WARNING - It is not legal advice — have counsel confirm the specific wording and workflow match your data practices.

Privacy Policy (template) for Wonka Electronics¶

Effective date: [Month DD, YYYY] Last updated: [Month DD, YYYY]

Note before publishing: This template is built around the requirements of Quebec’s Act respecting the protection of personal information in the private sector (commonly called “Law 25”). It is a starting point, not legal advice — have it reviewed by a lawyer familiar with Law 25 and, if you have users outside Quebec, with PIPEDA/GDPR/CCPA as applicable before publishing. Replace all bracketed placeholders with your organization’s actual information.

1. Who we are¶

[Company Legal Name] (“we,” “us,” or “the Company”) operates [website URL] (the “Site”). This Privacy Policy explains how we collect, use, disclose, and protect personal information in accordance with Quebec’s Act respecting the protection of personal information in the private sector (the “Act”).

Person in charge of the protection of personal information (Privacy Officer): By default, this role is held by [Name/Title, e.g., “the President” or a named Privacy Officer], as required under section 3.1 of the Act. You can reach this person using the contact details in Section 12.

2. Personal information we collect¶

Depending on how you interact with the Site, we may collect:

Identification information: name, email address, phone number, mailing address
Account information: username, password (encrypted), preferences
Transactional information: billing details, purchase history [remove if not applicable]
Technical information: IP address, browser type, device identifiers, pages viewed, referring URLs
Communications: messages you send us via forms, chat, or email
[Add any other categories specific to your site, e.g., location data, health information, biometric data — note that “sensitive” personal information triggers heightened obligations under the Act]

3. Purposes of collection¶

We collect personal information only for purposes that a reasonable person would consider appropriate in the circumstances, including to:

Provide, operate, and maintain the Site and our services
Process transactions and send related communications
Respond to inquiries and provide customer support
Improve the Site through analytics
Send marketing communications (only with your consent — see Section 4)
Detect, prevent, and address fraud, security, or technical issues
Comply with legal obligations

We will not use your personal information for a purpose other than those disclosed at the time of collection without obtaining your consent, except where permitted or required by law.

We obtain your consent before collecting, using, or disclosing your personal information, except where the law permits us to do otherwise. Consent may be express (e.g., checking a box) or implied by context, depending on the sensitivity of the information involved. More sensitive information (e.g., health, financial, or biometric data) requires express, clearly given consent.

You may withdraw your consent at any time, subject to legal or contractual restrictions, by contacting us using the details in Section 12. Withdrawing consent may affect our ability to provide certain services.

5. Cookies and tracking technologies¶

The Site uses cookies and similar technologies to:

[ ] Enable core site functionality (necessary)
[ ] Remember your preferences
[ ] Measure and analyze site usage (e.g., [Google Analytics / other tool])
[ ] Support advertising [remove if not applicable]

You can manage cookie preferences through [your cookie banner / browser settings]. Non-essential cookies are only activated with your consent, in accordance with Law 25’s requirements around technologies that involve the identification, location, or profiling of individuals.

6. Disclosure of personal information¶

We do not sell personal information. We may share it with:

Service providers / processors (e.g., hosting, payment processing, email delivery, analytics) under contracts requiring them to protect the information and use it only for the purposes we specify
Professional advisors (legal, accounting) as needed
Authorities, where required by law or a valid legal request
A purchaser, in the event of a merger, acquisition, or sale of assets, subject to appropriate safeguards

Transfers outside Quebec¶

If personal information is transferred to a service provider or third party located outside Quebec, we conduct a Privacy Impact Assessment (PIA) to confirm the information will receive protection equivalent to that provided under Quebec law, as required by section 17 of the Act. Where required, such transfers are governed by contract.

7. Automated decision-making¶

Not applicable

8. Retention and destruction¶

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law. Once the purpose is fulfilled and no legal retention obligation applies, we securely destroy, anonymize, or de-identify the information in accordance with our internal retention policy.

9. Security safeguards¶

We implement physical, organizational, and technological safeguards appropriate to the sensitivity of the information, including [encryption in transit and at rest / access controls / employee training / describe your actual measures]. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Confidentiality incidents (data breaches)¶

In the event of a confidentiality incident involving personal information that presents a risk of serious injury, we will:

Notify the Commission d’accès à l’information (CAI)
Notify affected individuals
Take reasonable measures to reduce the risk of injury and prevent similar incidents
Maintain a register of confidentiality incidents, as required by the Act

11. Your rights¶

Subject to certain exceptions provided by law, you have the right to:

Access the personal information we hold about you
Rectify inaccurate, incomplete, or ambiguous information, or information collected unlawfully
Withdraw consent to the collection, use, or disclosure of your information (see Section 4)
Request the cessation of dissemination of your personal information, or that a hyperlink leading to it be de-indexed, where the dissemination causes serious injury to your reputation or privacy that is clearly greater than the public’s interest in knowing the information, or where the information is being used for commercial or promotional purposes unrelated to that purpose (“right to be forgotten”)
Data portability: request that we provide your personal information in a structured, commonly used technological format, or transfer it directly to another organization, where technically feasible

How to exercise your rights¶

Submit a written request to our Privacy Officer (Section 12). We will respond within 30 days of receiving your request. If we deny a request, we will explain why and inform you of available recourses.

Filing a complaint¶

If you are not satisfied with our response, you have the right to file a complaint with:

Commission d’accès à l’information du Québec (CAI) Website: www.cai.gouv.qc.ca

12. Contact us¶

For any question about this Privacy Policy or to exercise your rights, contact our Privacy Officer:

[Name / Title] [Company Legal Name] [Mailing Address] Email: [privacy@yourcompany.com] Phone: [Phone number]

13. Changes to this Policy¶

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be communicated through [the Site / email], as appropriate.

This Privacy Policy is governed by the laws of the Province of Quebec, Canada.