenaires d'affaires inc.
Email: confidentialite@1mpact.ca
Saint-Jean-sur-Richelieu (Québec), Canada

Any question about this policy, any request to exercise your rights and any incident report may be sent to that address.

2. Scope

1MPACT is an HR business-partner firm. We operate the 1mpact.ca website and an internal software tool that we use to catalogue our service offerings, prepare proposals and have them accepted by our clients through an electronic signature.

1MPACT alone determines the purposes and means of collection and acts as the enterprise responsible within the meaning of the Act, both for website visitors and for our clients' information entered in the software. The Service is not offered to third parties as a product or subscription: it is a tool internal to 1MPACT.

3. Personal information collected

3.1 Team member accounts

• Email address, password (stored only in hashed form), interface language and role within 1MPACT.

3.2 Information about our clients

• Name, contact details and business-context notes of 1MPACT's clients;
• Proposal content: services offered, prices, contractual clauses, sections written or generated.

3.3 Contact requests (site assistant)

If you use the site's contact assistant, we collect — only after your explicit consent shown in the conversation — your name, your company name, one contact detail (email or phone) and, where applicable, your message. No information is transmitted before that consent.

3.4 Acceptance and electronic signature of proposals

When a client views a proposal through a public link and responds to it, we collect: their name, email, electronic signature, the timestamp of acceptance or refusal, their IP address and their browser identifier (“user-agent”). These elements form the signature's audit trail and demonstrate its integrity.

3.5 Technical logs

Views of public proposals and certain security events (rate limiting, errors) are logged with the IP address and user-agent, for security, audit and abuse-prevention purposes.

3.6 Cookies

See section 10 below.

4. Purposes of use

We use personal information only for the following purposes:

• Provide, operate and secure the website and software (authentication, backups);
• Prepare, send and have our service proposals signed;
• Respond to contact requests received through the site;
• Build the audit trail required for the validity of electronic signatures;
• Prevent fraud and abuse, diagnose technical incidents;
• Meet our legal obligations.

We do not use your personal information for behavioural advertising and we do not sell any personal information.

5. Consent

Except as otherwise provided by the Act, we collect personal information directly from the person concerned, with their clear, free and informed consent, given for specific purposes. You may withdraw your consent at any time by writing to confidentialite@1mpact.ca; withdrawal does not affect the lawfulness of processing carried out beforehand and may limit our ability to provide the Service.

6. Artificial intelligence

1MPACT uses language models to assist in drafting the content of its proposals. In this regard:

• Anonymization before any call. The personal information contained in a proposal's context (names, emails, phone numbers, organization names) is pseudonymized before being sent to the model: it is replaced by neutral tokens, and the correspondence table stays in memory on our server — it is never transmitted. As a result, no personal information is disclosed to the AI provider, regardless of where its inference infrastructure is located.
• Provider. The primary provider is Cohere, a Canadian company. If it is unavailable, a fallback provider may be used; since the text sent is already anonymized, no personal information depends on it.
• No training. We do not use your information to train artificial-intelligence models.
• Interaction log. Each generation is logged (model used, request and response — masked, token volume) for traceability and diagnostics.
• No fully automated decision. Artificial intelligence proposes content; the decision to send a proposal and its final content always rest with a human. 1MPACT does not make any decision based exclusively on automated processing within the meaning of section 12.1 of the Act.

7. Hosting, service providers and place of processing

The Service is designed to keep information in Québec. We use only the providers necessary to operate it, under agreements ensuring adequate protection:

• OVH — hosting of the application and database on servers located in Beauharnois (Québec);
• Document storage — generated PDF documents are kept locally, on that same server in Québec (no foreign cloud storage);
• Cohere (a Canadian company) — text generation, as described in section 6, without any personal information being disclosed to it (prior anonymization).

Hosting and storage therefore remain in Québec, and no personal information is disclosed to the AI provider. Before any disclosure of personal information outside Québec, we carry out the privacy impact assessment required by section 17 of the Act. These providers act only on our instructions and acquire no right to use the information for their own purposes. We disclose no personal information to third parties for commercial or advertising purposes.

8. Retention and destruction

• Information tied to a team member's account is kept for the duration of their collaboration with 1MPACT;
• Accepted proposals and their signature trail are kept for as long as necessary to prove the contract, in accordance with the applicable limitation periods in Québec;
• Unconverted contact requests are deleted no later than 24 months after they are received;
• Artificial-intelligence interaction logs are automatically purged after a predefined retention period;
• When the purposes are fulfilled, the information is securely destroyed or anonymized in accordance with the Act.

9. Security measures

We apply security measures that are reasonable and proportionate to the sensitivity of the information, including: encryption of communications (TLS), password hashing, dedicated hosting in Québec, role-based access control, event logging, rate limiting on public pages, anonymization of personal information before any artificial-intelligence processing, and the principle of least privilege with our providers.

10. Cookies

The Service uses only essential cookies, supplemented by an anonymous, cookieless audience measurement (Cloudflare Web Analytics) that does not require consent. Since no non-essential cookie is set, no consent banner is displayed. The categories are as follows:

The Service uses no advertising cookie and no third-party individual-tracking technology.

11. Your rights

In accordance with the Act, you may:

• Access the personal information we hold about you;
• Request its correction if it is inaccurate, incomplete or equivocal;
• Withdraw your consent to its use or disclosure;
• Request that dissemination cease or that information be de-indexed, in the cases provided by the Act;
• Obtain, where the Act so provides, the portability of the computerized personal information you provided to us, in a structured, commonly used technological format;
• Request the destruction of information whose retention is no longer necessary.

Send your request in writing to confidentialite@1mpact.ca. We will respond diligently, no later than 30 days after receiving it. If you are dissatisfied with how your request is handled, you may file a complaint with the Commission d'accès à l'information du Québec (CAI).

12. Confidentiality incidents

We keep a register of confidentiality incidents. Any incident presenting a risk of serious injury is reported diligently to the Commission d'accès à l'information and to the persons concerned, in accordance with sections 3.5 and following of the Act, and we take reasonable measures to reduce the risks and prevent a similar incident from recurring.

13. Minors

The Service is intended for businesses and is not directed at persons under 14 years of age. We do not knowingly collect personal information from minors.

14. Changes to this policy

We may amend this policy to reflect changes to the Service or to legislation. The current, dated version is published permanently at this address; in the event of a significant change, a notice will be posted on the site.

15. Language

This policy is published in French and in English. In case of discrepancy, the French version prevails.